Function at 0x402a48
Capabilities:
Create thread
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov dword [rbp + 0x78], edx
mov dword [rbp - 8], 0
mov dword [rbp + 0x4c], 0
mov qword [rbp - 0x10], 0xffffffffffffffff
mov qword [rbp + 0x40], 0
lea rcx, str.Kernel32
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x3c], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 0x10]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1f0fff
mov r9, rax
mov r8, rbx
mov rdx, qword [rbp + 0x70]
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
mov dword [rbp + 0x2c], eax
cmp dword [rbp + 0x2c], 0
je 0x402aef
mov rax, qword [rbp - 0x10]
jmp 0x402af3
mov rax, qword [rbp + 0x70]
lea rdx, [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
test eax, eax
je 0x402ce0
mov eax, dword [rbp - 8]
cmp eax, 0x103
jne 0x402ce0
mov rax, qword [rbp + 0x30]
lea rdx, str.ExitProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20], rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
cmp dword [rbp + 0x2c], 0
je 0x402b4e
mov rax, qword [rbp - 0x10]
jmp 0x402b52
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp - 4]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
jne 0x402ce9
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x4c], eax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov edx, dword [rbp + 0x78]
cmp dword [rbp + 0x2c], 0
je 0x402bc2
mov rax, qword [rbp - 0x10]
jmp 0x402bc6
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
test eax, eax
jne 0x402ce9
lea rdx, [0x00408070]
lea rcx, str.C:Program_Fileslithik_binlithik_rpc.log
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
je 0x402ce9
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_fclose
cmp qword [rbp + 0x18], 0
je 0x402ce9
lea rdx, [0x004080a3]
lea rcx, str.C:Program_Fileslithik_binlithik_rpc.log
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
movzx eax, word [rbp - 0x12]
movzx r10d, ax
movzx eax, word [rbp - 0x14]
movzx r9d, ax
movzx eax, word [rbp - 0x16]
movzx r8d, ax
movzx eax, word [rbp - 0x18]
movzx ecx, ax
movzx eax, word [rbp - 0x1a]
movzx edx, ax
movzx eax, word [rbp - 0x1e]
movzx ebx, ax
movzx eax, word [rbp - 0x20]
movzx r11d, ax
mov rax, qword [rbp + 0x10]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, ebx
mov r8d, r11d
lea rdx, str._04d__02d__02d__02d:_02d:_02d._03d
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov rcx, qword [rbp + 0x70]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessId]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov r9d, ebx
mov r8d, edx
lea rdx, str.SafeTerminateProcess_unable_to_terminate_PID__lu_with_TerminateProcess__error_0x_08lX_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x402ce9
mov dword [rbp + 0x3c], 1
jmp 0x402cea
nop
cmp qword [rbp + 0x40], 0
je 0x402ecc
mov dword [rbp - 8], 0
cmp dword [rbp + 0x2c], 0
je 0x402d08
mov rax, qword [rbp - 0x10]
jmp 0x402d0c
mov rax, qword [rbp + 0x70]
lea rdx, [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
test eax, eax
je 0x402ec5
mov eax, dword [rbp - 8]
cmp eax, 0x103
jne 0x402ec5
cmp dword [rbp + 0x2c], 0
je 0x402d3e
mov rax, qword [rbp - 0x10]
jmp 0x402d42
mov rax, qword [rbp + 0x70]
mov edx, 0x2710
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0x102
jne 0x402eac
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov edx, dword [rbp + 0x78]
cmp dword [rbp + 0x2c], 0
je 0x402d81
mov rax, qword [rbp - 0x10]
jmp 0x402d85
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
test eax, eax
jne 0x402eac
lea rdx, [0x00408070]
lea rcx, str.C:Program_Fileslithik_binlithik_rpc.log
call sub.msvcrt.dll_fopen
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x402eac
mov rax, qword [rbp + 8]
mov rcx, rax
call sub.msvcrt.dll_fclose
cmp qword [rbp + 8], 0
je 0x402eac
lea rdx, [0x004080a3]
lea rcx, str.C:Program_Fileslithik_binlithik_rpc.log
call sub.msvcrt.dll_fopen
mov qword [rbp], rax
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
movzx eax, word [rbp - 0x22]
movzx r10d, ax
movzx eax, word [rbp - 0x24]
movzx r9d, ax
movzx eax, word [rbp - 0x26]
movzx r8d, ax
movzx eax, word [rbp - 0x28]
movzx ecx, ax
movzx eax, word [rbp - 0x2a]
movzx edx, ax
movzx eax, word [rbp - 0x2e]
movzx ebx, ax
movzx eax, word [rbp - 0x30]
movzx r11d, ax
mov rax, qword [rbp]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, ebx
mov r8d, r11d
lea rdx, str._04d__02d__02d__02d:_02d:_02d._03d
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
cmp dword [rbp + 0x2c], 0
je 0x402e75
mov rax, qword [rbp - 0x10]
jmp 0x402e79
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessId]
call rax
mov edx, eax
mov rax, qword [rbp]
mov r9d, ebx
mov r8d, edx
lea rdx, str.SafeTerminateProcess_unable_to_terminate_timed_out_PID__lu_with_TerminateProcess__error_0x_08lX_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [rbp]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp + 0x3c], 1
jmp 0x402ecc
mov dword [rbp + 0x3c], 1
cmp dword [rbp + 0x2c], 0
je 0x402ee2
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x3c], 0
jne 0x402ef6
mov eax, dword [rbp + 0x4c]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov eax, dword [rbp + 0x3c]
add rsp, 0xd8
pop rbx
pop rbp
ret