Function at 0x43fbac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569338
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], 1
cmp ecx, 0x113
ja 0x43fdff
je 0x43fd99
lea eax, [ecx - 1]
cmp eax, 0xa2
ja case.0x43fb66.4
movzx eax, byte [eax + 0x440194]
jmp dword [eax*4 + 0x44015c]
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x78]
jmp 0x440093
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x48]
jmp 0x440093
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x4c]
jmp 0x440093
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
push eax
mov ecx, edi
call fcn.00443930
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x440095
mov ecx, edi
call fcn.0048b210
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
mov ecx, edi
cmp esi, 1
sete al
push eax
call fcn.00443930
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x440095
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x43fc15
mov ecx, dword [edi + 0x37c]
test ecx, ecx
je 0x43fc15
add ecx, 0x280
call fcn.0048b210
and dword [ebx + 0x18], 0xfffffffb
mov dword [ebx + 4], eax
xor ebx, ebx
jmp 0x440095
lea ecx, [edi + 0x30]
call fcn.0048f1d0
test eax, eax
je case.0x43fb66.6
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
lea ecx, [edi + 0x30]
test eax, eax
je 0x43fc59
push str.restore
call fcn.0048ead0
test eax, eax
je 0x43fc52
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x10c]
push 0x57c778
jmp 0x43fc78
push 0x57c778
call fcn.0048ead0
test eax, eax
je 0x43fc73
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x10c]
push str.restore
lea ecx, [edi + 0x30]
call fcn.0048ead0
test eax, eax
je case.0x43fb66.6
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x10c]
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x440095
mov dword [ebp - 0x2c], ebx
cmp dword [edi + 0x38c], ebx
je 0x43fcc7
mov dword [edi + 0x38c], ebx
cmp dword [edi + 0x388], ebx
je 0x43fcc1
push 0
push 0
push 1
push 0x25
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [edi + 0x388], ebx
xor ebx, ebx
jmp 0x440095
mov ecx, dword [edi + 0x37c]
mov dword [ebp - 0x2c], ebx
test ecx, ecx
je 0x43fced
add ecx, 0x280
call fcn.0048b210
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [edi + 0x38c], ebx
jne 0x43fc15
push 0
lea esi, [edi + 0x388]
mov dword [edi + 0x38c], 1
mov dword [esi], ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push 0
push 0x26
call ebx
cmp dword [esi], 0
je 0x43fc15
push 0
push 0
push 0
push 0x25
call ebx
xor ebx, ebx
jmp 0x440095
call fcn.004254d0
mov ecx, eax
call fcn.004255c0
test eax, eax
je 0x43fc15
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, edi
test eax, eax
je 0x43fd63
call fcn.0043f1c0
xor ebx, ebx
jmp 0x440095
call fcn.0043ef40
xor ebx, ebx
jmp 0x440095
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x5c]
jmp 0x440093
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x6c]
jmp 0x440093
cmp esi, 0x10
jne 0x43fde0
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [edi + 4]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [edi + 4]
call esi
jmp 0x440095
cmp esi, 0x11
jne 0x440095
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
call fcn.00443d50
jmp 0x440095
cmp ecx, 0x7e8
ja 0x440014
je 0x43ffe5
mov eax, ecx
sub eax, 0x40a
je 0x43ff65
sub eax, 0x5a
je 0x43fe6a
sub eax, 0x12d
jne case.0x43fb66.4
test esi, esi
je 0x440095
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x43fe5a
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x43fe5a
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], ebx
push 0x28
push esi
call fcn.004747df
add esp, 8
jmp 0x440095
lea eax, [ebp - 0x34]
push eax
call fcn.004254d0
mov ecx, eax
call fcn.00424630
mov edx, dword [0x5ce9d4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43fea0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0041cc20
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.0050f3b0
mov edx, dword [ebp - 0x14]
mov esi, eax
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x43ff09
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43feff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44014d
push edx
push ecx
call fcn.004747df
add esp, 8
test esi, esi
jne 0x43ff1a
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43ff25
push 0
push 0
mov ecx, edi
call fcn.0048bc10
mov esi, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x440095
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x440095
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x440095
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x440095
call fcn.00415b60
mov ecx, eax
test ecx, ecx
je 0x440152
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push str.play
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0040e320
test al, al
jne 0x43ffa6
push 4
push str.play
lea ecx, [ebp - 0x30]
call fcn.0041aed0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00445af0
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fc15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
jmp 0x440095
mov ecx, dword [edi + 0x3a4]
test ecx, ecx
je 0x440095
call fcn.0044a560
mov ecx, dword [edi + 0x3a4]
test ecx, ecx
je 0x440009
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi + 0x3a4], ebx
jmp 0x440095
sub ecx, 0x7e9
je 0x44007f
sub ecx, 1
je 0x440026
mov dword [ebp - 0x2c], ebx
jmp 0x440095
push 0xb
push str.start_delay
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0041cb30
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
lea ecx, [edi + 0x3a8]
call fcn.0050c840
lea ecx, [ebp - 0x28]
imul esi, eax, 0x3e8
mov dword [ebp - 4], 0xffffffff
call fcn.00407770
push 0
push esi
push 0x11
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x440095
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push dword [ebp + 0x10]
push esi
push 0x7e9
call fcn.00441f20
mov ebx, eax
mov eax, dword [edi + 0x360]
mov esi, dword [ebp + 8]
test eax, eax
je 0x440117
cmp esi, eax
jne 0x440117
mov eax, dword [ebp + 0x10]
add eax, 0xfffffdfe
cmp eax, 1
ja 0x440115
cmp dword [0x5cea70], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4400d1
call ebx
sub eax, dword [0x5cea70]
cmp eax, 0x1f4
jb 0x44010e
call ebx
cmp dword [edi + 0x37c], 0
mov dword [0x5cea70], eax
je 0x440103
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x440103
mov ecx, dword [edi + 0x37c]
push 1
push 1
add ecx, 0x280
call fcn.0048bc10
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2c], 1
xor ebx, ebx
cmp dword [ebp - 0x2c], 0
je 0x440121
mov eax, ebx
jmp 0x44012f
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x38]
push esi
call fcn.00496090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret 0xc
call fcn.00522e79
push 0x80004005
call fcn.0040e300
insd dword es:[edi], dx
sti
inc ebx
add byte [edi - 0x53ffbc05], dl
sti
inc ebx
add byte [ebp + edi*8 - 0x36fffbd], al
inc ebx
add byte [edx - 0x38ffbc05], al
sti
inc ebx
add bh, ch
sti
inc ebx
add byte [esp + edi*8], bl
inc ebx
add byte [edi - 3], ch
inc ebx
add byte [edx - 0x31ffbc04], bl
cld
inc ebx
add byte [edi*8 + 0x210043], dh
inc esp
add byte [eax], al
add dword [edx], eax
or eax, 218956803
or eax, 218959117
or eax, 218957069
or eax, 218959117
push es
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
pop es
or byte [218959117], cl
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or dword [218959117], ecx
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218827277
or al, 204
int3