Function at 0x40f380
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x40f5a7
cmp dword [esi + 0x1c], 0
je 0x40f5a7
call fcn.0040f290
test al, al
je 0x40f3cd
push dword [esi + 0x44]
push dword [esi + 0x10c]
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esi + 0x10c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x20], 0
mov al, byte [esi + 4]
mov byte [ecx], al
lea eax, [ebp - 0x1c]
inc dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x20]
movq xmm0, qword [ebp - 0x1c]
mov dword [ebp - 0x30], 0x14
movq qword [eax], xmm0
lea eax, [ebp - 0x30]
add dword [esi + 0x20], 8
push eax
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x40f45f
cmp dword [ebp - 0x2c], 1
jne 0x40f45f
mov ecx, dword [ebp - 0x28]
lea eax, [esi + 0xd0]
xor ebx, ebx
cmp ecx, dword [eax - 4]
je 0x40f44d
cmp ecx, dword [eax]
je 0x40f44c
cmp ecx, dword [eax + 4]
je 0x40f447
cmp ecx, dword [eax + 8]
je 0x40f442
add ebx, 4
add eax, 0x10
cmp ebx, 0x10
jl 0x40f422
jmp 0x40f44d
add ebx, 3
jmp 0x40f44d
add ebx, 2
jmp 0x40f44d
inc ebx
push ecx
call dword [sym.imp.USER32.dll_DestroyCursor]
or eax, 0xffffffff
cmp ebx, 0x10
cmove ebx, eax
jmp 0x40f462
or ebx, 0xffffffff
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x20]
mov byte [eax], bl
inc dword [esi + 0x20]
cmp byte [esi + 4], 2
jne 0x40f507
mov eax, dword [esi + 0x68]
mov ebx, dword [esi + 0x80]
mov edx, dword [esi + 0x44]
mov dword [ebp - 8], ebx
xor ebx, ebx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
test ecx, ecx
jle 0x40f4db
nop dword [eax + eax]
push dword [esi + 0x10]
mov edi, ecx
mov ecx, 0x32
push ebx
push 0
sub edi, ebx
push edx
cmp edi, 0x32
cmovg edi, ecx
push edi
push eax
push ebx
push 0
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
add ebx, edi
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp ebx, ecx
jl 0x40f4a0
mov eax, dword [esi + 0x68]
push dword [eax + 0x14]
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x20]
push eax
push dword [esi + 0x60]
push dword [esi + 0x78]
call fcn.0040f930
mov ecx, dword [ebp + 8]
add eax, dword [esi + 0x20]
mov dword [ecx], eax
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi + 0x30]
cmp edi, dword [esi + 0x2c]
jge 0x40f520
nop
push edi
mov ecx, esi
call fcn.0040f5c0
add edi, 0xe
cmp edi, dword [esi + 0x2c]
jl 0x40f510
mov eax, dword [esi + 0x30]
mov ecx, 0xe
add eax, 3
mov ebx, dword [ebp + 8]
cdq
idiv ecx
mov ecx, dword [ebp - 0x1c]
mov edi, dword [esi + 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebx], edi
mov dword [esi + 0x30], edx
cmp dword [0x5dc4a0], ecx
jne 0x40f55c
cmp dword [0x5dc49c], eax
jne 0x40f55c
cmp edi, 0xa
jne 0x40f55c
mov dword [ebx], 0
jmp 0x40f567
mov dword [0x5dc4a0], ecx
mov dword [0x5dc49c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x14]
call ebx
sub eax, dword [edi]
cmp eax, dword [esi + 0x18]
jae 0x40f591
nop dword [eax]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [edi]
cmp eax, dword [esi + 0x18]
jb 0x40f580
call ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4