Function at 0x4417bf
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push ebx
mov ebx, dword [esi + 0x1000]
push ebp
push edi
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ebp, ebp
push ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x28], ebx
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
push ebx
mov dword [esp + 0x14], eax
call edi
mov dword [esp + 0x28], eax
mov dword [esi + 0x1080], ebx
mov dword [esp + 0x18], ebp
mov eax, dword [esi + 0x10a8]
test eax, eax
jne 0x4417fa
mov eax, dword [esi + 0x109c]
cmp eax, ebp
mov dword [esi + 0x10a8], 1
je 0x44181f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esi + 0x10a4]
push dword [esi + 0x10a0]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [esp + 0x14]
mov dword [esi + 0x109c], eax
call edi
push dword [esi + 0x10a4]
mov dword [esp + 0x30], eax
push dword [esi + 0x10a0]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [esp + 0x2c]
call edi
push 0xcc0020
push dword [esi + 0x11c0]
push dword [esi + 0x11bc]
push ebx
push dword [esi + 0x10a4]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
push dword [esi + 0x10a0]
push ebp
push ebp
push dword [esp + 0x30]
call ebx
push dword [esp + 0x2c]
push dword [esp + 0x14]
call edi
mov dword [esi + 0x10a8], ebp
mov eax, dword [esi + 0x1098]
cmp eax, 1
mov dword [esi + 0x1060], 4
je 0x441c8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x44], eax
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x10a8]
test eax, eax
jne 0x4418c6
push dword [esi + 0x109c]
mov dword [esi + 0x10a8], 1
push dword [esp + 0x14]
call edi
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x1060]
cmp eax, 8
je 0x4418fa
cmp eax, 0xc
jne 0x441949
push dword [esp + 0x18]
push dword [esp + 0x10]
call edi
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x18]
mov dword [esp + 0x30], eax
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push dword [esi + 0x1030]
push dword [esi + 0x1034]
push dword [esp + 0x30]
call ebx
push dword [esp + 0x20]
push dword [esp + 0x10]
call edi
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x18], ebp
cmp dword [esp + 0x30], ebp
mov dword [esi + 0x1060], ebp
jne 0x441be2
mov eax, esi
call fcn.004415d8
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x1060]
cmp eax, 8
je 0x441974
cmp eax, 0xc
jne 0x4419cc
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], eax
call edi
push 0xcc0020
push dword [esi + 0x1030]
mov dword [esp + 0x28], eax
push dword [esi + 0x1034]
push dword [esp + 0x1c]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push ebp
push ebp
push dword [esp + 0x2c]
call ebx
push dword [esp + 0x20]
push dword [esp + 0x10]
call edi
push dword [esp + 0x30]
push dword [esp + 0x10]
call edi
cmp dword [esi + 0x1064], ebp
mov dword [esp + 0x20], eax
je 0x441b5d
push dword [esp + 0x24]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esp + 0x24]
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebp
push 1
push 1
push dword [esi + 0x102c]
mov dword [esp + 0x24], eax
push dword [esi + 0x1028]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push ebp
push 1
push 1
push dword [esi + 0x102c]
mov dword [esp + 0x48], eax
push dword [esi + 0x1028]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push dword [esp + 0x38]
mov dword [esp + 0x40], eax
push dword [esp + 0x20]
call edi
push dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
push dword [esp + 0x18]
call edi
push dword [esi + 0x107c]
mov dword [esp + 0x44], eax
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x18]
mov dword [esp + 0x4c], eax
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push ebp
push ebp
push dword [esp + 0x34]
call ebx
push dword [esp + 0x3c]
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x330008
push ebp
push ebp
push dword [esp + 0x20]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push ebp
push ebp
push dword [esp + 0x3c]
call ebx
push 0x8800c6
push ebp
push ebp
push dword [esp + 0x20]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push dword [esi + 0x1030]
push dword [esi + 0x1034]
push dword [esp + 0x30]
call ebx
push 0x8800c6
push ebp
push ebp
push dword [esp + 0x28]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push ebp
push ebp
push dword [esp + 0x2c]
call ebx
push 0xee0086
push ebp
push ebp
push dword [esp + 0x18]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push dword [esi + 0x1030]
push dword [esi + 0x1034]
push dword [esp + 0x30]
call ebx
push dword [esp + 0x38]
push dword [esp + 0x20]
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x40]
push dword [esp + 0x18]
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x441b86
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x18]
push dword [esi + 0x102c]
push dword [esi + 0x1028]
push dword [esi + 0x1030]
push dword [esi + 0x1034]
push dword [esp + 0x30]
call ebx
push dword [esp + 0x20]
push dword [esp + 0x10]
call edi
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x1c]
push dword [esi + 0x10a4]
push dword [esi + 0x10a0]
push dword [esi + 0x11c0]
push dword [esi + 0x11bc]
push dword [esp + 0x44]
call ebx
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x1c]
push dword [esi + 0x10a4]
push dword [esi + 0x10a0]
push ebp
push ebp
push dword [esp + 0x48]
jmp 0x441c09
push 0xcc0020
push ebp
push ebp
push dword [esp + 0x34]
push dword [esi + 0x10a4]
push dword [esi + 0x10a0]
push dword [esi + 0x11c0]
push dword [esi + 0x11bc]
push dword [esp + 0x44]
call ebx
push dword [esp + 0x2c]
push dword [esp + 0x14]
call edi
mov eax, dword [esi + 0x106c]
cmp eax, ebp
mov dword [esi + 0x10a8], ebp
je 0x441c2a
imul eax, eax, 0xa
jmp 0x441c30
mov eax, dword [esi + 0x1078]
mov dword [esp + 0x30], eax
jmp 0x441c56
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x44]
cmp dword [esp + 0x30], eax
jbe 0x441c61
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x1098]
cmp eax, 1
jne 0x441c36
movzx eax, byte [esi + 0x1004]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x1098]
cmp eax, 1
jne 0x4418b8
cmp dword [esp + 0x18], ebp
je 0x441c8b
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
call edi
push dword [esp + 0x10]
call edi
pop edi
xor eax, eax
pop ebp
mov dword [esi + 0x1098], 2
inc eax
pop ebx
add esp, 0x3c
ret