Function at 0x1400459dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rcx, qword [0x14013c9c8]
xor esi, esi
cmp rcx, rsi
je 0x140045a16
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14013c9c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14013c9c8], rsi
lea rdx, [0x140122928]
lea rcx, [0x14013d130]
call fcn.1400251f0
lea rcx, [0x140122928]
call fcn.14002af4c
mov rcx, qword [rsp + 0x70]
mov edx, 0x2d
mov qword [rsp + 0x30], rcx
cmp dx, word [rcx]
mov al, 0x2a
cmove eax, edx
mov rbx, rsi
lea ebp, [rdx - 0x2b]
movsx edi, al
movzx eax, word [rcx]
cmp edi, eax
jne 0x140045ad7
movzx eax, word [rcx + 2]
cmp edi, eax
jne 0x140045ad7
lea rdx, [rcx + 4]
lea rcx, [0x1401214f0]
mov r8d, ebp
call fcn.14005c4dc
cmp al, sil
je 0x140045ad2
mov rax, qword [rsp + 0x30]
add rax, 8
mov rbx, rax
jmp 0x140045aa7
mov edx, 9
cmp dx, cx
ja 0x140045a9a
cmp cx, 0xd
jbe 0x140045ab4
mov edx, 0x20
cmp dx, cx
je 0x140045ab4
add rax, rbp
mov qword [rsp + 0x30], rax
movzx ecx, word [rax]
cmp cx, si
jne 0x140045a8a
mov word [rax], si
add qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x30]
call fcn.1400170fc
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x70], rcx
jmp 0x140045ad7
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
mov r12d, 1
cmp edi, eax
jne 0x140045b40
movzx eax, word [rcx + 2]
cmp edi, eax
jne 0x140045b40
add rcx, 4
lea rdx, [rsp + 0x30]
mov r8d, r12d
mov qword [rsp + 0x30], rcx
lea rcx, [0x140122924]
call fcn.140065d7c
cmp al, sil
je 0x140045b1d
mov edi, r12d
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
jmp 0x140045b96
add qword [rsp + 0x30], 4
lea rdx, [rsp + 0x30]
lea rcx, [0x140121f98]
mov r8d, r12d
call fcn.140065d7c
cmp al, sil
je 0x140045b81
mov edi, ebp
jmp 0x140045b11
lea rdx, [rsp + 0x70]
lea rcx, [0x14012291c]
mov r8d, 5
call fcn.140065d7c
cmp al, sil
je 0x140045b61
mov edi, r12d
jmp 0x140045b96
lea rdx, [rsp + 0x70]
lea rcx, str._sys
mov r8d, 4
call fcn.140065d7c
cmp al, sil
je 0x140045b81
mov edi, ebp
jmp 0x140045b96
lea rcx, str.UCallBackhWnd
call fcn.14001ad08
mov edi, esi
cmp rax, rsi
setne dil
mov qword [rsp + 0x38], rbx
cmp rbx, rsi
jne 0x140045bd3
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x38]
mov edx, 0x2c
mov qword [rsp + 0x38], rax
call fcn.1400e8c3c
mov rbx, qword [rsp + 0x38]
cmp word [rbx], si
je 0x140045bd3
mov word [rbx], si
mov rbx, qword [rsp + 0x38]
add rbx, rbp
mov qword [rsp + 0x38], rbx
cmp edi, esi
jne 0x140045be4
cmp word [rbx], si
je 0x140045be4
mov rcx, rbx
call fcn.14004596c
mov rbp, 0xffffffff80000002
lea r8, str.Shell.x
lea rdx, str.SOFTWAREPELOGON
mov rcx, rbp
call qword [0x14013d3f8]
xor edx, edx
xor ecx, ecx
call fcn.14003e758
mov rcx, qword [rsp + 0x70]
call fcn.140102490
mov r8, qword [0x14013a290]
cmp edi, r12d
lea ecx, [rax + rax]
lea rax, str.UShell
lea rdx, str.SOFTWAREPELOGON
mov dword [rsp + 0x28], ecx
cmove r8, rax
mov rax, qword [rsp + 0x70]
mov r9d, r12d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [0x14013d3f0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov ebx, eax
call fcn.14001b8d4
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
lea r8, str.SysShel.ack
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov rcx, rbp
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x80], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x88], 4
call qword [0x14013cd48]
cmp eax, esi
jne 0x140045cb7
cmp dword [rsp + 0x78], esi
jne 0x140045ce1
xor r9d, r9d
lea rcx, [0x14013d130]
xor r8d, r8d
lea edx, [r9 + 5]
call fcn.14001963c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1770
ja 0x140045cf8
jmp 0x140045c5d
lea rcx, [0x14013d130]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x96
call fcn.14001963c
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret