Function at 0x140020ad8
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
mov rbp, rsp
sub rsp, 0x68
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
call fcn.14000d798
mov r13d, eax
test eax, eax
jns 0x140020b42
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020b2e
test byte [rcx + 0x1c], 1
je 0x140020b2e
mov edx, 0xa
mov r9d, r13d
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, r13d
lea rcx, str.ERROR:_GetSupportDir___failed___X__n
call fcn.140006cb0
jmp 0x14002101f
and qword [rbp + 0x50], 0
lea rbx, [0x140061510]
mov r9, rbx
mov r8, qword [rbp + 0x40]
lea rdx, [0x1400551f0]
lea rcx, [rbp + 0x50]
call fcn.14003b888
mov r13d, eax
mov rsi, qword [rbp + 0x50]
test eax, eax
jns 0x140020bc7
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020bac
test byte [rcx + 0x1c], 1
je 0x140020bac
mov edx, 0xb
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp + 0x40]
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.14000d5f0
mov r9d, r13d
mov r8, rbx
mov rdx, qword [rbp + 0x40]
lea rcx, str.ERROR:_NewSprintfW__ls___ls__failed___X__n
call fcn.140006cb0
jmp 0x140021011
and qword [rbp - 0x18], 0
lea rbx, str.Cmd.exe
mov r8, rbx
lea rdx, [rbp - 0x18]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.14003aec0
mov r13d, eax
mov r14, qword [rbp - 0x18]
test eax, eax
jns 0x140020c33
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020c27
test byte [rcx + 0x1c], 1
je 0x140020c27
mov edx, 0xc
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rdx, rbx
lea rcx, str.ERROR:_UtilGetSystemPath__ls__Failed___X__n
jmp 0x140020c82
mov rcx, r14
call fcn.14002ff98
mov r13d, eax
test eax, eax
jns 0x140020c8f
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020c78
test byte [rcx + 0x1c], 1
je 0x140020c78
mov edx, 0xd
mov dword [rsp + 0x20], r13d
mov r9, r14
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rdx, r14
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__Failed___X__n
mov r8d, r13d
call fcn.140006cb0
jmp 0x140021003
and qword [rbp - 0x10], 0
lea rbx, str.SystemInfo.exe
mov r8, rbx
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.14003aec0
mov r13d, eax
mov rdi, qword [rbp - 0x10]
test eax, eax
jns 0x140020cfe
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020cef
test byte [rcx + 0x1c], 1
je 0x140020cef
mov edx, 0xe
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rdx, rbx
lea rcx, str.ERROR:_UtilGetSystemPath__ls__Failed___X__n
jmp 0x140020fec
mov rcx, rdi
call fcn.14002ff98
mov r13d, eax
test eax, eax
jns 0x140020d52
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020d43
test byte [rcx + 0x1c], 1
je 0x140020d43
mov edx, 0xf
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rdx, rdi
lea rcx, str.ERROR:_MpUtilMicrosoftCertCheck__ls__Failed___X__n
jmp 0x140020fec
mov rcx, rsi
call fcn.140012ff0
mov r13d, eax
cmp eax, 0x80070001
jle 0x140020fac
add eax, 0x7ff8fffc
cmp eax, 0x7ff8fffb
jbe 0x140020fac
and qword [rbp + 0x50], 0
mov r9, rsi
mov r8, rdi
lea rdx, str._C__ls_____ls_
lea rcx, [rbp + 0x50]
call fcn.14003b888
mov r13d, eax
mov rbx, qword [rbp + 0x50]
test eax, eax
jns 0x140020df3
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020dd9
test byte [rcx + 0x1c], 1
je 0x140020dd9
mov edx, 0x11
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.14000d5f0
mov r9d, r13d
mov r8, rsi
mov rdx, rdi
lea rcx, str.ERROR:_NewSprintfW__ls___ls__Failed___X__n
call fcn.140006cb0
jmp 0x140020f9d
and qword [rbp + 0x48], 0
mov qword [rsp + 0x20], r14
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.14003f9a4
mov r13d, eax
test eax, eax
jns 0x140020e5d
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020e46
test byte [rcx + 0x1c], 1
je 0x140020e46
mov edx, 0x12
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, r13d
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__failed___X__n
call fcn.140006cb0
jmp 0x140020f8e
mov edx, 0x124f80
mov rcx, qword [rbp + 0x48]
call fcn.14003bc2c
test al, al
je 0x140020ed1
lea rax, str.___a_
mov r13d, 0x800705b4
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020eab
test byte [rcx + 0x1c], 1
je 0x140020eab
mov edx, 0x13
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov r8d, r13d
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__time_out___X__n
call fcn.140006cb0
mov edx, 0x5b4
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140020f8e
and dword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140020f31
call fcn.140038cd4
mov r13d, eax
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020f20
test byte [rcx + 0x1c], 1
je 0x140020f20
mov edx, 0x14
mov r9d, r13d
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov edx, r13d
lea rcx, str.ERROR:_GetExitCodeProcess_failed___X__n
call fcn.140006cb0
jmp 0x140020f8e
mov r8d, dword [rbp + 0x38]
test r8d, r8d
je 0x140020f8b
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020f74
test byte [rcx + 0x1c], 1
je 0x140020f74
mov edx, 0x15
mov dword [rsp + 0x20], r8d
mov r9, rbx
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.14000230c
mov r8d, dword [rbp + 0x38]
mov rdx, rbx
lea rcx, str.ERROR:_UtilCreateProcess__ls__exits_with_code__u__n
call fcn.140006cb0
mov r13d, 0x80004005
jmp 0x140020f8e
xor r13d, r13d
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140020f9d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140020ff5
mov rcx, rbx
call fcn.140040784
jmp 0x140020ff5
lea rax, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rax
je 0x140020fe2
test byte [rcx + 0x1c], 1
je 0x140020fe2
mov edx, 0x10
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x140061d30]
mov rcx, qword [rcx + 0x10]
call fcn.140002410
mov rdx, rsi
lea rcx, str.ERROR:_UtilDeletePathSafe__ls__failed___X__n
mov r8d, r13d
call fcn.140006cb0
nop
test rdi, rdi
je 0x140021003
mov rcx, rdi
call fcn.140040784
nop
test r14, r14
je 0x140021011
mov rcx, r14
call fcn.140040784
nop
test rsi, rsi
je 0x14002101f
mov rcx, rsi
call fcn.140040784
nop
cmp qword [rbp + 0x40], 0
je 0x14002102f
mov rcx, qword [rbp + 0x40]
call fcn.140040784
mov eax, r13d
add rsp, 0x68
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret