Function at 0x140005ffc
Capabilities:
Check for time delay via gettickcount
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rdi, rdx
lea rax, [0x140038ab0]
xor edx, edx
mov qword [rbp - 9], rax
mov qword [rbp - 0x21], rdx
lea rax, [0x140039430]
mov r15d, edx
mov qword [rbp - 0x31], rdx
mov sil, dl
mov qword [rbp - 0x29], rdx
mov r13d, edx
mov qword [rbp - 0x39], rdx
mov r14d, edx
mov qword [rbp + 0x7f], rdx
mov r12, rcx
mov qword [rbp - 1], rax
xorps xmm0, xmm0
lea rdx, str.D:_A__GA___SY__A__GA___BA_
lea rcx, [rbp - 0x21]
movdqu xmmword [rbp - 0x19], xmm0
call fcn.1400115e4
mov ebx, eax
test eax, eax
js 0x14000641e
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rbp - 0x31]
call fcn.1400115e4
mov ebx, eax
test eax, eax
js 0x14000641a
mov rax, qword [rbp - 0x21]
lea r15d, [r14 + 0x18]
and dword [rbp + 0x17], r13d
lea r8, str.GlobalOfficeSourceEngine64Mutex
xor edx, edx
mov dword [rbp + 7], r15d
lea rcx, [rbp + 7]
mov qword [rbp + 0xf], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test rax, rax
jne 0x1400060dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000641a
mov edx, 0x2710
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x140006120
cmp ebx, 0xffffffff
jne 0x140006116
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070080
jne 0x140006122
jmp 0x1400060dd
xor ebx, ebx
test ebx, ebx
js 0x14000641a
and dword [rbp + 0x17], r14d
lea r9, str.GlobalOffice64SourceEngineRunning
mov dword [rbp + 7], r15d
lea rcx, [rbp + 7]
mov r15, qword [rbp - 0x31]
mov esi, 1
mov edx, esi
mov qword [rbp + 0xf], r15
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x29], rax
test rax, rax
jne 0x14000617a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000641e
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x1400061b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000641e
mov rax, qword [rbp - 0x39]
mov rcx, rax
call fcn.140002628
mov ebx, eax
test eax, eax
js 0x14000641e
lea rdx, [rbp - 9]
call fcn.140015078
mov ebx, eax
test eax, eax
js 0x14000641e
test r12, r12
je 0x140006215
test rdi, rdi
je 0x140006215
and dword [rdi + 0xc], r14d
mov rdx, rdi
mov rcx, r12
mov dword [rdi + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140006215
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000623c
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp qword [0x14003fcb0], r14
je 0x1400062ba
mov ebx, 0x8000ffff
mov r12b, r14b
xor edi, edi
mov rcx, qword [rbp + rdi*8 - 9]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14000626c
add rdi, rsi
cmp rdi, 2
jl 0x140006241
test r12b, r12b
je 0x14000641e
mov rcx, qword [0x14003fcb0]
test rcx, rcx
je 0x14000641e
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x1400062ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14000641e
and qword [0x14003fcb0], 0
jmp 0x14000641e
or dword [0x14003fcb8], 0xf0000040
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r12b, sil
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
test rax, rax
jne 0x1400062fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000623f
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
jne 0x140006346
and qword [rsp + 0x40], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
and qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
and dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140006362
call fcn.140006504
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, r14
mov dword [rsp + 0x20], esi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14003fbf8], eax
mov ebx, esi
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x19], rax
test r14, r14
je 0x140006386
mov qword [rbp - 0x11], r14
mov ebx, 2
mov r9d, 0xea60
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ecx, eax
cmp eax, 0xc0
je 0x140006386
cmp eax, 0x102
jne 0x1400063e1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [0x14003fc04], 0xea60
sub eax, dword [0x14003fbf8]
cmp eax, ecx
jb 0x140006386
mov r8d, eax
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov ecx, esi
call fcn.1400148c4
xor ebx, ebx
jmp 0x14000623f
test ecx, 0xffffff7f
je 0x1400063da
test r14, r14
je 0x140006386
lea eax, [rbx - 1]
cmp eax, ecx
jne 0x140006386
mov rcx, qword [rbp + 0x7f]
call fcn.140006504
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, r14
mov dword [rsp + 0x20], esi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140006386
mov r15, qword [rbp - 0x31]
mov rcx, qword [0x14003fbf0]
test rcx, rcx
je 0x140006462
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x14002f570]
mov rdx, qword [0x14003fbf0]
mov rax, qword [rdx + 8]
add rdx, 8
movsxd rcx, dword [rax + 4]
add rcx, rdx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14002f570]
and qword [0x14003fbf0], 0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140006471
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14000647f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x140006491
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rbp - 0x29]
test rdi, rdi
je 0x1400064ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400064c8
test sil, sil
je 0x1400064bf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400064d5
mov rcx, r15
call fcn.1400152f4
mov rax, qword [rbp - 0x21]
test rax, rax
je 0x1400064e6
mov rcx, rax
call fcn.1400152f4
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret