Function at 0x18002016c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rcx, qword [0x18008d218]
lea rsi, [0x18008d218]
cmp rcx, rsi
je 0x1800201c9
test byte [rcx + 0x1c], 0x10
je 0x1800201c9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1800734a8]
mov edx, 0x18
mov r9, rdi
call fcn.180001364
or r13, 0xffffffffffffffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80000000
mov qword [rbp - 1], r13
mov rdx, rdi
lea rcx, [rbp - 1]
lea r9d, [r13 + 4]
call fcn.180035cb0
xor r12d, r12d
mov ebx, eax
test eax, eax
jns 0x180020210
mov rcx, qword [rbp - 1]
cmp rcx, r13
je 0x1800202ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800202ad
lfence
mov rcx, qword [r14]
mov qword [r14], r13
cmp rcx, r13
je 0x180020224
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 1]
lea rcx, [rbp - 1]
mov r9d, 1
mov qword [rbp - 1], r13
mov r8d, 0x80000000
mov dword [rsp + 0x20], 4
mov rdx, rdi
call fcn.180035cb0
mov ebx, eax
test eax, eax
jns 0x180020271
cmp rsi, r13
je 0x180020260
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 1]
cmp rcx, r13
je 0x1800202a6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800202a6
lfence
cmp rsi, r13
je 0x180020282
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 1]
xor edx, edx
mov rcx, rdi
call fcn.180023e88
mov ebx, eax
test eax, eax
jns 0x1800202a0
cmp rsi, r13
je 0x1800202a6
mov rcx, rsi
jmp 0x180020269
mov qword [r14], rsi
mov ebx, r12d
lea rsi, [0x18008d218]
test ebx, ebx
je 0x1800202ea
mov rcx, qword [0x18008d218]
cmp rcx, rsi
je 0x1800202e0
test byte [rcx + 0x1c], 1
je 0x1800202e0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1800734a8]
mov edx, 0x19
mov qword [rsp + 0x20], rdi
mov r9d, ebx
call fcn.180006038
mov eax, 0x80510006
jmp 0x180020590
mov rcx, rdi
call fcn.1800205b4
mov ebx, eax
test eax, eax
jns 0x18002033b
lfence
mov rcx, qword [0x18008d218]
cmp rcx, rsi
je 0x180020334
test byte [rcx + 0x1c], 1
je 0x180020334
mov rcx, qword [rcx + 0x10]
lea r9, [0x1800733d0]
mov dword [rsp + 0x28], eax
lea r8, [0x1800734a8]
lea rax, str.AntiMalware_Definition_Update
mov qword [rsp + 0x20], rax
call fcn.18001f86c
mov eax, ebx
jmp 0x180020590
lfence
mov r9, r15
mov qword [rbp + 7], r12
mov r8, rdi
lea rdx, str.__ls___x:__ls_
lea rcx, [rbp + 7]
call fcn.1800363e0
mov esi, eax
test eax, eax
jns 0x180020378
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18002036c
call fcn.180040d20
mov rdi, r12
lea r13, [0x18008d218]
jmp 0x1800203b0
mov rcx, qword [0x18008d218]
lea r13, [0x18008d218]
mov rdi, qword [rbp + 7]
cmp rcx, r13
je 0x1800203ad
test byte [rcx + 0x1c], 4
je 0x1800203ad
mov rcx, qword [rcx + 0x10]
lea r8, [0x1800734a8]
mov edx, 0x22
mov r9, rdi
call fcn.180001364
mov esi, r12d
test esi, esi
js 0x180020581
xorps xmm0, xmm0
lea rcx, [rbp + 0x1f]
mov rbx, r12
mov qword [rbp + 0xf], rbx
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.180038be8
mov esi, eax
test eax, eax
jns 0x1800203fd
mov r14, qword [rbp + 0x1f]
mov r15, qword [rbp + 0x27]
test r14, r14
je 0x1800203ee
mov rdx, r15
mov rcx, r14
call fcn.180038a78
test r15, r15
je 0x18002043a
mov rcx, r15
call fcn.180040d20
jmp 0x18002043a
mov r8d, 0x4000
lea rcx, [rbp + 0xf]
mov rdx, rdi
call fcn.1800385ac
mov rbx, qword [rbp + 0x1f]
mov esi, eax
mov r14, qword [rbp + 0x27]
test rbx, rbx
je 0x180020429
mov rdx, r14
mov rcx, rbx
call fcn.180038a78
test r14, r14
je 0x180020436
mov rcx, r14
call fcn.180040d20
mov rbx, qword [rbp + 0xf]
test esi, esi
js 0x180020573
mov qword [rbp + 0x17], rbx
mov dword [rbp + 0x7f], r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, [rbp + 0x7f]
mov r14d, eax
lea rdx, [rbp + 0x17]
call fcn.18003b254
mov r15d, 0x80070102
mov esi, eax
cmp eax, r15d
jne 0x1800204ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, r14d
cmp ecx, 0x1bb1d8
jb 0x1800204a4
sub r14d, eax
cmp r14d, 0x3e8
jb 0x1800204a4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, [rbp + 0x7f]
mov r14d, eax
lea rdx, [rbp + 0x17]
call fcn.18003b254
jmp 0x180020466
mov esi, 0x800705b4
jmp 0x180020573
test esi, esi
js 0x180020573
cmp dword [rbp + 0x7f], r12d
je 0x1800204fb
mov rax, qword [0x18008d218]
cmp rax, r13
je 0x1800204f4
test byte [rax + 0x1c], 2
je 0x1800204f4
lfence
mov rcx, qword [0x18008d218]
lea r8, [0x1800734a8]
mov edx, 0x1b
mov r9, rdi
mov rcx, qword [rcx + 0x10]
call fcn.180001364
mov rbx, qword [rbp + 0xf]
mov esi, 0x800704c7
jmp 0x180020573
lea rdx, [rbp - 9]
mov dword [rbp - 9], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x18002051b
call fcn.180035b20
mov esi, eax
test eax, eax
js 0x180020573
mov eax, dword [rbp - 9]
test eax, eax
je 0x180020570
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rax, qword [0x18008d218]
cmp rax, r13
je 0x18002056c
test byte [rax + 0x1c], 1
je 0x18002056c
lfence
mov rcx, qword [0x18008d218]
lea r8, [0x1800734a8]
mov edx, 0x1c
mov dword [rsp + 0x20], esi
mov r9, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1800013c4
mov rbx, qword [rbp + 0xf]
test esi, esi
js 0x180020573
mov esi, r12d
test rbx, rbx
je 0x180020581
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x18002058e
mov rcx, rdi
call fcn.180040d20
mov eax, esi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret