Function at 0x14004f6e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rsi, r9
mov ebx, r8d
mov rdi, rdx
mov r12, rcx
mov r13d, 0x456
mov eax, dword [0x14019c334]
xor r14d, r14d
cmp eax, r14d
je 0x14004f747
cmp byte [0x14019bf25], r14b
je 0x14004f747
cmp eax, ebx
jne 0x14004f747
mov dword [r11 - 0x68], r13d
xor r9d, r9d
lea r8, str.PECMD2012
lea rcx, [0x14019cb40]
call fcn.14005b8d0
mov eax, 0x312
cmp ebx, eax
ja 0x14004f9e2
cmp ebx, eax
je 0x14004f8df
mov eax, ebx
mov ebp, 1
sub eax, ebp
je 0x14004f8b5
sub eax, ebp
je 0x14004f876
sub eax, 0x10f
je 0x14004fa7a
sub eax, 2
je 0x14004f7bf
cmp eax, 0x106
jne 0x14004fa02
mov ebx, 0x8000
cmp esi, ebx
jne 0x14004f79e
mov ecx, ebx
call fcn.140068af0
cmp esi, 0x8004
je 0x14004fa7a
cmp esi, ebx
je 0x14004fa7a
lea eax, [rsi - 0x17]
cmp eax, 2
ja 0x14004f7d1
jmp 0x14004fa7a
mov edx, 0x14
cmp esi, edx
jne 0x14004f827
mov rcx, rdi
call qword [sym.imp.USER32.dll_KillTimer]
mov al, byte [0x1401958ab]
cmp al, r14b
jle 0x14004fa7a
cmp al, 0x10
je 0x14004fa7a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14019c0f0], eax
mov byte [0x1401958ab], 2
mov r12d, 0xa
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
mov r8d, 0xc8
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x14004fa7a
mov r12d, 0xa
cmp esi, r12d
jne 0x14004fa7a
mov ebx, dword [0x14019c0f0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, dword [0x1401958b0]
jb 0x14004fa7a
mov byte [0x1401958ab], 0x10
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
call fcn.140068af0
mov byte [0x1401958ab], bpl
jmp 0x14004fa7a
movzx eax, word [0x14019c054]
cmp ax, bp
jle 0x14004f8a8
dec ax
mov word [0x14019c054], ax
movsx edx, ax
mov rcx, qword [0x14019c048]
call qword [sym.imp.USER32.dll_UnregisterHotKey]
mov ax, word [0x14019c054]
cmp ax, bp
jg 0x14004f882
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x14004fa7a
cmp byte [0x14019bf25], r14b
je 0x14004fa7a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44b
mov rcx, qword [0x14019c048]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004fa7a
mov qword [rsp + 0x40], r14
mov edx, 0x303a
mov r13d, 0x80070057
lea rcx, [rsp + 0x48]
call fcn.140063580
nop
mov rdi, qword [rsp + 0x48]
lea rbx, [rdi + 0x64]
mov qword [rsp + 0x40], rbx
mov ebp, 1
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0xa0], 0x3000
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x38], 0x186a0
mov r8d, esi
lea rdx, str.HotKey_d
mov rcx, rdi
call fcn.140029bc4
mov word [rbx], r14w
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
mov r8, rdi
lea rdx, str.SOFTWAREPELOGON
mov rcx, 0xffffffff80000002
call qword [0x14019bf60]
mov rdx, qword [rsp + 0x40]
movzx eax, word [rdx]
cmp ax, r14w
je 0x14004f9cd
sub ax, 0x30
cmp ax, 9
ja 0x14004f9b1
lea ebx, [rbp + 0x2b]
mov r8d, ebx
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.140066b60
mov r8d, ebx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140066b60
mov rdx, qword [rsp + 0x40]
cmp word [rdx], r14w
je 0x14004f9cd
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.14004d38c
mov r13d, eax
movsxd rbx, r13d
lea rcx, [rsp + 0x48]
call fcn.14005b520
mov rax, rbx
jmp 0x14004fa92
mov eax, ebx
sub eax, 0x446
je 0x14004fa7e
sub eax, 4
je 0x14004fa88
sub eax, 1
je 0x14004fa53
cmp eax, 0xb
je 0x14004fa1a
mov r9, qword [rsp + 0xb0]
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14004fa92
cmp byte [0x14019cb40], r14b
je 0x14004fa7a
mov r8, qword [rsp + 0xb0]
cmp r8, 0x206
je 0x14004fa46
cmp r8, 0x205
je 0x14004fa46
cmp r8, 0x204
jne 0x14004fa7a
mov rdx, rsi
mov rcx, rdi
call fcn.14004f544
jmp 0x14004fa7a
cmp byte [0x14019cb40], r14b
jne 0x14004fa7a
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.PECMD2012
mov rdx, rdi
lea rcx, [0x14019cb40]
call fcn.14005b8d0
xor eax, eax
jmp 0x14004fa92
xor edx, edx
mov rcx, r12
call fcn.140034d04
mov rcx, r12
call fcn.1400350c0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret