Function at 0x1400eca1c
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov bl, r8b
mov r15, rcx
mov r13d, 0xea60
mov dword [rbp + 0x50], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, r13d
lea rcx, str.MpService_SpyNetServiceWaitTimout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
js 0x1400eca71
mov r13d, dword [rbp + 0x50]
test bl, bl
jne 0x1400ecaaf
xor edx, edx
mov ecx, 0xa0000
call fcn.1400fda18
test eax, eax
jns 0x1400ecaaf
mov ebx, 0x927c0
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
jmp 0x1400ecad7
mov ebx, 0x5265c00
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
js 0x1400ecade
mov ebx, dword [rbp + 0x50]
lea r14, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x1400ecb1a
test byte [rcx + 0x1c], 4
je 0x1400ecb1a
mov eax, 0x10624dd3
mul ebx
mov r9d, edx
shr r9d, 6
mov edx, 0xa
lea r8, [0x140148448]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edi, 0x1b7740
mov dword [rbp + 0x50], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, edi
lea rcx, str.MpService_SpyNetServiceBusyTimout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
js 0x1400ecb49
mov edi, dword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r13d
mov rcx, qword [r15 + 0x38]
call fcn.1400faddc
test al, al
je 0x1400ecbe5
lea r12d, [r13 + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp r12d, ecx
ja 0x1400ecb8b
sub esi, eax
cmp r12d, esi
jbe 0x1400ecbc6
mov ecx, dword [r15 + 0x78]
test ecx, ecx
je 0x1400ecba7
mov eax, r14d
sub eax, ecx
cmp edi, eax
ja 0x1400ecba7
sub ecx, r14d
cmp edi, ecx
jbe 0x1400ecc3e
cmp dword [r15 + 0x70], 0
je 0x1400ecbc6
mov ecx, dword [r15 + 0x74]
mov eax, r14d
sub eax, ecx
cmp ebx, eax
ja 0x1400ecbc6
sub ecx, r14d
cmp ebx, ecx
jbe 0x1400ecc71
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r13d
mov rcx, qword [r15 + 0x38]
call fcn.1400faddc
test al, al
jne 0x1400ecb6c
lea r14, [0x14016d280]
mov ecx, dword [r15 + 0x60]
test ecx, ecx
jns 0x1400ecc29
call fcn.1400fa0a8
test eax, eax
jne 0x1400ecc29
call fcn.1400fa0d4
test eax, eax
jne 0x1400ecc29
mov rax, qword [0x14016d280]
cmp rax, r14
je 0x1400ecc29
test byte [rax + 0x1c], 1
je 0x1400ecc29
mov edx, 0xb
mov r9d, ecx
lea r8, [0x140148448]
mov rcx, qword [rax + 0x10]
call fcn.140044380
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x14016d280]
lea rbx, [0x14016d280]
cmp rcx, rbx
je 0x1400ecc78
test byte [rcx + 0x1c], 1
je 0x1400ecc78
mov edx, 0xc
mov r9d, edi
lea r8, [0x140148448]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x1400ecc78
lea rbx, [0x14016d280]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov edx, edi
mov rcx, qword [r15 + 0x38]
call fcn.1400fe9a8
test al, al
je 0x1400ecc29
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400eccc1
test byte [rcx + 0x1c], 1
je 0x1400eccc1
mov edx, 0xd
mov r9d, edi
lea r8, [0x140148448]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400ecc29