Function at 0x140005660
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0xa8
mov rcx, qword [rdx + 8]
mov r8d, shutdown
lea rdx, str.K0YaAARJEsUhTYjhw3t2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000568c
xor eax, eax
add rsp, 0xa8
ret
mov qword [rsp + 0xb0], rbx
lea rcx, [0x140005640]
mov qword [rsp + 0x90], rdi
mov edx, 1
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.140005350
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14000570f
mov ecx, 0x280
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400056ea
xor ebx, ebx
jmp 0x14000570f
xor edx, edx
mov r8d, 0x280
mov rcx, rdi
call fcn.140021acb
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 0x280
mov dword [rbx + 0x14], 0x280
mov ecx, dword [rbx + 0x10]
mov qword [rsp + 0x80], r13
cmp ecx, 0x100
jge 0x140005727
xor r13d, r13d
jmp 0x140005758
mov r13, qword [rbx + 8]
add ecx, 0xffffff00
mov dword [rbx + 0x10], ecx
lea rax, [r13 + 0x100]
mov qword [rbx + 8], rax
cmp ecx, 0x100
jl 0x140005758
add qword [rbx + 8], 0x100
add ecx, 0xffffff00
mov dword [rbx + 0x10], ecx
mov qword [rsp + 0x98], rsi
cmp ecx, 0x80
jge 0x14000576c
xor esi, esi
jmp 0x140005781
mov rsi, qword [rbx + 8]
lea rax, [rsi + 0x80]
mov qword [rbx + 8], rax
lea eax, [rcx - 0x80]
mov dword [rbx + 0x10], eax
mov rax, qword [0x140036d20]
mov qword [rsp + 0x38], rsi
cmp word [rax + 0x80], 3
jne 0x1400057a0
mov rcx, qword [rax + 0x88]
jmp 0x1400057a2
xor ecx, ecx
cmp word [rax + 0x20], 1
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x78], r14
jne 0x1400057ba
movzx r14d, word [rax + 0x28]
jmp 0x1400057bd
xor r14d, r14d
cmp word [rax + 0x90], 3
mov dword [rsp + 0xc0], r14d
mov qword [rsp + 0xa0], rbp
jne 0x1400057e0
mov rbp, qword [rax + 0x98]
jmp 0x1400057e2
xor ebp, ebp
cmp word [rax + 0xa0], 3
mov qword [rsp + 0x40], rbp
jne 0x1400057ff
mov rcx, qword [rax + 0xa8]
mov qword [rsp + 0x30], rcx
jmp 0x140005808
mov qword [rsp + 0x30], 0
cmp word [rax + 0x30], 2
jne 0x140005814
mov ecx, dword [rax + 0x38]
jmp 0x140005816
xor ecx, ecx
cmp word [rax + 0x50], 1
mov dword [0x140036d28], ecx
jne 0x140005829
movzx ecx, word [rax + 0x58]
jmp 0x14000582b
xor ecx, ecx
movsx eax, cx
xor ebx, ebx
mov dword [0x140036d10], eax
lea ecx, [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140036d20]
mov rdi, rax
mov qword [rsp + 0x48], rax
cmp word [r8 + 0x450], 2
jne 0x140005862
mov r9d, dword [r8 + 0x458]
jmp 0x140005865
xor r9d, r9d
cmp word [r8 + 0x460], 2
jne 0x140005879
mov edx, dword [r8 + 0x468]
jmp 0x14000587b
xor edx, edx
cmp word [r8 + 0x440], 2
jne 0x14000588f
mov ecx, dword [r8 + 0x448]
jmp 0x140005891
xor ecx, ecx
cmp word [r8 + 0x430], 1
jne 0x1400058a6
movzx eax, word [r8 + 0x438]
jmp 0x1400058a8
xor eax, eax
cmp word [r8 + 0x280], 2
cwde
mov dword [rdi], eax
mov dword [rdi + 4], ecx
mov dword [rdi + 8], edx
mov dword [rdi + 0xc], r9d
jne 0x140005923
cmp dword [r8 + 0x288], ebx
je 0x140005923
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r8, qword [0x140036d20]
cmp word [r8 + 0x280], 2
jne 0x1400058ef
mov r9d, dword [r8 + 0x288]
jmp 0x1400058f2
xor r9d, r9d
movzx eax, word [rsp + 0x50]
imul ecx, eax, 0x64
movzx eax, word [rsp + 0x52]
add ecx, eax
movzx eax, word [rsp + 0x56]
imul edx, ecx, 0x64
add edx, eax
xor eax, eax
cmp edx, r9d
setae al
test eax, eax
je 0x140005923
call fcn.140005590
mov r8, qword [0x140036d20]
cmp word [r8 + 0x40], 2
jne 0x140005931
mov r12d, dword [r8 + 0x48]
jmp 0x140005934
xor r12d, r12d
movsxd rcx, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov edx, r12d
mov r15, rax
call fcn.14000bfe0
cmp dword [0x140036d28], ebx
je 0x140005f4f
nop word [rax + rax]
mov rdx, qword [rsp + 0x28]
mov r8d, ebx
mov rcx, rdi
call fcn.14000cb30
mov r9, rax
lea r8, [0x140029100]
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.140001bb0
mov rdx, qword [rsp + 0x28]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0xc8], 0
call fcn.14000cb30
mov r9, rax
lea r8, [0x140029100]
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.140001bb0
mov r9, qword [rsp + 0x30]
lea r8, [0x140029100]
mov edx, 0x100
mov dword [0x140036d14], 1
lea rcx, [0x140036d30]
call fcn.140001bb0
mov r8, rbp
movzx edx, r14w
mov rcx, rsi
call fcn.14000acc0
cmp qword [0x140033958], 0
je 0x1400059ff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov r8d, r12d
mov rdx, r15
mov rcx, r13
call fcn.140009b10
mov rcx, qword [0x140033958]
mov ebx, eax
test rcx, rcx
je 0x140005a21
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test ebx, ebx
jle 0x140005b1d
mov edx, ebx
mov rcx, r15
call fcn.14000c460
mov rbx, rax
test eax, eax
jle 0x140005b1d
mov ecx, dword [r15 + 4]
mov rbx, r15
movsxd r14, eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [r15]
movsxd rdi, eax
call qword [sym.imp.WS2_32.dll_ntohl]
lea rsi, [rdi + 8]
mov rdx, rdi
add rsi, r15
lea rbp, [r14 + r15]
cmp rsi, rbp
jae 0x140005aa2
nop dword [rax]
lea rcx, [rbx + 8]
mov r8d, eax
call fcn.1400074b0
mov ecx, dword [rsi + 4]
mov rbx, rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rsi]
movsxd rdi, eax
call qword [sym.imp.WS2_32.dll_ntohl]
lea rsi, [rdi + 8]
mov rdx, rdi
add rsi, rbx
cmp rsi, rbp
jb 0x140005a70
movsxd rdx, edi
lea rcx, [rbx + 8]
mov r8d, eax
call fcn.1400074b0
mov r8, r14
xor edx, edx
mov rcx, r15
call fcn.140021acb
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov r14d, dword [rsp + 0xc0]
call fcn.140005fa0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ebx, [rax + 0xdac]
call fcn.140006560
test eax, eax
jle 0x140005af4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jb 0x140005ae1
mov rbx, qword [0x140032a30]
xor edi, edi
test rbx, rbx
je 0x140005b9f
cmp dword [rbx + 4], 0
je 0x140005b2c
mov rdi, rbx
mov rbx, qword [rbx + 0x24]
test rbx, rbx
jne 0x140005b06
jmp 0x140005b9f
cmp ebx, 0xffffffff
jne 0x140005ad0
mov ebx, 1
jmp 0x140005e5c
cmp dword [rbx + 0xc], 0
jne 0x140005b3d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xc], eax
jmp 0x140005b0c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xc]
cmp eax, 0x3e8
jbe 0x140005b0c
cmp dword [rbx + 0x10], 0
jne 0x140005b62
mov rcx, qword [rbx + 0x1c]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x1c]
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x140005b76
cmp dword [rbx + 0x10], 2
je 0x140005b0c
mov rax, qword [rbx + 0x24]
mov rcx, rbx
test rdi, rdi
je 0x140005b92
mov qword [rdi + 0x24], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rdi + 0x24]
jmp 0x140005b13
mov qword [0x140032a30], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x1c
call fcn.14000d0a0
mov rbx, qword [0x140034ae8]
test eax, eax
je 0x140005c1c
test rbx, rbx
je 0x140005c89
nop dword [rax]
cmp dword [rbx + 4], 0
je 0x140005bd3
mov edx, 0x1000
mov rcx, rbx
call fcn.140002690
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140005bc0
mov rcx, qword [0x140034ae8]
test rcx, rcx
je 0x140005c89
nop dword [rax]
cmp dword [rcx + 4], 0
mov rax, qword [rcx + 0x10]
je 0x140005c02
mov rbx, rcx
mov rcx, rax
jmp 0x140005c15
test rbx, rbx
je 0x140005c7c
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x140005bf0
jmp 0x140005c89
test rbx, rbx
je 0x140005c89
cmp dword [rbx + 4], 0
je 0x140005c34
mov edx, 0x80000
mov rcx, rbx
call fcn.140002690
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140005c21
mov rcx, qword [0x140034ae8]
test rcx, rcx
je 0x140005c89
nop dword [rax]
cmp dword [rcx + 4], 0
mov rax, qword [rcx + 0x10]
je 0x140005c62
mov rbx, rcx
mov rcx, rax
jmp 0x140005c75
test rbx, rbx
je 0x140005c7c
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x140005c50
jmp 0x140005c89
mov qword [0x140034ae8], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebx, ebx
lea rdi, [0x140032a50]
cmp dword [rbx + rdi + 0x48], 1
jne 0x140005d2e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbx + rdi + 0x5c], eax
jae 0x140005d2e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + rdi]
add eax, 0x3a98
mov dword [rbx + rdi + 0x5c], eax
call qword [sym.imp.WS2_32.dll_htonl]
cmp dword [0x140036d14], 1
mov dword [rsp + 0xb8], eax
jne 0x140005d15
mov rax, qword [0x140036d20]
cmp word [rax + 0x1c0], 2
jne 0x140005d15
mov ecx, dword [rax + 0x1c8]
test ecx, ecx
je 0x140005d15
mov r8d, reloc.WS2_32.dll_ntohl
cmp ecx, 4
jb 0x140005d01
lea r9d, [r8 - 0xd]
jmp 0x140005d1c
lea rdx, [rsp + 0xb8]
mov ecx, 4
call fcn.14000a2f0
jmp 0x140005d2e
xor r9d, r9d
lea r8d, [r9 + 0xe]
mov edx, 4
lea rcx, [rsp + 0xb8]
call fcn.14000a200
add rbx, 0x60
cmp rbx, 0xf00
jb 0x140005c92
call fcn.140005030
mov rax, qword [0x140036d20]
cmp word [rax + 0x280], 2
jne 0x140005df6
cmp dword [rax + 0x288], 0
je 0x140005df6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r8, qword [0x140036d20]
cmp word [r8 + 0x280], 2
jne 0x140005d8c
mov r9d, dword [r8 + 0x288]
jmp 0x140005d8f
xor r9d, r9d
movzx eax, word [rsp + 0x50]
imul ecx, eax, 0x64
movzx eax, word [rsp + 0x52]
add ecx, eax
movzx eax, word [rsp + 0x56]
imul edx, ecx, 0x64
add edx, eax
xor eax, eax
cmp edx, r9d
setae al
test eax, eax
je 0x140005df6
cmp dword [0x140036d14], 1
mov dword [0x140036d28], 0
jne 0x140005de4
cmp word [r8 + 0x1c0], 2
jne 0x140005de4
cmp dword [r8 + 0x1c8], 0
je 0x140005de4
mov r9d, 1
jmp 0x140005de7
xor r9d, r9d
mov r8d, 0x1a
xor edx, edx
xor ecx, ecx
call fcn.14000a200
cmp qword [0x140036d18], 0
jbe 0x140005e50
cmp qword [0x140033958], 0
je 0x140005e10
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [0x140033970]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [0x140033978]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [0x140033958]
test rcx, rcx
je 0x140005e3c
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov r8, rbp
movzx edx, r14w
mov rcx, rsi
call fcn.14000acc0
call fcn.140009e50
mov ebx, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0x48]
cmp qword [0x140033958], 0
je 0x140005e6c
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [0x140033970]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [0x140033978]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [0x140033958]
test rcx, rcx
je 0x140005e98
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rax, qword [0x140036d20]
cmp word [rax + 0x280], 2
jne 0x140005f04
cmp dword [rax + 0x288], 0
je 0x140005f04
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rax, qword [0x140036d20]
cmp word [rax + 0x280], 2
jne 0x140005ed7
mov r8d, dword [rax + 0x288]
jmp 0x140005eda
xor r8d, r8d
movzx eax, word [rsp + 0x60]
imul ecx, eax, 0x64
movzx eax, word [rsp + 0x62]
add ecx, eax
movzx eax, word [rsp + 0x66]
imul edx, ecx, 0x64
add edx, eax
xor eax, eax
cmp edx, r8d
setae al
test eax, eax
je 0x140005f04
call fcn.140005590
mov eax, dword [0x140036d28]
test eax, eax
je 0x140005f4f
mov ecx, dword [0x140036d10]
test ecx, ecx
je 0x140005f3d
imul ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
je 0x140005f3d
mov edx, 4
lea rcx, [rsp + 0x20]
call fcn.14000be90
call fcn.140006ab0
cmp dword [0x140036d28], 0
jne 0x140005960
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140005590
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret