Function at 0x14006d5ec
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov bl, r8b
mov rdi, rcx
mov esi, 0xea60
mov dword [rbp + 0x40], esi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x40]
mov edx, esi
lea rcx, str.MpService_SpyNetServiceWaitTimout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
test bl, bl
jne 0x14006d68a
xor edx, edx
mov ecx, 0xa0000
call fcn.14007c6b8
test eax, eax
jns 0x14006d68a
mov ebx, 0x927c0
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
jmp 0x14006d6bd
mov ebx, 0x5265c00
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceLifeTimout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
mov r15d, dword [rbp + 0x50]
lea r14, str.8__r_
mov rcx, qword [str.8__r_]
cmp rcx, r14
je 0x14006d6fe
test byte [rcx + 0x1c], 4
je 0x14006d6fe
mov eax, 0x10624dd3
mul r15d
mov r9d, edx
shr r9d, 6
mov edx, 0xa
lea r8, [0x1400bce58]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
mov ebx, 0x1b7740
mov dword [rbp + 0x50], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
movabs r10, 0xb1e1875a16511370
lea r8, [rbp + 0x50]
mov edx, ebx
lea rcx, str.MpService_SpyNetServiceBusyTimout
mov rax, qword [rax + 0xa0]
call qword [0x14009aae8]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov r13d, dword [rbp + 0x40]
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400799fc
test al, al
je 0x14006d7d3
lea r12d, [r13 + 0x3a98]
mov ebx, dword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp r12d, ecx
ja 0x14006d77a
sub esi, eax
cmp r12d, esi
jbe 0x14006d7b4
mov ecx, dword [rdi + 0x78]
test ecx, ecx
je 0x14006d795
mov eax, r14d
sub eax, ecx
cmp ebx, eax
ja 0x14006d795
sub ecx, r14d
cmp ebx, ecx
jbe 0x14006d842
cmp dword [rdi + 0x70], 0
je 0x14006d7b4
mov ecx, dword [rdi + 0x74]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
ja 0x14006d7b4
sub ecx, r14d
cmp r15d, ecx
jbe 0x14006d875
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r13d
mov rcx, qword [rdi + 0x38]
call fcn.1400799fc
test al, al
jne 0x14006d75b
lea r14, str.8__r_
mov ecx, dword [rdi + 0x60]
test ecx, ecx
jns 0x14006d82d
cmp ecx, 0x80070008
je 0x14006d82d
cmp ecx, 0x8007000e
je 0x14006d82d
cmp ecx, 0x800705aa
je 0x14006d82d
cmp ecx, 0x8077ffff
je 0x14006d82d
call fcn.14007988c
test eax, eax
jne 0x14006d82d
mov rax, qword [str.8__r_]
cmp rax, r14
je 0x14006d82d
test byte [rax + 0x1c], 1
je 0x14006d82d
mov edx, 0xb
mov r9d, ecx
lea r8, [0x1400bce58]
mov rcx, qword [rax + 0x10]
call fcn.140003d18
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [str.8__r_]
lea rsi, str.8__r_
cmp rcx, rsi
je 0x14006d87c
test byte [rcx + 0x1c], 1
je 0x14006d87c
mov edx, 0xc
mov r9d, ebx
lea r8, [0x1400bce58]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
jmp 0x14006d87c
lea rsi, str.8__r_
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
movabs r10, 0x8a8d371252de0b70
mov rax, qword [rax + 0x18]
call qword [0x14009aae8]
mov edx, ebx
mov rcx, qword [rdi + 0x38]
call fcn.14007c84c
test al, al
je 0x14006d82d
mov rcx, qword [str.8__r_]
cmp rcx, rsi
je 0x14006d8d0
test byte [rcx + 0x1c], 1
je 0x14006d8d0
mov edx, 0xd
mov r9d, ebx
lea r8, [0x1400bce58]
mov rcx, qword [rcx + 0x10]
call fcn.140003d18
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14006d82d