Function at 0x18002bfe0
Capabilities:
Check for time delay via gettickcount
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
cmp dword [0x1801b0450], 0
mov rsi, rcx
je 0x18002c03a
lea r9, str.CIMHookCThread::Run_Begin_
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
call fcn.1800b3b40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsi + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 1
mov dword [rsi + 0x64], eax
cmp dword [0x1801aa490], 0
jne 0x18002c08c
cmp dword [0x1801aa48c], 0
jne 0x18002c08c
call fcn.180025f60
cmp eax, 2
jne 0x18002c08c
mov rcx, rsi
call fcn.18002a2a0
mov ecx, dword [0x1801aa488]
test eax, eax
mov dword [0x1801aa48c], eax
cmove ecx, ebx
mov dword [0x1801aa488], ecx
mov rcx, qword [rsi + 0x20]
xor edi, edi
xor eax, eax
lea edx, [rdi + 0x64]
mov ebp, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x4c], edi
mov r15d, edi
mov r14d, edi
mov dword [rsp + 0x48], edi
mov r12d, edi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x78], edi
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18002c8bf
cmp dword [0x1801aa488], 0
jne 0x18002c8bf
cmp dword [section..IMHookC], 0
jne 0x18002c8bf
cmp dword [0x1801cd004], 0
jne 0x18002c8bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rsp + 0x78]
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.18002b5a0
mov edx, dword [0x1801cd008]
test edx, edx
jne 0x18002c153
cmp dword [0x1801cd014], edx
jne 0x18002c153
inc r13d
cmp r13d, 0x168
ja 0x18002c8bf
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18002c8a5
cmp dword [0x1801aa4a8], 0
mov r13d, edi
jne 0x18002c366
mov r8d, dword [0x1801aa48c]
mov eax, edx
and eax, r8d
cmp eax, 0x800
je 0x18002c188
cmp eax, 0x100
je 0x18002c188
cmp eax, 0x80000
jne 0x18002c312
mov ecx, dword [rsi + 0x64]
lea eax, [rcx + 0xea60]
cmp eax, ebx
jbe 0x18002c312
mov edi, dword [0x1801aae80]
test edi, edi
je 0x18002c1c2
lea eax, [rcx + 0x2710]
mov ecx, 0x3e8
cmp eax, ebx
mov eax, 0x1388
cmovb ecx, eax
add ecx, edi
cmp ecx, ebx
jae 0x18002c312
mov rcx, qword [0x1801aa4c0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x18002c1e0
mov rcx, rsi
call fcn.180029830
jmp 0x18002c2f6
xor eax, eax
lea rcx, [rsp + 0x2c2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x2c0], ax
call fcn.18007ead0
mov rcx, qword [0x1801aa4c0]
lea r9, [rsp + 0x2c0]
mov edx, reloc.WS2_32.dll_listen
mov r8d, 0x104
call qword [sym.imp.USER32.dll_SendMessageW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x2c0]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18002c2f6
lea rcx, [rsp + 0xb2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb0], ax
call fcn.18007ead0
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x2c0]
mov r9d, 0x104
or edx, 0xffffffff
call fcn.18000f870
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18002c2f6
lea rax, [rsp + 0xb0]
lea rdi, [0x1801aa4d0]
sub rdi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x18002c2b7
add rax, 2
test ecx, ecx
jne 0x18002c2a4
test edx, edx
je 0x18002c2f6
lea rdi, [0x1801aa4d0]
xor edx, edx
mov r8d, 0x208
mov rcx, rdi
call fcn.18007ead0
xor eax, eax
mov rdx, rax
nop word [rax + rax]
movzx eax, word [rsp + rdx + 0xb0]
add rdx, 2
mov word [rdx + rdi - 2], ax
test ax, ax
jne 0x18002c2e0
cmp dword [0x1801aa4a8], 0
mov edx, dword [0x1801cd008]
mov dword [0x1801aae80], ebx
jne 0x18002c366
mov r8d, dword [0x1801aa48c]
and edx, r8d
cmp edx, 0x4000
je 0x18002c374
cmp edx, 0x1000000
je 0x18002c374
cmp edx, 0x80000000
je 0x18002c374
cmp edx, 0x40000000
je 0x18002c374
cmp edx, 0x80
je 0x18002c374
cmp edx, 0x11
je 0x18002c374
cmp edx, 0x800
je 0x18002c374
call fcn.180001260
test eax, eax
jne 0x18002c374
mov edx, dword [0x1801cd008]
mov eax, edx
and eax, dword [0x1801aa48c]
cmp eax, 8
je 0x18002c374
and edx, dword [0x1801aa48c]
cmp edx, 0x10000000
jne 0x18002c37c
mov rcx, rsi
call fcn.18002a870
cmp dword [0x1801aa48c], 0x80000000
jne 0x18002c390
mov rcx, rsi
call fcn.180029e00
test r12d, r12d
je 0x18002c3a5
lea eax, [r12 + 0x2710]
cmp eax, ebx
jae 0x18002c42c
call fcn.180001550
test eax, eax
je 0x18002c429
cmp dword [0x1801a220c], 0
jne 0x18002c411
call fcn.180001660
mov rdi, rax
test rax, rax
je 0x18002c429
mov r12d, 1
mov rcx, rsi
mov dword [0x1801a220c], r12d
call fcn.18002a870
mov r8d, dword [0x1801a2214]
lea rcx, [0x1801a9dc0]
mov rdx, rdi
call fcn.180016b90
lea rcx, [0x1801a9dc0]
mov r8d, r12d
mov edx, r12d
call fcn.180017070
mov ecx, dword [0x1801a2214]
call fcn.18001e3b0
mov r8d, r12d
jmp 0x18002c41f
mov ecx, dword [0x1801a2214]
call fcn.18001e3b0
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.180029380
mov r12d, ebx
mov edi, dword [rsp + 0x44]
mov eax, 0x99999999
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
lea edi, [rdi + rax*2]
mov eax, edi
inc edi
mov dword [rsp + 0x44], edi
test eax, eax
jne 0x18002c8a3
mov edi, dword [rsp + 0x54]
test edi, edi
je 0x18002c469
lea eax, [rdi + 0x2710]
cmp eax, ebx
jae 0x18002c479
lea rcx, [0x1801afb50]
call fcn.1800b4fd0
mov dword [rsp + 0x54], ebx
cmp dword [0x1801aa4a8], 0x1000000
jne 0x18002c4a4
mov rcx, qword [0x1801aa4b8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x18002c4a4
xor eax, eax
mov dword [reloc.WS2_32.dll_accept], eax
mov dword [0x1801aa4a8], eax
mov ecx, dword [0x1801b0450]
test ecx, ecx
je 0x18002c4e7
mov rax, qword [0x1801aa4b8]
lea r9, str._thread__line_wnd___d____p_
lea r8, [0x18012b1a8]
mov qword [rsp + 0x28], rax
mov eax, dword [reloc.WS2_32.dll_accept]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.1800b3b40
mov ecx, dword [0x1801b0450]
cmp dword [0x1801aa4a8], 0
jne 0x18002c6d8
cmp ebp, 0xe10
jg 0x18002c6aa
cmp ebp, 0x3c
jle 0x18002c543
cmp dword [0x1801aa48c], 0
jne 0x18002c543
test ecx, ecx
je 0x18002c52f
lea r9, str._thread__timeout
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
call fcn.1800b3b40
call fcn.180001550
test eax, eax
je 0x18002c8bf
inc ebp
jmp 0x18002c6d8
cmp ebp, 0x12c
jle 0x18002c561
mov edi, dword [rsp + 0x50]
cmp ebx, edi
jb 0x18002c561
lea eax, [rdi + 0xea60]
cmp eax, ebx
jae 0x18002c6a6
mov dword [rsp + 0x50], ebx
test ecx, ecx
je 0x18002c586
lea r9, str.CheckIsIM
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
call fcn.1800b3b40
mov ecx, dword [rsi + 0x40]
xor eax, eax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.18000d710
test eax, eax
je 0x18002c6a6
cmp dword [0x1801b0450], 0
je 0x18002c5fd
mov rax, qword [rsp + 0x70]
lea r9, str.CheckIsIM___08x__08x__08x_0x_016I64x_
lea r8, [0x18012b1a8]
mov qword [rsp + 0x38], rax
mov eax, dword [0x1801cd008]
lea rcx, [0x1801afb58]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x58]
or edx, 0xffffffff
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call fcn.1800b3b40
mov eax, dword [rsp + 0x60]
mov edi, 1
mov dword [0x1801aa4a0], eax
mov eax, dword [rsp + 0x64]
mov dword [0x1801aa4ac], edi
mov dword [0x1801aa4a4], eax
mov rax, qword [rsp + 0x58]
mov qword [0x1801aa498], rax
mov eax, dword [rsp + 0x68]
mov dword [0x1801aa4a8], eax
mov rax, qword [rsp + 0x70]
mov qword [0x1801aa4b0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x68], eax
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x18002c6a6
cmp dword [0x1801aa4a8], 0x1000000
jne 0x18002c6a6
lea rcx, [0x1801aa210]
mov r8d, edi
mov edx, 0x1000000
call fcn.18001f010
lea rcx, [0x1801aa210]
call fcn.18001efb0
lea rcx, [0x1801a9dc0]
mov r8d, 0x8000000
mov rdx, rax
mov qword [0x1801aa4b8], rax
call fcn.180016b90
mov rcx, rsi
call fcn.18002b810
mov dword [reloc.WS2_32.dll_accept], edi
inc ebp
jmp 0x18002c6d8
test ecx, ecx
je 0x18002c6cb
lea r9, str._thread__timeout_2
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
call fcn.1800b3b40
call fcn.180001550
test eax, eax
je 0x18002c8bf
xor edi, edi
cmp dword [rsi + 0x60], edi
je 0x18002c6e4
mov ebp, edi
mov dword [rsi + 0x60], edi
call fcn.180001550
test eax, eax
jne 0x18002c6f9
cmp dword [0x1801aa4a8], eax
je 0x18002c8a5
mov rcx, rsi
call fcn.18002a870
mov edi, dword [rsp + 0x4c]
test edi, edi
je 0x18002c713
lea eax, [rdi + 0x4e20]
cmp eax, ebx
jae 0x18002c71f
mov rcx, rsi
call fcn.180029c90
mov dword [rsp + 0x4c], ebx
mov edi, dword [rsp + 0x48]
test edi, edi
je 0x18002c731
lea eax, [rdi + 0x1b58]
cmp eax, ebx
jae 0x18002c74d
lea rcx, [0x1801a2218]
call fcn.180001b70
lea rcx, [0x1801a2218]
call fcn.180001e00
mov dword [rsp + 0x48], ebx
mov ecx, dword [0x1801aa4a8]
test ecx, ecx
je 0x18002c8a3
cmp ecx, 0x8000000
jne 0x18002c78a
test r15d, r15d
je 0x18002c773
lea eax, [r15 + 0x2710]
cmp eax, ebx
jae 0x18002c787
lea rcx, [0x1801a2230]
xor edx, edx
call fcn.1800024f0
mov ecx, dword [0x1801aa4a8]
mov r15d, ebx
cmp ecx, 0x80000000
jne 0x18002c7b3
test r14d, r14d
je 0x18002c7a2
lea eax, [r14 + 0x2710]
cmp eax, ebx
jae 0x18002c7b0
lea rcx, [0x1801a9dc0]
xor edx, edx
call fcn.180016d90
mov r14d, ebx
mov rcx, rsi
call fcn.180029160
mov rcx, rsi
call fcn.18002bb80
mov edx, dword [0x1801aa4a8]
xor r8d, r8d
mov rcx, rsi
call fcn.180029380
cmp dword [0x1801a220c], 0
jne 0x18002c818
mov edx, dword [0x1801aa48c]
mov ecx, dword [0x1801aa4a8]
call fcn.1800011d0
test eax, eax
je 0x18002c818
lea rcx, [0x1801aa210]
call fcn.18001efb0
mov ebx, 1
test rax, rax
je 0x18002c81d
mov rcx, rax
mov dword [0x1801a220c], ebx
call fcn.1800017c0
jmp 0x18002c81d
mov ebx, 1
lea rcx, [0x1801aa210]
xor edi, edi
mov dword [rsp + 0x40], edi
call fcn.18001efb0
mov edx, dword [0x1801a93ac]
lea r8, [rsp + 0x40]
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0x40], edi
je 0x18002c875
mov rcx, rsi
call fcn.180029c90
lea rcx, [0x1801aa210]
call fcn.18001efb0
mov edx, dword [0x1801a93b0]
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x18002c8a5
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x18002c8a5
xor edi, edi
mov rcx, qword [rsi + 0x20]
mov edx, VarCyFromDisp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18002c0e2
mov rcx, rsi
call fcn.18002a770
cmp dword [0x1801b0450], 0
je 0x18002c8ed
lea r9, str.CIMHookCThread::Run_End_
lea r8, [0x18012b1a8]
lea rcx, [0x1801afb58]
or edx, 0xffffffff
call fcn.1800b3b40
xor eax, eax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.18007e1e0
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret