Function at 0x1400e5fa0
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value
Set registry value

Disassembly:
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400e6f90
xor eax, eax
ret
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r15, r9
mov r12, r8
movsxd rdi, edx
mov rbx, rcx
test edx, edx
jns 0x1400e6fdd
xor eax, eax
jmp 0x1400e7335
lea rax, vtable._BaseModule::CAutoLocker.0
mov qword [rsp + 0x58], rax
lea rsi, [rcx + 0x58]
mov qword [rsp + 0x60], rsi
test rsi, rsi
je 0x1400e7000
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbx + 0x40], 0
jl 0x1400e7011
mov r14d, 1
jmp 0x1400e7323
mov ecx, 8
call fcn.140171ab4
mov qword [rsp + 0x38], rax
xor r13d, r13d
test rax, rax
je 0x1400e7032
mov rcx, rax
call fcn.1402bf450
jmp 0x1400e7035
mov rax, r13
mov qword [rbx + 0x98], rax
mov rdx, rdi
mov rcx, rax
call fcn.1402c3db0
test al, al
jne 0x1400e707f
mov rcx, qword [rbx + 0x98]
call fcn.1402c6120
mov r14, qword [rbx + 0x98]
test r14, r14
je 0x1400e7078
mov rcx, r14
call fcn.1402bf550
mov edx, 8
mov rcx, r14
call fcn.140171af0
mov qword [rbx + 0x98], r13
mov dword [rbx + 0x40], edi
test edi, edi
jns 0x1400e708e
mov r14d, r13d
jmp 0x1400e7323
test r12, r12
je 0x1400e709f
lea rcx, [rbx + 0x50]
mov rdx, r12
call fcn.1400a0260
test r15, r15
je 0x1400e70b2
lea rcx, [rbx + 0x48]
mov rdx, r15
call fcn.1400a0260
jmp 0x1400e7124
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1400e7124
xor r8d, r8d
lea rdx, [rsp + 0x70]
call fcn.1402c0db0
nop
cmp qword [rax + 0x18], 8
jb 0x1400e70d6
mov rax, qword [rax]
lea rcx, [rbx + 0x48]
mov rdx, rax
call fcn.1400a0260
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400e7124
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e711f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e7363
call fcn.140171af0
mov rcx, rbx
call fcn.1400e74c0
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x50], r13
mov r9d, 0x2021f
lea r8, str.SOFTWAREComMaster
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.14007dcc0
mov r14d, 1
test eax, eax
je 0x1400e71a1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1402a5ca4
call fcn.1402a5c78
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
inc r8d
mov dword [rbx + 0x38], r8d
mov rdi, qword [rsp + 0x40]
jmp 0x1400e7314
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.140289490
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.stat_rand
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e7224
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, r14d
ja 0x1400e7224
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400e7213
test r14b, al
jne 0x1400e7224
shr rax, 1
cmp word [rbp + rax*2 - 0x72], 0
je 0x1400e7218
jmp 0x1400e7224
mov word [rbp - 0x70], r13w
lea rcx, [rbp - 0x70]
call fcn.140291898
mov dword [rbx + 0x38], eax
cmp dword [rbx + 0x38], 0
jne 0x1400e7303
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1402a5ca4
call fcn.1402a5c78
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
inc r8d
mov dword [rbx + 0x38], r8d
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400e7358
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, dword [rbx + 0x38]
lea rdx, [0x1402f6018]
lea rcx, [rsp + 0x38]
call fcn.14000b080
mov rsi, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400e72e2
mov rax, rsi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x1400e72b0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
lea rdx, str.stat_rand
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400e72f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400e7314
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
test rdi, rdi
je 0x1400e7323
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rsi, rsi
je 0x1400e7332
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140172190
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000adf0
nop
call fcn.14028c66c
int3