Function at 0x140005bb8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400389e8]
xor ecx, ecx
mov qword [rbp - 9], rax
mov r14, rdx
mov rax, qword [0x1400389e0]
lea rdx, str.D:_A__GA___SY__A__GA___BA_
mov qword [rbp - 0x21], rcx
mov edi, ecx
mov qword [rbp - 0x29], rcx
mov r13d, ecx
mov r15d, ecx
mov qword [rbp + 0x7f], rcx
mov r12d, ecx
mov dword [rbp + 0x77], ecx
mov esi, ecx
mov qword [rbp - 1], rax
xorps xmm0, xmm0
lea rcx, [rbp - 0x21]
movdqu xmmword [rbp - 0x19], xmm0
call fcn.140010340
mov ebx, eax
test eax, eax
js 0x140005f21
lea rdx, str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
lea rcx, [rbp - 0x29]
call fcn.140010340
mov ebx, eax
test eax, eax
js 0x140005f21
mov rax, qword [rbp - 0x21]
lea r8, str.GlobalOfficeSourceEngine64Mutex
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
xor edx, edx
mov qword [rbp + 0xf], rax
mov dword [rbp + 7], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r15, rax
test rax, rax
jne 0x140005c95
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f21
mov edx, 0x2710
mov rcx, r15
call fcn.14001328c
mov ebx, eax
test eax, eax
js 0x140005f21
mov rax, qword [rbp - 0x29]
lea r9, str.GlobalOffice64SourceEngineRunning
and dword [rbp + 0x17], esi
lea rcx, [rbp + 7]
mov edi, 1
mov dword [rbp + 7], 0x18
mov edx, edi
mov qword [rbp + 0xf], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
test rax, rax
jne 0x140005cfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f21
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x140005d31
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f21
lea rdx, [0x140038ab8]
mov rcx, r12
call fcn.140002670
mov ebx, eax
test eax, eax
js 0x140005f21
lea r9, [0x140029fe8]
mov r8d, 2
lea rdx, [rbp - 9]
lea rcx, str.HeavyH2O_Source64Engine_V1_0
call fcn.1400145b0
mov ebx, eax
test eax, eax
js 0x140005f21
mov rax, qword [rbp + 0x67]
test rax, rax
je 0x140005db7
test r14, r14
je 0x140005db7
and dword [r14 + 0xc], esi
mov rdx, r14
mov rcx, rax
mov dword [r14 + 4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140005db7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f06
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, edi
mov ecx, edi
call fcn.140011198
mov ebx, eax
test eax, eax
js 0x140005f06
xor r9d, r9d
mov dword [rbp + 0x77], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x140005e15
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f06
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
jne 0x140005e60
and qword [rsp + 0x40], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
and qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20019
xor r8d, r8d
and dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005e83
lea rdx, [0x140038ae4]
call fcn.1400057f0
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbp - 0x19], r12
mov ebx, edi
mov dword [0x140038ae8], eax
test rsi, rsi
je 0x140005ea3
mov qword [rbp - 0x11], rsi
mov ebx, 2
mov r9d, 0xea60
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ecx, eax
cmp eax, 0xc0
je 0x140005ea3
cmp eax, 0x102
jne 0x140005fed
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [0x140038ac4], 0xea60
mov edx, eax
mov r8d, dword [0x140038ae8]
sub edx, r8d
cmp edx, ecx
jb 0x140005ea3
sub eax, r8d
lea rdx, str.Shutting_down__timed_out_after__d_ticks
mov r8d, eax
mov ecx, edi
call fcn.1400141a0
xor ebx, ebx
xor r8d, r8d
lea rcx, [rbp - 9]
lea edx, [r8 + 2]
call fcn.140014680
cmp dword [rbp + 0x77], 0
je 0x140005f21
call fcn.1400111c4
mov rcx, qword [0x140038ab8]
test rcx, rcx
je 0x140005f57
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, qword [0x140038ab8]
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [0x140038ab8], 0
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140005f66
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140005f74
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140005f82
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x140005f99
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140005fb4
test edi, edi
je 0x140005fab
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140005fc2
call fcn.140010418
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140005fd0
call fcn.140010418
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, 0xffffff7f
je 0x140005f04
test rsi, rsi
je 0x140005ea3
lea eax, [rbx - 1]
cmp eax, ecx
jne 0x140005ea3
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x140038ae4]
call fcn.1400057f0
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140005ea3