Function at 0x140005b24
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140027fb8]
mov r14, rdx
xor edx, edx
mov qword [r11 - 0x60], rax
mov rax, qword [0x140027fb0]
mov r13, rcx
mov qword [r11 - 0x78], rdx
mov qword [r11 - 0x80], rdx
mov edi, edx
mov qword [rsp + 0x50], rdx
mov r15d, edx
mov r12d, edx
mov esi, edx
mov qword [r11 + 0x20], rdx
mov qword [r11 - 0x70], rdx
mov qword [r11 - 0x68], rdx
mov dword [rbp + 0x20], edx
lea rcx, [r11 - 0x78]
lea rdx, str.D:_A__GA___SY__A__GA___BA_
mov qword [r11 - 0x58], rax
call fcn.14001599c
mov ebx, eax
test eax, eax
js 0x140005ea3
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rsp + 0x58]
call fcn.14001599c
mov ebx, eax
test eax, eax
js 0x140005ea3
mov rax, qword [rsp + 0x60]
and dword [rbp - 0x38], esi
lea r8, str.GlobalOfficeSourceEngine64Mutex
lea rcx, [rbp - 0x48]
xor edx, edx
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x48], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r15, rax
test rax, rax
jne 0x140005c03
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005ea3
mov edx, 0x2710
mov rcx, r15
call fcn.140019858
mov ebx, eax
cmp eax, 0x80070102
je 0x140005ea3
test eax, eax
js 0x140005ea3
mov rax, qword [rsp + 0x58]
and dword [rbp - 0x38], esi
mov edi, 1
lea r9, str.GlobalOffice64SourceEngineRunning
lea rcx, [rbp - 0x48]
xor r8d, r8d
mov edx, edi
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x48], 0x18
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140005c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005ea3
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x140005cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005ea3
lea rdx, [0x140028398]
mov rcx, r12
call fcn.140001140
mov ebx, eax
test eax, eax
js 0x140005ea3
lea r9, [0x140020f98]
lea rdx, [rsp + 0x78]
lea rcx, str.HeavyH2O_Source64Engine_V1_0
mov r8d, 2
call fcn.1400169b0
mov ebx, eax
test eax, eax
js 0x140005ea3
test r13, r13
je 0x140005d30
test r14, r14
je 0x140005d30
and dword [r14 + 0xc], esi
mov rdx, r14
mov rcx, r13
mov dword [r14 + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140005d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005e87
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, edi
mov ecx, edi
call fcn.1400198d0
mov ebx, eax
test eax, eax
js 0x140005e87
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x140005d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005e87
mov rcx, qword [rbp + 0x28]
test rcx, rcx
jne 0x140005ddb
and qword [rsp + 0x40], rcx
lea rax, [rbp + 0x28]
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140005dfe
lea rdx, [0x1400283c8]
call fcn.14000610c
mov rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 4]
mov r9, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rsp + 0x68], r12
mov ebx, edi
mov dword [0x1400283c4], eax
test rsi, rsi
je 0x140005e20
mov qword [rsp + 0x70], rsi
mov ebx, 2
lea rdx, [rsp + 0x68]
mov r9d, 0xea60
xor r8d, r8d
mov ecx, ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov r11d, eax
cmp eax, 0xc0
je 0x140005e20
cmp eax, 0x102
jne 0x140005f76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1400283a4]
mov r8d, dword [0x1400283c4]
imul ecx, ecx, 0xea60
mov edx, eax
sub edx, r8d
cmp edx, ecx
jb 0x140005e20
sub eax, r8d
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov ecx, edi
mov r8d, eax
call fcn.140019144
xor ebx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
lea edx, [r8 + 2]
call fcn.140016a88
cmp dword [rbp + 0x20], 0
je 0x140005ea3
call fcn.140019904
mov rcx, qword [0x140028398]
test rcx, rcx
je 0x140005ed9
mov rax, qword [rcx]
call qword [rax + 0x50]
mov r11, qword [0x140028398]
mov rax, qword [r11 + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, r11
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [0x140028398], 0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140005ee8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140005ef6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140005f04
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140005f20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140005f3b
test edi, edi
je 0x140005f32
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005f4a
call fcn.140015a7c
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140005f59
call fcn.140015a7c
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, eax
je 0x140005e85
cmp eax, 0x80
je 0x140005e85
test rsi, rsi
je 0x140005e20
lea eax, [rbx - 1]
cmp eax, r11d
jne 0x140005e20
mov rcx, qword [rbp + 0x28]
lea rdx, [0x1400283c8]
call fcn.14000610c
mov rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 4]
mov r9, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140005e20