Function at 0x140041240
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
cmp byte [0x1403896bc], 0
mov rbx, rcx
je 0x14004138b
xor esi, esi
cmp dword [rbx + 8], esi
ja 0x1400413a6
inc dword [rbx]
cmp dword [rbx], 0x708
jae 0x140176644
cmp dword [rbx + 4], esi
je 0x1400413de
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
nop dword [rax + rax]
test eax, eax
je 0x14004130d
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x50], rdi
cmp eax, dword [rbx + 0x18]
jne 0x140041380
inc dword [rbx + 0x14]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov edi, eax
sub edi, dword [rsp + 0x4c]
cmp edi, dword [rbx + 4]
jae 0x14004131b
cmp edi, dword [rbx + 0xc]
mov rdi, qword [rsp + 0x50]
jae 0x140041426
mov eax, dword [rbx + 0x14]
lea r8, [rsp + 0x40]
mov rcx, qword [0x140314848]
mov r9d, 4
xor edx, edx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
nop dword [rax + rax]
mov ebx, eax
or ebx, 0x10000000
jl 0x1401766fa
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rsi
ret
cmp byte [rbx + 0x1c], sil
jne 0x1400412c5
lea rcx, [0x14038a3d0]
mov byte [rbx + 0x1c], 1
call fcn.14000ef1c
add eax, 0xfffffffb
cmp eax, 2
ja 0x14004143b
cmp dword [0x14038a488], esi
jne 0x14004143b
mov al, 1
test al, al
je 0x1400412c5
lea rdx, [rbx + 0x1d]
mov rcx, rbx
call fcn.14000fb18
call fcn.14000f7b0
test eax, eax
js 0x14017669d
xor ecx, ecx
call fcn.14003e9f4
test eax, eax
jns 0x1400412c5
jmp 0x1401766bc
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], esi
jmp 0x1400412ae
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbx + 0x10], eax
mov byte [0x1403896bc], 1
jmp 0x14004125a
mov rdx, qword [rbx + 0x20]
xor r9d, r9d
mov rcx, qword [0x140389690]
mov r8d, 0x3e8
mov dword [rsp + 0x20], 0x3e8
call qword [0x1403ad7d0]
nop dword [rax + rax]
test eax, eax
je 0x140176628
mov dword [rbx + 8], esi
jmp 0x140041265
movzx eax, byte [rbx + 0x1d]
test al, al
jne 0x140176673
mov ecx, 0x7530
mov dword [rbx + 4], ecx
test al, al
jne 0x14017667d
lea r8, str.UserIdleTimeInterval
lea r9, [rsp + 0x40]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.14002c200
test eax, eax
js 0x14004127c
jmp 0x140176689
mov rcx, rbx
call fcn.14000f61c
test eax, eax
jns 0x1400412d3
jmp 0x1401766db
xor al, al
jmp 0x14004134b
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov edx, reloc.UxTheme.dll_Ordinal_86
call fcn.14019dc84
nop
jmp 0x1400413d6
mov rcx, rbx
call fcn.14000f61c
test eax, eax
jns 0x140041273
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, Ordinal_95
call fcn.14009cb2c
nop
jmp 0x140041273
mov ecx, 0x1f40
jmp 0x1400413ef
lea r8, str.RetailIdleTimeInterval
jmp 0x140041401
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14004127c
mov dword [rbx + 4], eax
jmp 0x14004127c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, reloc.SHCORE.dll_Ordinal_142
call fcn.14009cb2c
nop
jmp 0x14004136c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, 0x8f
call fcn.14009cb2c
nop
jmp 0x1400412c5
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, DllRegisterServer
call fcn.14009cb2c
nop
jmp 0x1400412d3
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_shellcontentdeliverymanagerutilslibcontentdeliverymanagertriggerscontentdeliverymanagertriggers.cpp
mov r9d, ebx
mov edx, Ordinal_113
call fcn.14001e09c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, ebx
mov edx, 0x97
call fcn.14009cb2c
nop
jmp 0x14004130d