Function at 0x14010e000
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0xb0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15, r8
mov r12, rdx
mov rdi, rcx
and dword [rbp - 0x69], 0
xor r14d, r14d
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], r14
and dword [rbp - 0x21], r14d
xor edx, edx
lea r8d, [r14 + 0x1c]
lea rcx, [rbp - 0x1d]
call sub.msvcrt.dll_memset
xor r10d, r10d
mov dword [rbp - 0x51], r10d
xor eax, eax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov ebx, r10d
mov dword [rbp - 0x71], r10d
mov r13, qword [rbp + 0x7f]
cmp qword [rbp + 0x6f], r10
je 0x14010e518
mov rsi, qword [rbp + 0x77]
test rsi, rsi
je 0x14010e518
test r12, r12
je 0x14010e518
test r15, r15
je 0x14010e518
test r13, r13
je 0x14010e518
mov rcx, qword [rdi + 0x118]
lea edi, [rax + 1]
test rcx, rcx
je 0x14010e11f
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14010e11c
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
lea rsi, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e573
test byte [rcx + 0x1c], dil
je 0x14010e573
lea edx, [rdi + 0x19]
mov r9d, ebx
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
jmp 0x14010e56c
mov dword [rbp - 0x71], edi
mov edx, edi
mov r14, qword [rbp + 0x6f]
mov rcx, r14
call fcn.140110394
mov edx, edi
mov rcx, rsi
call fcn.140110394
and dword [r13], ebx
lea rcx, [rbp - 0x69]
call qword [sym.imp.WINHTTP.dll_WinHttpGetDefaultProxyConfiguration]
test eax, eax
je 0x14010e1f9
mov rdx, qword [rbp - 0x61]
test rdx, rdx
je 0x14010e1f9
lea rsi, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e18c
test byte [rcx + 0x1c], 4
je 0x14010e18c
mov edx, reloc.OLEAUT32.dll_DispGetParam
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rdx, qword [rbp - 0x61]
mov rcx, r14
call fcn.14010bed8
mov ebx, eax
xor r10d, r10d
test eax, eax
js 0x14010e1c2
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rbp + 0x77]
call fcn.14010bed8
mov ebx, eax
xor r10d, r10d
test eax, eax
js 0x14010e1c2
mov eax, dword [rbp - 0x69]
mov dword [r13], eax
mov ebx, r10d
jmp 0x14010e559
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e560
test byte [rcx + 0x1c], dil
je 0x14010e560
mov edx, 0x1c
mov r9d, ebx
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
jmp 0x14010e556
lea rcx, [rbp - 0x51]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
xor r10d, r10d
lea r14d, [r10 + 3]
test eax, eax
je 0x14010e24a
mov edx, dword [rbp - 0x51]
test edx, edx
je 0x14010e222
mov eax, edi
mov dword [rbp - 0x21], eax
mov dword [rbp - 0x1d], r14d
mov ebx, edi
jmp 0x14010e225
mov eax, dword [rbp - 0x21]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14010e23a
or eax, 2
mov dword [rbp - 0x21], eax
mov qword [rbp - 0x19], rcx
mov ebx, edi
test edx, edx
jne 0x14010e253
cmp qword [rbp - 0x49], r10
jne 0x14010e253
cmp qword [rbp - 0x41], r10
jne 0x14010e253
mov ebx, edi
mov dword [rbp - 0x1d], r14d
mov dword [rbp - 0x21], edi
mov dword [rbp - 5], edi
lea rsi, [0x140148ea8]
test ebx, ebx
je 0x14010e426
mov qword [rbp - 0x31], r10
mov qword [rbp - 0x29], r10
lea rax, [0x14010e630]
lea r8, [0x1400055f4]
cmp dword [rbp + 0x67], r10d
cmovne r8, rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea rdx, [0x14010e638]
lea rcx, [rbp - 0x31]
call fcn.14011016c
mov ebx, eax
test eax, eax
jns 0x14010e2e3
lea rsi, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e2d3
test byte [rcx + 0x1c], dil
je 0x14010e2d3
mov edx, 0x1d
mov r9d, eax
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
nop
mov edx, edi
lea rcx, [rbp - 0x31]
call fcn.140110394
jmp 0x14010e556
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e30a
test byte [rcx + 0x1c], 4
je 0x14010e30a
mov edx, 0x1e
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
call sub.KERNEL32.dll_GetTickCount
lea r9, [rbp - 0x69]
lea r8, [rbp - 0x21]
mov rdx, qword [rbp - 0x31]
mov rcx, qword [rbp + 0x4f]
mov rcx, qword [rcx]
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov r15d, eax
call sub.KERNEL32.dll_GetTickCount
test r15d, r15d
je 0x14010e3b9
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e360
test byte [rcx + 0x1c], 4
je 0x14010e360
mov edx, 0x1f
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rdx, qword [rbp - 0x61]
mov rcx, qword [rbp + 0x6f]
call fcn.14010bed8
mov ebx, eax
test eax, eax
js 0x14010e392
mov rdx, qword [rbp - 0x59]
mov r12, qword [rbp + 0x77]
mov rcx, r12
call fcn.14010bed8
mov ebx, eax
test eax, eax
js 0x14010e392
mov eax, dword [rbp - 0x69]
mov dword [r13], eax
jmp 0x14010e40d
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e2d3
test byte [rcx + 0x1c], dil
je 0x14010e2d3
mov edx, 0x20
mov r9d, ebx
jmp 0x14010e2c2
mov rax, qword [0x140148ea8]
cmp rax, rsi
je 0x14010e409
test byte [rax + 0x1c], dil
je 0x14010e409
call sub.KERNEL32.dll_GetLastError
movzx r9d, ax
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
mov eax, 0x80004005
test r9d, r9d
cmovns r9d, eax
mov edx, 0x21
lea r8, [0x140001328]
mov rcx, qword [0x140148ea8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov r12, qword [rbp + 0x77]
mov edx, edi
lea rcx, [rbp - 0x31]
call fcn.140110394
xor r10d, r10d
test r15d, r15d
jne 0x14010e50c
jmp 0x14010e42a
mov r12, qword [rbp + 0x77]
cmp qword [rbp - 0x41], r10
je 0x14010e50c
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e465
test byte [rcx + 0x1c], 4
je 0x14010e465
mov edx, 0x22
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
xor r10d, r10d
mov rax, qword [rbp - 0x41]
cmp word [rax], r10w
je 0x14010e4c3
cmp word [rax], 0x3a
jne 0x14010e47c
cmp word [rax + 2], r10w
je 0x14010e4c3
mov dword [r13], r14d
mov rdx, qword [rbp - 0x41]
mov rcx, qword [rbp + 0x6f]
call fcn.14010bed8
mov ebx, eax
xor r10d, r10d
test eax, eax
jns 0x14010e4bc
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e560
test byte [rcx + 0x1c], dil
je 0x14010e560
lea edx, [r10 + 0x23]
mov r9d, eax
jmp 0x14010e1e4
mov rcx, qword [0x140148ea8]
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x14010e513
cmp word [rax], r10w
je 0x14010e513
cmp word [rax], 0x3a
jne 0x14010e4df
cmp word [rax + 2], r10w
je 0x14010e513
mov rdx, qword [rbp - 0x39]
mov rcx, r12
call fcn.14010bed8
mov ebx, eax
xor r10d, r10d
test eax, eax
jns 0x14010e50c
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e560
test byte [rcx + 0x1c], dil
je 0x14010e560
lea edx, [r10 + 0x24]
jmp 0x14010e4b4
mov rcx, qword [0x140148ea8]
mov ebx, r10d
jmp 0x14010e560
mov ebx, 0x80070057
lea rsi, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x14010e5c5
mov edi, 1
test byte [rcx + 0x1c], dil
je 0x14010e5c5
lea edx, [rdi + 0x18]
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
xor r10d, r10d
mov rcx, qword [0x140148ea8]
cmp dword [rbp - 0x71], r10d
je 0x14010e573
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [0x140148ea8]
test ebx, ebx
js 0x14010e5c1
mov r9, qword [rbp + 0x6f]
test r9, r9
je 0x14010e5c1
mov r8, qword [rbp + 0x77]
test r8, r8
je 0x14010e5c1
test r13, r13
je 0x14010e5c1
cmp rcx, rsi
je 0x14010e5c1
test byte [rcx + 0x1c], 4
je 0x14010e5c1
mov edx, 0x25
mov eax, dword [r13]
mov dword [rsp + 0x28], eax
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [r9]
lea r8, [0x140001328]
mov rcx, qword [rcx + 0x10]
call fcn.14003fddc
mov r14, qword [rbp - 0x61]
test r14, r14
je 0x14010e5d2
mov rcx, r14
call sub.KERNEL32.dll_GlobalFree
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14010e5e0
call sub.KERNEL32.dll_GlobalFree
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14010e5ee
call sub.KERNEL32.dll_GlobalFree
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x14010e5ff
mov rcx, rax
call sub.KERNEL32.dll_GlobalFree
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x14010e610
mov rcx, rax
call sub.KERNEL32.dll_GlobalFree
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret