Function at 0x1400de830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x10050
call fcn.1400f7000
sub rsp, rax
mov ebx, dword [rsp + 0x100b8]
mov rbp, r9
mov esi, dword [rsp + 0x100b0]
mov edi, r8d
mov r15, rdx
mov r12, rcx
test rcx, rcx
je 0x1400de87d
xor r9d, r9d
mov byte [rsp + 0x20], 1
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.1400dc860
test esi, esi
mov qword [rsp + 0x100a8], r13
mov eax, 1
mov r14d, 0x1f4
cmovne r14d, esi
mov dword [rsp + 0x100b8], eax
cmp ebx, 1
mov esi, gethostbyname
cmovge esi, ebx
cmp edi, eax
mov ebx, eax
cmovge ebx, edi
test r15, r15
je 0x1400dec29
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x406
mov rcx, r15
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400dec29
movsxd rax, ebx
cmp rax, qword [rsp + 0x48]
jg 0x1400dec29
lea rdx, [rsp + 0x100b0]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x100b0]
xor edx, edx
mov ecx, reloc.WSOCK32.dll_getservbyport
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400dec29
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x1400de95f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400dec29
mov eax, dword gs:[0x48]
dec ebx
mov dword [rsp + 0x10090], eax
xor eax, eax
mov word [rsp + 0x50], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x100a0], eax
movsxd rax, ebx
mov ebx, dword [rsp + 0x100a0]
mov qword [rsp + 0x40], rax
nop dword [rax]
lea rcx, [rsp + 0x10098]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov r8, rax
mov dword [rsp + 0x28], 0x7d0
mov rcx, r15
mov edx, 0x40c
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400deb07
mov eax, 0x7fff
cmp word [rsp + 0x10098], ax
ja 0x1400debb3
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x10098]
mov qword [rsp + 0x30], rax
mov r9, r13
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x40d
mov rcx, r15
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400deb07
movzx r9d, word [rsp + 0x10098]
lea r8, [rsp + 0x50]
inc r9d
mov qword [rsp + 0x20], 0
add r9, r9
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400debac
cmp word [rbp], 0
je 0x1400deb88
mov rcx, qword [0x14012f240]
mov edx, dword [rcx + 0x30]
sub edx, 1
je 0x1400dead3
sub edx, 1
je 0x1400deabd
cmp edx, 2
je 0x1400deaa8
lea rax, [rsp + 0x50]
mov r8, rbp
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400deaa4
add rax, 2
test ecx, ecx
jne 0x1400dea90
test edx, edx
jmp 0x1400deafc
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140088e40
test rax, rax
setne al
jmp 0x1400deaff
mov rdx, rbp
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
setne al
jmp 0x1400deaff
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbp + r8*2], 0
jne 0x1400deae0
mov rdx, rbp
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
sete al
test al, al
jne 0x1400deb88
test r12, r12
jne 0x1400debb8
mov rcx, r15
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400debdb
mov eax, dword [rsp + 0x10090]
cmp dword [0x140136030], eax
jne 0x1400deb5c
test r14d, r14d
js 0x1400deb46
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + rbx]
sub ecx, eax
cmp ecx, 5
jle 0x1400deb61
mov edx, 1
mov ecx, esi
call fcn.140001b00
mov rax, qword [rsp + 0x40]
jmp 0x1400de9a0
test r14d, r14d
js 0x1400deb76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + rbx]
sub ecx, eax
cmp ecx, 5
jle 0x1400dec05
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x40]
jmp 0x1400de9a0
mov rcx, qword [0x140132a80]
lea rdx, [0x1400f98c8]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
jmp 0x1400debb3
xor eax, eax
mov word [rsp + 0x50], ax
test r12, r12
je 0x1400debdb
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.1400dc860
mov dword [rsp + 0x100b8], eax
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x100b8]
jmp 0x1400dec8e
mov rcx, qword [0x140132a80]
lea rdx, [0x14011026c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
jmp 0x1400debdb
test r12, r12
lea rax, [0x14011026c]
lea rdx, [0x1401107d4]
cmovne rdx, rax
cmp word [rdx], 0x30
jne 0x1400dec4b
cmp word [rdx + 2], 0
je 0x1400dec5b
mov rax, qword [0x14012f240]
test byte [rax + 0x140], 1
jne 0x1400dec78
mov rcx, qword [0x140132a80]
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400dc860
jmp 0x1400dec8e
mov rcx, qword [0x140136730]
lea r9, [0x1400f97e4]
xor r8d, r8d
call fcn.140063d20
mov r13, qword [rsp + 0x100a8]
add rsp, 0x10050
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret