Function at 0x180017114
Capabilities:
Check for time delay via gettickcount
Check if file exists
Link function at runtime on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rcx
xor esi, esi
mov dword [rsp + 0x28], esi
cmp qword [rcx + 0x28], rsi
je 0x18001716b
lea eax, [rsi + 1]
jmp 0x1800174ca
xor eax, eax
lea r12d, [rax + 1]
lock cmpxchg dword [rcx + 0x48], r12d
je 0x1800171b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [r14 + 0x4c]
test eax, eax
jne 0x1800171a9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
jae 0x1800171a9
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [r14 + 0x4c]
test ecx, ecx
je 0x180017189
cmp qword [r14 + 0x28], rsi
setne sil
mov eax, esi
jmp 0x1800174ca
mov word [rsp + 0x60], si
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [0x180169370]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r13, [r14 + 8]
mov rcx, qword [r13]
or ebx, 0xffffffff
cmp dword [rcx - 0x10], esi
jl 0x1800171fa
lea rdx, [0x18008c460]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov r15, rax
test rax, rax
jne 0x1800171ff
mov r15d, ebx
jmp 0x180017206
sub r15, qword [r13]
sar r15, 1
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x180017505
mov rax, qword [rax]
call qword [rax + ILCombine]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x1800174fa
mov rax, qword [rax]
call qword [rax + ILCombine]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
test r15d, r15d
jle 0x1800172f5
mov r8d, r15d
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.180017698
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.18000525c
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18001728d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8d, [r15 + 2]
mov rax, qword [r13]
mov r9d, dword [rax - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.180004a00
mov dword [rsp + 0x28], r12d
mov rdx, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.180017570
and r12d, 0xfffffffe
mov dword [rsp + 0x28], r12d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1800172e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
jmp 0x1800172f9
or r15d, 0xffffffff
lea rcx, [rsp + 0x60]
cmp dword [rdi - 0x10], esi
jne 0x1800173cf
lea rdx, str...deepscancloudcom264.dll
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x18001732c
call rax
jmp 0x180017332
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001742e
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [0x180169370]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str...cloudcom264.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x18001737c
call rax
jmp 0x180017382
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001742e
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1800173a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1800173c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1800174ca
lea rdx, [0x18008c4c8]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x180017402
call rax
jmp 0x180017408
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001742e
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x180017429
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1800173a7
lea rcx, [rsp + 0x60]
call fcn.180065f9c
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180017463
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x18001745e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1800173a7
mov rcx, rax
cmp dword [rbx - 0x10], esi
lea rdx, [0x18008c528]
je 0x180017475
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r14 + 0x18], rax
mov rcx, r14
call fcn.180017014
mov edi, eax
lea rdx, [rbx - 0x18]
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x1800174a7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1800174c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000a540
nop
mov ecx, 0x80004005
call fcn.18000a540
int3