Function at 0x14007afb8
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov sil, r8b
mov r14, rcx
mov r15d, 0xea60
mov dword [rsp + 0x70], r15d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x70]
mov edx, r15d
lea rcx, str.MpService_SampleHeaderServiceWaitTimeout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
js 0x14007b00d
mov r15d, dword [rsp + 0x70]
and dword [rsp + 0x80], 0
lea rax, str.MpSampleSubmissionLowPriAgentLifeInMins
lea rdi, str.MpSampleSubmissionHighPriAgentLifeInMins
test sil, sil
cmove rdi, rax
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpQueryEngineConfigDword]
test eax, eax
js 0x14007b088
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14007b0d6
test byte [rcx + 0x1c], 4
je 0x14007b0d6
mov edx, 0x1b
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x14013f120]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov rcx, qword [0x14016d280]
jmp 0x14007b0d6
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14007b0c4
test byte [rcx + 0x1c], 1
je 0x14007b0c4
mov edx, 0x1c
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x14013f120]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov rcx, qword [0x14016d280]
neg sil
sbb eax, eax
and eax, 0x14
add eax, 0xa
mov dword [rsp + 0x80], eax
imul r12d, dword [rsp + 0x80], 0xea60
cmp rcx, rbx
je 0x14007b111
test byte [rcx + 0x1c], 4
je 0x14007b111
mov eax, 0x10624dd3
mul r12d
mov r9d, edx
shr r9d, 6
mov edx, 0x1d
lea r8, [0x14013f120]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edi, 0x1b7740
mov dword [rsp + 0x70], edi
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0x70]
mov edx, edi
lea rcx, str.MpService_SampleHeaderServiceBusyTimout
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
js 0x14007b143
mov edi, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r15d
mov rcx, qword [r14 + 0x38]
call fcn.1400faddc
test al, al
je 0x14007b1d1
lea r13d, [r15 + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp r13d, ecx
ja 0x14007b180
sub esi, eax
cmp r13d, esi
jbe 0x14007b1b9
mov ecx, dword [r14 + 0x68]
test ecx, ecx
je 0x14007b19a
mov eax, ebp
sub eax, ecx
cmp edi, eax
ja 0x14007b19a
sub ecx, ebp
cmp edi, ecx
jbe 0x14007b22d
cmp dword [r14 + 0x60], 0
je 0x14007b1b9
mov ecx, dword [r14 + 0x64]
mov eax, ebp
sub eax, ecx
cmp r12d, eax
ja 0x14007b1b9
sub ecx, ebp
cmp r12d, ecx
jbe 0x14007b257
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov edx, r15d
mov rcx, qword [r14 + 0x38]
call fcn.1400faddc
test al, al
jne 0x14007b162
mov ecx, dword [r14 + 0x50]
test ecx, ecx
jns 0x14007b215
call fcn.1400fa0a8
test eax, eax
jne 0x14007b215
call fcn.1400fa0d4
test eax, eax
jne 0x14007b215
mov rax, qword [0x14016d280]
cmp rax, rbx
je 0x14007b215
test byte [rax + 0x1c], 1
je 0x14007b215
mov edx, 0x1e
mov r9d, ecx
lea r8, [0x14013f120]
mov rcx, qword [rax + 0x10]
call fcn.140044380
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14007b257
test byte [rcx + 0x1c], 1
je 0x14007b257
mov edx, 0x1f
mov r9d, edi
lea r8, [0x14013f120]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov edx, edi
mov rcx, qword [r14 + 0x38]
call fcn.1400fe9a8
test al, al
je 0x14007b215
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14007b2a1
test byte [rcx + 0x1c], 1
je 0x14007b2a1
mov edx, 0x20
mov r9d, edi
lea r8, [0x14013f120]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14007b215