Function at 0x140042a40
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push rdi
push r15
sub rsp, 0x90
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [r11 + 0x10], rbp
mov rbx, rcx
mov qword [r11 + 0x18], rsi
xor r15d, r15d
mov qword [r11 + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xb60], eax
cmp byte [rbx + 0x750], r15b
jne 0x140042de3
cmp byte [rbx + 0x751], r15b
jne 0x140042de3
mov edx, dword [rbx + 0xb58]
mov rcx, qword [rbx + 0x38]
add edx, 0x400
call fcn.140026c00
mov rdx, qword [rbx + 0x38]
lea r14, [rbx + 0x744]
mov r8d, dword [rbx + 0xb58]
mov r9, r14
mov rcx, qword [rbx + 0x618]
mov qword [rsp + 0x20], r15
mov rdx, qword [rdx + 0x16f0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [r14]
test eax, eax
jne 0x140042ba2
test edi, edi
je 0x140042af1
mov byte [rbx + 0x751], 1
mov rdx, qword [rbx + 0x758]
test rdx, rdx
je 0x140042bb6
movsxd rcx, dword [rbx + 0x760]
cmp ecx, dword [rbx + 0x764]
jge 0x140042bb6
mov esi, dword [rcx + rdx]
test esi, esi
je 0x140042bb6
lea eax, [rcx + 4]
xor r8d, r8d
xor ecx, ecx
mov dword [rbx + 0x760], eax
xor edx, edx
call sym.AmazonVNCViewer.exe_adler32_z
mov rbp, qword [rbx + 0x38]
mov r8, rdi
mov ecx, eax
mov rdx, qword [rbp + 0x16f0]
call sym.AmazonVNCViewer.exe_adler32_z
cmp eax, esi
jne 0x140042bb6
mov ecx, edi
mov word [rsp + 0x78], 0x507
and ecx, 0xff0000
mov dword [rsp + 0x7c], 0x2000000
mov eax, edi
lea rdx, [rsp + 0x78]
shr eax, 0x10
mov r9b, 7
or ecx, eax
mov r8d, InitCommonControls
mov eax, edi
shr ecx, 8
shl eax, 0x10
and edi, 0xff00
or eax, edi
shl eax, 8
or ecx, eax
mov dword [rsp + 0x80], ecx
mov rcx, rbp
call fcn.1400261c0
jmp 0x140042ce4
test edi, edi
jne 0x140042af1
mov byte [rbx + 0x750], 1
jmp 0x140042d73
mov esi, dword [rbx + 0xb58]
xor al, al
add esi, 0x400
mov dword [rsp + 0x30], esi
cmp byte [rbx + 0x754], al
je 0x140042c1c
cmp dword [rbx + 0xb54], 1
je 0x140042c1c
mov rcx, qword [rbx + 0x38]
mov edx, esi
call fcn.140026af0
mov rax, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
mov r9d, dword [r14]
mov dword [rsp + 0x20], 0xffffffff
mov r8, qword [rax + 0x16f0]
mov rcx, qword [rax + 0x16e0]
call sym.AmazonVNCViewer.exe_compress2
test eax, eax
jne 0x140042dc5
mov edi, dword [r14]
mov al, 1
mov esi, dword [rsp + 0x30]
movzx ebp, al
cmp esi, edi
mov word [rsp + 0x68], 0x507
cmova ebp, r15d
movzx eax, bpl
shl eax, 0x18
mov dword [rsp + 0x6c], eax
test bpl, bpl
je 0x140042c67
mov edx, esi
mov eax, esi
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov ecx, esi
shl ecx, 0x10
mov eax, esi
and eax, 0xff00
shr edx, 8
or ecx, eax
shl ecx, 8
or edx, ecx
mov dword [rsp + 0x70], edx
jmp 0x140042c8e
mov ecx, edi
mov eax, edi
shl eax, 0x10
and ecx, 0xff00
or ecx, eax
mov eax, edi
and eax, 0xff0000
shr edi, 0x10
or eax, edi
shl ecx, 8
shr eax, 8
or ecx, eax
mov dword [rsp + 0x70], ecx
cmp dword [rbx + 0xb54], 1
lea rdx, [rsp + 0x68]
mov rcx, qword [rbx + 0x38]
mov r8d, InitCommonControls
jne 0x140042cb0
mov r9b, 1
call fcn.140026600
jmp 0x140042cbd
mov r9b, 7
mov byte [rsp + 0x20], 1
call fcn.140026140
mov rcx, qword [rbx + 0x38]
xor r9d, r9d
test bpl, bpl
je 0x140042cd5
mov rdx, qword [rcx + 0x16e0]
mov r8d, esi
jmp 0x140042cdf
mov r8d, dword [r14]
mov rdx, qword [rcx + 0x16f0]
call fcn.140026600
mov eax, dword [r14]
mov rcx, rbx
add qword [rbx + 0x748], rax
mov r8, qword [rbx + 0x748]
mov rdx, qword [rbx + 0x40]
call fcn.140040a90
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov rdi, rax
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140042d6d
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rsp + 0x40], 0x10
je 0x140042d6d
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov rdx, rdi
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140042d30
cmp byte [rbx + 0x48], r15b
jne 0x140042dd0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xb60]
cmp eax, 0x3e8
jle 0x140042d8d
mov ecx, __WSAFDIsSet
jmp 0x140042dae
cmp byte [rbx + 0x72], r15b
jne 0x140042db4
cmp dword [rbx + 0xb54], 1
je 0x140042db4
mov rax, qword [rbx + 0x38]
cmp dword [rax + 0x52b4], r15d
jne 0x140042db4
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0x752], r15b
jne 0x140042a72
xor al, al
jmp 0x140042ded
mov byte [rbx + 0x751], 1
xor al, al
jmp 0x140042ded
mov rcx, rbx
mov byte [rbx + 0x751], 1
call fcn.140042e30
xor al, al
jmp 0x140042ded
mov rcx, rbx
call fcn.140042e30
mov al, 1
mov r14, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x90
pop r15
pop rdi
pop rbx
ret