Function at 0x1400106d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r13, rcx
mov rdx, qword [rcx + 0x1f8]
lea rcx, str._Check_process_stopped:___d__n
call fcn.14000bc30
cmp qword [r13 + 0x1f8], 0
jne 0x14001072f
xor eax, eax
jmp 0x140010c55
lea rbx, vtable.ExportedObject_class_IPsStateManagerEx_.0
mov qword [rsp + 0x70], rbx
xor esi, esi
mov qword [rsp + 0x78], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
movdqa xmm0, xmmword [0x1400904a0]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [0x14009cc90]
mov qword [rbp - 0x28], rax
mov word [rbp - 8], si
mov dword [rbp], 0xabcd
mov dword [rbp + 0xc], 0xabcd
lea rax, [rbp - 0x28]
mov qword [rbp + 4], rax
mov dword [rbp + 0x21a], 0xabcd
lea rax, [rbp + 0x10]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x18], 0x104
mov qword [rbp - 0x10], 0x104
mov qword [rbp - 0x20], rsi
mov word [rbp + 0x10], si
lea rax, [rbp + 0x10]
mov qword [rbp - 0x38], rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140007410
nop
lea rcx, [rbp - 0x40]
call fcn.140006480
lea rdx, str.psstatemgr.dll
lea rcx, [rbp - 0x40]
call fcn.140007130
lea rdx, [0x14008d480]
mov rax, qword [rbp - 0x40]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140006040
test eax, eax
je 0x140010814
lea r12d, [rsi - 1]
jmp 0x140010bfc
mov r12d, esi
mov rdi, qword [r13 + 0x1f0]
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], sil
jne 0x140010ba0
lea r14, [0x14008d480]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rsi
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140006f00
movzx eax, byte [rdi + 0x30]
mov byte [rsp + 0x30], al
cmp byte [r13 + 0x4b8], 0
je 0x140010874
test al, al
je 0x140010af4
mov r8, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r8, rax
mov edx, dword [rsp + 0x20]
lea rcx, str.Processes_check_stop__d__s_n
call fcn.14000bc30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rcx]
mov r9, qword [rdx + 8]
mov rdx, r14
mov r8, qword [rsp + 0x28]
test r8, r8
cmovne rdx, r8
mov r8d, 0x1e
call r9
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
mov r8d, eax
mov edx, esi
lea rcx, str.Processes_check_stop__d__d_n
call fcn.14000bc30
test esi, esi
je 0x1400108e9
cmp esi, 0x5b4
jne 0x140010af2
lea r15, [r13 + 0x200]
mov r14, qword [r15]
mov rbx, qword [r14]
cmp rbx, r14
je 0x140010a08
nop
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], 0
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140006f00
movzx eax, byte [rbx + 0x30]
mov byte [rsp + 0x48], al
lea rcx, [0x14008d480]
mov r8, rcx
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r8, rax
mov rax, rcx
mov rdx, qword [rsp + 0x40]
test rdx, rdx
cmovne rax, rdx
sub r8, rax
nop
movzx esi, word [rax]
movzx ecx, word [rax + r8]
sub esi, ecx
jne 0x140010964
add rax, 2
test ecx, ecx
jne 0x140010950
test rdx, rdx
je 0x14001099e
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x14001099e
cmp dword [rdx - 0x10], 0xabcd
jne 0x140010c91
cmp dword [rdx - 4], 0xabcd
jne 0x140010c91
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140010c91
lea rcx, [rsp + 0x40]
call fcn.14000c390
nop
test esi, esi
je 0x140010ae4
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400109dd
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400109d8
cmp rbx, qword [rax + 0x10]
jne 0x1400109d8
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400109c5
mov rbx, rax
jmp 0x1400109ff
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400109ff
nop dword [rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400109f0
cmp rbx, r14
jne 0x140010900
mov rsi, qword [r15]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0
mov ecx, 0x38
call fcn.140048438
mov r14, rax
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x20]
mov dword [r14 + 0x20], eax
mov qword [r14 + 0x28], 0
lea rdx, [rsp + 0x28]
lea rcx, [r14 + 0x28]
call fcn.140006f00
movzx eax, byte [rsp + 0x30]
mov byte [r14 + 0x30], al
mov qword [r14], rsi
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], rsi
mov word [r14 + 0x18], 0
mov rax, qword [r15]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
cmp byte [rcx + 0x19], sil
jne 0x140010aa5
mov eax, dword [r14 + 0x20]
mov qword [rsp + 0x38], rcx
cmp eax, dword [rcx + 0x20]
jge 0x140010a97
mov dword [rsp + 0x40], 1
mov rcx, qword [rcx]
jmp 0x140010a9f
mov dword [rsp + 0x40], esi
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], sil
je 0x140010a80
movabs rax, 0x492492492492492
cmp qword [r15 + 8], rax
je 0x140010c85
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x60], xmm0
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.140016d80
inc r12d
lea r14, [0x14008d480]
jmp 0x140010af4
xor esi, esi
inc r12d
lea r14, [0x14008d480]
jmp 0x140010af4
xor esi, esi
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140010b33
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140010b33
cmp dword [rcx - 0x10], 0xabcd
jne 0x140010c9b
cmp dword [rcx - 4], 0xabcd
jne 0x140010c9b
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140010c9b
lea rcx, [rsp + 0x28]
call fcn.14000c390
nop
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x140010b6a
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x140010b65
cmp rdi, qword [rax + 0x10]
jne 0x140010b65
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140010b52
mov rdi, rax
jmp 0x140010b8f
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140010b8f
nop word [rax + rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140010b80
cmp byte [rdi + 0x19], 0
je 0x140010840
lea rbx, vtable.ExportedObject_class_IPsStateManagerEx_.0
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x140010bc2
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140010bc2
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
call rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140010bdf
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
mov qword [rbp - 0x50], rsi
mov word [rax], si
lea rcx, [rbp - 0x40]
call fcn.140006d00
nop
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
call fcn.1400068a0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140010c52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010c4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c8b
call fcn.140048430
nop
mov eax, r12d
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140048410
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000c940
nop
call fcn.140054034
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3