Function at 0x140005bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400379d0]
xor ecx, ecx
mov qword [rbp - 9], rax
mov r14, rdx
mov rax, qword [0x1400379c8]
lea rdx, str.D:_A__GA___SY__A__GA___BA_
mov qword [rbp - 0x21], rcx
mov edi, ecx
mov qword [rbp - 0x29], rcx
mov r13d, ecx
mov r15d, ecx
mov qword [rbp + 0x7f], rcx
mov r12d, ecx
mov dword [rbp + 0x77], ecx
mov esi, ecx
mov qword [rbp - 1], rax
xorps xmm0, xmm0
lea rcx, [rbp - 0x21]
movdqu xmmword [rbp - 0x19], xmm0
call fcn.1400102e8
mov ebx, eax
test eax, eax
js 0x140005f29
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rbp - 0x29]
call fcn.1400102e8
mov ebx, eax
test eax, eax
js 0x140005f29
mov rax, qword [rbp - 0x21]
lea r8, str.GlobalOfficeSourceEngine64Mutex
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
xor edx, edx
mov qword [rbp + 0xf], rax
mov dword [rbp + 7], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r15, rax
test rax, rax
jne 0x140005c9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f29
mov edx, 0x2710
mov rcx, r15
call fcn.140012f6c
mov ebx, eax
test eax, eax
js 0x140005f29
mov rax, qword [rbp - 0x29]
lea r9, str.GlobalOffice64SourceEngineRunning
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
mov edi, 1
mov dword [rbp + 7], 0x18
mov edx, edi
mov qword [rbp + 0xf], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
test rax, rax
jne 0x140005d05
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f29
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x140005d39
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f29
lea rdx, [0x140037aa0]
mov rcx, r12
call fcn.14000267c
mov ebx, eax
test eax, eax
js 0x140005f29
lea r9, [0x140029fc8]
mov r8d, 2
lea rdx, [rbp - 9]
lea rcx, str.HeavyH2O_Source64Engine_V1_0
call fcn.140014290
mov ebx, eax
test eax, eax
js 0x140005f29
mov rax, qword [rbp + 0x67]
test rax, rax
je 0x140005dbf
test r14, r14
je 0x140005dbf
and dword [r14 + 0xc], esi
mov rdx, r14
mov rcx, rax
mov dword [r14 + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140005dbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f0e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, edi
mov ecx, edi
call fcn.140011064
mov ebx, eax
test eax, eax
js 0x140005f0e
xor r9d, r9d
mov dword [rbp + 0x77], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x140005e1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f0e
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
jne 0x140005e68
and qword [rsp + 0x40], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
and qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
and dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005e8b
lea rdx, [0x140037acc]
call fcn.1400057f8
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp - 0x19], r12
mov ebx, edi
mov dword [0x140037ad0], eax
test rsi, rsi
je 0x140005eab
mov qword [rbp - 0x11], rsi
mov ebx, 2
mov r9d, 0xea60
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ecx, eax
cmp eax, 0xc0
je 0x140005eab
cmp eax, 0x102
jne 0x140005ff5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [0x140037aac], 0xea60
mov edx, eax
mov r8d, dword [0x140037ad0]
sub edx, r8d
cmp edx, ecx
jb 0x140005eab
sub eax, r8d
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov r8d, eax
mov ecx, edi
call fcn.140013e80
xor ebx, ebx
xor r8d, r8d
lea rcx, [rbp - 9]
lea edx, [r8 + 2]
call fcn.140014360
cmp dword [rbp + 0x77], 0
je 0x140005f29
call fcn.140011090
mov rcx, qword [0x140037aa0]
test rcx, rcx
je 0x140005f5f
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, qword [0x140037aa0]
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [0x140037aa0], 0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005f6e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140005f7c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140005f8a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x140005fa1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140005fbc
test edi, edi
je 0x140005fb3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140005fca
call fcn.1400103c0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140005fd8
call fcn.1400103c0
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, 0xffffff7f
je 0x140005f0c
test rsi, rsi
je 0x140005eab
lea eax, [rbx - 1]
cmp eax, ecx
jne 0x140005eab
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x140037acc]
call fcn.1400057f8
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140005eab