Function at 0x494adf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xf8
mov eax, 0x510d90
call fcn.004f41e2
mov esi, ecx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0x34]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp + 0x1c]
push dword [edx]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp + 0x40]
shl ecx, 8
mov dword [ebp - 0xe4], eax
movzx eax, byte [ebp + 0x30]
or ecx, eax
mov dword [ebp - 0xec], edi
movzx eax, byte [ebp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xf0], edx
movzx eax, byte [ebp + 0x28]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xe8], ecx
mov ecx, dword [0x5a22a0]
call fcn.0041e97a
mov ecx, dword [0x5a22a0]
push eax
call fcn.0040b595
push dword [edi]
mov ecx, dword [esi + 4]
mov bl, al
call fcn.0040c9f8
mov edi, eax
xor eax, eax
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], eax
test bl, bl
je 0x494bb4
mov ecx, dword [0x5a22a0]
push eax
call fcn.0040b595
mov ebx, esi
lea esi, [ebx + 0x4056]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.ConEmuC64.exe
push edi
call fcn.004e5a5b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edx, dword [ebx + 4]
mov ecx, 0x3e98
test eax, eax
lea edi, [ecx + 0x10]
cmove ecx, edi
lea edi, [ecx + edx]
mov ax, word [edi]
cmp ax, word [esi]
jne 0x494c15
mov ax, word [edi + 2]
cmp ax, word [ebx + 0x4058]
jne 0x494c15
mov ax, word [edi + 6]
cmp ax, word [ebx + 0x405c]
jne 0x494c15
xor eax, eax
mov byte [ebp - 0xc9], al
jmp 0x494c1c
mov byte [ebp - 0xc9], 1
mov eax, dword [ebp - 0xec]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
test ecx, ecx
jne 0x494c33
mov ecx, 0x514870
mov dword [eax], ecx
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x494c38
sub ecx, edx
mov edx, dword [ebx + 4]
sar ecx, 1
add edx, 0xa90
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x494c53
sub edx, esi
sar edx, 1
lea edi, [edx + 0x384]
add edi, ecx
lea eax, [edi + edi]
push eax
call fcn.004e1c0a
mov esi, dword [ebp - 0xdc]
pop ecx
xor ecx, ecx
mov dword [esi], eax
mov word [eax], cx
cmp dword [ebx + 0x3c54], 2
jne 0x494d33
push 0x524d9c
push edi
push dword [esi]
call fcn.004019cd
mov eax, dword [ebx + 4]
add eax, 0xa90
push eax
push edi
push dword [esi]
call fcn.004019cd
push 0x524d94
push edi
push dword [esi]
call fcn.004019cd
mov ecx, dword [0x5a23ec]
push 1
call fcn.004673c5
test eax, eax
je 0x494cd7
push str._log
push edi
push dword [esi]
call fcn.004019cd
or dword [ebp - 0xd8], 0xffffffff
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004e98ce
mov edx, dword [esi]
pop ecx
pop ecx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xdc], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd0]
jne 0x494d00
push dword [ebp - 0xd8]
sub ecx, dword [ebp - 0xdc]
mov eax, edi
sar ecx, 1
sub eax, ecx
push str._system:_u__cmd
push eax
lea eax, [edx + ecx*2]
push eax
call fcn.004e1e5a
add esp, 0x10
push 0x524d9c
push edi
push dword [esi]
call fcn.004019cd
push dword [ebp - 0xd4]
push edi
push dword [esi]
call fcn.004019cd
push 0x524d94
push edi
push dword [esi]
call fcn.004019cd
push 1
mov ecx, ebx
call fcn.00497662
test eax, eax
je 0x494d8c
cmp eax, 2
mov ecx, str.__LOG
mov edx, str.__LOG2
cmovne edx, ecx
cmp eax, 3
mov ecx, str.__LOG3
cmovne ecx, edx
push ecx
push edi
push dword [esi]
call fcn.004019cd
push 2
pop ecx
cmp dword [ebx + 0x3c50], ecx
jne 0x494db6
mov eax, dword [ebx + 4]
cmp byte [eax + 0x45a0], 0
jne 0x494db6
push str.__ADMIN
push edi
mov dword [ebx + 0x3c18], ecx
push dword [esi]
call fcn.004019cd
cmp byte [ebp - 0xc9], 0
jne 0x494dcc
push str.__OMITHOOKSWARN
push edi
push dword [esi]
call fcn.004019cd
mov ecx, dword [esi]
mov edx, 0x600000
cmp dword [ebx + 0x3e78], 2
lea eax, [edx + 0x20]
cmovne edx, eax
lea eax, [ecx + 2]
mov dword [ebp - 0xd4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd0]
jne 0x494de9
sub ecx, dword [ebp - 0xd4]
mov eax, edi
push edx
sar ecx, 1
sub eax, ecx
push str.__CINMODE_X
push eax
mov eax, dword [esi]
lea eax, [eax + ecx*2]
push eax
call fcn.004e22e7
mov ecx, dword [ebx + 0x4288]
add esp, 0x10
call fcn.0047b62c
mov ecx, dword [ebx + 0x4288]
mov dword [ebp - 0xdc], eax
call fcn.0047b61d
mov ecx, dword [esi]
mov edx, eax
mov eax, dword [ebx + 0x39ac]
mov dword [ebp - 0xd8], eax
lea eax, [ecx + 2]
mov dword [ebp - 0xd4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd0]
jne 0x494e4e
push dword [ebp - 0xe8]
mov eax, dword [0x5a23ec]
sub ecx, dword [ebp - 0xd4]
sar ecx, 1
mov dword [ebp - 0xd4], ecx
push dword [eax + 0xc44]
push dword [eax + 0xc48]
add eax, 0xc60
push eax
push dword [ebx + 0x42a0]
push edx
push dword [ebp - 0xdc]
push dword [0x5a22a4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0xd4]
push eax
push dword [ebp - 0xd8]
mov eax, edi
sub eax, ecx
push str.__AID_u__GID_u__GHWND_08X__BW_i__BH_i__BZ_i___FN_s___FW_i__FH_i__TA_08X
push eax
mov eax, dword [esi]
lea eax, [eax + ecx*2]
push eax
call fcn.004e22e7
mov eax, dword [0x5a23ec]
add esp, 0x34
cmp byte [eax + 0x113ec], 0
jne 0x494ee1
push str.__HIDE
push edi
push dword [esi]
call fcn.004019cd
push edi
push dword [esi]
lea ecx, [ebx + 0x3c14]
call fcn.004e870f
push str.__ROOT
push edi
push dword [esi]
call fcn.004019cd
mov eax, dword [ebp - 0xec]
push dword [eax]
push edi
push dword [esi]
call fcn.004019cd
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
mov dword [eax], ecx
cmp byte [ebp + 0x14], cl
je 0x494f22
mov ecx, ebx
call fcn.004842a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xf4]
mov dword [ecx], eax
lea eax, [ebx + 0x3ecc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, dword [ebp - 0xf0]
lea ecx, [ebx + 0x3f38]
push 0xffffffffffffffff
push dword [edi]
call fcn.004e2ad6
push 0xffffffffffffffff
push dword [edi]
lea ecx, [ebx + 0x3f94]
call fcn.004e2ad6
push 0xffffffffffffffff
xor eax, eax
lea ecx, [ebx + 0x3ff0]
push eax
call fcn.004e2ad6
push 1
mov ecx, ebx
call fcn.00497662
test eax, eax
je 0x495015
lea ecx, [ebp - 0xc8]
call fcn.004e25a1
xor eax, eax
lea edi, [ebx + 0x3c14]
push eax
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.004eab66
mov dword [ebp - 0xe8], eax
lea ecx, [ebp - 0xc8]
lea eax, [ebp - 0xe8]
push eax
call fcn.004e2618
mov ecx, dword [ebx]
xor eax, eax
push eax
push eax
push 0x52737c
push dword [ebp - 0xc8]
push 0x55539c
push dword [esi]
push str._:_Cmd
call fcn.004dc01d
push eax
push str.Starting_VCon_
lea ecx, [ebp - 0x6c]
call fcn.004e2531
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0044612f
push eax
mov ecx, ebx
call fcn.0048a02d
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004e25e0
jmp 0x49501b
lea edi, [ebx + 0x3c14]
xor eax, eax
push eax
push dword [ebp - 0xe4]
lea eax, [ebx + 0x27060]
push eax
push dword [ebp - 0xe0]
push dword [ebp - 0xf8]
push dword [ebp - 0xf0]
push dword [esi]
push edi
push ebx
call fcn.00484f8f
add esp, 0x24
mov byte [ebp - 0xc9], al
mov ecx, ebx
push 1
call fcn.00497662
test eax, eax
je 0x4950db
xor eax, eax
push 0x40
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.004f5a90
add esp, 0xc
cmp byte [ebp - 0xc9], 0
jne 0x4951aa
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0xe4]
push dword [eax]
call fcn.0040114c
mov ecx, dword [ebx]
add esp, 0xc
push eax
push str.__failed__code
call fcn.004dc01d
push eax
push str.VCon_
lea ecx, [ebp - 0x6c]
call fcn.004e2531
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 2
call fcn.0044612f
push eax
mov ecx, ebx
call fcn.0048a02d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
mov edi, dword [ebp - 0xe0]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xf4]
sub eax, dword [ecx]
cmp byte [ebp - 0xc9], 0
mov ecx, dword [ebp - 0x100]
mov dword [ecx], eax
je 0x49521d
cmp dword [ebx + 0x3c50], 2
jne 0x495123
mov eax, dword [ebx + 4]
cmp byte [eax + 0x45a0], 0
je 0x49512f
push dword [edi]
mov ecx, ebx
push dword [edi + 8]
call fcn.00492a7d
call esi
mov dword [ebx + 0x4ab4], eax
xor eax, eax
cmp dword [ebx + 0x3c50], 2
mov dword [ebx + 0x4abc], eax
je 0x49515f
push 1
lea esi, [edi + 8]
mov ecx, ebx
push esi
call fcn.0048fefa
push dword [esi]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor eax, eax
mov ecx, dword [ebx + 4]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xd0]
push eax
push 1
push 1
call fcn.0041ef08
test al, al
jne 0x495199
cmp dword [ebp - 0xd0], 0
je 0x495199
push dword [ebp - 0xd0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x495238
push dword [ebp - 0x104]
call fcn.004ea440
pop ecx
jmp 0x495238
mov edi, dword [ebp - 0xe0]
cmp dword [edi + 8], 0
je 0x4951cd
push dword [edi + 8]
lea eax, [ebp - 0xac]
push str.__ServerPID_u
push eax
call fcn.00401104
add esp, 0xc
mov ecx, dword [ebx]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xac]
push eax
push str.__started
call fcn.004dc01d
push eax
push str.VCon_
lea ecx, [ebp - 0x6c]
call fcn.004e2531
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 3
call fcn.0044612f
push eax
mov ecx, ebx
call fcn.0048a02d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
jmp 0x4950e1
xor eax, eax
cmp dword [ebx + 0x4aac], eax
je 0x495238
or dword [ebx + 0x4aac], 0xffffffff
mov dword [ebx + 0x3c18], 2
mov al, byte [ebp - 0xc9]
call fcn.004f418c
ret 0x3c