Function at 0x18005c168
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x818]
sub rsp, 0x900
mov rsi, rcx
movabs rdi, 0xd993efbb19cfe32d
xor r14d, r14d
cmp byte [0x18010a5a4], r14b
je 0x18005c4b1
lea r8d, [r14 + 6]
lea rdx, str.aol:__
lea rcx, [0x180108580]
call fcn.1800a74e0
test eax, eax
je 0x18005c1cf
cmp byte [0x180108580], r14b
jne 0x18005c4b1
mov rbx, rsi
call fcn.18004a0b0
test al, al
jne 0x18005c1e4
call fcn.180049e38
test al, al
je 0x18005c236
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], al
lea edi, [rax + 0x19]
mov rcx, rsi
jmp 0x18005c213
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetTopWindow]
test rax, rax
je 0x18005c236
mov rbx, rax
mov rcx, rax
mov r8d, edi
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetClassNameA]
lea rdx, str.Shell_Embedding
lea rcx, [rsp + 0x20]
call fcn.1800a86c0
test eax, eax
jne 0x18005c1ff
mov r15d, 0x50
mov rcx, rbx
jmp 0x18005c255
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
je 0x18005c268
mov rcx, rax
mov r8d, r15d
lea rdx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
mov edi, eax
jle 0x18005c241
mov rcx, rsi
call fcn.18004a1ec
or rbx, 0xffffffffffffffff
test al, al
je 0x18005c2a9
movsd xmm0, qword [str.Read_Email]
movsd qword [rbp - 0x80], xmm0
movzx eax, word [0x1800d4108]
mov word [rbp - 0x78], ax
mov al, byte [0x1800d410a]
mov byte [rbp - 0x76], al
lea rax, [rbp - 0x80]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], r14b
jne 0x18005c2a0
test edi, edi
je 0x18005c5f7
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], r14b
lea rax, [rbp - 0x80]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x18005c2ce
lea rcx, [rsp + 0x20]
cmp rbx, rdi
ja 0x18005c2f9
mov qword [rsp + 0x30], rbx
mov r8, rbx
lea rdx, [rbp - 0x80]
call fcn.18009fc20
mov byte [rsp + rbx + 0x20], r14b
jmp 0x18005c309
lea r9, [rbp - 0x80]
mov r8b, r14b
mov rdx, rbx
call fcn.180003a38
nop
lea rcx, [rsp + 0x20]
call fcn.180049c78
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.18000f948
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], r14b
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
add rdx, rcx
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x40]
call fcn.18004a3d8
lea rdx, str.aol:__waol.exe__cs_title
lea rcx, [rbp - 0x30]
call fcn.180003484
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.180003dc4
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x28]
call fcn.18000b4c4
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8d, 0x823
lea rcx, [0x180108580]
call fcn.1800a8850
mov ebx, 0x1000
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18005c408
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x18005c402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c68a
call fcn.18009d1f4
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18005c441
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x18005c43c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c690
call fcn.18009d1f4
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], r14b
lea rcx, [rbp + 0x58]
call fcn.18000f874
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x58]
call fcn.18009c330
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18005c5f7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x18005c4a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c684
call fcn.18009d1f4
jmp 0x18005c5f7
call fcn.18005ceb8
test al, al
je 0x18005c601
cmp byte [0x180108580], r14b
jne 0x18005c601
mov ebx, 0x824
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1800a02d0
mov r8d, ebx
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.18004fbec
test eax, eax
jne 0x18005c601
cmp byte [0x18010a364], r14b
je 0x18005c544
lea rcx, [rbp + 0x828]
call fcn.18005a108
cmp byte [rax + 0x36], r14b
je 0x18005c533
mov r9, r14
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rdi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x36
jb 0x18005c513
mov byte [rax + 0x36], r14b
lea r8, [rbp - 0x30]
mov rdx, rax
mov ecx, 3
call fcn.18006a848
lea rcx, [rbp - 0x30]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], r14b
jne 0x18005c54f
test rax, rax
je 0x18005c601
lea r15, [0x180108460]
mov qword [rsp + 0x20], r15
mov rcx, r15
call fcn.180007dac
mov byte [rsp + 0x28], 1
lea rax, [rbp - 0x30]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x18005c57e
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rbx, rax
ja 0x18005c5c2
lea rdi, [0x1801012d0]
cmp rax, 0x10
cmovae rdi, qword [0x1801012d0]
mov qword [0x1801012e0], rbx
mov r8, rbx
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.18009fc20
mov byte [rdi + rbx], r14b
jmp 0x18005c5d8
lea r9, [rbp - 0x30]
mov r8b, r14b
mov rdx, rbx
lea rcx, [0x1801012d0]
call fcn.180003a38
mov r8d, 0x823
lea rdx, [rbp - 0x30]
lea rcx, [0x180108580]
call fcn.1800a8850
mov rcx, r15
call fcn.180007dc4
nop
movabs rdi, 0xd993efbb19cfe32d
cmp byte [0x18010a364], r14b
je 0x18005c64f
lea rcx, [rbp + 0x828]
call fcn.18005a2a8
cmp byte [rax + 0x3d], r14b
je 0x18005c63f
mov r9, r14
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rdi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3d
jb 0x18005c61f
mov byte [rax + 0x3d], r14b
mov r8, rsi
mov rdx, rax
mov ecx, 3
call fcn.18006a848
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180108fd0], eax
mov rdx, rsi
mov ecx, 2
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp fcn.18005d240
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3