Function at 0x140005c7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140029518]
mov r12, rcx
xor ecx, ecx
mov qword [r11 - 0x68], rax
mov rax, qword [0x140029420]
mov rsi, rdx
mov qword [r11 - 0x80], rcx
mov qword [rsp + 0x50], rcx
mov ebp, ecx
mov r15, rcx
mov r13, rcx
mov r14, rcx
mov rdi, rcx
mov qword [r11 + 0x20], rcx
mov qword [r11 - 0x78], rcx
mov qword [r11 - 0x70], rcx
mov dword [rsp + 0xf0], ecx
lea rdx, str.D:_A__GA___SY__A__GA___BA_
lea rcx, [r11 - 0x80]
mov qword [r11 - 0x60], rax
call fcn.14000fedc
mov ebx, eax
test eax, eax
js 0x14000602e
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rsp + 0x50]
call fcn.14000fedc
mov ebx, eax
test eax, eax
js 0x14000602e
mov rax, qword [rsp + 0x58]
and dword [rsp + 0x90], edi
lea r8, str.GlobalOfficeSourceEngine64Mutex
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
jne 0x140005d6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000602e
mov edx, 0x2710
mov rcx, r13
call fcn.140013f2c
mov ebx, eax
cmp eax, 0x80070102
je 0x14000602e
test eax, eax
js 0x14000602e
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x90], edi
mov ebp, 1
lea r9, str.GlobalOffice64SourceEngineRunning
lea rcx, [rsp + 0x80]
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 0x18
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r15, rax
test rax, rax
jne 0x140005df0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000602e
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
test rax, rax
jne 0x140005e24
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000602e
lea rdx, [0x140029548]
mov rcx, r14
call fcn.1400024f8
mov ebx, eax
test eax, eax
js 0x14000602e
lea r9, [0x140021fd8]
lea rdx, [rsp + 0x70]
lea rcx, str.HeavyH2O_Source64Engine_V1_0
mov r8d, 2
call fcn.140010b18
mov ebx, eax
test eax, eax
js 0x14000602e
test r12, r12
je 0x140005ea5
test rsi, rsi
je 0x140005ea5
and dword [rsi + 0xc], edi
mov rdx, rsi
mov rcx, r12
mov dword [rsi + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140005ea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000600e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, ebp
mov ecx, ebp
call fcn.140013f98
mov ebx, eax
test eax, eax
js 0x14000600e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0xf0], ebp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x140005f07
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000600e
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
jne 0x140005f5e
and qword [rsp + 0x40], rcx
lea rax, [rsp + 0xf8]
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x140005f85
lea rdx, [0x140029550]
call fcn.140005888
mov rcx, qword [rsp + 0xf8]
xor edx, edx
lea r8d, [rdx + 4]
mov r9, rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rsp + 0x60], r14
mov ebx, ebp
mov dword [0x140029544], eax
test rdi, rdi
je 0x140005fa7
mov qword [rsp + 0x68], rdi
mov ebx, 2
lea rdx, [rsp + 0x60]
mov r9d, 0xea60
xor r8d, r8d
mov ecx, ebx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov r11d, eax
cmp eax, 0xc0
je 0x140005fa7
cmp eax, 0x102
jne 0x1400060fe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x140029524]
mov r8d, dword [0x140029544]
imul ecx, ecx, 0xea60
mov edx, eax
sub edx, r8d
cmp edx, ecx
jb 0x140005fa7
sub eax, r8d
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov ecx, ebp
mov r8d, eax
call fcn.140013454
xor ebx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x70]
lea edx, [r8 + 2]
call fcn.140010be4
cmp dword [rsp + 0xf0], 0
je 0x14000602e
call fcn.140013fc4
mov rcx, qword [0x140029548]
test rcx, rcx
je 0x140006062
mov rax, qword [rcx]
call qword [rax + 0x50]
mov r11, qword [0x140029548]
mov rax, qword [r11 + 8]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + r11 + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [0x140029548], 0
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x140006075
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140006083
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140006091
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400060a8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400060c3
test ebp, ebp
je 0x1400060ba
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400060d2
call fcn.14000ffb8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400060e1
call fcn.14000ffb8
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, eax
je 0x14000600c
cmp eax, 0x80
je 0x14000600c
test rdi, rdi
je 0x140005fa7
lea eax, [rbx - 1]
cmp eax, r11d
jne 0x140005fa7
mov rcx, qword [rsp + 0xf8]
lea rdx, [0x140029550]
call fcn.140005888
mov rcx, qword [rsp + 0xf8]
xor edx, edx
lea r8d, [rdx + 4]
mov r9, rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140005fa7