Function at 0x140005ba8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400389d8]
xor ecx, ecx
mov qword [rbp - 9], rax
mov r14, rdx
mov rax, qword [0x1400389d0]
lea rdx, str.D:_A__GA___SY__A__GA___BA_
mov qword [rbp - 0x21], rcx
mov edi, ecx
mov qword [rbp - 0x29], rcx
mov r13d, ecx
mov r15d, ecx
mov qword [rbp + 0x7f], rcx
mov r12d, ecx
mov dword [rbp + 0x77], ecx
mov esi, ecx
mov qword [rbp - 1], rax
xorps xmm0, xmm0
lea rcx, [rbp - 0x21]
movdqu xmmword [rbp - 0x19], xmm0
call fcn.1400102c8
mov ebx, eax
test eax, eax
js 0x140005f11
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rbp - 0x29]
call fcn.1400102c8
mov ebx, eax
test eax, eax
js 0x140005f11
mov rax, qword [rbp - 0x21]
lea r8, str.GlobalOfficeSourceEngine64Mutex
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
xor edx, edx
mov qword [rbp + 0xf], rax
mov dword [rbp + 7], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r15, rax
test rax, rax
jne 0x140005c85
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f11
mov edx, 0x2710
mov rcx, r15
call fcn.140012ed4
mov ebx, eax
test eax, eax
js 0x140005f11
mov rax, qword [rbp - 0x29]
lea r9, str.GlobalOffice64SourceEngineRunning
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
mov edi, 1
mov dword [rbp + 7], 0x18
mov edx, edi
mov qword [rbp + 0xf], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
test rax, rax
jne 0x140005ced
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f11
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x140005d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f11
lea rdx, [0x140038aa8]
mov rcx, r12
call fcn.140002660
mov ebx, eax
test eax, eax
js 0x140005f11
lea r9, [0x140029fa8]
mov r8d, 2
lea rdx, [rbp - 9]
lea rcx, str.HeavyH2O_Source64Engine_V1_0
call fcn.140014274
mov ebx, eax
test eax, eax
js 0x140005f11
mov rax, qword [rbp + 0x67]
test rax, rax
je 0x140005da7
test r14, r14
je 0x140005da7
and dword [r14 + 0xc], esi
mov rdx, r14
mov rcx, rax
mov dword [r14 + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140005da7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005ef6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, edi
mov ecx, edi
call fcn.140011044
mov ebx, eax
test eax, eax
js 0x140005ef6
xor r9d, r9d
mov dword [rbp + 0x77], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x140005e05
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005ef6
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
jne 0x140005e50
and qword [rsp + 0x40], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
and qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
and dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005e73
lea rdx, [0x140038ad4]
call fcn.1400057e0
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp - 0x19], r12
mov ebx, edi
mov dword [0x140038ad8], eax
test rsi, rsi
je 0x140005e93
mov qword [rbp - 0x11], rsi
mov ebx, 2
mov r9d, 0xea60
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ecx, eax
cmp eax, 0xc0
je 0x140005e93
cmp eax, 0x102
jne 0x140005fdd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [0x140038ab4], 0xea60
mov edx, eax
mov r8d, dword [0x140038ad8]
sub edx, r8d
cmp edx, ecx
jb 0x140005e93
sub eax, r8d
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov r8d, eax
mov ecx, edi
call fcn.140013e64
xor ebx, ebx
xor r8d, r8d
lea rcx, [rbp - 9]
lea edx, [r8 + 2]
call fcn.140014344
cmp dword [rbp + 0x77], 0
je 0x140005f11
call fcn.140011070
mov rcx, qword [0x140038aa8]
test rcx, rcx
je 0x140005f47
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, qword [0x140038aa8]
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [0x140038aa8], 0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005f56
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140005f64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140005f72
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x140005f89
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140005fa4
test edi, edi
je 0x140005f9b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140005fb2
call fcn.1400103a0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140005fc0
call fcn.1400103a0
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, 0xffffff7f
je 0x140005ef4
test rsi, rsi
je 0x140005e93
lea eax, [rbx - 1]
cmp eax, ecx
jne 0x140005e93
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x140038ad4]
call fcn.1400057e0
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140005e93