Function at 0x14000fb50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, rdx
mov qword [rsp + 0x40], rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rcx + 0x1f8]
lea rcx, str._Stopping_process:___d__n
call fcn.14000bc30
cmp qword [rdi + 0x1f8], 0
jne 0x14000fbb4
xor eax, eax
jmp 0x140010178
lea rsi, [rdi + 0x200]
mov qword [rsp + 0x30], rsi
mov rbx, qword [rsi]
mov r8, qword [rbx + 8]
mov rdx, rsi
mov rcx, rsi
call fcn.140016390
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
xor eax, eax
mov qword [rsi + 8], rax
lea rax, vtable.ExportedObject_class_IPsStateManager_.0
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rsp + 0x58], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
movdqa xmm0, xmmword [0x1400904a0]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], si
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
lea rax, [0x14009cc90]
mov qword [rbp - 0x48], rax
mov word [rbp - 0x28], si
mov dword [rbp - 0x20], 0xabcd
mov dword [rbp - 0x14], 0xabcd
lea rax, [rbp - 0x48]
mov qword [rbp - 0x1c], rax
mov dword [rbp + 0x1fa], 0xabcd
lea rax, [rbp - 0x10]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x38], 0x104
mov qword [rbp - 0x30], 0x104
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x10], si
lea rax, [rbp - 0x10]
mov qword [rbp - 0x58], rax
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.140007410
nop
lea rcx, [rbp - 0x60]
call fcn.140006480
lea rdx, str.psstatemgr.dll
lea rcx, [rbp - 0x60]
call fcn.140007130
lea rdx, [0x14008d480]
mov rax, qword [rbp - 0x60]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140014c70
test eax, eax
je 0x14000fccb
lea r14d, [rsi - 1]
jmp 0x140010118
mov r14d, esi
mov dword [rsp + 0x20], esi
mov byte [r15], r14b
mov r13d, esi
lea r12, [rdi + 0x1f0]
lea r15, [0x14008d480]
nop word [rax + rax]
mov edx, esi
mov r8, qword [r12]
mov rbx, qword [r8]
test r13d, r13d
jle 0x14000fd64
nop
inc edx
cmp rbx, r8
je 0x1400100b6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000fd38
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000fd33
nop
cmp rbx, qword [rax + 0x10]
jne 0x14000fd33
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000fd20
mov rbx, rax
jmp 0x14000fd5f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000fd5f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000fd50
cmp edx, r13d
jl 0x14000fd00
cmp rbx, r8
je 0x1400100b6
cmp byte [rdi + 0x4b8], 0
je 0x14000fd80
cmp byte [rbx + 0x30], 0
je 0x140010055
mov rax, qword [rbx + 0x28]
mov r8, r15
test rax, rax
cmovne r8, rax
mov edx, dword [rbx + 0x20]
lea rcx, str.Processes_stop__d__s_n
call fcn.14000bc30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x10]
mov r8, qword [rbx + 0x28]
lea rdx, [0x14008d480]
test r8, r8
cmovne rdx, r8
mov r8d, 0x78
call r9
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov r8d, eax
mov edx, r14d
lea rcx, str.Processes_stop__d__d_n
call fcn.14000bc30
mov qword [rsp + 0x28], 0
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140006f00
nop
test r14d, r14d
je 0x14000fe23
cmp r14d, 0x5b4
je 0x14000fe23
cmp r14d, 0xbc2
je 0x14001005d
mov r14d, dword [rsp + 0x20]
jmp 0x14000fe43
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.1400159a0
mov r14d, dword [rsp + 0x20]
inc r14d
mov dword [rsp + 0x20], r14d
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000fe6c
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000fe8f
cmp rbx, qword [rax + 0x10]
jne 0x14000fe8f
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000fe57
jmp 0x14000fe8f
mov rdx, qword [rax]
cmp byte [rdx + 0x19], 0
jne 0x14000fe8f
nop word [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x14000fe80
mov rdi, qword [rsp + 0x28]
lea r15, [0x14008d480]
cmp rax, qword [r12]
je 0x140010009
nop word [rax + rax]
mov r8, r15
test rdi, rdi
cmovne r8, rdi
mov rcx, qword [rax + 0x28]
mov rdx, r15
test rcx, rcx
cmovne rdx, rcx
sub r8, rdx
nop dword [rax + rax]
movzx ecx, word [rdx]
cmp cx, word [rdx + r8]
jne 0x14000fee7
add rdx, 2
test cx, cx
jne 0x14000fed0
xor ecx, ecx
jmp 0x14000feec
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x14000ffa6
mov rcx, rax
mov rbx, qword [rax + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14000ff25
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000ff3f
nop dword [rax + rax]
cmp rcx, qword [rbx + 0x10]
jne 0x14000ff3f
mov rcx, rbx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
je 0x14000ff10
jmp 0x14000ff3f
mov rdx, qword [rbx]
cmp byte [rdx + 0x19], 0
jne 0x14000ff3f
nop
mov rbx, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x14000ff30
mov rdx, rax
mov rcx, r12
call fcn.140016580
mov rsi, rax
lea rcx, [rax + 0x28]
mov rdx, qword [rcx]
test rdx, rdx
je 0x14000ff8e
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x14000ff8e
cmp dword [rdx - 0x10], 0xabcd
jne 0x1400101b2
cmp dword [rdx - 4], 0xabcd
jne 0x1400101b2
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x1400101b2
call fcn.14000c390
nop
mov edx, 0x38
mov rcx, rsi
call fcn.140048430
mov rax, rbx
jmp 0x14000ffff
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14000ffd8
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x14000ffd3
nop word [rax + rax]
cmp rax, qword [rcx + 0x10]
jne 0x14000ffd3
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x14000ffc0
mov rax, rcx
jmp 0x14000ffff
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], 0
jne 0x14000ffff
nop dword [rax]
nop dword [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x14000fff0
cmp rax, qword [r12]
jne 0x14000feb0
test rdi, rdi
je 0x140010043
mov rax, qword [rdi - 0xc]
test rax, rax
je 0x140010043
cmp dword [rdi - 0x10], 0xabcd
jne 0x1400101bc
cmp dword [rdi - 4], 0xabcd
jne 0x1400101bc
mov rax, qword [rax + 0x10]
cmp dword [rdi + rax*2 + 2], 0xabcd
jne 0x1400101bc
lea rcx, [rsp + 0x28]
call fcn.14000c390
nop
mov rdi, qword [rsp + 0x38]
xor esi, esi
inc r13d
jmp 0x14000fcf0
mov rax, qword [rsp + 0x40]
mov byte [rax], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400100a4
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400100a4
cmp dword [rax - 0x10], 0xabcd
jne 0x1400101a8
cmp dword [rax - 4], 0xabcd
jne 0x1400101a8
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400101a8
lea rcx, [rsp + 0x28]
call fcn.14000c390
nop
mov r14d, dword [rsp + 0x20]
jmp 0x140010118
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1400100da
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400100da
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400100f9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
mov qword [rbp - 0x70], rsi
mov word [rax], si
lea rcx, [rbp - 0x60]
call fcn.140006d00
nop
lea rax, vtable.ExportedObject_class_IPsStateManager_.0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.1400068a0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140010175
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001016f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400101a2
call fcn.140048430
nop
mov eax, r14d
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140048410
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140054034
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3