Function at 0x140006740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r15d, r15d
mov esi, r9d
mov r14, r8
mov qword [rdx], r15
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r15
mov qword [rcx], r15
call sub.mytilus3.dll_GetCommonShellVersion3
cmp eax, 0x17
je 0x1400067bf
lea rdx, str.Version_of_CommonShell_DLL_doesnt_match_what_is_expected
lea ecx, [r15 + 1]
call fcn.1400031e0
call sub.mytilus3.dll_GetCommonShellVersion3
lea r8d, [r15 + 0x17]
lea rdx, str.Expecting_DLL_with_version__lu____found_DLL_with_version__lu
lea ecx, [r15 + 1]
mov r9d, eax
call fcn.1400031e0
mov eax, 0xfd
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x90], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
mov ebx, dword [0x1400209c8]
mov edi, dword [0x14001f530]
lea rcx, [0x14001e9c8]
mov ebp, eax
call fcn.14000a7d0
test rax, rax
je 0x14000682d
mov r8, qword [0x14001f4d0]
mov edx, dword [0x14001f4c8]
lea rcx, [0x14001da78]
call fcn.14000a7d0
mov ecx, 0x2328
test rax, rax
cmove edi, ecx
cmp byte [0x14001f55c], 1
jne 0x140006845
call fcn.140006410
mov eax, 1
jmp 0x140006dec
cmp byte [0x14001f55b], 1
mov r8, qword [0x14001f568]
mov rdx, qword [0x14001f560]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r15
mov eax, 4
cmove ebx, eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov r9d, edi
mov ecx, ebx
mov dword [rsp + 0x20], 1
call sub.mytilus3.dll_GetEngine3
test ax, ax
je 0x1400068af
movzx edi, ax
lea rdx, str.Engine_initialisation_failed_with_engine_error__lu
mov ecx, 1
mov r8d, edi
call fcn.1400031e0
mov eax, edi
jmp 0x140006dec
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x78]
sub eax, ebp
mov edx, eax
call fcn.140005e50
cmp byte [0x14001f539], r15b
mov edi, eax
je 0x1400068f9
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + 8]
mov eax, edi
jmp 0x140006dec
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp byte [0x140020bec], r15b
mov rbx, rax
je 0x140006a80
lea rdx, str.Configured_for_alert_n
mov ecx, 1
call fcn.1400031e0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rsp + 0x80]
call sub.mytilus3_worker.dll_GetAlerter
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x74]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rsp + 0x6c]
mov dx, 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x64]
mov rax, qword [rcx]
mov dx, 5
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
mov dx, 3
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [rax + 0x28]
mov eax, dword [rsp + 0xd0]
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rcx]
mov r9d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call qword [rdi + 0x30]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
or r8d, 0xffffffff
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x38], r15
mov rax, qword [rcx]
lea rdx, str.Command_Line_Scan
lea r9, [0x1400192c4]
mov qword [rsp + 0x30], rdx
lea rdx, str.Command_Line_Scanner
mov dword [rsp + 0x28], 0x15
mov qword [rsp + 0x20], rdx
lea rdx, str.McAfee
lea r8, str.VSCore
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbx]
lea r9, [0x140001050]
lea r8, section..text
lea rdx, [0x1400011b0]
mov rcx, rbx
mov qword [rsp + 0x20], rbx
call qword [rax + 0xa8]
cmp byte [0x14001f55f], r15b
mov rax, qword [rbx]
sete r9b
cmp byte [0x14001f55e], r15b
mov byte [rsp + 0x30], r15b
sete r8b
cmp byte [0x14001f55d], r15b
mov rcx, rbx
sete dl
mov byte [rsp + 0x28], r15b
mov byte [rsp + 0x20], r15b
call qword [rax + 0x38]
mov rax, qword [rbx]
movzx r9d, byte [0x14001f538]
movzx r8d, byte [0x14001f537]
movzx edx, byte [0x14001f536]
mov rcx, rbx
call qword [rax + 0x20]
mov rax, qword [rbx]
movzx edx, byte [0x14001f558]
mov rcx, rbx
call qword [rax + 0x30]
mov eax, dword [0x14001f54c]
mov rdi, qword [rbx]
movzx r8d, byte [0x14001f55a]
movzx edx, byte [0x14001f559]
mov byte [rsp + 0x30], r15b
mov dword [rsp + 0x28], eax
mov r9b, 1
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call qword [rdi + 0x28]
mov rax, qword [rbx]
mov rdx, qword [0x14001f550]
mov rcx, rbx
call qword [rax + 0x88]
cmp byte [0x14001f534], r15b
je 0x140006b69
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 3]
call qword [rax + 0x18]
cmp byte [0x14001f535], r15b
je 0x140006b82
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call qword [rax + 0x18]
mov rax, qword [rbx]
mov rdx, qword [0x14001f540]
mov rcx, rbx
call qword [rax + 0x78]
mov rax, qword [rbx]
mov r8d, dword [0x1400209d0]
mov edx, dword [0x1400209cc]
mov rcx, rbx
call qword [rax + 0x40]
mov rax, qword [rbx]
mov r8d, dword [0x1400209d8]
mov edx, dword [0x1400209d4]
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
mov r8d, dword [0x1400209e0]
mov edx, dword [0x1400209dc]
mov rcx, rbx
call qword [rax + 0x50]
cmp word [0x14001fb88], r15w
lea rbp, [0x14001f530]
je 0x140006c20
mov rax, r15
nop
nop
cmp word [rax + rbp + 0x658], 0x2c
jne 0x140006c04
mov word [rax + rbp + 0x658], r15w
add rax, 2
cmp rax, 0x208
jb 0x140006bf0
mov rax, qword [rbx]
lea rdx, [0x14001fb88]
mov rcx, rbx
call qword [rax + 0x58]
cmp word [0x14001fd90], r15w
je 0x140006c91
mov rax, r15
nop
cmp word [rax + rbp + 0x860], 0x2c
jne 0x140006c44
mov word [rax + rbp + 0x860], r15w
add rax, 2
cmp rax, 0x208
jb 0x140006c30
cmp word [0x14001fd90], r15w
lea rsi, [0x14001fd90]
je 0x140006c88
mov rax, qword [rbx]
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x60]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rsi, [rsi + rcx*2]
cmp word [rsi], ax
jne 0x140006c61
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
mov rax, qword [rbx]
mov edx, 0x5001
mov rcx, rbx
call qword [rax + 0xb0]
mov rax, qword [rbx]
mov edx, 0x5000
mov rcx, rbx
call qword [rax + 0xb0]
mov rax, qword [rbx]
mov edx, 0x5002
mov rcx, rbx
call qword [rax + 0xb0]
mov rax, qword [rbx]
mov edx, 0x5003
mov rcx, rbx
call qword [rax + 0xb0]
cmp word [0x14001ff98], r15w
je 0x140006d4d
mov rax, r15
cmp word [rax + rbp + 0xa68], 0x2c
jne 0x140006cf6
mov word [rax + rbp + 0xa68], r15w
add rax, 2
cmp rax, 0x208
jb 0x140006ce2
cmp word [0x14001ff98], r15w
lea rsi, [0x14001ff98]
je 0x140006d4d
mov rcx, rsi
call fcn.140001930
test eax, eax
je 0x140006d35
mov rdi, qword [rbx]
mov rcx, rsi
call fcn.140001930
mov rcx, rbx
mov edx, eax
call qword [rdi + 0xb0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rsi, [rsi + rcx*2]
cmp word [rsi], ax
jne 0x140006d13
cmp byte [0x14001f549], r15b
je 0x140006d61
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x70]
cmp word [0x14001f980], r15w
je 0x140006d7d
mov rcx, qword [rsp + 0x78]
lea rdx, [0x14001f980]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp word [0x1400201a0], r15w
je 0x140006dbb
movzx eax, byte [0x1400209c5]
mov rcx, qword [rsp + 0x78]
mov r9b, 1
mov rdi, qword [rcx]
mov byte [rsp + 0x30], al
movzx eax, byte [0x1400209c4]
mov byte [rsp + 0x28], al
lea rdx, [0x1400201a0]
movzx r8d, r9b
mov dword [rsp + 0x20], r15d
call qword [rdi + 0x78]
cmp byte [0x140021018], r15b
je 0x140006dd2
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0xb8]
mov rax, qword [rsp + 0x80]
mov qword [r14], rax
mov rax, qword [rsp + 0x78]
mov qword [r12], rbx
mov qword [r13], rax
xor eax, eax
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x90]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rsi
ret