Function at 0x140098e10
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movdqa xmmword [rsp + 0x300], xmm6
mov r15, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea rdx, [rsp + 0x2d8]
movdqu xmmword [rdx + 0x10], xmm0
mov word [rdx], 0
mov rcx, qword [rcx]
call fcn.14009eb10
mov rsi, qword [r15]
mov rbp, qword [rsi + 0x90]
mov rdi, qword [rsi + 0x98]
cmp rbp, rdi
je 0x140098ee4
lea rsi, [rsp + 0x180]
lea r14, [rsp + 0xb0]
lea rbx, [rsp + 0x2d8]
cmp qword [rbp + 0x18], 0xf
mov rax, rbp
jbe 0x140098ea6
mov rax, qword [rbp]
mov qword [rsp + 0xb0], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xb8], rax
mov rcx, rsi
mov rdx, r14
call fcn.1400405a0
mov rcx, rsi
mov rdx, rbx
call fcn.14009eb10
mov rcx, rsi
call fcn.1400066b0
add rbp, 0x20
cmp rdi, rbp
jne 0x140098e98
mov rsi, qword [r15]
cmp qword [rsi + 0x30], 0
je 0x140098f5c
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x20
mov byte [rdi], 0
lea rdx, str.database
mov r8d, 8
mov rcx, rdi
call fcn.140006510
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14009a2a0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14009eb10
mov rcx, rbx
call fcn.1400066b0
mov rcx, rdi
call fcn.1400064a0
mov rsi, qword [r15]
cmp qword [rsi + 0x50], 0
je 0x140098fd4
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x40
mov byte [rdi], 0
lea rdx, str.metrics_dir
mov r8d, ntohl
mov rcx, rdi
call fcn.140006510
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14009a2a0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14009eb10
mov rcx, rbx
call fcn.1400066b0
mov rcx, rdi
call fcn.1400064a0
mov rsi, qword [r15]
mov rax, qword [rsi + 0x70]
test rax, rax
mov qword [rsp + 0x58], r15
je 0x14009908b
cmp qword [rsi + 0x78], 0xf
jbe 0x140098ff3
mov rsi, qword [rsi + 0x60]
jmp 0x140098ff7
add rsi, 0x60
lea rdx, [rsp + 0xa0]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400405a0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x130]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, [0x140158a01]
mov r8d, 3
mov rcx, rdi
call fcn.140006510
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14009a2a0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14009eb10
mov rcx, rbx
call fcn.1400066b0
mov rcx, rdi
call fcn.1400064a0
mov rcx, rsi
call fcn.1400066b0
mov rsi, qword [r15]
mov r15, qword [rsi + 0x80]
mov r12, qword [r15]
mov qword [rsp + 0x60], r12
cmp r12, r15
je 0x14009922f
mov r14d, 0xf
movq xmm6, r14
pslldq xmm6, 8
xor r13d, r13d
lea rdi, [rsp + 0x2b0]
lea rsi, [rsp + 0xc0]
lea rbx, [rsp + 0x290]
lea rbp, [rsp + 0x180]
movdqu xmmword [rsp + 0x2c0], xmm6
mov byte [rsp + 0x2b0], r13b
mov rdx, qword [r12 + 0x30]
inc rdx
mov rcx, rdi
call fcn.14003eb60
mov r8, qword [r12 + 0x30]
cmp qword [r12 + 0x38], r14
jbe 0x14009910a
mov rdx, qword [r12 + 0x20]
jmp 0x14009910f
lea rdx, [r12 + 0x20]
mov rcx, rdi
call fcn.140009660
mov dl, 0x3d
mov rcx, rdi
call fcn.140019340
mov r8, qword [r12 + 0x50]
cmp qword [r12 + 0x58], r14
jbe 0x140099134
mov r12, qword [r12 + 0x40]
jmp 0x140099138
add r12, 0x40
mov rcx, rdi
mov rdx, r12
call fcn.140009660
movdqu xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x130], xmm0
movdqu xmmword [rax + 0x10], xmm6
mov byte [rax], r13b
mov rax, qword [rsp + 0x140]
cmp qword [rsp + 0x148], r14
lea rcx, [rsp + 0x130]
jbe 0x140099186
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov rcx, rsi
lea rdx, [rsp + 0x90]
call fcn.1400405a0
movdqu xmmword [rsp + 0x2a0], xmm6
mov byte [rsp + 0x290], r13b
mov r8d, 0xa
mov rcx, rbx
lea rdx, str.annotation
call fcn.140006510
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call fcn.14009a2a0
mov rcx, rbp
lea rdx, [rsp + 0x2d8]
call fcn.14009eb10
mov rcx, rbp
call fcn.1400066b0
mov rcx, rbx
call fcn.1400064a0
mov rcx, rsi
call fcn.1400066b0
lea rcx, [rsp + 0x130]
call fcn.1400064a0
mov rcx, rdi
call fcn.1400064a0
lea rcx, [rsp + 0x60]
call fcn.1400986b0
mov r12, qword [rsp + 0x60]
cmp r12, r15
jne 0x1400990d6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140099355
mov r15, qword [rsp + 0x58]
mov rcx, qword [r15]
mov rcx, qword [rcx + 0xc8]
mov r9, qword [0x14017b790]
mov r8, qword [0x14017b788]
mov rdx, qword [0x14017b780]
lea rbp, [0x14017f978]
mov qword [rsp + 0x40], rbp
lea rbp, [0x14017f968]
mov qword [rsp + 0x38], rbp
lea rbp, [0x14017f958]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x130]
mov rcx, rdi
call fcn.14009ec50
lea rsi, [rsp + 0x2b0]
mov rcx, rdi
mov rdx, rsi
call fcn.14009efa0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x290]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, str.__initial_client_data
mov r8d, 0x16
mov rcx, rdi
call fcn.140006510
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov r9, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov rdx, rcx
sub rdx, r9
cmp r8, rdx
jbe 0x1400993bd
mov rdx, rax
sub rdx, r8
cmp rdx, r9
jb 0x1400993bd
cmp rcx, 0xf
jbe 0x14009933e
mov rdi, qword [rsp + 0x290]
lea rcx, [rsp + 0x2b0]
xor edx, edx
mov r8, rdi
call fcn.140019390
jmp 0x1400993db
mov ecx, 2
call fcn.14002c2f0
xor ebx, ebx
test al, al
mov r15, qword [rsp + 0x58]
je 0x1400999d0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x180
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, [0x140158a10]
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
xor ebx, ebx
jmp 0x1400999d0
cmp rax, 0xf
jbe 0x1400993cb
mov rsi, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x290]
mov rdx, rsi
call fcn.140009660
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x10], xmm0
mov byte [rax], 0
lea rsi, [rsp + 0xc0]
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
jbe 0x140099427
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x180]
mov rcx, rdi
call fcn.1400405a0
lea rbx, [rsp + 0x2d8]
mov rcx, rdi
mov rdx, rbx
call fcn.14009eb10
mov rcx, rdi
call fcn.1400066b0
mov rcx, rsi
call fcn.1400064a0
lea r14, [rsp + 0x290]
mov rcx, r14
call fcn.1400064a0
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.1400064a0
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xf0], xmm6
movdqa xmmword [rsp + 0x120], xmm6
movdqa xmmword [rsp + 0x110], xmm6
movdqa xmmword [rsp + 0x100], xmm6
movdqa xmmword [rsp + 0xe0], xmm6
movdqa xmmword [rsp + 0xd0], xmm6
movdqa xmmword [rsp + 0xc0], xmm6
mov dword [rsp + 0xfc], 0x100
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov qword [rsp + 0x110], rax
mov ecx, 0xfffffff5
call rdi
mov qword [rsp + 0x118], rax
mov ecx, 0xfffffff4
call rdi
mov qword [rsp + 0x120], rax
xor eax, eax
mov qword [rsi + 0x10], rax
movdqa xmmword [rsi], xmm6
mov qword [rsp + 0x70], rax
mov eax, dword [0x14017f9b8]
mov ecx, dword [0x1401800d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x140099ae8
mov eax, dword [0x14017f9c8]
mov ecx, dword [0x1401800d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x140099b31
mov rbp, qword [0x14017f9b0]
test rbp, rbp
je 0x1400995fa
mov rax, qword [0x14017f9c0]
test rax, rax
je 0x1400995fa
mov dword [rsp + 0xc0], 0x70
lea r9, [rsp + 0x290]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call rbp
test eax, eax
je 0x140099802
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x1400999a8
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b1
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x188]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
call fcn.140002bb0
mov rcx, rsi
call fcn.14002c830
jmp 0x1400999a8
mov dword [rsp + 0xc0], 0x68
xor edi, edi
xor eax, eax
cmp qword [rsp + 0x2f0], 7
jbe 0x14009961c
mov rbx, qword [rsp + 0x2d8]
mov rcx, qword [r15]
cmp qword [rcx + 0x18], 8
jb 0x140099629
mov rcx, qword [rcx]
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x40], rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14009979f
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14002c2f0
test esi, esi
jne 0x1400996d2
test al, al
je 0x1400996d2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f0
mov r9d, 1
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_thread
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14002c2f0
test esi, esi
jne 0x14009973c
test al, al
je 0x14009973c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f3
mov r9d, 1
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_process
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
mov ecx, 0xc8
add rcx, qword [r15]
lea rsi, [rsp + 0x180]
mov qword [rsi], 0xffffffffffffffff
mov rdx, rsi
call fcn.14009a090
pxor xmm0, xmm0
movdqu xmmword [rsi + 0x14], xmm0
movdqu xmmword [rsi + 4], xmm0
mov dword [rsi], 2
lea r8, [rsp + 0x60]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r15]
lea rdx, [rsp + 0x180]
call fcn.14009e600
mov ebx, eax
jmp 0x1400999ac
mov ecx, 2
call fcn.14002c2f0
xor ebx, ebx
test al, al
je 0x1400999ac
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1eb
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.CreateProcess
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
xor ebx, ebx
jmp 0x1400999ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140099952
lea rsi, [rsp + 0x290]
mov rcx, qword [rsi]
call fcn.14011a3b0
mov rdi, rax
mov qword [rsp + 0x128], rax
mov edx, 1
xor r8d, r8d
mov rcx, rax
mov r9, rsi
call qword [0x14017f9b0]
test eax, eax
je 0x140099a44
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14009a500
mov rax, qword [rsp + 0x128]
mov qword [rsi], rax
mov rax, qword [rsp + 0x2c0]
sub rax, qword [rsp + 0x2b0]
sar rax, 3
cmp rax, 7
ja 0x14009988c
lea rcx, [rsp + 0x2b0]
mov edx, 8
call fcn.1400ca180
lea rdx, [0x14017b780]
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.1401028b0
lea rdx, [0x14017b788]
mov rcx, rsi
call fcn.1401028b0
lea rdx, [0x14017b790]
mov rcx, rsi
call fcn.1401028b0
mov edx, 0xc8
add rdx, qword [r15]
mov rcx, rsi
call fcn.1401028b0
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.1401028b0
mov rdx, qword [rsp + 0x110]
mov rcx, rsi
call fcn.14009a480
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call fcn.14009a480
mov rdx, qword [rsp + 0x120]
mov rcx, rsi
call fcn.14009a480
mov r9, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r9
mov rcx, qword [rsp + 0x128]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x20002
call qword [0x14017f9c0]
test eax, eax
je 0x140099a96
mov eax, 0x80000
jmp 0x140099609
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x1400999a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b5
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList__size_
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
xor ebx, ebx
xor edi, edi
lea rcx, [rsp + 0x70]
call fcn.14009a500
test rdi, rdi
je 0x1400999c3
mov rcx, rdi
call fcn.14011a3a0
lea rcx, [rsp + 0x2b0]
call fcn.1400dbd10
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400999ee
call fcn.14009e520
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x2d8]
call fcn.1400066b0
cmp bl, 1
mov eax, 1
adc rax, 0
xchg qword [0x14017f9a8], rax
mov rcx, r15
call fcn.14009a1e0
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.14011a370
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x1400997fb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1c0
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList
jmp 0x1400997ee
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x1400997fb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1da
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x190]
lea rdx, str.UpdateProcThreadAttribute
jmp 0x1400997ee
lea rcx, [0x14017f9b8]
call fcn.14011a5a0
mov eax, dword [0x14017f9b8]
cmp eax, 0xffffffff
jne 0x14009953c
lea rcx, [0x14014ae76]
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.14009f040
mov qword [0x14017f9b0], rax
lea rcx, [0x14017f9b8]
call fcn.14011a540
jmp 0x14009953c
lea rcx, [0x14017f9c8]
call fcn.14011a5a0
mov eax, dword [0x14017f9c8]
cmp eax, 0xffffffff
jne 0x140099561
cmp qword [0x14017f9b0], 0
je 0x140099b6e
lea rcx, [0x14014ae76]
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.14009f040
jmp 0x140099b70
xor eax, eax
mov qword [0x14017f9c0], rax
lea rcx, [0x14017f9c8]
call fcn.14011a540
jmp 0x140099561