Function at 0x1400a3b4c
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov bl, r8b
mov rdi, rcx
mov esi, 0xea60
mov dword [rbp + 0x40], esi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x40]
mov edx, esi
lea rcx, str.MpService_SpyNetServiceWaitTimout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
test bl, bl
jne 0x1400a3bea
xor edx, edx
mov ecx, 0xa0000
call fcn.1400b6d88
test eax, eax
jns 0x1400a3bea
mov ebx, 0x927c0
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
jmp 0x1400a3c1d
mov ebx, 0x5265c00
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
mov r15d, dword [rbp + 0x50]
lea r14, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, r14
je 0x1400a3c5e
test byte [rcx + 0x1c], 4
je 0x1400a3c5e
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0xa
lea r8, [0x1401367e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
mov ebx, 0x1b7740
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov r13d, dword [rbp + 0x40]
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400b401c
test al, al
je 0x1400a3d33
lea r12d, [r13 + 0x3a98]
mov ebx, dword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp r12d, ecx
ja 0x1400a3cda
sub esi, eax
cmp r12d, esi
jbe 0x1400a3d14
mov ecx, dword [rdi + 0x78]
test ecx, ecx
je 0x1400a3cf5
mov eax, r14d
sub eax, ecx
cmp ebx, eax
ja 0x1400a3cf5
sub ecx, r14d
cmp ebx, ecx
jbe 0x1400a3da2
cmp dword [rdi + 0x70], 0
je 0x1400a3d14
mov ecx, dword [rdi + 0x74]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x1400a3d14
sub ecx, r14d
cmp r15d, ecx
jbe 0x1400a3dd5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400b401c
test al, al
jne 0x1400a3cbb
lea r14, [0x140158280]
mov ecx, dword [rdi + 0x60]
test ecx, ecx
jns 0x1400a3d8d
cmp ecx, 0x80070008
je 0x1400a3d8d
cmp ecx, 0x8007000e
je 0x1400a3d8d
cmp ecx, 0x800705aa
je 0x1400a3d8d
cmp ecx, 0x8077ffff
je 0x1400a3d8d
call fcn.1400b3eac
test eax, eax
jne 0x1400a3d8d
mov rax, qword [0x140158280]
cmp rax, r14
je 0x1400a3d8d
test byte [rax + 0x1c], 1
je 0x1400a3d8d
mov edx, 0xb
mov r9d, ecx
lea r8, [0x1401367e0]
mov rcx, qword [rax + 0x10]
call fcn.140005700
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140158280]
lea rsi, [0x140158280]
cmp rcx, rsi
je 0x1400a3ddc
test byte [rcx + 0x1c], 1
je 0x1400a3ddc
mov edx, 0xc
mov r9d, ebx
lea r8, [0x1401367e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
jmp 0x1400a3ddc
lea rsi, [0x140158280]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
movabs r10, 0x8a8d371252de0b70
mov rax, qword [rax + 0x18]
call qword [case.0x1400bdf0e.0]
mov edx, ebx
mov rcx, qword [rdi + 0x38]
call fcn.1400b6f1c
test al, al
je 0x1400a3d8d
mov rcx, qword [0x140158280]
cmp rcx, rsi
je 0x1400a3e30
test byte [rcx + 0x1c], 1
je 0x1400a3e30
mov edx, 0xd
mov r9d, ebx
lea r8, [0x1401367e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400a3d8d