Function at 0x140035108
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov dil, r8b
mov rsi, rcx
mov ebx, 0xea60
mov dword [rax + 8], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x80]
mov edx, ebx
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
and dword [rsp + 0x90], 0
lea rax, str.MpSampleSubmissionHighPriAgentLifeInMins
lea rbp, str.MpSampleSubmissionLowPriAgentLifeInMins
test dil, dil
cmovne rbp, rax
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x1400351d7
lea rbx, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rbx
je 0x140035225
test byte [rcx + 0x1c], 4
je 0x140035225
mov edx, 0x1b
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x14012ec90]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rcx, qword [0x140158280]
jmp 0x140035225
lea rbx, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rbx
je 0x140035213
test byte [rcx + 0x1c], 1
je 0x140035213
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x14012ec90]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rcx, qword [0x140158280]
neg dil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x90], eax
imul r15d, dword [rsp + 0x90], 0xea60
cmp rcx, rbx
je 0x140035260
test byte [rcx + 0x1c], 4
je 0x140035260
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0x1d
lea r8, [0x14012ec90]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
mov edi, 0x1b7740
mov dword [rsp + 0x98], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x98]
mov edx, edi
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [case.0x1400bdf0e.0]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov r13d, dword [rsp + 0x80]
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.1400b401c
test al, al
je 0x14003533a
lea r12d, [r13 + 0x3a98]
mov edi, dword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebp
cmp r12d, ecx
ja 0x1400352e8
sub ebp, eax
cmp r12d, ebp
jbe 0x140035322
mov ecx, dword [rsi + 0x68]
test ecx, ecx
je 0x140035303
mov eax, r14d
sub eax, ecx
cmp edi, eax
ja 0x140035303
sub ecx, r14d
cmp edi, ecx
jbe 0x1400353a5
cmp dword [rsi + 0x60], 0
je 0x140035322
mov ecx, dword [rsi + 0x64]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x140035322
sub ecx, r14d
cmp r15d, ecx
jbe 0x1400353cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.1400b401c
test al, al
jne 0x1400352c9
mov ecx, dword [rsi + 0x50]
test ecx, ecx
jns 0x140035394
cmp ecx, 0x80070008
je 0x140035394
cmp ecx, 0x8007000e
je 0x140035394
cmp ecx, 0x800705aa
je 0x140035394
cmp ecx, 0x8077ffff
je 0x140035394
call fcn.1400b3eac
test eax, eax
jne 0x140035394
mov rax, qword [0x140158280]
cmp rax, rbx
je 0x140035394
test byte [rax + 0x1c], 1
je 0x140035394
mov edx, 0x1e
mov r9d, ecx
lea r8, [0x14012ec90]
mov rcx, qword [rax + 0x10]
call fcn.140005700
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [0x140158280]
cmp rcx, rbx
je 0x1400353cf
test byte [rcx + 0x1c], 1
je 0x1400353cf
mov edx, 0x1f
mov r9d, edi
lea r8, [0x14012ec90]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
movabs r10, 0x8a7d2e8e7cdcab70
mov rax, qword [rax + 0x18]
call qword [case.0x1400bdf0e.0]
mov edx, edi
mov rcx, qword [rsi + 0x38]
call fcn.1400b6f1c
test al, al
je 0x140035394
mov rcx, qword [0x140158280]
cmp rcx, rbx
je 0x140035427
test byte [rcx + 0x1c], 1
je 0x140035427
mov edx, 0x20
mov r9d, edi
lea r8, [0x14012ec90]
mov rcx, qword [rcx + 0x10]
call fcn.140005700
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140035394