Function at 0x140031ed8
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov dil, r8b
mov rsi, rcx
mov ebx, 0xea60
mov dword [rax + 8], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x80]
mov edx, ebx
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
and dword [rsp + 0x90], 0
lea rax, str.MpSampleSubmissionHighPriAgentLifeInMins
lea rbp, str.MpSampleSubmissionLowPriAgentLifeInMins
test dil, dil
cmovne rbp, rax
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x140031fa7
lea rbx, str.8__r_
mov rcx, qword [str.8__r_]
cmp rcx, rbx
je 0x140031ff5
test byte [rcx + 0x1c], 4
je 0x140031ff5
mov edx, 0x1b
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x1400b7118]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov rcx, qword [str.8__r_]
jmp 0x140031ff5
lea rbx, str.8__r_
mov rcx, qword [str.8__r_]
cmp rcx, rbx
je 0x140031fe3
test byte [rcx + 0x1c], 1
je 0x140031fe3
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x1400b7118]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov rcx, qword [str.8__r_]
neg dil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x90], eax
imul r15d, dword [rsp + 0x90], 0xea60
cmp rcx, rbx
je 0x140032030
test byte [rcx + 0x1c], 4
je 0x140032030
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0x1d
lea r8, [0x1400b7118]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
mov edi, 0x1b7740
mov dword [rsp + 0x98], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x98]
mov edx, edi
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov r13d, dword [rsp + 0x80]
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.1400799fc
test al, al
je 0x14003210a
lea r12d, [r13 + 0x3a98]
mov edi, dword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebp
cmp r12d, ecx
ja 0x1400320b8
sub ebp, eax
cmp r12d, ebp
jbe 0x1400320f2
mov ecx, dword [rsi + 0x68]
test ecx, ecx
je 0x1400320d3
mov eax, r14d
sub eax, ecx
cmp edi, eax
ja 0x1400320d3
sub ecx, r14d
cmp edi, ecx
jbe 0x140032175
cmp dword [rsi + 0x60], 0
je 0x1400320f2
mov ecx, dword [rsi + 0x64]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x1400320f2
sub ecx, r14d
cmp r15d, ecx
jbe 0x14003219f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.1400799fc
test al, al
jne 0x140032099
mov ecx, dword [rsi + 0x50]
test ecx, ecx
jns 0x140032164
cmp ecx, 0x80070008
je 0x140032164
cmp ecx, 0x8007000e
je 0x140032164
cmp ecx, 0x800705aa
je 0x140032164
cmp ecx, 0x8077ffff
je 0x140032164
call fcn.14007988c
test eax, eax
jne 0x140032164
mov rax, qword [str.8__r_]
cmp rax, rbx
je 0x140032164
test byte [rax + 0x1c], 1
je 0x140032164
mov edx, 0x1e
mov r9d, ecx
lea r8, [0x1400b7118]
mov rcx, qword [rax + 0x10]
call fcn.140003d18
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [str.8__r_]
cmp rcx, rbx
je 0x14003219f
test byte [rcx + 0x1c], 1
je 0x14003219f
mov edx, 0x1f
mov r9d, edi
lea r8, [0x1400b7118]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
movabs r10, 0x8a7d2e8e7cdcab70
mov rax, qword [rax + 0x18]
call qword [0x14009aae8]
mov edx, edi
mov rcx, qword [rsi + 0x38]
call fcn.14007c84c
test al, al
je 0x140032164
mov rcx, qword [str.8__r_]
cmp rcx, rbx
je 0x1400321f7
test byte [rcx + 0x1c], 1
je 0x1400321f7
mov edx, 0x20
mov r9d, edi
lea r8, [0x1400b7118]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140032164