Function at 0x140021584
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov ebx, 0xea60
mov dil, r8b
mov dword [rax + 8], ebx
mov rsi, rcx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x80]
mov edx, ebx
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call qword [0x14003b4b0]
lea rax, str.MpSampleSubmissionHighPriAgentLifeInMins
test dil, dil
lea rbp, str.MpSampleSubmissionLowPriAgentLifeInMins
cmovne rbp, rax
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x14002164e
mov rcx, qword [0x140060048]
lea rbx, [0x140060048]
cmp rcx, rbx
je 0x1400216a6
test byte [rcx + 0x1c], 4
je 0x1400216a6
lfence
mov rcx, qword [0x140060048]
lea r8, [0x140051718]
mov eax, dword [rsp + 0x90]
mov edx, 0x1b
mov r9, rbp
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000319c
mov rcx, qword [0x140060048]
jmp 0x1400216a6
mov rcx, qword [0x140060048]
lea rbx, [0x140060048]
cmp rcx, rbx
je 0x140021694
test byte [rcx + 0x1c], 1
je 0x140021694
lfence
mov rcx, qword [0x140060048]
lea r8, [0x140051718]
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.14000319c
mov rcx, qword [0x140060048]
neg dil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x90], eax
imul r15d, dword [rsp + 0x90], 0xea60
cmp rcx, rbx
je 0x1400216e1
test byte [rcx + 0x1c], 4
je 0x1400216e1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140051718]
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
mov edx, 0x1d
shr r9d, 6
call fcn.1400012f0
mov edi, 0x1b7740
mov dword [rsp + 0x98], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x98]
mov edx, edi
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [0x14003b4b0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, dword [rsp + 0x80]
mov edx, r13d
mov rcx, qword [rsi + 0x38]
mov ebp, eax
call fcn.14002d800
test al, al
je 0x1400217b0
mov edi, dword [rsp + 0x98]
lea r12d, [r13 + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebp
cmp r12d, ecx
ja 0x14002175e
sub ebp, eax
cmp r12d, ebp
jbe 0x140021798
mov ecx, dword [rsi + 0x68]
test ecx, ecx
je 0x140021779
mov eax, r14d
sub eax, ecx
cmp edi, eax
ja 0x140021779
sub ecx, r14d
cmp edi, ecx
jbe 0x140021804
cmp dword [rsi + 0x60], 0
je 0x140021798
mov ecx, dword [rsi + 0x64]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x140021798
sub ecx, r14d
cmp r15d, ecx
jbe 0x14002182e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsi + 0x38]
mov edx, r13d
mov ebp, eax
call fcn.14002d800
test al, al
jne 0x14002173f
mov r9d, dword [rsi + 0x50]
test r9d, r9d
jns 0x1400217f3
mov ecx, r9d
call fcn.14002e70c
test eax, eax
jne 0x1400217f3
call fcn.14002e6d8
test eax, eax
jne 0x1400217f3
mov rcx, qword [0x140060048]
cmp rcx, rbx
je 0x1400217f3
test byte [rcx + 0x1c], 1
je 0x1400217f3
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1e]
lea r8, [0x140051718]
call fcn.1400012f0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [0x140060048]
cmp rcx, rbx
je 0x14002182e
test byte [rcx + 0x1c], 1
je 0x14002182e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140051718]
mov edx, 0x1f
mov r9d, edi
call fcn.1400012f0
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x14003b4b0]
mov rcx, qword [rsi + 0x38]
mov edx, edi
call fcn.14002d87c
test al, al
je 0x1400217f3
mov rcx, qword [0x140060048]
cmp rcx, rbx
je 0x14002187c
test byte [rcx + 0x1c], 1
je 0x14002187c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140051718]
mov edx, 0x20
mov r9d, edi
call fcn.1400012f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400217f3