Function at 0x14006e50c
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x58], 0
lea rcx, [rbp + 0x58]
call fcn.140055b88
mov ebx, eax
test eax, eax
jns 0x14006e587
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e563
test byte [rcx + 0x1c], 1
je 0x14006e563
mov edx, 0xa
mov r9d, eax
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetSupportDir___failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14006e580
call fcn.140030c60
mov eax, ebx
jmp 0x14006ec4b
and qword [rbp + 0x50], 0
lea rsi, str.FltmcInfo.txt
mov r9, rsi
mov rbx, qword [rbp + 0x58]
mov r8, rbx
lea rdx, [0x140123d80]
lea rcx, [rbp + 0x50]
call fcn.1400f23a4
mov edi, eax
test eax, eax
jns 0x14006e626
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e5ed
test byte [rcx + 0x1c], 1
je 0x14006e5ed
mov edx, 0xb
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.14006041c
mov r9d, edi
mov r8, rsi
mov rdx, rbx
lea rcx, [0x1401245d0]
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14006e612
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e61f
mov rcx, rbx
call fcn.140030c60
mov eax, edi
jmp 0x14006ec4b
and qword [rbp - 0x10], 0
lea rsi, [0x140132658]
mov r8, rsi
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1400f5658
mov edi, eax
test eax, eax
jns 0x14006e6aa
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e680
test byte [rcx + 0x1c], 1
je 0x14006e680
mov edx, 0xc
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, edi
mov rdx, rsi
lea rcx, str.ERROR:_UtilGetSystemPath__ls__failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14006e603
call fcn.140030c60
jmp 0x14006e603
mov rdi, qword [rbp - 0x10]
mov rcx, rdi
call fcn.1400cac9c
mov esi, eax
test eax, eax
jns 0x14006e735
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e6f1
test byte [rcx + 0x1c], 1
je 0x14006e6f1
mov edx, 0xd
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, rdi
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__failed___lx__n
call fcn.1400ec5f0
nop
test rdi, rdi
je 0x14006e712
mov rcx, rdi
call fcn.140030c60
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14006e721
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e72e
mov rcx, rbx
call fcn.140030c60
mov eax, esi
jmp 0x14006ec4b
and qword [rbp - 8], 0
lea r14, str.fltmc.exe
mov r8, r14
lea rdx, [rbp - 8]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1400f5658
mov esi, eax
test eax, eax
jns 0x14006e7b9
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e78f
test byte [rcx + 0x1c], 1
je 0x14006e78f
mov edx, 0xe
mov dword [rsp + 0x20], eax
mov r9, r14
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, r14
lea rcx, str.ERROR:_UtilGetSystemPath__ls__failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14006e704
call fcn.140030c60
jmp 0x14006e704
mov rsi, qword [rbp - 8]
mov rcx, rsi
call fcn.1400cac9c
mov r14d, eax
test eax, eax
jns 0x14006e858
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e805
test byte [rcx + 0x1c], 1
je 0x14006e805
mov edx, 0xf
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r14d
mov rdx, rsi
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__failed___lx__n
call fcn.1400ec5f0
nop
test rsi, rsi
je 0x14006e826
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e834
mov rcx, rdi
call fcn.140030c60
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14006e843
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e850
mov rcx, rbx
call fcn.140030c60
mov eax, r14d
jmp 0x14006ec4b
mov r14, qword [rbp + 0x50]
mov rcx, r14
call fcn.1400edec0
mov r15d, eax
cmp eax, 0x80070001
jle 0x14006ebc8
lea ecx, [rax + 0x7ff8fffc]
cmp ecx, 0x7ff8fffb
jbe 0x14006ebc8
and qword [rbp + 0x50], 0
mov r9, r14
mov r8, rsi
lea rdx, str._C__ls_____ls_
lea rcx, [rbp + 0x50]
call fcn.1400f23a4
mov r15d, eax
test eax, eax
jns 0x14006e90c
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e8e0
test byte [rcx + 0x1c], 1
je 0x14006e8e0
mov edx, 0x11
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9, rsi
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.14006041c
mov r9d, r15d
mov r8, r14
mov rdx, rsi
lea rcx, [0x1401245d0]
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14006ec11
call fcn.140030c60
jmp 0x14006ec11
and qword [rbp + 0x48], 0
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r15, qword [rbp + 0x50]
mov rdx, r15
lea rcx, [rbp + 0x48]
call fcn.1400fb0ec
mov r12d, eax
test eax, eax
jns 0x14006e9e2
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e974
test byte [rcx + 0x1c], 1
je 0x14006e974
mov edx, 0x12
mov dword [rsp + 0x20], eax
mov r9, r15
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r12d
mov rdx, r15
lea rcx, str.ERROR:_UtilCreateProcess__ls__failed___lx__n
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006e995
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14006e9a3
mov rcx, r15
call fcn.140030c60
nop
test rsi, rsi
je 0x14006e9b1
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e9bf
mov rcx, rdi
call fcn.140030c60
nop
test r14, r14
je 0x14006e9cd
mov rcx, r14
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e9da
mov rcx, rbx
call fcn.140030c60
mov eax, r12d
jmp 0x14006ec4b
mov edx, 0x124f80
mov rcx, qword [rbp + 0x48]
call fcn.1400f1e80
test al, al
je 0x14006ea56
lea rdx, [0x140162280]
mov r12d, 0x800705b4
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006ea30
test byte [rcx + 0x1c], 1
je 0x14006ea30
mov edx, 0x13
mov dword [rsp + 0x20], r12d
mov r9, r15
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r12d
mov rdx, r15
lea rcx, str.ERROR:_UtilCreateProcess__ls__time_out___lx__n
call fcn.1400ec5f0
mov edx, 0x5b4
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14006e986
and dword [rbp + 0x40], 0
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14006eab9
call fcn.1400f259c
mov r12d, eax
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006eaa5
test byte [rcx + 0x1c], 1
je 0x14006eaa5
mov edx, 0x14
mov r9d, eax
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, r12d
lea rcx, str.ERROR:_GetExitCodeProcess_failed___lx__n
call fcn.1400ec5f0
jmp 0x14006e986
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x14006eb6d
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006eb00
test byte [rcx + 0x1c], 1
je 0x14006eb00
mov edx, 0x15
mov dword [rsp + 0x20], r8d
mov r9, r15
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, dword [rbp + 0x40]
mov rdx, r15
lea rcx, str.ERROR:_UtilCreateProcess__ls__exits_with_code__lu__n
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006eb1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14006eb2c
mov rcx, r15
call fcn.140030c60
nop
test rsi, rsi
je 0x14006eb3a
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006eb48
mov rcx, rdi
call fcn.140030c60
nop
test r14, r14
je 0x14006eb56
mov rcx, r14
call fcn.140030c60
nop
test rbx, rbx
je 0x14006eb63
mov rcx, rbx
call fcn.140030c60
mov eax, 0x80004005
jmp 0x14006ec4b
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006eb7c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14006eb8a
mov rcx, r15
call fcn.140030c60
nop
test rsi, rsi
je 0x14006eb98
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006eba6
mov rcx, rdi
call fcn.140030c60
nop
test r14, r14
je 0x14006ebb4
mov rcx, r14
call fcn.140030c60
nop
test rbx, rbx
je 0x14006ebc1
mov rcx, rbx
call fcn.140030c60
xor eax, eax
jmp 0x14006ec4b
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006ebfe
test byte [rcx + 0x1c], 1
je 0x14006ebfe
mov edx, 0x10
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140132f10]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r15d
mov rdx, r14
lea rcx, str.ERROR:_UtilDeletePathSafe__ls__failed___lx__n
call fcn.1400ec5f0
nop
test rsi, rsi
je 0x14006ec1f
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006ec2d
mov rcx, rdi
call fcn.140030c60
nop
test r14, r14
je 0x14006ec3b
mov rcx, r14
call fcn.140030c60
nop
test rbx, rbx
je 0x14006ec48
mov rcx, rbx
call fcn.140030c60
mov eax, r15d
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret