Function at 0x1400c5dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x10050
call fcn.1400ddab0
sub rsp, rax
mov rsi, r9
mov edi, r8d
mov r15, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400c5dfc
xor r9d, r9d
mov byte [rsp + 0x20], 1
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400c3f40
mov eax, dword [rsp + 0x100b0]
mov r14d, 0x1f4
test eax, eax
mov r12d, gethostbyname
cmovne r14d, eax
cmp dword [rsp + 0x100b8], 1
mov eax, 1
cmovge r12d, dword [rsp + 0x100b8]
mov ebx, eax
cmp edi, eax
mov dword [rsp + 0x100b0], eax
cmovge ebx, edi
test r15, r15
je 0x1400c5edd
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x406
mov rcx, r15
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400c5edd
movsxd rax, ebx
cmp rax, qword [rsp + 0x48]
jg 0x1400c5edd
lea rdx, [rsp + 0x100b8]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x100b8]
xor edx, edx
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400c5edd
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400c5f30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
lea rax, [0x1400f5d6c]
lea rdx, [0x1400f62d4]
cmovne rdx, rax
cmp word [rdx], 0x30
jne 0x1400c5eff
cmp word [rdx + 2], 0
je 0x1400c5f13
mov rax, qword [0x140112060]
test byte [rax + 0x140], 1
jne 0x1400c61f4
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400c620a
mov eax, dword gs:[0x48]
dec ebx
mov dword [rsp + 0x100a0], eax
xor eax, eax
mov word [rsp + 0x50], ax
mov qword [rsp + 0x100a8], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
movsxd rax, ebx
mov qword [rsp + 0x10098], rax
lea rcx, [rsp + 0x10090]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov r8, rax
mov dword [rsp + 0x28], 0x7d0
mov rcx, r15
mov edx, 0x40c
mov dword [rsp + 0x20], 2
mov ebx, 0x7fff
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400c60c6
cmp word [rsp + 0x10090], bx
ja 0x1400c617d
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x10090]
mov r8, qword [rsp + 0x10098]
mov r9, rbx
mov qword [rsp + 0x30], rax
mov edx, 0x40d
mov dword [rsp + 0x28], 0x7d0
mov rcx, r15
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1400c60c6
movzx r9d, word [rsp + 0x10090]
lea r8, [rsp + 0x50]
inc r9d
mov qword [rsp + 0x20], 0
add r9, r9
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400c6176
cmp word [rsi], 0
je 0x1400c6155
mov rcx, qword [0x140112060]
mov edx, dword [rcx + 0x30]
sub edx, 1
je 0x1400c6097
sub edx, 1
je 0x1400c6081
cmp edx, 2
je 0x1400c606c
lea rax, [rsp + 0x50]
mov r8, rsi
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400c6068
add rax, 2
test ecx, ecx
jne 0x1400c6054
test edx, edx
jmp 0x1400c60bb
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140071b30
test rax, rax
setne al
jmp 0x1400c60be
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
setne al
jmp 0x1400c60be
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400c60a0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
sete al
test al, al
jne 0x1400c6155
test rbp, rbp
jne 0x1400c6182
mov rcx, r15
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400c61a2
mov eax, dword [rsp + 0x100a0]
cmp dword [0x140117b88], eax
jne 0x1400c6122
test r14d, r14d
js 0x1400c6108
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + r13]
sub ecx, eax
cmp ecx, 5
jle 0x1400c612a
mov edx, 1
mov ecx, r12d
call fcn.1400018c0
mov rax, qword [rsp + 0x10098]
jmp 0x1400c5f64
mov ebx, r13d
test r14d, r14d
js 0x1400c613f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + rbx]
sub ecx, eax
cmp ecx, 5
jle 0x1400c61d3
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x10098]
jmp 0x1400c5f64
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400c617d
xor eax, eax
mov word [rsp + 0x50], ax
test rbp, rbp
je 0x1400c61a2
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea rdx, [rsp + 0x50]
mov rcx, rbp
lea r8, [r9 - 1]
call fcn.1400c3f40
mov dword [rsp + 0x100b0], eax
mov rdx, qword [rsp + 0x40]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x100b0]
mov r13, qword [rsp + 0x100a8]
jmp 0x1400c620a
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400f5d6c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400c61a2
mov rcx, qword [0x1401192c0]
lea r9, [0x1400e0684]
xor r8d, r8d
call fcn.14004d4a0
add rsp, 0x10050
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret