Function at 0x14006df28
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
and qword [rbp + 0x48], 0
lea rcx, [rbp + 0x48]
call fcn.140055b88
mov ebx, eax
test eax, eax
jns 0x14006dfa1
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006df7d
test byte [rcx + 0x1c], 1
je 0x14006df7d
mov edx, 0x1e
mov r9d, eax
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetSupportDir___failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006df9a
call fcn.140030c60
mov eax, ebx
jmp 0x14006e4fe
and qword [rbp + 0x50], 0
lea rsi, str.WindowsProxyInfo.txt
mov r9, rsi
mov rbx, qword [rbp + 0x48]
mov r8, rbx
lea rdx, [0x140123d80]
lea rcx, [rbp + 0x50]
call fcn.1400f23a4
mov edi, eax
test eax, eax
jns 0x14006e040
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e007
test byte [rcx + 0x1c], 1
je 0x14006e007
mov edx, 0x1f
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.14006041c
mov r9d, edi
mov r8, rsi
mov rdx, rbx
lea rcx, [0x1401245d0]
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14006e02c
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e039
mov rcx, rbx
call fcn.140030c60
mov eax, edi
jmp 0x14006e4fe
mov rdi, qword [rbp + 0x50]
mov rcx, rdi
call fcn.1400edec0
mov esi, eax
cmp eax, 0x80070001
jle 0x14006e499
lea ecx, [rax + 0x7ff8fffc]
cmp ecx, 0x7ff8fffb
jbe 0x14006e499
and qword [rbp - 0x18], 0
lea r14, [0x140132658]
mov r8, r14
lea rdx, [rbp - 0x18]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.1400f5658
mov esi, eax
test eax, eax
jns 0x14006e0ef
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e0c5
test byte [rcx + 0x1c], 1
je 0x14006e0c5
mov edx, 0x21
mov dword [rsp + 0x20], eax
mov r9, r14
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, r14
lea rcx, str.ERROR:_UtilGetSystemPath__ls__failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14006e4e1
call fcn.140030c60
jmp 0x14006e4e1
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call fcn.1400cac9c
mov r14d, eax
test eax, eax
jns 0x14006e17b
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e137
test byte [rcx + 0x1c], 1
je 0x14006e137
mov edx, 0x22
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r14d
mov rdx, rsi
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__failed___lx__n
call fcn.1400ec5f0
nop
test rsi, rsi
je 0x14006e158
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e166
mov rcx, rdi
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e173
mov rcx, rbx
call fcn.140030c60
mov eax, r14d
jmp 0x14006e4fe
and qword [rbp + 0x48], 0
mov r9, rdi
lea r15, str.netsh_winhttp_show_proxy
mov r8, r15
lea rdx, str._c__ls_____ls_
lea rcx, [rbp + 0x48]
call fcn.1400f23a4
mov r14d, eax
test eax, eax
jns 0x14006e20a
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e1de
test byte [rcx + 0x1c], 1
je 0x14006e1de
mov edx, 0x23
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9, r15
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.14006041c
mov r9d, r14d
mov r8, rdi
mov rdx, r15
lea rcx, [0x1401245d0]
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14006e14a
call fcn.140030c60
jmp 0x14006e14a
and qword [rbp + 0x40], 0
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r14, qword [rbp + 0x48]
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.1400fb0ec
mov r15d, eax
test eax, eax
jns 0x14006e2d2
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e272
test byte [rcx + 0x1c], 1
je 0x14006e272
mov edx, 0x24
mov dword [rsp + 0x20], eax
mov r9, r14
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r15d
mov rdx, r14
lea rcx, str.ERROR:_UtilCreateProcess__ls__failed___lx__n
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14006e293
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14006e2a1
mov rcx, r14
call fcn.140030c60
nop
test rsi, rsi
je 0x14006e2af
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e2bd
mov rcx, rdi
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e2ca
mov rcx, rbx
call fcn.140030c60
mov eax, r15d
jmp 0x14006e4fe
mov edx, 0x1d4c0
mov rcx, qword [rbp + 0x40]
call fcn.1400f1e80
test al, al
je 0x14006e346
lea rdx, [0x140162280]
mov r15d, 0x800705b4
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e320
test byte [rcx + 0x1c], 1
je 0x14006e320
mov edx, 0x25
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, r15d
mov rdx, r14
lea rcx, str.ERROR:_UtilCreateProcess__ls__time_out___lx__n
call fcn.1400ec5f0
mov edx, 0x5b4
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14006e284
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14006e3a9
call fcn.1400f259c
mov r15d, eax
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e395
test byte [rcx + 0x1c], 1
je 0x14006e395
mov edx, 0x26
mov r9d, eax
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, r15d
lea rcx, str.ERROR:_GetExitCodeProcess_failed___lx__n
call fcn.1400ec5f0
jmp 0x14006e284
mov r8d, dword [rbp + 0x38]
test r8d, r8d
je 0x14006e44f
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e3f0
test byte [rcx + 0x1c], 1
je 0x14006e3f0
mov edx, 0x27
mov dword [rsp + 0x20], r8d
mov r9, r14
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, dword [rbp + 0x38]
mov rdx, r14
lea rcx, str.ERROR:_UtilCreateProcess__ls__exits_with_code__lu__n
call fcn.1400ec5f0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14006e40e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14006e41c
mov rcx, r14
call fcn.140030c60
nop
test rsi, rsi
je 0x14006e42a
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e438
mov rcx, rdi
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e445
mov rcx, rbx
call fcn.140030c60
mov eax, 0x80004005
jmp 0x14006e4fe
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14006e45e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14006e46c
mov rcx, r14
call fcn.140030c60
nop
test rsi, rsi
je 0x14006e47a
mov rcx, rsi
call fcn.140030c60
nop
test rdi, rdi
je 0x14006e488
mov rcx, rdi
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e495
mov rcx, rbx
call fcn.140030c60
xor eax, eax
jmp 0x14006e4fe
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x14006e4ce
test byte [rcx + 0x1c], 1
je 0x14006e4ce
mov edx, 0x20
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140132ec8]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, rdi
lea rcx, str.ERROR:_UtilDeletePathSafe__ls__failed___lx__n
call fcn.1400ec5f0
nop
test rdi, rdi
je 0x14006e4ef
mov rcx, rdi
call fcn.140030c60
nop
test rbx, rbx
je 0x14006e4fc
mov rcx, rbx
call fcn.140030c60
mov eax, esi
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret