Function at 0x1401829e0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa28
movaps xmmword [rsp + 0xa10], xmm6
mov rdi, rdx
mov r12, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xa08], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14021fa78]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140183db4
mov rbp, qword [0x14021fa70]
test rbp, rbp
jne 0x140182c18
mov byte [r12 + 0x81], 0
movaps xmm0, xmmword [0x1401d9dd0]
lea rsi, [rsp + 0x2b0]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsi], 9
sete byte [r12 + 0x80]
cmp byte [r12 + 0x81], 0
setne dl
lea rax, [r12 + 0x30]
lea rsi, [r12 + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, r12
mov r9, rsi
call fcn.140183e00
test al, al
je 0x140182c98
cmp byte [r12 + 0x80], 0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
je 0x140182d42
movabs r15, 0xaaaaaaaaaaaaaaaa
mov rsi, qword [rsi]
lea rbx, [rsp + 0x6b0]
mov r8d, 0x354
mov rcx, rbx
mov dl, 0xaa
call fcn.140103d70
lea rax, [rsp + 0x160]
mov qword [rax], r15
mov qword [rsp + 0x20], rax
mov r9d, 0x354
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140182e69
cmp qword [rsp + 0x160], 0x354
jne 0x140182ee0
lea rsi, [rsp + 0x2b0]
mov r8d, 0x3f4
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
mov rdx, qword [rsp + 0x6d0]
mov rcx, rdi
lea rdi, [rsp + 0x90]
mov qword [rdi], r15
mov qword [rsp + 0x20], rdi
mov r9d, 0x3f4
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1401833de
cmp qword [rsp + 0x90], 0x3f4
je 0x14018357b
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182c0c
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::RTL_USER_PROCESS_PARAMETERS_crashpad::process_types::internal::Traits64__
mov r8d, 0xc5
mov rcx, rax
call fcn.1400cf4f0
lea rdx, str._incorrect_size
mov r8d, 0xf
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
xor eax, eax
mov rdi, qword [rsp + 0x30]
jmp 0x140182f5f
lea rdx, [rsp + 0x6b0]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call rbp
test eax, eax
jne 0x140182d1b
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182a4c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x4b
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f1120]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x140182a4c
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182ceb
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
xor esi, esi
mov rcx, qword [rsp + 0xa08]
xor rcx, rsp
call fcn.1401013e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa10]
add rsp, 0xa28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rsp + 0x6b0], 0
setne byte [r12 + 0x81]
je 0x140182a55
mov byte [r12 + 0x80], 0
mov dl, 1
jmp 0x140182a91
mov rsi, qword [rsi]
mov rax, rsi
shr rax, 0x20
jne 0x14018321b
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x6b0]
mov r8d, 0x230
mov rcx, rbx
mov dl, 0xaa
call fcn.140103d70
lea rax, [rsp + 0x160]
mov qword [rax], rbp
mov qword [rsp + 0x20], rax
mov r9d, 0x230
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140183458
cmp qword [rsp + 0x160], 0x230
jne 0x1401834bc
lea rsi, [rsp + 0x2b0]
mov r8d, 0x294
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
mov edx, dword [rsp + 0x6c0]
mov rcx, rdi
lea rdi, [rsp + 0x90]
mov qword [rdi], rbp
mov qword [rsp + 0x20], rdi
mov r9d, 0x294
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140183517
cmp qword [rsp + 0x90], 0x294
je 0x140183788
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182c0c
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::RTL_USER_PROCESS_PARAMETERS_crashpad::process_types::internal::Traits32__
jmp 0x140182be1
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_crashpad::process_types::internal::Traits64__
mov r8d, 0xad
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x140182f5d
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_crashpad::process_types::internal::Traits64__
mov r8d, 0xad
mov rcx, rax
call fcn.1400cf4f0
lea rdx, str._incorrect_size
mov r8d, 0xf
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
xor eax, eax
test al, al
je 0x1401831cc
xor esi, esi
cmp byte [r12 + 0x80], 0
sete sil
shl rsi, 0x20
dec rsi
movaps xmm0, xmmword [0x1401d9dd0]
lea rax, [rsp + 0x6b0]
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax], xmm0
lea rax, [r12 + 0x50]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x50], rsi
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
lea r8, [rsp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1401832b8
mov r15, qword [rsp + 0x6b0]
mov r13, qword [rsp + 0x6b8]
mov r11d, dword [rsp + 0x6c0]
mov r10, qword [rsp + 0x6c8]
mov r9d, dword [rsp + 0x6d0]
mov r8d, dword [rsp + 0x6d4]
mov ebp, dword [rsp + 0x6d8]
mov rcx, r12
mov r12, qword [r12 + 0x58]
mov rax, qword [rcx + 0x60]
cmp r12, rax
jae 0x14018306e
mov qword [r12], r15
mov qword [r12 + 8], r13
mov dword [r12 + 0x10], r11d
xor eax, eax
mov dword [r12 + 0x14], eax
mov qword [r12 + 0x18], r10
mov dword [r12 + 0x20], r9d
mov dword [r12 + 0x24], r8d
mov dword [r12 + 0x28], ebp
mov dword [r12 + 0x2c], eax
add r12, 0x30
mov qword [rcx + 0x58], r12
mov r12, rcx
mov rax, qword [rsp + 0x6c8]
test rax, rax
je 0x14018332b
add rbx, rax
cmp rbx, rsi
jbe 0x140182fa8
jmp 0x1401833da
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
sub r12, rdx
sar r12, 4
movabs rsi, 0xaaaaaaaaaaaaaaab
imul r12, rsi
lea rcx, [r12 + 1]
movabs rdi, 0x555555555555555
cmp rcx, rdi
ja 0x140183daa
mov dword [rsp + 0x48], r8d
sub rax, rdx
sar rax, 4
imul rax, rsi
lea rsi, [rax + rax]
cmp rsi, rcx
cmovb rsi, rcx
movabs rcx, 0x2aaaaaaaaaaaaaa
cmp rax, rcx
cmovae rsi, rdi
test rsi, rsi
je 0x1401831c5
mov rax, rsi
shl rax, 4
lea rdx, [rax + rax*2]
mov ecx, 0x10
mov edi, r9d
mov qword [rsp + 0x58], r15
mov r14, r10
mov r15d, r11d
call fcn.1401a0ea0
mov r11d, r15d
mov r10, r14
mov r15, qword [rsp + 0x58]
mov r9d, edi
lea rdx, [r12 + r12*2]
shl rdx, 4
lea rdi, [rax + rdx]
lea r8, [rsi + rsi*2]
shl r8, 4
add r8, rax
mov qword [rax + rdx], r15
mov qword [rax + rdx + 8], r13
mov dword [rax + rdx + 0x10], r11d
xor ecx, ecx
mov dword [rax + rdx + 0x14], ecx
mov qword [rax + rdx + 0x18], r10
mov dword [rax + rdx + 0x20], r9d
mov esi, dword [rsp + 0x48]
mov dword [rax + rdx + 0x24], esi
mov dword [rax + rdx + 0x28], ebp
mov dword [rax + rdx + 0x2c], ecx
mov r12, qword [rsp + 0x38]
mov rbp, qword [r12 + 0x50]
mov rcx, qword [r12 + 0x58]
cmp rcx, rbp
je 0x140183192
movaps xmm0, xmmword [rcx - 0x30]
movaps xmm1, xmmword [rcx - 0x20]
movaps xmm2, xmmword [rcx - 0x10]
lea rsi, [rcx - 0x30]
movaps xmmword [rdi - 0x10], xmm2
movaps xmmword [rdi - 0x20], xmm1
movaps xmmword [rdi - 0x30], xmm0
add rdi, 0xffffffffffffffd0
mov rcx, rsi
cmp rbp, rsi
jne 0x140183162
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
add rax, rdx
add rax, 0x30
mov qword [r12 + 0x50], rdi
mov qword [r12 + 0x58], rax
mov qword [r12 + 0x60], r8
test rcx, rcx
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
je 0x14018304c
call fcn.1401a0ed0
jmp 0x14018304c
xor eax, eax
jmp 0x140183109
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182ceb
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x140182cde
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rcx, [rsp + 0x2b0]
mov r8d, 0xf7
mov r9d, 2
call fcn.14004a520
lea rbx, [rsp + 0x2c0]
lea rdx, str.peb_address_0x_llx_out_of_range
lea rbp, [rsp + 0x6b0]
mov rcx, rbp
mov r8, rsi
call fcn.1400dce20
movzx r8d, byte [rbp + 0x17]
test r8b, r8b
jns 0x140183289
mov r8, qword [rsp + 0x6b8]
mov rbp, qword [rsp + 0x6b0]
mov rcx, rbx
mov rdx, rbp
call fcn.1400cf4f0
cmp byte [rsp + 0x6c7], 0
jns 0x1401832ab
mov rcx, qword [rsp + 0x6b0]
call fcn.140100564
lea rcx, [rsp + 0x2b0]
jmp 0x140182f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, 1
cmp eax, 0x57
je 0x140183380
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x14018337e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x149
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f51af]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x14018337e
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x14018337e
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x152
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, str.RegionSize__0
mov r8d, 0xf
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
xor ecx, ecx
mov sil, 1
test cl, cl
jne 0x140182ced
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182ceb
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x140182cde
mov cl, 1
jmp 0x140183380
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182c0c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::RTL_USER_PROCESS_PARAMETERS_crashpad::process_types::internal::Traits64__
mov r8d, 0xc5
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x140182c0c
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_crashpad::process_types::internal::Traits32__
jmp 0x140182ec8
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x2c0]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_crashpad::process_types::internal::Traits32__
jmp 0x140182f32
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182c0c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::RTL_USER_PROCESS_PARAMETERS_crashpad::process_types::internal::Traits32__
jmp 0x14018343d
lea r8, [r12 + 0x10]
lea rdx, [rsp + 0x320]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.140184d20
test al, al
je 0x1401839be
movaps xmm0, xmmword [0x1401d9dd0]
lea r8, [rsp + 0x120]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov rdx, qword [rsp + 0x6c8]
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
mov rdi, rsi
je 0x1401839c8
cmp qword [rsp + 0x90], 0x40
jne 0x140183a32
lea rsi, [rsp + 0x90]
mov r8d, 0x84
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
lea rdi, [rsp + 0x78]
xorps xmm0, xmm0
movaps xmmword [rdi + 8], xmm0
movaps xmmword [rdi - 8], xmm0
movaps xmmword [rdi - 0x18], xmm0
mov rbx, qword [rsp + 0x130]
mov rax, r12
mov r12, qword [rsp + 0x138]
add rax, 0x38
mov qword [rsp + 0x48], rax
lea r13, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r14, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], r15
mov qword [rsp + 0x20], r13
mov r9d, 0x84
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov r8, rsi
call r14
test eax, eax
je 0x140183c9f
cmp qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], 0x84
jne 0x140183a93
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea r8, [rsp + 0x60]
call fcn.140184d20
test al, al
jne 0x1401836d8
cmp byte [rsp + 0x77], 0
js 0x140183775
mov byte [rsp + 0x77], 3
lea rax, [rsp + 0x60]
movzx ecx, word [0x1401f536a]
mov word [rax + 4], cx
mov ecx, dword [0x1401f5366]
mov dword [rax], ecx
mov word [rax + 6], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x110]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x38]
mov rbp, qword [rax + 0x40]
cmp rbp, qword [rax + 0x48]
je 0x140183c8b
cmp byte [rsp + 0x77], 0
js 0x140183761
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x28], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x18], xmm0
add rbp, 0x30
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x40], rbp
cmp rbx, r12
je 0x140183b10
mov rbx, qword [rsp + 0x90]
jmp 0x140183654
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rcx, rbp
call fcn.1400d5aa0
jmp 0x14018372f
mov qword [rsp + 0x68], 3
mov rax, qword [rsp + 0x60]
jmp 0x1401836bf
lea r8, [r12 + 0x10]
lea rdx, [rsp + 0x2f0]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.1401850f0
test al, al
je 0x1401839be
movaps xmm6, xmmword [0x1401d9dd0]
lea r8, [rsp + 0x60]
movaps xmmword [r8 + 0x10], xmm6
movaps xmmword [r8], xmm6
mov dword [r8 + 0x20], 0xaaaaaaaa
mov edx, dword [rsp + 0x6bc]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x20], rdi
mov r9d, 0x24
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
mov rdi, rsi
je 0x140183b34
cmp qword [rsp + 0x90], 0x24
jne 0x140183b98
lea r15, [rsp + 0xb4]
mov qword [r15 + 0x1c], rbp
movaps xmmword [r15 + 0xc], xmm6
movaps xmmword [r15 - 4], xmm6
movaps xmmword [r15 - 0x14], xmm6
movaps xmmword [r15 - 0x24], xmm6
lea r14, [rsp + 0x138]
xorps xmm0, xmm0
movaps xmmword [r14 + 8], xmm0
movaps xmmword [r14 - 8], xmm0
movaps xmmword [r14 - 0x18], xmm0
mov rax, r12
mov r12d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x48], ecx
add rax, 0x38
mov qword [rsp + 0x40], rax
lea r13, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
lea rdi, [rsp + 0x90]
mov rsi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, r12d
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbp
mov qword [rsp + 0x20], r13
mov r9d, 0x48
mov rcx, qword [rsp + 0x30]
mov r8, rdi
call rsi
test eax, eax
je 0x140183d30
cmp qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], 0x48
jne 0x140183bf3
mov rcx, qword [rsp + 0x30]
mov rdx, r15
lea r8, [rsp + 0x120]
call fcn.1401850f0
test al, al
jne 0x1401838f5
cmp byte [rsp + 0x137], 0
js 0x1401839a5
mov byte [rsp + 0x137], 3
lea rax, [rsp + 0x120]
movzx ecx, word [0x1401f536a]
mov word [rax + 4], cx
mov ecx, dword [0x1401f5366]
mov dword [rax], ecx
mov word [rax + 6], 0
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xb0]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rcx
mov eax, dword [rsp + 0xd4]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0x40]
cmp rbx, qword [rax + 0x48]
je 0x140183d19
cmp byte [rsp + 0x137], 0
js 0x14018398b
mov rax, qword [rsp + 0x130]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x120]
movups xmmword [rbx], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rbx + 0x28], rax
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x18], xmm0
add rbx, 0x30
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x40], rbx
cmp r12d, dword [rsp + 0x48]
je 0x140183c70
mov r12d, dword [rsp + 0x90]
jmp 0x14018386e
mov rdx, qword [rsp + 0x120]
mov r8, qword [rsp + 0x128]
mov rcx, rbx
call fcn.1400d5aa0
jmp 0x140183956
mov qword [rsp + 0x128], 3
mov rax, qword [rsp + 0x120]
jmp 0x1401838dc
xor eax, eax
mov rdi, rsi
jmp 0x140182f5f
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_LDR_DATA_crashpad::process_types::internal::Traits64__
mov r8d, 0xb6
jmp 0x140182ece
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_LDR_DATA_crashpad::process_types::internal::Traits64__
mov r8d, 0xb6
jmp 0x140182f38
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140183b10
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::LDR_DATA_TABLE_ENTRY_crashpad::process_types::internal::Traits64__
mov r8d, 0xbe
mov rcx, rax
call fcn.1400cf4f0
lea rdx, str._incorrect_size
mov r8d, 0xf
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
cmp byte [rsp + 0x77], 0
js 0x140183b28
mov al, 1
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
jmp 0x140182f5f
mov rcx, qword [rsp + 0x60]
call fcn.140100564
jmp 0x140183b17
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_LDR_DATA_crashpad::process_types::internal::Traits32__
jmp 0x140183a27
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140182f5d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::PEB_LDR_DATA_crashpad::process_types::internal::Traits32__
jmp 0x140183a88
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140183c70
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14004a520
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::LDR_DATA_TABLE_ENTRY_crashpad::process_types::internal::Traits32__
mov r8d, 0xbe
mov rcx, rax
call fcn.1400cf4f0
lea rdx, str._incorrect_size
mov r8d, 0xf
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.14004a9c0
cmp byte [rsp + 0x137], 0
jns 0x140183b17
mov rcx, qword [rsp + 0x120]
jmp 0x140183b2d
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.140184eb0
jmp 0x14018374b
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140183b10
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::LDR_DATA_TABLE_ENTRY_crashpad::process_types::internal::Traits64__
mov r8d, 0xbe
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x140183b10
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x120]
call fcn.140184eb0
jmp 0x140183973
mov ecx, 2
call fcn.1400d9610
test al, al
je 0x140183c70
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov r8d, 0x76
mov r9d, 2
call fcn.140158e40
lea rcx, [rsp + 0x170]
lea rdx, [0x1401f536e]
mov r8d, 0x12
call fcn.1400cf4f0
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::ReadStruct_HANDLE__crashpad::WinVMAddress__T____T__crashpad::process_types::LDR_DATA_TABLE_ENTRY_crashpad::process_types::internal::Traits32__
mov r8d, 0xbe
mov rcx, rax
call fcn.1400cf4f0
mov rcx, rsi
call fcn.140158f30
jmp 0x140183c70
mov rcx, qword [rsp + 0x40]
call fcn.140131070
lea rcx, [0x14021fa78]
call fcn.140100680
cmp dword [0x14021fa78], 0xffffffff
jne 0x140182a3c
lea rcx, [0x1401e6676]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14008f0d0
mov qword [0x14021fa70], rax
lea rcx, [0x14021fa78]
call fcn.140100718
jmp 0x140182a3c