Function at 0x140042d20
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov qword [r11 + 0x10], rsi
mov rbx, rcx
mov qword [r11 + 0x18], r14
xor r12d, r12d
mov qword [r11 - 0x28], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xb60], eax
cmp byte [rbx + 0x750], r12b
jne 0x1400430bf
cmp byte [rbx + 0x751], r12b
jne 0x1400430bf
mov edx, dword [rbx + 0xb58]
mov rcx, qword [rbx + 0x38]
add edx, 0x400
call fcn.140027070
mov rdx, qword [rbx + 0x38]
lea r15, [rbx + 0x744]
mov r8d, dword [rbx + 0xb58]
mov r9, r15
mov rcx, qword [rbx + 0x618]
mov qword [rsp + 0x20], r12
mov rdx, qword [rdx + 0x16f0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [r15]
mov edi, ecx
test eax, eax
jne 0x140042e7c
test ecx, ecx
je 0x140042dd4
mov byte [rbx + 0x751], 1
mov rdx, qword [rbx + 0x758]
test rdx, rdx
je 0x140042e90
movsxd rcx, dword [rbx + 0x760]
cmp ecx, dword [rbx + 0x764]
jge 0x140042e90
mov esi, dword [rcx + rdx]
test esi, esi
je 0x140042e90
lea eax, [rcx + 4]
xor r8d, r8d
xor ecx, ecx
mov dword [rbx + 0x760], eax
xor edx, edx
call sym.vncviewer.exe_adler32_z
mov r14, qword [rbx + 0x38]
mov ecx, eax
mov r8d, edi
mov rdx, qword [r14 + 0x16f0]
call sym.vncviewer.exe_adler32_z
cmp eax, esi
jne 0x140042e90
mov ecx, edi
mov word [rbp + 0x1f], 0x507
shl ecx, 0x10
lea rdx, [rbp + 0x1f]
mov eax, edi
mov dword [rbp + 0x23], 0x2000000
and eax, 0xff00
mov r9b, 7
or ecx, eax
mov r8d, InitCommonControls
mov eax, edi
shl ecx, 8
and eax, 0xff0000
shr edi, 0x10
or eax, edi
shr eax, 8
or ecx, eax
mov dword [rbp + 0x27], ecx
mov rcx, r14
call fcn.1400266a0
jmp 0x140042fbe
test ecx, ecx
jne 0x140042dd4
mov byte [rbx + 0x750], 1
jmp 0x14004304f
mov edi, dword [rbx + 0xb58]
xor sil, sil
add edi, 0x400
mov eax, r12d
mov dword [rbp - 0x29], edi
cmp byte [rbx + 0x754], r12b
je 0x140042efb
cmp dword [rbx + 0xb54], 1
je 0x140042efb
mov rcx, qword [rbx + 0x38]
mov edx, edi
call fcn.140026f90
mov rax, qword [rbx + 0x38]
lea rdx, [rbp - 0x29]
mov r9d, dword [r15]
mov dword [rsp + 0x20], 0xffffffff
mov r8, qword [rax + 0x16f0]
mov rcx, qword [rax + 0x16e0]
call sym.vncviewer.exe_compress2
test eax, eax
jne 0x1400430a1
mov edi, dword [rbp - 0x29]
mov sil, 1
mov eax, 1
mov edx, dword [r15]
mov word [rbp + 0xf], 0x507
cmp edi, edx
jbe 0x140042f55
xor sil, sil
mov dword [rbp + 0x13], r12d
mov ecx, edx
mov eax, edx
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
mov eax, edx
and eax, 0xff0000
shr edx, 0x10
or eax, edx
shl ecx, 8
shr eax, 8
or ecx, eax
mov dword [rbp + 0x17], ecx
cmp dword [rbx + 0xb54], 1
lea rdx, [rbp + 0xf]
mov rcx, qword [rbx + 0x38]
mov r8d, InitCommonControls
jne 0x140042f8a
mov r9b, 1
call fcn.140026ae0
jmp 0x140042f97
shl eax, 0x18
mov dword [rbp + 0x13], eax
test sil, sil
je 0x140042f0f
mov edx, edi
mov eax, edi
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov ecx, edi
shl ecx, 0x10
mov eax, edi
and eax, 0xff00
shr edx, 8
or ecx, eax
shl ecx, 8
or edx, ecx
mov dword [rbp + 0x17], edx
jmp 0x140042f34
mov r9b, 7
mov byte [rsp + 0x20], 1
call fcn.140026620
mov rcx, qword [rbx + 0x38]
xor r9d, r9d
test sil, sil
je 0x140042faf
mov rdx, qword [rcx + 0x16e0]
mov r8d, edi
jmp 0x140042fb9
mov r8d, dword [r15]
mov rdx, qword [rcx + 0x16f0]
call fcn.140026ae0
mov eax, dword [r15]
mov rcx, rbx
add qword [rbx + 0x748], rax
mov r8, qword [rbx + 0x748]
mov rdx, qword [rbx + 0x40]
call fcn.140040d70
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov dword [rsp + 0x20], 1
mov rdx, rax
lea rcx, [rbp - 0x21]
xor r8d, r8d
mov rdi, rax
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140043049
nop word [rax + rax]
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp - 0x19], 0x10
je 0x140043049
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x21]
mov rdx, rdi
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140043010
cmp byte [rbx + 0x48], r12b
jne 0x1400430ac
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xb60]
cmp eax, 0x3e8
jle 0x140043069
mov ecx, __WSAFDIsSet
jmp 0x14004308a
cmp byte [rbx + 0x72], r12b
jne 0x140043090
cmp dword [rbx + 0xb54], 1
je 0x140043090
mov rax, qword [rbx + 0x38]
cmp dword [rax + 0x52b4], r12d
jne 0x140043090
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0x752], r12b
jne 0x140042d53
xor al, al
jmp 0x1400430c9
mov byte [rbx + 0x751], 1
xor al, al
jmp 0x1400430c9
mov rcx, rbx
mov byte [rbx + 0x751], 1
call fcn.140043100
xor al, al
jmp 0x1400430c9
mov rcx, rbx
call fcn.140043100
mov al, 1
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x98
pop r12
pop rdi
pop rbx
pop rbp
ret