Function at 0x10091f70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x1017b5ab
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x101cc114]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101cc114]
xor eax, esp
push eax
lea eax, [esp + 0x264]
mov dword fs:[0], eax
mov esi, dword [esp + 0x274]
mov eax, dword [esp + 0x288]
mov bh, bh
push ebx
pop ebx
push eax
lea eax, [esp + 0x64]
push eax
push esi
call fcn.10057f00
add esp, 0xc
mov ebp, ebp
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x26c], ebx
mov bl, bl
mov edi, dword [esp + 0x28c]
cmp edi, ebx
jle 0x100920f5
mov ebp, dword [esp + 0x290]
cmp ebp, ebx
jle 0x100920f5
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
mov ebx, eax
mov ch, ch
call edi
mov bh, bh
sub eax, ebx
cmp eax, ebp
jae 0x100920d0
lea ecx, [ecx]
nop
mov ecx, ecx
mov dword [esp + 0x14], 0
push ecx
pop ecx
push ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x290]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x290]
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x290]
push eax
mov eax, dword [esp + 0x290]
push ecx
push edx
push eax
push esi
call fcn.10058280
add esp, 0x28
test eax, eax
je 0x100920d0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push esi
call fcn.100616e0
add esp, 0x10
mov dword [esp + 0x34], eax
mov cl, cl
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1011745c
add esp, 4
mov al, al
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
call fcn.1007db70
mov ch, ch
mov eax, dword [esp + 0x28c]
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov bl, bl
call edi
push eax
pop eax
sub eax, ebx
cmp eax, ebp
jb 0x10092020
mov ecx, dword [esp + 0x28c]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.10069840
add esp, 0xc
mov ebp, eax
mov esi, esi
xor ebx, ebx
jmp 0x100921be
mov cl, cl
push edx
pop edx
mov dword [esp + 0x14], ebx
mov dl, dl
mov ch, ch
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x290]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x290]
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x290]
push eax
mov eax, dword [esp + 0x290]
push ecx
push edx
push eax
push esi
call fcn.10058280
add esp, 0x28
test eax, eax
jne 0x1009216a
mov dword [esp + 0x26c], 0xffffffff
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x10092163
push eax
call fcn.1010959d
add esp, 4
xor eax, eax
jmp 0x10092208
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push esi
call fcn.100616e0
add esp, 0x10
mov dword [esp + 0x34], eax
push ebx
pop ebx
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1011745c
add esp, 4
mov eax, eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
call fcn.1007db70
xchg ebx, eax
xchg ebx, eax
push edi
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.10069840
add esp, 0xc
mov ebp, eax
mov dh, dh
mov edx, edx
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
xor esi, esi
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x100921ea
mov eax, dword [esp + 0x2c]
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x100921ea
mov edx, dword [ecx + esi*4]
push edx
call edi
mov edx, edx
add esi, 1
jmp 0x100921c8
mov dword [esp + 0x26c], 0xffffffff
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x10092206
push eax
call fcn.1010959d
add esp, 4
mov eax, ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.10117937
add esp, 0x25c
ret