Function at 0x140075374
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov sil, r8b
mov rdi, rcx
mov ebx, 0xea60
mov dword [rsp + 0x70], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x70]
mov edx, ebx
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
mov r13d, dword [rsp + 0x70]
test eax, eax
cmovs r13d, ebx
and dword [rsp + 0x80], 0
lea rax, str.MpSampleSubmissionLowPriAgentLifeInMins
lea rbp, str.MpSampleSubmissionHighPriAgentLifeInMins
test sil, sil
cmove rbp, rax
lea rdx, [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x140075443
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140075491
test byte [rcx + 0x1c], 4
je 0x140075491
mov edx, 0x1b
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x1401341d8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov rcx, qword [0x140162280]
jmp 0x140075491
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14007547f
test byte [rcx + 0x1c], 1
je 0x14007547f
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x1401341d8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov rcx, qword [0x140162280]
neg sil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x80], eax
imul r15d, dword [rsp + 0x80], 0xea60
cmp rcx, rbx
je 0x1400754cc
test byte [rcx + 0x1c], 4
je 0x1400754cc
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0x1d
lea r8, [0x1401341d8]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov ebp, 0x1b7740
mov dword [rsp + 0x70], ebp
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x70]
mov edx, ebp
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
mov esi, dword [rsp + 0x70]
test eax, eax
cmovs esi, ebp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400f1e80
test al, al
je 0x14007558f
lea r12d, [r13 + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebp
cmp r12d, ecx
ja 0x14007553d
sub ebp, eax
cmp r12d, ebp
jbe 0x140075577
mov ecx, dword [rdi + 0x68]
test ecx, ecx
je 0x140075558
mov eax, r14d
sub eax, ecx
cmp esi, eax
ja 0x140075558
sub ecx, r14d
cmp esi, ecx
jbe 0x140075601
cmp dword [rdi + 0x60], 0
je 0x140075577
mov ecx, dword [rdi + 0x64]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x140075577
sub ecx, r14d
cmp r15d, ecx
jbe 0x14007562b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400f1e80
test al, al
jne 0x14007551e
mov ecx, dword [rdi + 0x50]
test ecx, ecx
jns 0x1400755e9
cmp ecx, 0x80070008
je 0x1400755e9
cmp ecx, 0x8007000e
je 0x1400755e9
cmp ecx, 0x800705aa
je 0x1400755e9
cmp ecx, 0x8077ffff
je 0x1400755e9
call fcn.1400f11a8
test eax, eax
jne 0x1400755e9
mov rax, qword [0x140162280]
cmp rax, rbx
je 0x1400755e9
test byte [rax + 0x1c], 1
je 0x1400755e9
mov edx, 0x1e
mov r9d, ecx
lea r8, [0x1401341d8]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14007562b
test byte [rcx + 0x1c], 1
je 0x14007562b
mov edx, 0x1f
mov r9d, esi
lea r8, [0x1401341d8]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov edx, esi
mov rcx, qword [rdi + 0x38]
call fcn.1400f5a38
test al, al
je 0x1400755e9
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140075675
test byte [rcx + 0x1c], 1
je 0x140075675
mov edx, 0x20
mov r9d, esi
lea r8, [0x1401341d8]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400755e9