Function at 0x140041ef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
cmp byte [0x14037b66c], 0
mov rbx, rcx
je 0x14004203b
xor esi, esi
cmp dword [rbx + 8], esi
ja 0x140042056
inc dword [rbx]
cmp dword [rbx], 0x708
jae 0x1401694f2
cmp dword [rbx + 4], esi
je 0x14004208e
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
nop dword [rax + rax]
test eax, eax
je 0x140041fbd
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x50], rdi
cmp eax, dword [rbx + 0x18]
jne 0x140042030
inc dword [rbx + 0x14]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov edi, eax
sub edi, dword [rsp + 0x4c]
cmp edi, dword [rbx + 4]
jae 0x140041fcb
cmp edi, dword [rbx + 0xc]
mov rdi, qword [rsp + 0x50]
jae 0x1400420d6
mov eax, dword [rbx + 0x14]
lea r8, [rsp + 0x40]
mov rcx, qword [0x140307758]
mov r9d, 4
xor edx, edx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
nop dword [rax + rax]
mov ebx, eax
or ebx, 0x10000000
jl 0x1401695a8
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rsi
ret
cmp byte [rbx + 0x1c], sil
jne 0x140041f75
lea rcx, [0x14037c370]
mov byte [rbx + 0x1c], 1
call fcn.14000f17c
add eax, 0xfffffffb
cmp eax, 2
ja 0x1400420eb
cmp dword [0x14037c428], esi
jne 0x1400420eb
mov al, 1
test al, al
je 0x140041f75
lea rdx, [rbx + 0x1d]
mov rcx, rbx
call fcn.14000fd78
call fcn.14000fa10
test eax, eax
js 0x14016954b
xor ecx, ecx
call fcn.14003f6a4
test eax, eax
jns 0x140041f75
jmp 0x14016956a
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], esi
jmp 0x140041f5e
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbx + 0x10], eax
mov byte [0x14037b66c], 1
jmp 0x140041f0a
mov rdx, qword [rbx + 0x20]
xor r9d, r9d
mov rcx, qword [0x14037b640]
mov r8d, 0x3e8
mov dword [rsp + 0x20], 0x3e8
call qword [0x14039e670]
nop dword [rax + rax]
test eax, eax
je 0x1401694d6
mov dword [rbx + 8], esi
jmp 0x140041f15
movzx eax, byte [rbx + 0x1d]
test al, al
jne 0x140169521
mov ecx, 0x7530
mov dword [rbx + 4], ecx
test al, al
jne 0x14016952b
lea r8, str.UserIdleTimeInterval
lea r9, [rsp + 0x40]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.14002cdc0
test eax, eax
js 0x140041f2c
jmp 0x140169537
mov rcx, rbx
call fcn.14000f87c
test eax, eax
jns 0x140041f83
jmp 0x140169589
xor al, al
jmp 0x140041ffb
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov edx, reloc.UxTheme.dll_Ordinal_86
call fcn.140190ca4
nop
jmp 0x140042086
mov rcx, rbx
call fcn.14000f87c
test eax, eax
jns 0x140041f23
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, Ordinal_95
call fcn.14009d7ec
nop
jmp 0x140041f23
mov ecx, 0x1f40
jmp 0x14004209f
lea r8, str.RetailIdleTimeInterval
jmp 0x1400420b1
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140041f2c
mov dword [rbx + 4], eax
jmp 0x140041f2c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, reloc.SHCORE.dll_Ordinal_142
call fcn.14009d7ec
nop
jmp 0x14004201c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, 0x8f
call fcn.14009d7ec
nop
jmp 0x140041f75
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, eax
mov edx, DllRegisterServer
call fcn.14009d7ec
nop
jmp 0x140041f83
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_shellcontentdeliverymanagerutilslibcontentdeliverymanagertriggerscontentdeliverymanagertriggers.cpp
mov r9d, ebx
mov edx, Ordinal_113
call fcn.14001eb0c
mov rcx, qword [rsp + 0x38]
lea r8, str.pcshell_shellexploreruseridledetector.cpp
mov r9d, ebx
mov edx, 0x97
call fcn.14009d7ec
nop
jmp 0x140041fbd