Function at 0x14002ddb0
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
mov rbp, rsp
sub rsp, 0x68
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
call fcn.1400133d4
mov r13d, eax
test eax, eax
jns 0x14002de1a
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002de06
test byte [rcx + 0x1c], 1
je 0x14002de06
mov edx, 0xa
mov r9d, r13d
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400059f4
mov edx, r13d
lea rcx, str.ERROR:_GetSupportDir___failed___lx__n
call fcn.1400ae8a0
jmp 0x14002e2f8
and qword [rbp + 0x50], 0
lea rbx, [0x14012d210]
mov r9, rbx
mov r8, qword [rbp + 0x40]
lea rdx, [0x14011f890]
lea rcx, [rbp + 0x50]
call fcn.1400b4ccc
mov r13d, eax
mov rsi, qword [rbp + 0x50]
test eax, eax
jns 0x14002de9f
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002de84
test byte [rcx + 0x1c], 1
je 0x14002de84
mov edx, 0xb
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp + 0x40]
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400131d8
mov r9d, r13d
mov r8, rbx
mov rdx, qword [rbp + 0x40]
lea rcx, [0x1401200e0]
call fcn.1400ae8a0
jmp 0x14002e2ea
and qword [rbp - 0x18], 0
lea rbx, str.Cmd.exe
mov r8, rbx
lea rdx, [rbp - 0x18]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1400b71fc
mov r13d, eax
mov r14, qword [rbp - 0x18]
test eax, eax
jns 0x14002df0b
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002deff
test byte [rcx + 0x1c], 1
je 0x14002deff
mov edx, 0xc
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rdx, rbx
lea rcx, str.ERROR:_UtilGetSystemPath__ls__failed___lx__n
jmp 0x14002df5a
mov rcx, r14
call fcn.14008bfec
mov r13d, eax
test eax, eax
jns 0x14002df67
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002df50
test byte [rcx + 0x1c], 1
je 0x14002df50
mov edx, 0xd
mov dword [rsp + 0x20], r13d
mov r9, r14
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rdx, r14
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__failed___lx__n
mov r8d, r13d
call fcn.1400ae8a0
jmp 0x14002e2dc
and qword [rbp - 0x10], 0
lea rbx, str.SystemInfo.exe
mov r8, rbx
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1400b71fc
mov r13d, eax
mov rdi, qword [rbp - 0x10]
test eax, eax
jns 0x14002dfd6
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002dfc7
test byte [rcx + 0x1c], 1
je 0x14002dfc7
mov edx, 0xe
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rdx, rbx
lea rcx, str.ERROR:_UtilGetSystemPath__ls__failed___lx__n
jmp 0x14002e080
mov rcx, rdi
call fcn.14008bfec
mov r13d, eax
test eax, eax
jns 0x14002e027
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e01b
test byte [rcx + 0x1c], 1
je 0x14002e01b
mov edx, 0xf
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rdx, rdi
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__failed___lx__n
jmp 0x14002e080
mov rcx, rsi
call fcn.1400afeb0
mov r13d, eax
test eax, eax
jns 0x14002e08d
add eax, 0x7ff8fffe
cmp eax, 1
jbe 0x14002e08d
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e076
test byte [rcx + 0x1c], 1
je 0x14002e076
mov edx, 0x10
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov rdx, rsi
lea rcx, str.ERROR:_UtilDeletePathSafe__ls__failed___lx__n
mov r8d, r13d
call fcn.1400ae8a0
jmp 0x14002e2ce
and qword [rbp + 0x50], 0
mov r9, rsi
mov r8, rdi
lea rdx, str._C__ls_____ls_
lea rcx, [rbp + 0x50]
call fcn.1400b4ccc
mov r13d, eax
mov rbx, qword [rbp + 0x50]
test eax, eax
jns 0x14002e108
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e0ee
test byte [rcx + 0x1c], 1
je 0x14002e0ee
mov edx, 0x11
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400131d8
mov r9d, r13d
mov r8, rsi
mov rdx, rdi
lea rcx, [0x1401200e0]
call fcn.1400ae8a0
jmp 0x14002e2c0
and qword [rbp + 0x48], 0
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.1400bd49c
mov r13d, eax
test eax, eax
jns 0x14002e180
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e169
test byte [rcx + 0x1c], 1
je 0x14002e169
mov edx, 0x12
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov r8d, r13d
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__failed___lx__n
call fcn.1400ae8a0
jmp 0x14002e2b1
mov edx, 0x124f80
mov rcx, qword [rbp + 0x48]
call fcn.1400b401c
test al, al
je 0x14002e1f4
lea rax, [0x140158280]
mov r13d, 0x800705b4
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e1ce
test byte [rcx + 0x1c], 1
je 0x14002e1ce
mov edx, 0x13
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov r8d, r13d
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__time_out___lx__n
call fcn.1400ae8a0
mov edx, 0x5b4
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14002e2b1
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14002e254
call fcn.1400b4f5c
mov r13d, eax
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e243
test byte [rcx + 0x1c], 1
je 0x14002e243
mov edx, 0x14
mov r9d, r13d
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400059f4
mov edx, r13d
lea rcx, str.ERROR:_GetExitCodeProcess_failed___lx__n
call fcn.1400ae8a0
jmp 0x14002e2b1
mov r8d, dword [rbp + 0x38]
test r8d, r8d
je 0x14002e2ae
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x14002e297
test byte [rcx + 0x1c], 1
je 0x14002e297
mov edx, 0x15
mov dword [rsp + 0x20], r8d
mov r9, rbx
lea r8, [0x14012d9f0]
mov rcx, qword [rcx + 0x10]
call fcn.1400055d0
mov r8d, dword [rbp + 0x38]
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__exits_with_code__lu__n
call fcn.1400ae8a0
mov r13d, 0x80004005
jmp 0x14002e2b1
xor r13d, r13d
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14002e2c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14002e2ce
mov rcx, rbx
call fcn.1400e9470
nop
test rdi, rdi
je 0x14002e2dc
mov rcx, rdi
call fcn.1400e9470
nop
test r14, r14
je 0x14002e2ea
mov rcx, r14
call fcn.1400e9470
nop
test rsi, rsi
je 0x14002e2f8
mov rcx, rsi
call fcn.1400e9470
nop
cmp qword [rbp + 0x40], 0
je 0x14002e308
mov rcx, qword [rbp + 0x40]
call fcn.1400e9470
mov eax, r13d
add rsp, 0x68
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret