Function at 0x140007d38
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7a0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rsp + 0x790], rax
mov byte [rsp + 0x40], r9b
mov r14, r8
mov esi, edx
mov rdi, rcx
mov qword [rsp + 0x78], rcx
mov r9d, edx
xor r8d, r8d
mov dl, 8
call fcn.140015adc
xor r15d, r15d
cmp byte [0x14006853c], r15b
jne 0x140007e2f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVisualStudio15.0EnterpriseToolsFaultTesting
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007e28
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.vsperfcmd.exe
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140007e28
cmp dword [rsp + 0x44], 4
jne 0x140007e28
cmp dword [rsp + 0x48], 1
jne 0x140007e28
mov byte [r15], r15b
mov byte [0x14006853c], 1
xor edx, edx
mov rcx, r14
call fcn.140019adc
test eax, eax
je 0x140007e74
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xe123051a
call qword [rax]
mov dword [rdi], 1
mov dword [rsp + 0x350], 4
lea rcx, [rsp + 0x350]
call fcn.1400254f0
jmp 0x14000850d
lea rax, vtable.CEnvironment.0
mov qword [rsp + 0x90], rax
lea rax, vtable.ISecurable.0
mov qword [rsp + 0x98], rax
lea rax, vtable.CSecurableKernelObject.0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], r15
lea rax, vtable.CSharedMemory.0
mov qword [rsp + 0x90], rax
lea rax, vtable.CSharedMemory.1.0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r15
mov dword [rsp + 0xb8], r15d
mov qword [rsp + 0xc0], r15
mov byte [rsp + 0xc8], r15b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
mov dword [rsp + 0x44], eax
imul r12d, esi, 0x3e8
or eax, 0xffffffff
cmp esi, eax
cmove r12d, esi
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.140007cf0
test al, al
jne 0x140007f32
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
mov r14, qword [rsp + 0xa8]
mov qword [rsp + 0x70], r14
mov r8d, dword [r14 + 0x4a8]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x140007f8c
mov edx, 0xe123051a
mov ecx, 0xe123052a
cmp eax, 5
cmove edx, ecx
mov rcx, rdi
call fcn.14000ad18
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
mov rcx, rbx
call fcn.1400125fc
mov esi, eax
test eax, eax
je 0x140007fc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov rcx, rdi
call fcn.14000ad18
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
lea rcx, [rsp + 0x1d0]
call fcn.14001b4bc
nop
mov byte [rsp + 0x20], r15b
xor r9d, r9d
mov r8d, dword [r14]
mov edx, dword [r14 + 4]
lea rcx, [rsp + 0x1d0]
call fcn.14001b5dc
mov dword [rsp + 0x50], r15d
xor r14d, r14d
mov dword [rsp + 0x4c], r14d
cmp byte [rsp + 0x40], r14b
jne 0x14000829b
mov r14d, dword [rsp + 0x68]
xor eax, eax
mov rsi, rax
mov rcx, qword [rsp + 0x340]
call fcn.14001916c
xor edx, edx
mov r13d, edx
mov rcx, qword [rsp + 0x1f8]
mov eax, dword [rcx + 8]
cmp eax, 0xffffffff
je 0x140008079
cmp eax, dword [rsp + 0x328]
jb 0x14000803b
mov esi, edx
jmp 0x14000804c
imul esi, eax, 0x234
add esi, 0x230
add rsi, rcx
jne 0x14000805d
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000025
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov r14d, dword [rsi + 4]
mov dword [rsp + 0x68], r14d
mov r8d, r14d
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
mov rcx, qword [rsp + 0x340]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test r13, r13
je 0x140008220
cmp r14d, r15d
je 0x140008217
cmp r14d, dword [rsp + 0x4c]
je 0x1400080bf
lea r9, [rsi + 0x20]
mov r8d, dword [rsi + 4]
mov edx, 0x61230d2e
mov rcx, qword [rdi + 8]
call fcn.1400077f4
mov dword [rsp + 0x4c], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x44]
mov edx, r12d
sub edx, eax
add edx, dword [rsp + 0x44]
cmp ecx, r12d
mov eax, 0
cmova edx, eax
or eax, 0xffffffff
cmp r12d, eax
cmove edx, eax
mov eax, 0xfa
cmp edx, eax
cmova edx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15d, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x1400081c0
cmp r15d, 0x102
jne 0x140008189
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov r13d, dword [rsp + 0x44]
sub ecx, r13d
mov edx, r12d
sub edx, eax
add edx, r13d
cmp ecx, r12d
mov eax, 0
cmova edx, eax
or ecx, 0xffffffff
cmp r12d, ecx
cmove edx, ecx
test edx, edx
jne 0x140008180
mov edx, 0xe1230523
mov rcx, rdi
call fcn.14000ad18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1d0]
call fcn.14001b558
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
mov r15d, eax
mov dword [rsp + 0x50], eax
jmp 0x1400081cd
mov edx, 0xe1230526
mov rcx, rdi
call fcn.14000ad18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1d0]
call fcn.14001b558
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
mov r15d, r14d
mov dword [rsp + 0x50], r14d
mov r13d, dword [rsp + 0x44]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000828d
mov edx, 0xa1230927
mov rcx, rdi
call fcn.14000ad18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1d0]
call fcn.14001b558
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov r13d, dword [rsp + 0x44]
sub ecx, r13d
mov edx, r12d
sub edx, eax
add edx, r13d
cmp ecx, r12d
mov eax, 0
cmova edx, eax
or ecx, 0xffffffff
cmp r12d, ecx
cmove edx, ecx
test edx, edx
jne 0x140008287
mov edx, 0xe1230523
mov rcx, rdi
call fcn.14000ad18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1d0]
call fcn.14001b558
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
jmp 0x14000850d
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
test rsi, rsi
jne 0x140008009
xor r14d, r14d
lea rcx, [rsp + 0x350]
call fcn.1400153b0
nop
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, 0x4d28
mov rdx, qword [0x140067ce8]
lea rcx, [rsp + 0x350]
call fcn.1400154f4
mov r15, r14
cmp dword [rsp + 0x370], r14d
cmovne r15, qword [rsp + 0x368]
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x61230d0f
call qword [rax]
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x61230cea
call qword [rax]
lea rcx, [rsp + 0x490]
call fcn.140019f60
nop
lea rcx, [rsp + 0x490]
call fcn.14001a0f4
cmp dword [rsp + 0x784], r14d
je 0x14000839a
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x490]
call fcn.14001a284
test eax, eax
jne 0x140008351
jmp 0x140008339
mov eax, dword [rsp + 0x48]
imul rcx, rax, 0x258
mov rax, qword [rsp + 0x608]
mov dword [rcx + rax + 0x10], 6
or esi, 0xffffffff
mov dword [rcx + rax + 0x14], esi
mov dword [rcx + rax + 0x18], esi
mov dword [rcx + rax + 0x1c], esi
mov dword [rcx + rax + 0x20], esi
mov r8, qword [rsp + 0x608]
lea rdx, [rcx + r8]
mov rcx, qword [rsp + 0x778]
call fcn.140023180
jmp 0x14000839d
or esi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, r13d
mov edx, r12d
sub edx, eax
add edx, r13d
cmp ecx, r12d
cmova edx, r14d
cmp r12d, esi
cmove edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1400083ef
mov rcx, rdi
cmp esi, 0x102
mov edx, 0xe1230523
je 0x1400083ea
mov edx, 0xe1230526
call fcn.14000ad18
mov esi, r14d
mov dword [rsp + 0x6c], r14d
mov r12d, 0xc0000000
mov r13d, 0xa1230917
cmp esi, dword [r15 + 0x9f4]
jae 0x1400084ab
mov eax, esi
lea r14, [rax + rax*2]
shl r14, 7
mov eax, dword [r14 + r15 + 0x9f8]
and eax, r12d
cmp eax, r12d
je 0x14000842c
jmp 0x1400084a0
mov ecx, dword [r14 + r15 + 0x9f8]
call fcn.1400120a4
mov rbx, rax
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x58], rax
mov r10, qword [rcx]
lea r9, [rsp + 0x58]
mov r8d, 1
mov edx, r13d
call qword [r10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [r15 + 0x9f8]
add rcx, r14
call fcn.14000933c
mov rbx, rax
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x60], rax
mov r10, qword [rcx]
lea r9, [rsp + 0x60]
mov r8d, 1
mov edx, r13d
call qword [r10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rdi], 1
inc esi
mov dword [rsp + 0x6c], esi
jmp 0x140008403
xor r14d, r14d
cmp dword [rdi], r14d
jne 0x1400084d6
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x4ac], r14d
je 0x1400084d6
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa1230919
call qword [rax]
nop
lea rcx, [rsp + 0x490]
call fcn.14001a08c
nop
lea rcx, [rsp + 0x350]
call fcn.140015440
nop
lea rcx, [rsp + 0x1d0]
call fcn.14001b558
nop
lea rcx, [rsp + 0x90]
call fcn.140015440
mov rcx, qword [rsp + 0x790]
xor rcx, rsp
call fcn.140026390
add rsp, 0x7a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret