Function at 0x1400538e0
Capabilities:
Create process on windows
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
movaps xmmword [rsp + 0x2f0], xmm6
mov r12, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x140054ee2
xorps xmm0, xmm0
lea rdx, [rsp + 0x2d0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.1400a14b0
mov r8, qword [r12]
mov rsi, qword [r8 + 0x78]
mov r15, qword [r8 + 0x80]
cmp rsi, r15
je 0x140053a10
lea rdi, [rsp + 0x108]
lea rbx, [rsp + 0x2c0]
lea r14, [rsp + 0x2d0]
jmp 0x1400539e3
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rax
mov rcx, rsi
test rcx, rcx
jne 0x1400539ad
test rax, rax
jne 0x140054ed3
mov rcx, rdi
mov rdx, rbx
call fcn.1400cd6a0
mov rcx, rdi
mov rdx, r14
call fcn.1400a14b0
cmp byte [rsp + 0x11f], 0
jns 0x1400539da
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
add rsi, 0x18
cmp rsi, r15
je 0x140053a0c
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14005398c
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x2c0], rcx
mov qword [rsp + 0x2c8], rax
test rax, rax
jns 0x14005399f
jmp 0x140054ed6
mov r8, qword [r12]
movzx eax, byte [r8 + 0x2f]
test al, al
jns 0x140053a1d
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x140053aba
lea rcx, [rsp + 0x80]
mov byte [rcx + 0x17], 8
lea rax, str.database
cmp rcx, rax
ja 0x140053a4f
lea rcx, [rsp + 0x88]
cmp rcx, rax
ja 0x140054eee
add r8, 0x18
movabs rax, 0x6573616261746164
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov byte [rdx + 8], 0
lea rsi, [rsp + 0x108]
mov rcx, rsi
call fcn.14005f4a0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.1400a14b0
cmp byte [rsi + 0x17], 0
jns 0x140053a9f
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140053ab6
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
mov r8, qword [r12]
movzx eax, byte [r8 + 0x47]
test al, al
jns 0x140053ac7
mov rax, qword [r8 + 0x38]
test rax, rax
je 0x140053b6a
lea rcx, [rsp + 0x80]
mov byte [rcx + 0x17], 0xb
lea rax, str.metrics_dir
cmp rcx, rax
ja 0x140053af9
lea rcx, [rsp + 0x8b]
cmp rcx, rax
ja 0x140054ef1
add r8, 0x30
mov eax, dword [0x140201ea0]
lea rdx, [rsp + 0x80]
mov dword [rdx + 7], eax
mov rax, qword [str.metrics_dir]
mov qword [rdx], rax
mov byte [rdx + 0xb], 0
lea rsi, [rsp + 0x108]
mov rcx, rsi
call fcn.14005f4a0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.1400a14b0
cmp byte [rsi + 0x17], 0
jns 0x140053b4f
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140053b66
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
mov r8, qword [r12]
movzx eax, byte [r8 + 0x5f]
test al, al
mov qword [rsp + 0x58], r12
js 0x140053cc4
test rax, rax
je 0x140053c6c
add r8, 0x48
mov qword [rsp + 0x2b0], r8
mov qword [rsp + 0x2b8], rax
test r8, r8
je 0x140054ee5
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2b0]
call fcn.1400cd6a0
lea rcx, [rsp + 0x290]
mov byte [rcx + 0x17], 3
lea rax, [0x1401f590c]
cmp rcx, rax
ja 0x140053be0
lea rcx, [rsp + 0x293]
cmp rcx, rax
ja 0x140054ef4
mov al, byte [0x1401f590e]
lea rdx, [rsp + 0x290]
mov byte [rdx + 2], al
movzx eax, word [0x1401f590c]
mov word [rdx], ax
mov byte [rdx + 3], 0
lea rsi, [rsp + 0x108]
lea r8, [rsp + 0x80]
mov rcx, rsi
call fcn.14005f4a0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.1400a14b0
cmp byte [rsi + 0x17], 0
jns 0x140053c3a
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x2a7], 0
jns 0x140053c51
mov rcx, qword [rsp + 0x290]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140053c68
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
mov r8, qword [r12]
mov rdi, qword [r8 + 0x60]
lea r13, [r8 + 0x68]
cmp rdi, r13
je 0x140053f92
movabs r8, 0x7ffffffffffffff8
lea rax, str.annotation
lea r14, [rsp + 0x248]
cmp r14, rax
seta cl
lea rdx, [rsp + 0x252]
cmp rdx, rax
setbe sil
or sil, cl
lea rax, [r8 - 1]
mov qword [rsp + 0x60], rax
xorps xmm6, xmm6
mov byte [rsp + 0x68], sil
jmp 0x140053f63
mov rax, qword [r8 + 0x50]
test rax, rax
je 0x140053c6c
mov r8, qword [r8 + 0x48]
mov qword [rsp + 0x2b0], r8
mov qword [rsp + 0x2b8], rax
jns 0x140053b99
jmp 0x140054ef7
mov rax, r15
and rax, 0xfffffffffffffff8
add rax, 8
mov rsi, r13
mov r13, r14
mov r14, r15
or r14, 7
cmp r14, 0x17
cmove r14, rax
inc r14
mov rcx, r14
call fcn.14012cd5c
mov rbx, rax
movabs rax, 0x7ffffffffffffff8
add rax, 8
or rax, r14
mov r14, r13
mov r13, rsi
mov sil, byte [rsp + 0x68]
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x268], r15
jmp 0x140053d8d
mov rbp, qword [rdi + 0x28]
lea r15, [rbp + 1]
cmp r15, qword [rsp + 0x60]
ja 0x140054ed9
cmp r15, 0x16
ja 0x140053cec
movaps xmmword [rsp + 0x260], xmm6
mov qword [rsp + 0x270], 0
mov byte [rsp + 0x277], r15b
lea rbx, [rsp + 0x260]
lea rdx, [rdi + 0x20]
test r12b, r12b
jns 0x140053d99
mov rdx, qword [rdx]
cmp rdx, rbx
jb 0x140053dab
lea rax, [rbx + rbp]
cmp rax, rdx
ja 0x140054ee8
test rbp, rbp
je 0x140053dbb
mov rcx, rbx
mov r8, rbp
call fcn.140131180
mov word [rbx + rbp], 0x3d
movzx r8d, byte [rdi + 0x4f]
test r8b, r8b
js 0x140053dd5
lea rdx, [rdi + 0x38]
and r8d, 0x7f
jmp 0x140053ddd
mov r8, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x38]
lea rbx, [rsp + 0x80]
lea rcx, [rsp + 0x260]
call fcn.14001d840
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2a0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x290], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx ecx, byte [rsp + 0x2a7]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x290]
lea rdx, [rsp + 0x290]
cmovns rcx, rdx
mov qword [rsp + 0x280], rcx
mov qword [rsp + 0x288], rax
test rax, rax
js 0x140054edc
test rcx, rcx
jne 0x140053e67
test rax, rax
jne 0x140054eeb
mov rcx, rbx
lea rdx, [rsp + 0x280]
call fcn.1400cd6a0
mov byte [rsp + 0x25f], 0xa
test sil, sil
je 0x140054edf
movzx eax, word [0x140201ead]
mov word [rsp + 0x250], ax
mov rax, qword [str.annotation]
mov qword [rsp + 0x248], rax
mov byte [rsp + 0x252], 0
lea r15, [rsp + 0x108]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14005f4a0
mov rcx, r15
lea rdx, [rsp + 0x2d0]
call fcn.1400a14b0
cmp byte [rsp + 0x11f], 0
jns 0x140053eeb
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x25f], 0
jns 0x140053f02
mov rcx, qword [rsp + 0x248]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140053f19
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
cmp byte [rsp + 0x2a7], 0
jns 0x140053f30
mov rcx, qword [rsp + 0x290]
call fcn.14012cd4c
cmp byte [rsp + 0x277], 0
jns 0x140053f47
mov rcx, qword [rsp + 0x260]
call fcn.14012cd4c
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140053f7c
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140053f50
mov rdi, rax
cmp rax, r13
je 0x140053f8a
movzx r12d, byte [rdi + 0x37]
test r12b, r12b
js 0x140053d50
mov ebp, r12d
and ebp, 0x7f
jmp 0x140053d54
mov rax, qword [rdi + 0x10]
cmp qword [rax], rdi
mov rdi, rax
jne 0x140053f7c
jmp 0x140053f5b
mov rax, qword [rsp + 0x58]
mov r8, qword [rax]
mov rdi, qword [r8 + 0x90]
mov rsi, qword [r8 + 0x98]
cmp rdi, rsi
je 0x14005406e
lea rax, [0x140201eb0]
lea rbx, [rsp + 0x80]
cmp rbx, rax
seta cl
lea rdx, [rsp + 0x8a]
cmp rdx, rax
setbe bpl
or bpl, cl
lea r14, [rsp + 0x108]
lea r15, [rsp + 0x2d0]
jmp 0x140053ff8
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
add rdi, 0x18
cmp rdi, rsi
je 0x14005406e
mov byte [rsp + 0x97], 0xa
test bpl, bpl
je 0x140054ed0
movzx eax, word [0x140201eb8]
mov word [rsp + 0x88], ax
mov rax, qword [0x140201eb0]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x8a], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14005f4a0
mov rcx, r14
mov rdx, r15
call fcn.1400a14b0
cmp byte [rsp + 0x11f], 0
jns 0x14005405f
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140053fef
jmp 0x140053fe2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, qword [rsp + 0x58]
jne 0x140054149
mov r14d, 2
cmp dword [0x140231b60], 2
jg 0x1400540f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1a6
mov r9d, 2
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, [0x1402046a7]
mov r8d, 0xb
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
xor ebp, ebp
cmp byte [rsp + 0x2e7], 0
jns 0x14005410c
mov rcx, qword [rsp + 0x2d0]
call fcn.14012cd4c
mov qword [0x1402339f8], r14
mov rcx, rbx
call fcn.14004fc00
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.14012f6f0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2f0]
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, rax
mov rax, qword [rbx]
mov rax, qword [rax + 0xc8]
mov rcx, qword [0x1402286c0]
mov r9, qword [0x1402286b0]
mov r8, qword [0x1402286a0]
movsxd rdx, edi
cmp rdx, rdi
jne 0x140054efd
mov edx, edi
movsxd r10, eax
cmp r10, rax
jne 0x140054f05
movsxd r10, ecx
cmp r10, rcx
jne 0x140054f0d
movsxd r10, r9d
cmp r10, r9
jne 0x140054f15
movsxd r10, r8d
cmp r10, r8
jne 0x140054f1e
lea r10, [0x1402339c8]
mov qword [rsp + 0x48], r10
lea r10, [0x1402339bc]
mov qword [rsp + 0x40], r10
lea r10, [0x1402339b0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_llx_0x_llx_0x_llx
lea rsi, [rsp + 0x290]
mov rcx, rsi
call fcn.1400cd350
lea rcx, [rsp + 0x260]
mov byte [rcx + 0x17], 0x16
lea rax, str.__initial_client_data
cmp rcx, rax
ja 0x140054219
lea rcx, [rsp + 0x276]
cmp rcx, rax
ja 0x140054f2d
movups xmm0, xmmword [str.__initial_client_data]
lea r15, [rsp + 0x260]
movaps xmmword [r15], xmm0
movabs rax, 0x3d617461642d746e
mov qword [r15 + 0xe], rax
movzx eax, byte [rsp + 0x2a7]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0x298]
mov byte [r15 + 0x16], 0
cmovs rsi, qword [rsp + 0x290]
mov rcx, r15
mov rdx, rsi
call fcn.14001d840
mov rcx, qword [rax + 0x10]
lea r14, [rsp + 0x80]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [r14], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx ecx, byte [r14 + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [r14 + 8]
mov rcx, qword [r14]
cmovns rcx, r14
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x100], rax
test rax, rax
js 0x140054efa
test rcx, rcx
jne 0x1400542d1
test rax, rax
jne 0x140054f30
lea r13, [rsp + 0x108]
lea rdx, [rsp + 0xf8]
mov rcx, r13
call fcn.1400cd6a0
lea r12, [rsp + 0x2d0]
mov rcx, r13
mov rdx, r12
call fcn.1400a14b0
cmp byte [r13 + 0x17], 0
jns 0x140054310
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x97], 0
jns 0x140054327
mov rcx, qword [rsp + 0x80]
call fcn.14012cd4c
cmp byte [rsp + 0x277], 0
jns 0x14005433e
mov rcx, qword [rsp + 0x260]
call fcn.14012cd4c
cmp byte [rsp + 0x2a7], 0
jns 0x140054355
mov rcx, qword [rsp + 0x290]
call fcn.14012cd4c
xorps xmm6, xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0xbc], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x290], xmm6
mov qword [rsp + 0x2a0], 0
mov eax, dword [0x140233a08]
mov ecx, dword [0x140228d28]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054e18
mov eax, dword [0x140233a18]
mov ecx, dword [0x140228d28]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054e6f
mov rax, qword [0x140233a00]
test rax, rax
je 0x1400545ae
cmp qword [0x140233a10], 0
je 0x1400545ae
mov dword [rsp + 0x80], 0x70
movabs rcx, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x260]
mov qword [r9], rcx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x140243008]
test eax, eax
je 0x140054857
cmp dword [0x140231b60], 2
jg 0x1400544d1
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1d7
mov r9d, 2
call fcn.140006710
lea rcx, [rsp + 0x118]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.140167a60
mov rcx, rsi
call fcn.140006910
xor r12d, r12d
xor r15d, r15d
mov rbx, qword [rsp + 0x58]
mov r14d, 2
xor ebp, ebp
test r12, r12
je 0x140054568
mov eax, dword [0x140233a28]
mov ecx, dword [0x140228d28]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140054558
lea rcx, [0x140233a28]
call fcn.14012ce30
cmp dword [0x140233a28], 0xffffffff
jne 0x140054558
lea rcx, [0x1401f5a36]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140054f33
lea rdx, [0x140204805]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140233a20], rax
lea rcx, [0x140233a28]
call fcn.14012ce98
mov rax, qword [0x140233a20]
mov rcx, r12
call qword [0x140243008]
test r15, r15
je 0x140054575
mov rcx, r15
call fcn.14012cf90
mov rcx, qword [rsp + 0x290]
test rcx, rcx
je 0x140054598
mov rax, qword [rsp + 0x298]
cmp rax, rcx
jne 0x140054d63
call fcn.14012cd4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400540f5
jmp 0x140054f3d
mov dword [rsp + 0x80], 0x68
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x14005473e
cmp r8b, 0xc
jae 0x14005474c
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
movaps xmm0, xmmword [0x1401ee3a0]
movaps xmmword [rsp + 0x260], xmm0
cmp byte [rsp + 0x2e7], 0
js 0x14005461e
lea r12, [rsp + 0x2d0]
jmp 0x140054626
mov r12, qword [rsp + 0x2d0]
mov rbx, qword [rsp + 0x58]
cmp byte [rdx + 0x17], 0
jns 0x140054634
mov rdx, qword [rdx]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rcx, rdx
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400547e6
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x140231b60], 1
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jg 0x14005469e
cmp dword [0x140228658], 0
je 0x14005469e
test eax, eax
je 0x140054d70
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x140231b60], 1
jg 0x1400546c6
cmp dword [0x140228658], 0
je 0x1400546c6
test eax, eax
je 0x140054dc4
mov rsi, qword [rbx]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400546e3
call fcn.14004b510
test al, al
je 0x140054f3a
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x108]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x248]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [rbx]
call fcn.14004cb90
mov ebp, eax
movzx eax, al
mov r14d, 2
sub r14, rax
jmp 0x1400544e4
mov r8, qword [rdx + 8]
cmp r8, 0xc
jb 0x1400545e9
add r8, 0xfffffffffffffff4
mov qword [rsp + 0x20], r15
mov rcx, r13
mov r9, 0xffffffffffffffff
call fcn.140014640
cmp byte [rsp + 0x11f], 0
jns 0x140054776
mov r13, qword [rsp + 0x108]
lea rdx, str.rundll32.exe
mov rcx, r13
call fcn.1401496c4
mov esi, eax
cmp byte [rsp + 0x11f], 0
jns 0x14005479e
mov rcx, qword [rsp + 0x108]
call fcn.14012cd4c
cmp byte [rsp + 0x2e7], 0
mov rbx, qword [rsp + 0x58]
jns 0x1400547b5
mov r12, qword [rsp + 0x2d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
movaps xmm0, xmmword [0x1401ee3a0]
movaps xmmword [rsp + 0x260], xmm0
test esi, esi
je 0x140054d5c
mov rdx, qword [rbx]
jmp 0x14005462b
mov r14d, 2
cmp dword [0x140231b60], 2
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jg 0x1400544e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x222
mov r9d, 2
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
jmp 0x1400544e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400548c3
cmp dword [0x140231b60], 2
jg 0x1400544d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1db
mov r9d, 2
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
jmp 0x1400544d1
lea rsi, [rsp + 0x260]
mov rcx, qword [rsi]
call fcn.14012cd54
mov rcx, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x140233a00]
mov qword [rsp + 0x60], rcx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [0x140243008]
test eax, eax
je 0x140054cc9
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov ecx, 0x40
call fcn.14012cd5c
mov rbp, rax
add rax, 0x40
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x2a0], rax
test rbp, rbp
je 0x140054d46
mov rax, qword [0x1402286a0]
mov qword [rbp], rax
mov rax, rbp
add rax, 8
mov qword [rsp + 0x298], rax
je 0x140054d49
mov rax, qword [0x1402286b0]
mov qword [rbp + 8], rax
cmp rbp, 0xfffffffffffffff0
je 0x140054d4c
mov rax, qword [0x1402286c0]
mov qword [rbp + 0x10], rax
lea rsi, [rbp + 0x18]
mov qword [rsp + 0x298], rsi
mov rax, qword [rsp + 0x58]
mov r9, qword [rax]
mov rax, qword [rsp + 0x2a0]
cmp rsi, rax
jb 0x140054aa2
mov r8, qword [rsp + 0x290]
mov rbx, rsi
sub rbx, r8
sar rbx, 3
lea rdx, [rbx + 1]
mov rcx, rdx
shr rcx, 0x3d
jne 0x140054f90
movabs rcx, 0x1fffffffffffffff
sub rax, r8
mov rbp, rax
sar rbp, 2
cmp rbp, rdx
cmovbe rbp, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae rbp, rcx
test rbp, rbp
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
je 0x140054f93
cmp rbp, rcx
ja 0x140054f9a
lea rcx, [rbp*8]
call fcn.14012cd5c
shl rbx, 3
add rbx, rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
je 0x140054f9d
lea rax, [rax + rbp*8]
mov rcx, qword [rcx + 0xc8]
mov qword [rbx], rcx
lea rbp, [rbx + 8]
cmp rsi, rdx
je 0x140054d3b
mov rcx, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
mov qword [rbx - 8], rcx
add rbx, 0xfffffffffffffff8
cmp rsi, rdx
jne 0x140054a49
mov rcx, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rax
cmp rsi, rcx
je 0x140054a96
add rsi, 0xfffffffffffffff8
jne 0x140054a86
jmp 0x140054f27
test rcx, rcx
je 0x140054aba
call fcn.14012cd4c
jmp 0x140054aba
test rsi, rsi
je 0x140054d4f
mov rax, qword [r9 + 0xc8]
mov qword [rbp + 0x18], rax
add rbp, 0x20
mov qword [rsp + 0x298], rbp
mov rax, qword [rsp + 0x2a0]
cmp rbp, rax
jb 0x140054bc5
mov r8, qword [rsp + 0x290]
mov rsi, rbp
sub rsi, r8
sar rsi, 3
lea rdx, [rsi + 1]
mov rcx, rdx
shr rcx, 0x3d
jne 0x140054fa0
movabs rcx, 0x1fffffffffffffff
sub rax, r8
mov rbx, rax
sar rbx, 2
cmp rbx, rdx
cmovbe rbx, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae rbx, rcx
test rbx, rbx
mov qword [rsp + 0x70], r8
je 0x140054d55
cmp rbx, rcx
ja 0x140054fa3
lea rcx, [rbx*8]
call fcn.14012cd5c
shl rsi, 3
add rsi, rax
mov rdx, qword [rsp + 0x70]
je 0x140054fa6
lea rax, [rax + rbx*8]
mov qword [rsi], rdi
lea rbx, [rsi + 8]
cmp rbp, rdx
je 0x140054d33
mov rcx, qword [rbp - 8]
add rbp, 0xfffffffffffffff8
mov qword [rsi - 8], rcx
add rsi, 0xfffffffffffffff8
cmp rbp, rdx
jne 0x140054b6c
mov rcx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x298]
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rbx
mov qword [rsp + 0x2a0], rax
cmp rbp, rcx
je 0x140054bb9
add rbp, 0xfffffffffffffff8
jne 0x140054ba9
jmp 0x140054f2a
test rcx, rcx
je 0x140054bd9
call fcn.14012cd4c
jmp 0x140054bd9
test rbp, rbp
je 0x140054d52
mov qword [rbp], rdi
add rbp, 8
mov rbx, rbp
lea rsi, [rsp + 0x290]
mov qword [rsi + 8], rbx
mov rdx, qword [rsp + 0xd0]
mov rcx, rsi
call fcn.1400943b0
mov rdx, qword [rsp + 0xd8]
mov rcx, rsi
call fcn.1400943b0
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.1400943b0
mov r9, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r9
je 0x140054d43
mov rax, qword [0x140233a10]
mov rcx, qword [rsp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdx
mov r8d, 0x20002
xor edx, edx
call qword [0x140243008]
test eax, eax
je 0x140054c5d
mov ebp, 0x80000
jmp 0x1400545c9
cmp dword [0x140231b60], 2
jg 0x140054cb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x200
mov r9d, 2
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, [0x14020479a]
mov r8d, 0x19
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jmp 0x1400544dc
cmp dword [0x140231b60], 2
jg 0x140054d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1e6
mov r9d, 2
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, [0x140204778]
mov r8d, 0x21
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
xor r12d, r12d
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
jmp 0x1400544dc
mov rcx, rbp
jmp 0x140054b91
mov rcx, rsi
jmp 0x140054a6e
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x140054b46
xor edx, edx
jmp 0x140054634
add rax, 0xfffffffffffffff8
jne 0x14005458a
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 1
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
jmp 0x14005469e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x22a
mov r9d, 1
call fcn.140192850
lea rcx, [rsp + 0x118]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.140167a60
mov rcx, rsi
call fcn.1401928d0
jmp 0x1400546c6
lea rcx, [0x140233a08]
call fcn.14012ce30
cmp dword [0x140233a08], 0xffffffff
jne 0x140054408
lea rcx, [0x1401f5a36]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140054e6b
lea rdx, [0x1402046cc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140233a00], rax
lea rcx, [0x140233a08]
call fcn.14012ce98
jmp 0x140054408
xor eax, eax
jmp 0x140054e53
lea rcx, [0x140233a18]
call fcn.14012ce30
cmp dword [0x140233a18], 0xffffffff
jne 0x14005442d
cmp qword [0x140233a00], 0
je 0x140054ecc
lea rcx, [0x1401f5a36]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140054ecc
lea rdx, [0x1402046f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140233a10], rax
lea rcx, [0x140233a18]
call fcn.14012ce98
jmp 0x14005442d
xor eax, eax
jmp 0x140054eb4
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x140054545
int3
lea rdx, str.Free
lea r8, str....._third_partycrashpadcrashpadutilwin_scoped_handle.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r9d, 0x1e
call fcn.1400bab70
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, rsi
call fcn.140193d10
lea rdx, [0x140206171]
mov rcx, rdi
call fcn.1401a9b40
mov rcx, rdi
call fcn.140193d40
jmp 0x1400540f5
int3
xor eax, eax
jmp 0x140054a17
int3
int3
int3
int3
int3