Function at 0x18000aa80
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov rax, qword [0x180072270]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x68], r9
mov eax, r8d
mov dword [rsp + 0x34], eax
mov r8, rdx
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x70], rcx
mov rdx, qword [rbp + 0xb8]
mov qword [rbp - 0x80], rdx
movdqa xmm0, xmmword [0x180068a40]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov ebx, eax
mov dword [rsp + 0x38], eax
lea r9d, [rax - 0xa]
mov dword [rsp + 0x30], r9d
mov ecx, dword [rsp + 0x4c]
mov dword [rsp + 0x68], ecx
cmp eax, r9d
mov r9d, dword [0x180072380]
jbe 0x18000aff1
lea r13d, [rax - 0x120]
mov dword [rsp + 0x48], r13d
lea r10, [0x180000000]
mov r12, qword [rsp + 0x58]
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
movzx r14d, byte [rsp + 0x40]
mov esi, dword [rsp + 0x70]
mov r15d, dword [rsp + 0x70]
mov eax, dword [rsp + 0x30]
cmp r13d, 0x15
ja 0x18000afa7
mov ecx, dword [r10 + r13*4 + 0xb568]
add rcx, r10
jmp rcx
mov r8, qword [rsp + 0x78]
mov r9d, dword [0x180072380]
mov rdx, qword [rbp - 0x80]
lea r10, [0x180000000]
jmp 0x18000afa3
mov eax, ebx
sub eax, 0x116
je 0x18000ad50
cmp eax, 0x38
jne 0x18000ad61
mov dword [rsp + 0x60], 0
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18000b4db
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b4d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b4d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [0x180072338]
mov ecx, 0x125
call fcn.18000be90
add ebx, 0x38
cmp ebx, 0x186
jb 0x18000acf0
mov ebx, dword [rsp + 0x38]
mov dword [rsp + 0x68], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
test al, al
je 0x18000af97
mov edi, 0x93
mov r12, qword [rsp + 0x78]
mov r13d, dword [rsp + 0x68]
nop word [rax + rax]
cmp edi, 0x1f425
ja 0x18000ae5e
je 0x18000ae35
cmp edi, 0x93
je 0x18000ae29
cmp edi, 0x647d
je 0x18000ae14
cmp edi, 0xc867
je 0x18000ae06
cmp edi, 0x12c51
je 0x18000ade6
cmp edi, 0x1903b
jne 0x18000af6d
mov r14b, 1
jmp 0x18000af6d
mov eax, 0x61
mov word [rbp + 8], ax
mov eax, 0x6d
mov word [rbp + 9], ax
mov eax, 0x65
mov word [rbp + 0xa], ax
jmp 0x18000af6d
mov eax, 0x6e
mov word [rbp + 7], ax
jmp 0x18000af6d
mov dword [rbp + 3], 0x6c6946
mov eax, 0x65
mov word [rbp + 6], ax
jmp 0x18000af6d
mov dword [rbp], 0x706158
jmp 0x18000af6d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
lea rax, [rbp]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18000ae50
jmp 0x18000af6d
cmp edi, 0x2580f
je 0x18000af4a
cmp edi, 0x2bbf9
je 0x18000af40
cmp edi, 0x31fe3
je 0x18000af12
cmp edi, 0x383cd
je 0x18000aea0
cmp edi, 0x3e7b7
jne 0x18000af6d
call qword [r12 + 0x50]
jmp 0x18000af6d
test r14b, r14b
je 0x18000af6d
mov ebx, 0xce
nop
cmp ebx, 0xce
je 0x18000aef9
cmp ebx, 0x4398
je 0x18000aed9
cmp ebx, 0x8662
jne 0x18000af02
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18000af02
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000af02
lea r8, [rsp + 0x70]
mov edx, esi
lea rcx, [rbp]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18000af02
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000af02
mov qword [rsp + 0x70], 0
add ebx, 0x42ca
cmp ebx, 0xc85e
jbe 0x18000aeb0
jmp 0x18000af6d
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x4c]
mov edx, esi
lea rcx, [rbp]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov ecx, eax
mov eax, 0x10624dd3
mul r13d
mov r13d, edx
shr r13d, 6
test ecx, ecx
je 0x18000af6d
xor r14b, r14b
jmp 0x18000af6d
mov qword [rbp - 0x78], 0
jmp 0x18000af6d
xor r8d, r8d
mov rdx, r12
lea ecx, [r8 + 0x45]
call fcn.180039880
mov dword [rsp + 0x4c], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
sub r13d, r15d
add edi, 0x63ea
cmp edi, 0x44b0e
jbe 0x18000ada0
mov dword [rsp + 0x68], r13d
mov r12, qword [rsp + 0x58]
mov r13d, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x38]
jmp 0x18000abae
mov r8, rdi
jmp 0x18000abb3
mov eax, dword [rsp + 0x30]
dec ebx
mov dword [rsp + 0x38], ebx
dec r13d
mov dword [rsp + 0x48], r13d
cmp ebx, eax
ja 0x18000ab62
mov esi, dword [rsp + 0x54]
mov r15d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
jmp 0x18000b003
mov r15d, dword [rsp + 0x4c]
mov dword [rsp + 0x50], r15d
mov esi, dword [rsp + 0x4c]
mov dword [rsp + 0x54], esi
lea r11d, [rax + 0x514]
mov dword [rsp + 0x4c], r11d
cmp eax, r11d
jae 0x18000ad06
xorps xmm8, xmm8
movsd xmm7, qword [0x1800689c8]
mov r10, qword [0x180072388]
mov r13d, dword [rsp + 0x70]
movsd xmm6, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x70]
mov edi, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r14, qword [rbp + 0xb0]
mov r12d, dword [rsp + 0x30]
cmp eax, 0x329
ja 0x18000b13a
je 0x18000b101
sub eax, 0x121
je 0x18000b0de
sub eax, 0xa
je 0x18000b424
sub eax, 0x78
je 0x18000b0d4
sub eax, 0x82
je 0x18000b097
cmp eax, 0x82
jne 0x18000b0a1
mov rax, qword [rbp - 0x70]
cvttsd2si eax, qword [rax]
mov dword [rsp + 0x30], eax
mov r12d, eax
jmp 0x18000b0a1
test edx, edx
jns 0x18000b0c2
xor edx, edx
mov dword [rsp + 0x38], edx
mov eax, dword [rsp + 0x34]
add eax, 0x82
mov dword [rsp + 0x34], eax
cmp eax, r11d
jae 0x18000ad06
mov esi, dword [rsp + 0x54]
mov r8, qword [rsp + 0x78]
jmp 0x18000b052
mov r8d, dword [0x180072384]
cmp edx, r8d
jl 0x18000b0a1
lea edx, [r8 - 1]
jmp 0x18000b09d
mov rax, qword [rbp - 0x68]
cvttsd2si edx, qword [rax]
jmp 0x18000b09d
test r15d, r15d
jns 0x18000b0ed
xor r15d, r15d
mov dword [rsp + 0x50], r15d
jmp 0x18000b0a1
mov eax, dword [rsp + 0x34]
cmp r15d, r9d
jl 0x18000b0a5
lea r15d, [r9 - 1]
mov dword [rsp + 0x50], r15d
jmp 0x18000b0a5
mov eax, dword [rsp + 0x30]
test eax, eax
jns 0x18000b10d
xor eax, eax
jmp 0x18000b11d
mov r8d, dword [0x180072384]
cmp eax, r8d
jl 0x18000b121
lea eax, [r8 - 1]
mov dword [rsp + 0x30], eax
mov ecx, r15d
sub ecx, esi
mov dword [rsp + 0x48], ecx
mov r13d, eax
sub r13d, edx
mov r12d, dword [rsp + 0x30]
jmp 0x18000b0a1
cmp eax, 0x3ab
je 0x18000b39a
cmp eax, 0x42d
je 0x18000b25d
cmp eax, 0x4af
je 0x18000b167
cmp eax, 0x531
je 0x18000ad06
jmp 0x18000b0a5
movaps xmm6, xmm8
xor r15d, r15d
mov esi, dword [rsp + 0x48]
test r13d, r13d
js 0x18000b230
nop dword [rax + rax]
xor r11d, r11d
test esi, esi
js 0x18000b21b
nop dword [rax + rax]
mov r8d, 0x31
mov eax, r8d
sub eax, 0x30
je 0x18000b1d8
cmp eax, 1
jne 0x18000b206
mov eax, dword [rsp + 0x50]
sub eax, dword [rsp + 0x54]
imul eax, r11d
mov ecx, esi
imul ecx, dword [rsp + 0x54]
add eax, ecx
cdq
idiv esi
mov edi, eax
mov eax, r12d
mov ecx, dword [rsp + 0x38]
sub eax, ecx
imul eax, r15d
imul ecx, r13d
add eax, ecx
cdq
idiv r13d
mov ebx, eax
jmp 0x18000b206
mov eax, ebx
imul eax, r9d
add eax, edi
add eax, eax
cdqe
cmp dword [r14], 0
je 0x18000b1f2
movzx ecx, word [r10 + rax*2 + 2]
jmp 0x18000b1f7
movzx ecx, word [r10 + rax*2]
movsx eax, cx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm6, xmm0
dec r8d
cmp r8d, 0x2f
ja 0x18000b196
inc r11d
cmp r11d, esi
jle 0x18000b190
inc r15d
cmp r15d, r13d
jle 0x18000b180
mov edx, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x4c]
lea ecx, [r13 + 1]
lea eax, [rsi + 1]
imul ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm6
divsd xmm1, xmm0
movsd qword [rsp + 0x60], xmm1
mov ecx, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x50]
jmp 0x18000b0a1
mov esi, dword [rsp + 0x48]
cmp esi, 1
jg 0x18000b382
mov r12d, 0xa3
mov eax, r12d
sub eax, 0xa1
je 0x18000ad06
sub eax, 1
je 0x18000b329
cmp eax, 1
jne 0x18000b342
movaps xmm6, xmm8
test r13d, r13d
js 0x18000b342
mov r15d, dword [rsp + 0x30]
sub r15d, dword [rsp + 0x38]
mov esi, dword [rsp + 0x38]
imul esi, r13d
lea eax, [r13 + 1]
movsxd r14, eax
nop word [rax + rax]
mov rax, qword [rbp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
mov eax, esi
cdq
idiv r13d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp - 0x78], xmm0
movsd xmm1, qword [r8]
mov rax, qword [rbp - 0x80]
addsd xmm1, qword [rax]
mulsd xmm1, xmm7
movsd qword [rsp + 0x58], xmm1
mov r9d, 0x4d
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.18004fb60
movq xmm0, rax
addsd xmm6, xmm0
add esi, r15d
sub r14, 1
mov r8, qword [rsp + 0x78]
jne 0x18000b2c0
jmp 0x18000b342
lea eax, [r13 + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm6
divsd xmm1, xmm0
movsd qword [rsp + 0x60], xmm1
dec r12d
cmp r12d, 0xa0
mov r8, qword [rsp + 0x78]
ja 0x18000b270
mov r9d, dword [0x180072380]
mov r10, qword [0x180072388]
mov esi, dword [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r14, qword [rbp + 0xb0]
mov r12d, dword [rsp + 0x30]
mov r11d, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x34]
cmp r13d, 1
jle 0x18000b431
mov ecx, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x50]
jmp 0x18000b0a5
cmp ecx, 0xa
mov esi, 0xa
cmovg ecx, esi
mov dword [rsp + 0x48], ecx
cmp r13d, esi
cmovg r13d, esi
cmp ecx, 1
jg 0x18000b0a5
cmp r13d, 1
jg 0x18000b0a5
mov rax, qword [rbp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
mov rax, qword [rbp - 0x70]
movsd xmm0, qword [rax]
mov rax, qword [rbp - 0x68]
addsd xmm0, qword [rax]
mulsd xmm0, xmm7
movsd qword [rbp - 0x78], xmm0
movsd xmm1, qword [r8]
mov rax, qword [rbp - 0x80]
addsd xmm1, qword [rax]
mulsd xmm1, xmm7
movsd qword [rsp + 0x58], xmm1
lea r9d, [rsi + 0x43]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.18004fb60
mov qword [rsp + 0x58], rax
mov rbx, rax
jmp 0x18000ad0b
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x60], eax
jmp 0x18000ad06
test esi, esi
js 0x18000b4b5
mov r14d, dword [rsp + 0x50]
sub r14d, dword [rsp + 0x54]
mov ebx, esi
imul ebx, dword [rsp + 0x54]
lea eax, [rsi + 1]
movsxd rdi, eax
mov rax, qword [rbp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
mov rax, qword [rbp - 0x70]
movsd xmm0, qword [rax]
mov rax, qword [rbp - 0x68]
addsd xmm0, qword [rax]
mulsd xmm0, xmm7
movsd qword [rbp - 0x78], xmm0
mov eax, ebx
cdq
idiv esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0x58], xmm0
mov r9d, 0x4d
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.18004fb60
movq xmm0, rax
addsd xmm8, xmm0
add ebx, r14d
sub rdi, 1
jne 0x18000b450
lea eax, [rsi + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
movsd qword [rsp + 0x58], xmm8
mov rbx, qword [rsp + 0x58]
jmp 0x18000ad0b
call fcn.18005ddd8
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18000b52d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b528
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b528
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005ddd8
mov rax, rbx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.18005e580
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret