Function at 0x41f992
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
push edi
mov byte [ebp - 1], bl
jmp 0x41f9ad
inc byte [ebp - 1]
inc eax
inc eax
mov dword [ebp + 8], eax
cmp word [eax], 0x2a
je 0x41f9a5
lea eax, [ebp + 8]
push eax
call fcn.0040418b
mov al, byte [ebp - 1]
mov edi, dword [ebp + 8]
mov byte [0x4a6e45], al
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 4]
mov byte [ebp - 4], bl
mov byte [ebp - 2], bl
push eax
lea ebx, [ebp + 8]
mov dword [ebp - 0x18], edi
mov byte [ebp - 3], 0x2a
call fcn.00416d1e
mov eax, dword [ebp + 8]
xor ebx, ebx
add esp, 0x18
cmp word [eax], bx
je 0x41fb42
mov esi, 0x4a7658
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp - 1], bl
je 0x41fa26
cmp dword [0x4a6df8], ebx
je 0x41fa26
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41fb8d
mov eax, dword [ebp + 8]
movsx ecx, byte [ebp - 3]
mov byte [0x4a5281], 0xff
movzx edx, word [eax]
cmp ecx, edx
mov byte [0x4a6e39], 1
jne 0x41fa50
movzx eax, word [eax + 2]
cmp ecx, eax
jne 0x41fa50
mov byte [0x4a5281], bl
push 0x4a6b6c
push 0x10000
push edi
push 0x41f981
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp word [eax], bx
jne 0x41fa99
cmp byte [0x4a6e39], bl
je 0x41fb8d
call esi
sub eax, dword [ebp - 0x14]
cmp eax, 0x7d0
jae 0x41fb8d
mov dword [ebp - 0xc], ebx
call esi
mov edi, eax
add edi, 0x14
call esi
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x41fa85
cmp byte [0x4a5290], bl
jle 0x41fa85
cmp ecx, ebx
jbe 0x41fb32
cmp ecx, 0x7d0
jbe 0x41fad8
mov ecx, 0x3e8
jmp 0x41fae0
cmp ecx, 0x64
jbe 0x41fae0
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x41fb32
cmp dword [ebp - 0xc], ebx
jg 0x41fb03
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x41fb3a
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41fb3a
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0xc], ebx
jle 0x41fb32
dec dword [ebp - 0xc]
cmp byte [0x4a5290], bl
jg 0x41faf4
mov dword [ebp - 0xc], ebx
jmp 0x41fab3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], eax
movsx eax, byte [ebp - 2]
push eax
movsx eax, byte [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xbb8
call fcn.0040ec14
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call esi
cmp byte [ebp - 2], bl
mov dword [ebp - 0x1c], eax
je 0x41fb86
mov dword [ebp - 0x10], 0x4a6df8
mov dword [ebp - 0x18], 0xfa0
mov eax, dword [ebp - 0x10]
cmp dword [eax], ebx
jne 0x41fb94
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
call esi
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jae 0x41fb8d
mov dword [ebp - 0xc], ebx
call esi
mov edi, eax
add edi, 0xa
call esi
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x41fb86
cmp byte [0x4a5290], bl
jle 0x41fb86
cmp ecx, ebx
jbe 0x41fc27
cmp ecx, 0x7d0
jbe 0x41fbcd
mov ecx, 0x3e8
jmp 0x41fbd5
cmp ecx, 0x64
jbe 0x41fbd5
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x41fc27
cmp dword [ebp - 0xc], ebx
jg 0x41fbf8
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x41fc2f
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41fc2f
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0xc], ebx
jle 0x41fc27
dec dword [ebp - 0xc]
cmp byte [0x4a5290], bl
jg 0x41fbe9
mov dword [ebp - 0xc], ebx
jmp 0x41fba8