Function at 0x140067310
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov r15, r9
mov r13, r8
mov rsi, rcx
mov edx, dword [0x140203bf0]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
mov edx, dword [rax + rcx]
imul rax, rdx, 0xd8
add rax, qword [rsi + 0x648]
cmp dword [rax + 0xc0], 0
jne 0x140067f92
cmp byte [rsi + 0x1058], 0
jne 0x140067f92
xor r12d, r12d
mov r14, qword [0x140201e00]
test r14, r14
je 0x1400673d8
lea rbx, str.BEGIN_HEARTBEAT_n
mov edi, 0x10
nop dword [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x67]
mov r8d, edi
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400673d8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x1400673d8
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x1400673d8
add rbx, rax
sub rdi, rax
jne 0x1400673a0
mov byte [rsi + 0x1058], 1
mov ecx, 0xee8
call fcn.140116b34
mov rbx, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x140067483
lea rax, vtable.Fossilize::VulkanDevice.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
lea rcx, [rbx + 0x28]
xor edx, edx
mov r8d, 0x338
call fcn.140119350
mov dword [rbx + 0x360], r12d
mov qword [rbx + 0x368], r12
mov qword [rbx + 0x370], r12
mov dword [rbx + 0x378], 0
mov word [rbx + 0x37c], 0
lea rcx, [rbx + 0x380]
xor edx, edx
mov r8d, 0xb48
call fcn.140119350
lea rcx, [rbx + 0xec8]
call fcn.140006120
mov qword [rbx + 0xed0], r12
mov qword [rbx + 0xed8], r12
mov qword [rbx + 0xee0], r12
jmp 0x140067486
mov rbx, r12
mov rcx, qword [rsi + 0x1050]
mov qword [rsi + 0x1050], rbx
test rcx, rcx
je 0x1400674a3
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsi + 0x1068], r13
mov qword [rsi + 0x1070], r15
movzx eax, byte [rsi + 9]
mov byte [rsi + 0x1063], al
call fcn.1401140a0
mov rbx, rax
call fcn.140114084
cmp rbx, 0x989680
jne 0x1400674d7
imul rbx, rax, 0x64
jmp 0x1400674f3
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
lea rdx, [rsi + 0x1060]
mov rcx, qword [rsi + 0x1050]
call fcn.140002fd0
test al, al
je 0x140067fb9
mov r8, rsi
lea rdx, [0x1400615c0]
mov rcx, qword [rsi + 0x1050]
call fcn.140004dc0
movzx ecx, byte [rsi + 9]
test cl, cl
je 0x14006756d
mov rax, qword [rsi + 0x1050]
cmp byte [rax + 0x37b], 0
jne 0x14006756d
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_INFO:_Requested_pipeline_stats__but_device_does_not_support_them._Disabling._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov byte [rsi + 9], 0
xor cl, cl
cmp qword [rsi + 0xa0], 0
je 0x14006783b
mov r14, qword [rsi + 0x1050]
cmp byte [r14 + 0x379], 0
je 0x14006783b
mov edi, r12d
add r14, 0xeb8
nop word [rax + rax]
movzx r8d, byte [r14]
lea ecx, [rdi + rdi]
lea rax, [rbp - 0x39]
add rcx, rax
lea rdx, str._02x
call fcn.140031820
inc edi
lea r14, [r14 + 1]
cmp edi, 0x10
jb 0x1400675a0
mov r14, 0xffffffffffffffff
cmp qword [0x140201e00], 0
je 0x14006764f
lea r8, [rbp - 0x39]
lea rdx, str.MODULE_UUID__s_n
lea rcx, [rbp - 9]
call fcn.140031820
lea r15, [rbp - 9]
mov r12, qword [0x140201e00]
lea rax, [rbp - 9]
mov rdi, r14
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140067600
test rdi, rdi
je 0x14006764c
nop
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x67]
mov r8d, edi
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006768a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x14006768a
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x14006768a
add r15, rax
sub rdi, rax
jne 0x140067610
xor r12d, r12d
lea rdx, [rsi + 0x90]
lea rcx, [rbp - 0x59]
call fcn.140005f80
nop
mov rcx, qword [rbp - 0x49]
mov rdx, qword [rbp - 0x41]
cmp rcx, rdx
jae 0x140067696
lea rax, [rcx + 1]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x59]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x59]
mov word [rax + rcx], 0x2e
jmp 0x1400676a9
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9b, 0x2e
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x59]
call fcn.140005330
lea rax, [rbp - 0x39]
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1400676b0
mov rcx, qword [rbp - 0x49]
mov rdx, qword [rbp - 0x41]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x1400676fb
lea rax, [r14 + rcx]
mov qword [rbp - 0x49], rax
lea rdi, [rbp - 0x59]
cmp rdx, 0x10
cmovae rdi, qword [rbp - 0x59]
add rdi, rcx
mov r8, r14
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140118b40
mov byte [rdi + r14], 0
jmp 0x140067713
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.140017520
mov rcx, qword [rbp - 0x49]
mov rdx, qword [rbp - 0x41]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14006774a
lea rax, [rcx + 4]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x59]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x59]
mov dword [rax + rcx], 0x7a6f662e
mov byte [rax + rcx + 4], 0
jmp 0x14006776a
mov qword [rsp + 0x20], 4
lea r9, str..foz
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rbp - 0x59]
call fcn.140017520
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rcx, qword [rbp - 0x59]
xor edx, edx
call fcn.140035480
mov rcx, rax
mov r8, qword [rsi + 0xab0]
mov qword [rsi + 0xab0], rax
test r8, r8
je 0x1400677a9
mov rax, qword [r8]
mov edx, 1
mov rcx, r8
call qword [rax]
mov rcx, qword [rsi + 0xab0]
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x1400677fc
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_WARN:_Failed_to_prepare_module_identifier_database._Disabling_identifiers._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rcx, qword [rsi + 0xab0]
mov qword [rsi + 0xab0], r12
test rcx, rcx
je 0x1400677fc
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x140067837
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067832
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067fef
call fcn.140116b70
movzx ecx, byte [rsi + 9]
test cl, cl
je 0x14006792e
lea rdx, [rsi + 0xb0]
lea r8, str..__tmp.foz
lea rcx, [rbp - 0x59]
call fcn.14004a9f0
nop
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rcx, qword [rbp - 0x59]
mov edx, 3
call fcn.140035480
mov rcx, rax
mov r8, qword [rsi + 0x778]
mov qword [rsi + 0x778], rax
test r8, r8
je 0x14006789d
mov rax, qword [r8]
mov edx, 1
mov rcx, r8
call qword [rax]
mov rcx, qword [rsi + 0x778]
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x1400678f3
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_WARN:_Failed_to_prepare_stats_database._Disabling_pipeline_stats._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rcx, qword [rsi + 0x778]
mov qword [rsi + 0x778], r12
test rcx, rcx
je 0x1400678ef
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov byte [rsi + 9], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x14006792e
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067ff5
call fcn.140116b70
cmp qword [rsi + 0x20], 0
je 0x140067b07
mov dword [rbp - 0x39], 0x11
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov qword [rbp - 0x49], r12
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140067965
mov rcx, qword [rcx]
lea rdx, [0x14014cfb0]
call fcn.140123cbc
mov rdi, rax
test rax, rax
je 0x140067a18
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.140124288
mov rcx, rdi
call fcn.1401247e0
movsxd r14, eax
mov rcx, rdi
call fcn.140124abc
test r14, r14
je 0x140067a18
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.140030eb0
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, qword [rbp - 0x59]
call fcn.140123fb0
cmp rax, r14
jne 0x140067a18
lea rdx, [rbp - 0x59]
mov rcx, rsi
call fcn.14006bba0
test al, al
je 0x1400679ed
mov rcx, qword [rbp - 0x59]
mov qword [rbp - 0x19], rcx
mov rax, qword [rbp - 0x51]
sub rax, rcx
mov qword [rbp - 0x21], rax
jmp 0x140067a18
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_INFO:_Failed_to_validate_pipeline_cache._Creating_a_blank_one._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rax, qword [0x140202038]
mov rcx, qword [rsi + 0x1050]
lea r9, [rsi + 0x488]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
je 0x140067acd
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_WARN:_Failed_to_create_pipeline_cache__trying_to_create_a_blank_one._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
mov rax, qword [0x140202038]
mov rcx, qword [rsi + 0x1050]
lea r9, [rsi + 0x488]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
je 0x140067acd
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_create_pipeline_cache._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov qword [rsi + 0x488], r12
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140067b07
mov rdx, qword [rbp - 0x49]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067b02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067ffb
call fcn.140116b70
cmp qword [rsi + 0x40], 0
je 0x140067d70
mov rax, qword [rsi + 0x1050]
cmp byte [rax + 0x37c], 0
je 0x140067d45
mov dword [rbp - 0x39], 0x3b9d3b00
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov qword [rbp - 0x49], r12
lea rcx, [rsi + 0x30]
cmp qword [rcx + 0x18], 0x10
jb 0x140067b52
mov rcx, qword [rcx]
lea rdx, [0x14014cfb0]
call fcn.140123cbc
mov rdi, rax
test rax, rax
je 0x140067c54
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.140124288
mov rcx, rdi
call fcn.1401247e0
movsxd r14, eax
mov rcx, rdi
call fcn.140124abc
test r14, r14
je 0x140067c54
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.140030eb0
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, qword [rbp - 0x59]
call fcn.140123fb0
cmp rax, r14
jne 0x140067c54
mov r8, qword [rbp - 0x51]
mov rdx, qword [rbp - 0x59]
sub r8, rdx
cmp r8, 0x18
jae 0x140067bfb
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Validation_cache_header_is_too_small._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
jmp 0x140067c1f
movzx ecx, byte [rdx + 7]
shl ecx, 8
movzx eax, byte [rdx + 6]
or ecx, eax
shl ecx, 8
movzx eax, byte [rdx + 5]
or ecx, eax
shl ecx, 8
movzx eax, byte [rdx + 4]
or ecx, eax
cmp ecx, 1
je 0x140067c4c
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_INFO:_Failed_to_validate_validation_cache._Creating_a_blank_one._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
jmp 0x140067c54
mov qword [rbp - 0x19], rdx
mov qword [rbp - 0x21], r8
mov rax, qword [0x140202840]
mov rcx, qword [rsi + 0x1050]
lea r9, [rsi + 0x490]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
je 0x140067d09
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_WARN:_Failed_to_create_validation_cache__trying_to_create_a_blank_one._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
mov rax, qword [0x140202840]
mov rcx, qword [rsi + 0x1050]
lea r9, [rsi + 0x490]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
je 0x140067d09
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_create_validation_cache._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov qword [rsi + 0x490], r12
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140067d70
mov rdx, qword [rbp - 0x49]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067d3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067fb3
call fcn.140116b70
jmp 0x140067d70
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Requested_validation_cache__but_validation_layers_do_not_support_this_extension._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
cmp qword [rsi + 0xe0], 0
je 0x140067db1
mov rcx, rsi
call fcn.1400603e0
test al, al
jne 0x140067db1
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_WARN:_Failed_to_initialize_replayer_cache._Ignoring__n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
call fcn.1401140a0
mov rdi, rax
call fcn.140114084
cmp rdi, 0x989680
jne 0x140067dcd
imul rcx, rax, 0x64
jmp 0x140067dee
cqo
idiv rdi
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
sub rcx, rbx
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov ecx, 2
call fcn.140121190
mov rcx, rax
mov r8d, ebx
lea rdx, str.Fossilize_INFO:_Creating_Vulkan_device_took:__ld_ms_n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
test r13, r13
je 0x140067f92
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_INFO:_Replaying_for_application:_n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ebx, dword [r13 + 0x2c]
mov ecx, 2
call fcn.140121190
mov ecx, ebx
and ecx, 0xfff
mov r9d, ebx
shr r9d, 0xc
and r9d, 0x3ff
shr ebx, 0x16
mov dword [rsp + 0x20], ecx
mov r8d, ebx
lea rdx, str.Fossilize_INFO:___apiVersion:__u._u._u_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ebx, dword [r13 + 0x28]
mov ecx, 2
call fcn.140121190
mov r8d, ebx
lea rdx, str.Fossilize_INFO:___engineVersion:__u_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ebx, dword [r13 + 0x18]
mov ecx, 2
call fcn.140121190
mov r8d, ebx
lea rdx, str.Fossilize_INFO:___applicationVersion:__u_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rbx, qword [r13 + 0x20]
test rbx, rbx
je 0x140067f5b
mov ecx, 2
call fcn.140121190
mov r8, rbx
lea rdx, str.Fossilize_INFO:___engineName:__s_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rbx, qword [r13 + 0x10]
test rbx, rbx
je 0x140067f92
mov ecx, 2
call fcn.140121190
mov r8, rbx
lea rdx, str.Fossilize_INFO:___applicationName:__s_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14011d1bc
int3
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_create_Vulkan_device__bailing_..._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ecx, 1
call fcn.14011d624
int3
call fcn.14011d1bc
int3
call fcn.14011d1bc
int3
call fcn.14011d1bc
int3