Function at 0x14002810c
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov dil, r8b
mov rsi, rcx
mov ebx, 0xea60
mov dword [rax + 8], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x80]
mov edx, ebx
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call qword [0x14004a4e8]
nop
and dword [rsp + 0x90], 0
lea rax, str.MpSampleSubmissionHighPriAgentLifeInMins
lea rbp, str.MpSampleSubmissionLowPriAgentLifeInMins
test dil, dil
cmovne rbp, rax
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x1400281db
lea rbx, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rbx
je 0x140028229
test byte [rcx + 0x1c], 4
je 0x140028229
mov edx, 0x1b
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rcx, qword [str.___a_]
jmp 0x140028229
lea rbx, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rbx
je 0x140028217
test byte [rcx + 0x1c], 1
je 0x140028217
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rcx, qword [str.___a_]
neg dil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x90], eax
imul r15d, dword [rsp + 0x90], 0xea60
cmp rcx, rbx
je 0x140028264
test byte [rcx + 0x1c], 4
je 0x140028264
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0x1d
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
mov edi, 0x1b7740
mov dword [rsp + 0x98], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rsp + 0x98]
mov edx, edi
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [0x14004a4e8]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov r13d, dword [rsp + 0x80]
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.14003bc2c
test al, al
je 0x14002833e
lea r12d, [r13 + 0x3a98]
mov edi, dword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebp
cmp r12d, ecx
ja 0x1400282ec
sub ebp, eax
cmp r12d, ebp
jbe 0x140028326
mov ecx, dword [rsi + 0x68]
test ecx, ecx
je 0x140028307
mov eax, r14d
sub eax, ecx
cmp edi, eax
ja 0x140028307
sub ecx, r14d
cmp edi, ecx
jbe 0x140028392
cmp dword [rsi + 0x60], 0
je 0x140028326
mov ecx, dword [rsi + 0x64]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x140028326
sub ecx, r14d
cmp r15d, ecx
jbe 0x1400283bc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov edx, r13d
mov rcx, qword [rsi + 0x38]
call fcn.14003bc2c
test al, al
jne 0x1400282cd
mov r9d, dword [rsi + 0x50]
test r9d, r9d
jns 0x140028381
mov ecx, r9d
call fcn.14003b7fc
test eax, eax
jne 0x140028381
call fcn.14003b7c8
test eax, eax
jne 0x140028381
mov rcx, qword [str.___a_]
cmp rcx, rbx
je 0x140028381
test byte [rcx + 0x1c], 1
je 0x140028381
lea edx, [rax + 0x1e]
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [str.___a_]
cmp rcx, rbx
je 0x1400283bc
test byte [rcx + 0x1c], 1
je 0x1400283bc
mov edx, 0x1f
mov r9d, edi
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
movabs r10, 0x8a7d2e8e7cdcab70
mov rax, qword [rax + 0x18]
call qword [0x14004a4e8]
mov edx, edi
mov rcx, qword [rsi + 0x38]
call fcn.14003acdc
test al, al
je 0x140028381
mov rcx, qword [str.___a_]
cmp rcx, rbx
je 0x140028414
test byte [rcx + 0x1c], 1
je 0x140028414
mov edx, 0x20
mov r9d, edi
lea r8, [0x140063168]
mov rcx, qword [rcx + 0x10]
call fcn.140002170
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140028381