Function at 0x100065148
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r14d, r14d
lea rax, [r11 - 0x60]
xor r9d, r9d
mov qword [r11 - 0x70], r14
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x60], r14
mov rbp, r14
mov qword [r11 - 0x50], r14
mov qword [r11 - 0x78], rax
mov qword [r11 + 0x18], r14
mov rsi, r14
mov r13d, r14d
mov qword [r11 - 0x58], r14
mov qword [r11 + 0x20], r14
mov r15, r14
call fcn.1000b3920
mov ebx, eax
cmp eax, r14d
je 0x1000651ae
mov r8d, eax
mov edx, 0x10b70136
jmp 0x10006527d
mov rax, qword [rsp + 0x38]
mov edi, r14d
jmp 0x1000651be
inc edi
add rax, 8
cmp qword [rax], r14
jne 0x1000651b8
lea rcx, [rsp + 0x48]
call fcn.1000db468
mov ebx, eax
cmp eax, r14d
je 0x1000651f0
xor r9d, r9d
mov r8d, eax
mov edx, 0x10bd0136
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x48]
jmp 0x100065579
mov rbp, qword [rsp + 0x48]
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call qword [sym.imp.NETAPI32.dll_DsGetSiteNameW]
mov ebx, eax
cmp eax, r14d
je 0x10006521d
xor r9d, r9d
mov r8d, eax
mov edx, 0x10c00136
mov rcx, rbp
jmp 0x100065282
mov r8, qword [rsp + 0xb0]
lea rcx, [0x100018568]
mov rdx, rbp
call fcn.1000b99b0
mov edx, edi
xor ecx, ecx
shl rdx, 3
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, r14
jne 0x100065253
mov edx, 0x10cd0136
jmp 0x100065274
mov rdx, rbx
xor ecx, ecx
shl rdx, 2
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
mov qword [rsp + 0x30], rax
cmp rax, r14
jne 0x10006528c
mov edx, 0x10d50136
mov r8d, 0x8007000e
mov ebx, r8d
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100065579
test edi, edi
je 0x1000654c5
mov r15, qword [rsp + 0x38]
mov r12, rax
mov rbp, rsi
mov rax, qword [r15]
lea rcx, [0x1000185a0]
mov r8d, r13d
mov r9, rax
mov edx, r14d
mov qword [rsp + 0x50], rax
call fcn.1000b99b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, r13d
lea rdx, [rsi + rcx*8]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.NETAPI32.dll_DsGetSiteNameW]
mov dword [rsp + 0xa8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
mov ebx, dword [rsp + 0xa8]
mov r8d, eax
test ebx, ebx
je 0x100065320
lea rcx, [0x1000185e0]
mov edx, ebx
call fcn.1000b99b0
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x10e80136
call fcn.1000b51b8
mov dword [r12], 0x7fffffff
jmp 0x10006533b
mov rdx, qword [rbp]
lea rcx, [0x100018600]
call fcn.1000b99b0
mov dword [r12], r13d
inc r13d
add rbp, 8
inc r14d
add r15, 8
add r12, 4
cmp r14d, edi
jb 0x10006529f
mov rbp, qword [rsp + 0x48]
xor r14d, r14d
cmp r13d, r14d
je 0x1000654c0
mov rax, qword [0x10011c3c8]
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x40], r14
cmp rax, r14
jne 0x100065397
lea rdx, [0x10011c3c8]
lea rcx, [0x100018528]
call fcn.100065008
mov ebx, eax
mov rax, qword [0x10011c3c8]
jmp 0x10006539a
mov ebx, r14d
cmp ebx, r14d
je 0x1000653a9
mov r8d, ebx
mov edx, 0x105d0136
jmp 0x1000653c2
lea rdx, [rsp + 0x40]
mov rcx, r12
call rax
mov ebx, eax
cmp eax, r14d
je 0x1000653cc
mov r8d, eax
mov edx, 0x10600136
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
cmp ebx, r14d
je 0x1000653e8
mov r8d, ebx
mov edx, 0x10f60136
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100065574
mov rdx, qword [rsp + 0xb0]
lea rcx, [0x100018618]
call fcn.1000b99b0
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0xb8]
mov r9d, r13d
mov r8, rsi
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r14d
call fcn.100065090
mov ebx, eax
cmp eax, r14d
je 0x10006543f
mov qword [rsp + 0xb8], r14
mov r8d, eax
mov edx, 0x11030136
jmp 0x1000653d9
mov r12d, r14d
cmp r13d, r14d
jbe 0x1000654c0
mov rbx, r14
mov rcx, qword [rsp + 0xb8]
cmp dword [rbx + rcx], r14d
je 0x100065495
mov rcx, qword [rsp + 0xb0]
xor r9d, r9d
mov r8d, r12d
mov edx, 0x110d0136
call fcn.1000b51b8
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rbx + rsi]
mov r8d, dword [rbx + rax]
xor r9d, r9d
mov edx, 0x11110136
call fcn.1000b51b8
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rbx + rcx + 4]
mov r9d, dword [rbx + rcx]
mov r8, qword [rbx + rsi]
lea rcx, [0x100018650]
mov edx, r12d
mov dword [rsp + 0x20], eax
call fcn.1000b99b0
inc r12d
add rbx, 8
cmp r12d, r13d
jb 0x10006544a
mov r15, qword [rsp + 0x30]
mov r12d, r14d
cmp edi, r14d
jbe 0x100065571
mov r14, qword [rsp + 0x38]
cmp dword [r15], 0x7fffffff
je 0x100065545
movsxd rax, dword [r15]
mov rcx, qword [rsp + 0xb8]
mov r8d, dword [rcx + rax*8]
test r8d, r8d
je 0x100065506
mov rcx, qword [rsi + rax*8]
xor r9d, r9d
mov edx, 0x11220136
call fcn.1000b51b8
jmp 0x100065545
mov ebx, dword [rcx + rax*8 + 4]
mov rax, qword [rsi + rax*8]
mov r9, qword [r14]
mov r8d, dword [r15]
lea rcx, [0x1000186c0]
mov edx, r12d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1000b99b0
test ebx, ebx
js 0x100065538
cmp ebx, 0x7ffffffd
jle 0x10006553d
mov ebx, 0x7ffffffd
cmp ebx, 0x7ffffffe
jne 0x10006555a
mov rdx, qword [r14]
lea rcx, [0x100018718]
mov r8d, 0x7ffffffe
call fcn.1000b99b0
inc r12d
add r15, 4
add r14, 8
cmp r12d, edi
jb 0x1000654d6
xor r14d, r14d
mov ebx, r14d
mov r15, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1000b3c74
cmp rbp, r14
je 0x100065591
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r14
je 0x1000655a3
call sub.NETAPI32.dll_NetApiBufferFree
cmp rsi, r14
je 0x1000655d3
cmp r13d, r14d
jbe 0x1000655ca
mov rdi, rsi
mov ebp, r13d
mov rcx, qword [rdi]
cmp rcx, r14
je 0x1000655c0
call sub.NETAPI32.dll_NetApiBufferFree
add rdi, 8
sub rbp, 1
jne 0x1000655b3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r15, r14
je 0x1000655e1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0xb8]
cmp rdi, r14
je 0x100065637
mov rax, qword [0x10011c3b8]
cmp rax, r14
jne 0x100065619
lea rdx, [0x10011c3b8]
lea rcx, [0x100018550]
call fcn.100065008
mov r8d, eax
mov rax, qword [0x10011c3b8]
jmp 0x10006561c
mov r8d, r14d
cmp r8d, r14d
je 0x100065632
xor r9d, r9d
mov edx, 0x10980136
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100065637
mov rcx, rdi
call rax
cmp qword [rsp + 0x40], r14
je 0x100065649
lea rcx, [rsp + 0x40]
call qword [sym.imp.NTDSAPI.dll_DsUnBindW]
mov ecx, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.1000b7bec