Function at 0x14006e4c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
mov r15, rcx
and qword [rbp - 8], rsi
lea rcx, str.kernel32.dll
and qword [rbp - 0x10], rsi
mov r14, r8
and qword [rbp + 0x48], rsi
mov r13, rdx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14006e5bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x94
or ebx, 0x80070000
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilxmlutil.cpp
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.failed_to_get_handle_to_kernel32.dll
mov edx, edi
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 0x38]
lea r8d, [rsi + 5]
mov dword [rsp + 0x20], ebx
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilxmlutil.cpp
call fcn.1400012b4
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14006e589
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14007f838]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006e59f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14007f838]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.IsWow64Process
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006e63b
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r12, r12
je 0x14006e639
test rdi, rdi
je 0x14006e639
test rax, rax
je 0x14006e639
lea rcx, [rbp - 8]
mov rax, r12
call qword [0x14007f838]
mov cl, 1
mov rax, rdi
call qword [0x14007f838]
movzx edi, al
jmp 0x14006e63b
xor edi, edi
xor edx, edx
lea rax, [rbp + 0x48]
lea r9, [0x14007fdc0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400b81b0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14006e694
lea rax, str.failed_to_create_XML_DOM_Document
mov edx, 0xad
mov r9d, 0x38
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilxmlutil.cpp
mov dword [rsp + 0x20], ebx
lea r8d, [r9 - 0x33]
call fcn.1400012b4
jmp 0x14006e74c
mov rcx, qword [0x1400b81b0]
cmp rcx, qword [0x14007fdb0]
mov rax, qword [0x1400b81b8]
jne 0x14006e6b4
cmp rax, qword [0x14007fdb8]
je 0x14006e6c6
cmp rcx, qword [0x14007fda0]
jne 0x14006e6d0
cmp rax, qword [0x14007fda8]
jne 0x14006e6d0
mov dword [0x1400b81c0], 1
test r15, r15
je 0x14006e72e
mov rcx, qword [rbp + 0x48]
lea r8, [rbp - 0x10]
mov rdx, r15
call fcn.14006e774
mov ebx, eax
test eax, eax
jns 0x14006e6fc
lea rax, str.failed_XmlCreateElement
mov edx, 0xb8
jmp 0x14006e670
mov rcx, qword [rbp + 0x48]
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
call qword [0x14007f838]
mov ebx, eax
test eax, eax
jns 0x14006e72e
lea rax, str.failed_appendChild
mov edx, 0xba
jmp 0x14006e670
mov rax, qword [rbp + 0x48]
and qword [rbp + 0x48], 0
mov qword [r13], rax
test r14, r14
je 0x14006e74c
mov rax, qword [rbp - 0x10]
and qword [rbp - 0x10], 0
mov qword [r14], rax
test edi, edi
je 0x14006e573
mov rcx, qword [rbp - 8]
mov rax, rsi
call qword [0x14007f838]
test eax, eax
jne 0x14006e573
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]