Function at 0x1400b3bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x10050
call fcn.1400caa90
sub rsp, rax
mov esi, r8d
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400b3bed
xor r9d, r9d
mov byte [rsp + 0x20], 1
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400b1f60
mov eax, dword [rsp + 0x100b0]
mov edi, 0x1f4
test eax, eax
mov r13d, 1
mov ebx, r13d
mov r15d, gethostbyname
cmovne edi, eax
cmp dword [rsp + 0x100b8], 1
cmovge r15d, dword [rsp + 0x100b8]
cmp esi, ebx
cmovge ebx, esi
test r14, r14
je 0x1400b3cc7
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x406
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400b3cc7
movsxd rax, ebx
cmp rax, qword [rsp + 0x48]
jg 0x1400b3cc7
lea rdx, [rsp + 0x100b0]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x100b0]
xor edx, edx
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400b3cc7
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400b3d1a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
lea rax, [0x1400e1d2c]
lea rdx, [0x1400e2294]
cmovne rdx, rax
cmp word [rdx], 0x30
jne 0x1400b3ce9
cmp word [rdx + 2], 0
je 0x1400b3cfd
mov rax, qword [0x1400ff050]
test byte [rax + 0x140], r13b
jne 0x1400b3f47
mov rcx, qword [0x140102760]
xor r9d, r9d
mov byte [rsp + 0x20], r13b
lea r8, [r9 - 1]
call fcn.1400b1f60
jmp 0x1400b3f5d
mov eax, dword gs:[0x48]
dec ebx
mov dword [rsp + 0x100b8], eax
xor eax, eax
mov word [rsp + 0x50], ax
mov qword [rsp + 0x100a0], r12
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
movsxd rax, ebx
mov qword [rsp + 0x10098], rax
lea rcx, [rsp + 0x10090]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov r8, rax
mov dword [rsp + 0x28], 0x7d0
mov rcx, r14
mov edx, 0x40c
mov dword [rsp + 0x20], 2
mov ebx, 0x7fff
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400b3e26
cmp word [rsp + 0x10090], bx
ja 0x1400b3ed8
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x10090]
mov r8, qword [rsp + 0x10098]
mov r9, rbx
mov qword [rsp + 0x30], rax
mov edx, 0x40d
mov dword [rsp + 0x28], 0x7d0
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400b3e26
movzx r9d, word [rsp + 0x10090]
lea r8, [rsp + 0x50]
inc r9d
mov qword [rsp + 0x20], 0
add r9, r9
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b3ed1
mov rdx, qword [rsp + 0x100a8]
lea rcx, [rsp + 0x50]
call fcn.1400b2dc0
test al, al
jne 0x1400b3eb0
test rbp, rbp
jne 0x1400b3edd
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b3ef9
mov eax, dword [rsp + 0x100b8]
cmp dword [0x140105cc0], eax
jne 0x1400b3e7f
test edi, edi
js 0x1400b3e67
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + r12]
sub ecx, eax
cmp ecx, 5
jle 0x1400b3e82
mov edx, r13d
mov ecx, r15d
call fcn.1400019b0
mov rax, qword [rsp + 0x10098]
jmp 0x1400b3d4e
mov ebx, r12d
test edi, edi
js 0x1400b3e9a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + rbx]
sub ecx, eax
cmp ecx, 5
jle 0x1400b3f26
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x10098]
jmp 0x1400b3d4e
mov rcx, qword [0x140102760]
lea rdx, [0x1400cc6d4]
xor r9d, r9d
mov byte [rsp + 0x20], r13b
lea r8, [r9 - 1]
call fcn.1400b1f60
jmp 0x1400b3ed8
xor eax, eax
mov word [rsp + 0x50], ax
test rbp, rbp
je 0x1400b3ef9
xor r9d, r9d
mov byte [rsp + 0x20], r13b
lea rdx, [rsp + 0x50]
mov rcx, rbp
lea r8, [r9 - 1]
call fcn.1400b1f60
mov r13d, eax
mov rdx, qword [rsp + 0x40]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x100a0]
mov eax, r13d
jmp 0x1400b3f5d
mov rcx, qword [0x140102760]
lea rdx, [0x1400e1d2c]
xor r9d, r9d
mov byte [rsp + 0x20], r13b
lea r8, [r9 - 1]
call fcn.1400b1f60
jmp 0x1400b3ef9
mov rcx, qword [0x1401063c0]
lea r9, [0x1400cc644]
xor r8d, r8d
call fcn.140047870
add rsp, 0x10050
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret