Function at 0x440081
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5678a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5c324c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], 1
cmp ecx, 0x113
ja 0x43fe5f
je 0x43fdf9
lea eax, [ecx - 1]
cmp eax, 0xa2
ja case.0x43fbc6.4
movzx eax, byte [eax + 0x4401f4]
jmp dword [eax*4 + 0x4401bc]
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x78]
jmp 0x4400f3
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x48]
jmp 0x4400f3
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x4c]
jmp 0x4400f3
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
push eax
mov ecx, edi
call fcn.004439b0
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x4400f5
mov ecx, edi
call fcn.00489750
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
mov ecx, edi
cmp esi, 1
sete al
push eax
call fcn.004439b0
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x4400f5
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x43fc75
mov ecx, dword [edi + 0x37c]
test ecx, ecx
je 0x43fc75
add ecx, 0x280
call fcn.00489750
and dword [ebx + 0x18], 0xfffffffb
mov dword [ebx + 4], eax
xor ebx, ebx
jmp 0x4400f5
lea ecx, [edi + 0x30]
call fcn.0048d710
test eax, eax
je case.0x43fbc6.6
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
lea ecx, [edi + 0x30]
test eax, eax
je 0x43fcb9
push str.restore
call fcn.0048d010
test eax, eax
je 0x43fcb2
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x10c]
push 0x57a778
jmp 0x43fcd8
push 0x57a778
call fcn.0048d010
test eax, eax
je 0x43fcd3
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x10c]
push str.restore
lea ecx, [edi + 0x30]
call fcn.0048d010
test eax, eax
je case.0x43fbc6.6
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x10c]
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
jmp 0x4400f5
mov dword [ebp - 0x2c], ebx
cmp dword [edi + 0x38c], ebx
je 0x43fd27
mov dword [edi + 0x38c], ebx
cmp dword [edi + 0x388], ebx
je 0x43fd21
push 0
push 0
push 1
push 0x25
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [edi + 0x388], ebx
xor ebx, ebx
jmp 0x4400f5
mov ecx, dword [edi + 0x37c]
mov dword [ebp - 0x2c], ebx
test ecx, ecx
je 0x43fd4d
add ecx, 0x280
call fcn.00489750
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [edi + 0x38c], ebx
jne 0x43fc75
push 0
lea esi, [edi + 0x388]
mov dword [edi + 0x38c], 1
mov dword [esi], ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push 0
push 0x26
call ebx
cmp dword [esi], 0
je 0x43fc75
push 0
push 0
push 0
push 0x25
call ebx
xor ebx, ebx
jmp 0x4400f5
call fcn.00425500
mov ecx, eax
call fcn.004255f0
test eax, eax
je 0x43fc75
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, edi
test eax, eax
je 0x43fdc3
call fcn.0043f220
xor ebx, ebx
jmp 0x4400f5
call fcn.0043efa0
xor ebx, ebx
jmp 0x4400f5
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x5c]
jmp 0x4400f3
mov eax, dword [edi]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x6c]
jmp 0x4400f3
cmp esi, 0x10
jne 0x43fe40
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [edi + 4]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [edi + 4]
call esi
jmp 0x4400f5
cmp esi, 0x11
jne 0x4400f5
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
call fcn.00443dd0
jmp 0x4400f5
cmp ecx, 0x7e8
ja 0x440074
je 0x440045
mov eax, ecx
sub eax, 0x40a
je 0x43ffc5
sub eax, 0x5a
je 0x43feca
sub eax, 0x12d
jne case.0x43fbc6.4
test esi, esi
je 0x4400f5
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x43feba
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x43feba
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], ebx
push 0x28
push esi
call fcn.00472cbf
add esp, 8
jmp 0x4400f5
lea eax, [ebp - 0x34]
push eax
call fcn.00425500
mov ecx, eax
call fcn.00424660
mov edx, dword [0x5cc9d4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ff00
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0041cc50
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.0050d900
mov edx, dword [ebp - 0x14]
mov esi, eax
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x43ff69
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43ff5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4401ad
push edx
push ecx
call fcn.00472cbf
add esp, 8
test esi, esi
jne 0x43ff7a
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43ff85
push 0
push 0
mov ecx, edi
call fcn.0048a150
mov esi, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4400f5
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x4400f5
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x4400f5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x4400f5
call fcn.00415b90
mov ecx, eax
test ecx, ecx
je 0x4401b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push str.play
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0040e320
test al, al
jne 0x440006
push 4
push str.play
lea ecx, [ebp - 0x30]
call fcn.0041af00
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00445b70
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fc75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
jmp 0x4400f5
mov ecx, dword [edi + 0x3a4]
test ecx, ecx
je 0x4400f5
call fcn.0044a5d0
mov ecx, dword [edi + 0x3a4]
test ecx, ecx
je 0x440069
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi + 0x3a4], ebx
jmp 0x4400f5
sub ecx, 0x7e9
je 0x4400df
sub ecx, 1
je 0x440086
mov dword [ebp - 0x2c], ebx
jmp 0x4400f5
push 0xb
push str.start_delay
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0041cb60
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
lea ecx, [edi + 0x3a8]
call fcn.0050ad60
lea ecx, [ebp - 0x28]
imul esi, eax, 0x3e8
mov dword [ebp - 4], 0xffffffff
call fcn.00407770
push 0
push esi
push 0x11
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4400f5
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push dword [ebp + 0x10]
push esi
push 0x7e9
call fcn.00441fa0
mov ebx, eax
mov eax, dword [edi + 0x360]
mov esi, dword [ebp + 8]
test eax, eax
je 0x440177
cmp esi, eax
jne 0x440177
mov eax, dword [ebp + 0x10]
add eax, 0xfffffdfe
cmp eax, 1
ja 0x440175
cmp dword [0x5cca70], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x440131
call ebx
sub eax, dword [0x5cca70]
cmp eax, 0x1f4
jb 0x44016e
call ebx
cmp dword [edi + 0x37c], 0
mov dword [0x5cca70], eax
je 0x440163
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x440163
mov ecx, dword [edi + 0x37c]
push 1
push 1
add ecx, 0x280
call fcn.0048a150
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2c], 1
xor ebx, ebx
cmp dword [ebp - 0x2c], 0
je 0x440181
mov eax, ebx
jmp 0x44018f
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x38]
push esi
call fcn.004945d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472b5d
mov esp, ebp
pop ebp
ret 0xc
call fcn.005213e9
push 0x80004005
call fcn.0040e300
int 0xfb
inc ebx
add bh, dh
sti
inc ebx
add byte [esp + edi*8], cl
inc ebx
add ah, ah
std
inc ebx
add al, dh
cld
inc ebx
add dl, ah
sti
inc ebx
add byte [edi], ah
cld
inc ebx
add byte [edi - 4], cl
inc ebx
add byte [esp + edi*8 + 0x43], bh
add bh, cl
std
inc ebx
add dl, bh
cld
inc ebx
add byte [esi], ch
std
inc ebx
add byte [ebp + edi*8 + 0x810043], dl
inc esp
add byte [eax], al
add dword [edx], eax
or eax, 218956803
or eax, 218959117
or eax, 218957069
or eax, 218959117
push es
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
pop es
or byte [218959117], cl
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or dword [218959117], ecx
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218959117
or eax, 218827277
or al, 204
int3