Function at 0x1400c7758
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xbc8]
sub rsp, 0xca0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0xb90], rax
xor esi, esi
lea rdx, [rbp + 0x940]
mov dword [rsp + 0x50], esi
mov r12, rcx
mov rcx, qword [rcx]
mov r15d, esi
mov qword [rbp + 0x958], 7
mov qword [rbp + 0x950], rsi
mov word [rbp + 0x940], si
call fcn.1400f9398
mov rbx, qword [r12]
lea r13d, [rsi + 1]
mov rdi, qword [rbx + 0x98]
mov rbx, qword [rbx + 0x90]
jmp 0x1400c7838
cmp qword [rbx + 0x18], 0x10
jb 0x1400c77e7
mov rax, qword [rbx]
jmp 0x1400c77ea
mov rax, rbx
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rbp + 0xa30]
mov qword [rbp - 0x68], rax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x30], xmm0
call fcn.140050c60
lea rdx, [rbp + 0x940]
lea rcx, [rbp + 0xa30]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xa30]
mov dl, r13b
call fcn.140029bc0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400c77db
mov rax, qword [r12]
mov ebx, 0xf
cmp qword [rax + 0x30], rsi
je 0x1400c78ec
lea r8d, [rbx - 7]
mov qword [rbp + 0x9b8], rbx
lea rdx, str.database
mov qword [rbp + 0x9b0], rsi
lea rcx, [rbp + 0x9a0]
mov byte [rbp + 0x9a0], sil
call fcn.14002a1a4
mov r8, qword [r12]
lea rdx, [rbp + 0x9a0]
add r8, 0x20
lea rcx, [rbp + 0xb10]
call fcn.1400c7320
mov rcx, rax
lea rdx, [rbp + 0x940]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xb10]
mov dl, r13b
call fcn.140029bc0
mov rdx, qword [rbp + 0x9b8]
cmp rdx, 0x10
jb 0x1400c78d7
mov rcx, qword [rbp + 0x9a0]
inc rdx
mov r8, r13
call fcn.1400223b0
mov qword [rbp + 0x9b8], rbx
mov qword [rbp + 0x9b0], rsi
mov byte [rbp + 0x9a0], sil
mov rax, qword [r12]
cmp qword [rax + 0x50], rsi
je 0x1400c7998
mov r8d, ntohl
mov qword [rbp + 0x9f8], rbx
lea rdx, str.metrics_dir
mov qword [rbp + 0x9f0], rsi
lea rcx, [rbp + 0x9e0]
mov byte [rbp + 0x9e0], sil
call fcn.14002a1a4
mov r8, qword [r12]
lea rdx, [rbp + 0x9e0]
add r8, 0x40
lea rcx, [rbp + 0xb30]
call fcn.1400c7320
mov rcx, rax
lea rdx, [rbp + 0x940]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xb30]
mov dl, r13b
call fcn.140029bc0
mov rdx, qword [rbp + 0x9f8]
cmp rdx, 0x10
jb 0x1400c7983
mov rcx, qword [rbp + 0x9e0]
inc rdx
mov r8, r13
call fcn.1400223b0
mov qword [rbp + 0x9f8], rbx
mov qword [rbp + 0x9f0], rsi
mov byte [rbp + 0x9e0], sil
mov rax, qword [r12]
cmp qword [rax + 0x70], rsi
je 0x1400c7a8f
mov r8d, 3
mov qword [rbp + 0x9d8], rbx
lea rdx, [0x1401594ec]
mov qword [rbp + 0x9d0], rsi
lea rcx, [rbp + 0x9c0]
mov byte [rbp + 0x9c0], sil
call fcn.14002a1a4
mov rax, qword [r12]
cmp qword [rax + 0x78], 0x10
jb 0x1400c79e5
mov rcx, qword [rax + 0x60]
jmp 0x1400c79e9
lea rcx, [rax + 0x60]
mov rax, qword [rax + 0x70]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp + 0xa50]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.140050c60
lea r8, [rbp + 0xa50]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0xb50]
call fcn.1400c7320
mov rcx, rax
lea rdx, [rbp + 0x940]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xb50]
mov dl, r13b
call fcn.140029bc0
xor r8d, r8d
lea rcx, [rbp + 0xa50]
mov dl, r13b
call fcn.140029bc0
mov rdx, qword [rbp + 0x9d8]
cmp rdx, 0x10
jb 0x1400c7a7a
mov rcx, qword [rbp + 0x9c0]
inc rdx
mov r8, r13
call fcn.1400223b0
mov qword [rbp + 0x9d8], rbx
mov qword [rbp + 0x9d0], rsi
mov byte [rbp + 0x9c0], sil
mov rdi, qword [r12]
mov rdi, qword [rdi + 0x80]
mov rbx, qword [rdi]
jmp 0x1400c7cfa
mov r8d, 0xa
mov qword [rbp + 0xa18], 0xf
lea rdx, str.annotation
mov qword [rbp + 0xa10], rsi
lea rcx, [rbp + 0xa00]
mov byte [rbp + 0xa00], sil
call fcn.14002a1a4
mov rdx, qword [rbx + 0x30]
inc rdx
mov qword [rbp + 0x978], 0xf
mov qword [rbp + 0x970], rsi
mov byte [rbp + 0x960], sil
cmp rdx, 0xf
je 0x1400c7b2e
mov r8b, r13b
lea rcx, [rbp + 0x960]
call fcn.14002b41c
test al, al
je 0x1400c7b2e
cmp qword [rbp + 0x978], 0x10
lea rax, [rbp + 0x960]
mov qword [rbp + 0x970], rsi
cmovae rax, qword [rbp + 0x960]
mov byte [rax], sil
or r9, 0xffffffffffffffff
lea rdx, [rbx + 0x20]
xor r8d, r8d
lea rcx, [rbp + 0x960]
call fcn.14002a4e8
mov r8b, 0x3d
lea rcx, [rbp + 0x960]
mov rdx, r13
call fcn.14002b580
lea rdx, [rbx + 0x40]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x960]
call fcn.14002a4e8
mov r14d, 0xf
mov qword [rbp + 0x990], rsi
mov rdx, rax
mov qword [rbp + 0x998], r14
lea rcx, [rbp + 0x980]
mov byte [rbp + 0x980], sil
call fcn.14002a5f4
cmp qword [rbp + 0x998], 0x10
lea rax, [rbp + 0x980]
lea rdx, [rbp - 0x10]
cmovae rax, qword [rbp + 0x980]
lea rcx, [rbp + 0xa70]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x990]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140050c60
lea r8, [rbp + 0xa70]
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0xab0]
call fcn.1400c7320
mov rcx, rax
lea rdx, [rbp + 0x940]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xab0]
mov dl, r13b
call fcn.140029bc0
xor r8d, r8d
lea rcx, [rbp + 0xa70]
mov dl, r13b
call fcn.140029bc0
mov rdx, qword [rbp + 0x998]
cmp rdx, 0x10
jb 0x1400c7c43
mov rcx, qword [rbp + 0x980]
inc rdx
mov r8, r13
call fcn.1400223b0
mov rdx, qword [rbp + 0x978]
mov qword [rbp + 0x998], r14
mov qword [rbp + 0x990], rsi
mov byte [rbp + 0x980], sil
cmp rdx, 0x10
jb 0x1400c7c77
mov rcx, qword [rbp + 0x960]
inc rdx
mov r8, r13
call fcn.1400223b0
mov rdx, qword [rbp + 0xa18]
mov qword [rbp + 0x978], r14
mov qword [rbp + 0x970], rsi
mov byte [rbp + 0x960], sil
cmp rdx, 0x10
jb 0x1400c7cab
mov rcx, qword [rbp + 0xa00]
inc rdx
mov r8, r13
call fcn.1400223b0
mov qword [rbp + 0xa18], r14
mov qword [rbp + 0xa10], rsi
mov byte [rbp + 0xa00], sil
cmp byte [rbx + 0x19], sil
jne 0x1400c7cfa
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], sil
jne 0x1400c7cde
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x1400c7cd0
jmp 0x1400c7cfa
mov rax, qword [rbx + 8]
jmp 0x1400c7cf1
cmp rbx, qword [rax + 0x10]
jne 0x1400c7cf7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], sil
je 0x1400c7ce4
mov rbx, rax
cmp rbx, rdi
jne 0x1400c7aa2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, r13d
mov ecx, 0x1f0fff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400c7daf
lea edi, [rax + 2]
cmp dword [0x14017c080], edi
jg 0x1400c7d6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0xc8]
mov dword [rsp + 0x20], eax
mov r8d, 0x180
call fcn.140068d00
lea rdx, [0x140159460]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov r15d, r13d
test r13b, r15b
je 0x1400c7d7d
lea rcx, [rbp + 0xc8]
call fcn.140068d80
lea rcx, [rsp + 0x58]
call fcn.1400c8d3c
mov dl, r13b
xor r8d, r8d
lea rcx, [rbp + 0x940]
call fcn.140029bc0
xchg qword [0x14017a928], rdi
mov rcx, r12
call fcn.1400c8b50
xor al, al
jmp 0x1400c85af
mov rcx, qword [r12]
mov r8, qword [0x140175d30]
mov r9, qword [0x140175d38]
mov r10, qword [0x140175d40]
mov rdx, qword [rcx + 0xc8]
movsxd rcx, eax
cmp rax, rcx
je 0x1400c7dda
int3
movsxd rcx, edx
cmp rdx, rcx
je 0x1400c7de5
int3
movsxd rcx, r10d
cmp r10, rcx
je 0x1400c7df1
int3
movsxd rcx, r9d
cmp r9, rcx
je 0x1400c7dfd
int3
movsxd rcx, r8d
cmp r8, rcx
je 0x1400c7e09
int3
lea rcx, [0x14017a930]
mov qword [rsp + 0x48], rcx
lea rcx, [0x14017a958]
mov qword [rsp + 0x40], rcx
lea rcx, [0x14017a918]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0xa90]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_I64x_0x_I64x_0x_I64x
mov dword [rsp + 0x20], r10d
call fcn.140065790
lea rdx, str.__initial_client_data
lea rcx, [rbp + 0xb70]
call fcn.140028eb4
mov rdx, rax
lea r8, [rbp + 0xa90]
lea rcx, [rbp + 0xaf0]
call fcn.140069ba0
cmp qword [rax + 0x18], 0x10
jb 0x1400c7e82
mov rcx, qword [rax]
jmp 0x1400c7e85
mov rcx, rax
mov rax, qword [rax + 0x10]
lea rdx, [rbp]
mov qword [rbp - 0x40], rcx
lea rcx, [rbp + 0xad0]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp], xmm0
call fcn.140050d70
mov rcx, rax
lea rdx, [rbp + 0x940]
call fcn.1400f9398
xor r8d, r8d
lea rcx, [rbp + 0xad0]
mov dl, r13b
call fcn.140029bc0
lea rcx, [rbp + 0xaf0]
call fcn.140028e70
lea rcx, [rbp + 0xb70]
call fcn.140028e70
lea rcx, [rbp + 0xa90]
call fcn.140028e70
xor edx, edx
lea rcx, [rbp + 0x30]
lea r8d, [rdx + 0x70]
call fcn.140113400
mov ecx, 0xfffffff6
mov dword [rbp + 0x6c], 0x100
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
mov qword [rbp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [rbp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov qword [rbp + 0x90], rax
mov rbx, rsi
mov rax, qword gs:[0x58]
mov r14, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x50], rsi
mov rdi, qword [rax]
mov eax, 0x18
mov eax, dword [rax + rdi]
cmp dword [0x14017c54c], eax
jg 0x1400c85df
mov eax, 0x18
mov eax, dword [rax + rdi]
cmp dword [0x14017c578], eax
jg 0x1400c8623
mov rax, qword [0x14017c550]
test rax, rax
je 0x1400c82cb
cmp qword [0x14017c570], rsi
je 0x1400c82cb
lea r9, [rsp + 0x78]
mov dword [rbp + 0x30], 0x70
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
mov edi, 0x80000
call rax
test eax, eax
je 0x1400c8027
mov edi, 2
mov ecx, edi
call fcn.140067fc0
test al, al
je 0x1400c8007
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
mov r8d, 0x1b1
lea rcx, [rbp + 0x838]
call fcn.1400681c0
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
lea rcx, [rax + 8]
call fcn.14002bcb4
mov r15d, edi
test dil, r15b
je 0x1400c8018
lea rcx, [rbp + 0x838]
call fcn.140068220
lea rcx, [rsp + 0x50]
call fcn.1400c8df8
jmp 0x1400c7d7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400c8090
mov edi, 2
mov ecx, edi
call fcn.140067fc0
test al, al
je 0x1400c807c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x728]
mov dword [rsp + 0x20], eax
mov r8d, 0x1b5
call fcn.140068d00
lea rdx, str.InitializeProcThreadAttributeList__size_
lea rcx, [rax + 0x10]
call fcn.14002bcb4
lea r15d, [rdi + 2]
test r15b, 4
je 0x1400c8018
lea rcx, [rbp + 0x728]
call fcn.140068d80
jmp 0x1400c8018
mov rcx, qword [rsp + 0x78]
call fcn.140111e80
lea r9, [rsp + 0x78]
mov qword [rbp - 0x80], rax
xor r8d, r8d
mov qword [rbp + 0x98], rax
mov edx, r13d
mov rcx, rax
mov rbx, rax
call qword [0x14017c550]
test eax, eax
jne 0x1400c813a
lea edi, [rax + 2]
mov ecx, edi
call fcn.140067fc0
test al, al
je 0x1400c8108
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x1d8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1c0
call fcn.140068d00
lea rdx, [0x1401517a0]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
lea r15d, [rdi + 6]
test r15b, 8
je 0x1400c811a
lea rcx, [rbp + 0x1d8]
call fcn.140068d80
lea rcx, [rsp + 0x50]
call fcn.1400c8df8
test rbx, rbx
je 0x1400c7d7d
mov rcx, rbx
call fcn.140111880
jmp 0x1400c7d7d
lea rcx, [rsp + 0x50]
call fcn.1400c8df8
mov rax, qword [rbp + 0x98]
lea rcx, [rsp + 0x60]
mov edx, 8
mov qword [rsp + 0x50], rax
call fcn.140058ee0
lea rdx, [0x140175d30]
lea rcx, [rsp + 0x60]
call fcn.1400c8c28
lea rdx, [0x140175d38]
lea rcx, [rsp + 0x60]
call fcn.1400c8c28
lea rdx, [0x140175d40]
lea rcx, [rsp + 0x60]
call fcn.1400c8c28
mov rdx, qword [r12]
lea rcx, [rsp + 0x60]
add rdx, 0xc8
call fcn.1400c8c28
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.1400c8c28
mov rdx, qword [rbp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400c7470
mov rdx, qword [rbp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.1400c7470
mov rdx, qword [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.1400c7470
mov r13, qword [rsp + 0x60]
xor edx, edx
mov rax, qword [rsp + 0x68]
mov r9, r13
mov rcx, qword [rbp + 0x98]
sub rax, r13
and rax, 0xfffffffffffffff8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov r8d, 0x20002
mov qword [rsp + 0x20], rax
call qword [0x14017c570]
test eax, eax
jne 0x1400c82c4
lea edi, [rax + 2]
mov ecx, edi
call fcn.140067fc0
test al, al
je 0x1400c8271
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x2e8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1da
call fcn.140068d00
lea rdx, str.UpdateProcThreadAttribute
lea rcx, [rax + 0x10]
call fcn.14002bcb4
lea r15d, [rdi + 0xe]
test r15b, 0x10
je 0x1400c8283
lea rcx, [rbp + 0x2e8]
call fcn.140068d80
lea rcx, [rsp + 0x50]
call fcn.1400c8df8
test rbx, rbx
je 0x1400c829a
mov rcx, rbx
call fcn.140111880
test r13, r13
je 0x1400c82b3
mov r8, qword [rsp + 0x70]
sub r8, r13
sar r8, 3
mov rdx, r13
call fcn.140057490
lea rcx, [rsp + 0x58]
call fcn.1400c8d3c
mov dl, 1
jmp 0x1400c7d8a
mov r14, qword [rsp + 0x70]
jmp 0x1400c82d9
mov r13, qword [rsp + 0x60]
mov edi, esi
mov dword [rbp + 0x30], 0x68
cmp qword [rbp + 0x958], 8
lea rdx, [rbp + 0x940]
mov rcx, qword [r12]
cmovae rdx, qword [rbp + 0x940]
cmp qword [rcx + 0x18], 8
jb 0x1400c82fe
mov rcx, qword [rcx]
lea rax, [rbp + 0x10]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400c83c4
lea edi, [rax + 2]
mov ecx, edi
call fcn.140067fc0
test al, al
je 0x1400c8383
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x3f8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1eb
call fcn.140068d00
lea rdx, str.CreateProcess
lea rcx, [rax + 0x10]
call fcn.14002bcb4
lea r15d, [rdi + 0x1e]
test r15b, 0x20
je 0x1400c8395
lea rcx, [rbp + 0x3f8]
call fcn.140068d80
lea rcx, [rsp + 0x50]
call fcn.1400c8df8
test rbx, rbx
je 0x1400c83ac
mov rcx, rbx
call fcn.140111880
test r13, r13
je 0x1400c82b3
sub r14, r13
sar r14, 3
mov r8, r14
jmp 0x1400c82ab
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
mov edx, eax
call fcn.140067fc0
test al, al
je 0x1400c841b
test edx, edx
jne 0x1400c841b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x508]
mov dword [rsp + 0x20], eax
mov r8d, 0x1f0
call fcn.140068d00
lea rdx, str.CloseHandle_thread
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov r15d, 0x40
test r15b, 0x40
je 0x1400c8431
and r15d, 0xffffffbf
lea rcx, [rbp + 0x508]
call fcn.140068d80
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
mov edx, eax
call fcn.140067fc0
test al, al
je 0x1400c8487
test edx, edx
jne 0x1400c8487
bts r15d, 7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp + 0x618]
mov dword [rsp + 0x20], eax
mov r8d, 0x1f3
call fcn.140068d00
lea rdx, str.CloseHandle_process
lea rcx, [rax + 0x10]
call fcn.14002bcb4
test r15b, r15b
jns 0x1400c8498
lea rcx, [rbp + 0x618]
call fcn.140068d80
mov rcx, qword [r12]
lea rdx, [rbp - 0x78]
or qword [rbp - 0x78], 0xffffffffffffffff
add rcx, 0xc8
call fcn.1400c8db4
xor edx, edx
lea rcx, [rbp + 0xa0]
lea r8d, [rdx + 0x24]
call fcn.140113400
mov rcx, qword [r12]
lea r8, [rbp + 0xa20]
xor eax, eax
lea rdx, [rbp + 0xa0]
mov edi, 2
mov qword [rbp + 0xa20], rax
add rcx, 0xa8
mov dword [rbp + 0xa0], edi
mov dword [rbp + 0xa28], eax
call fcn.1400f8bf8
lea rcx, [rsp + 0x50]
test al, al
jne 0x1400c8551
call fcn.1400c8df8
test rbx, rbx
je 0x1400c8516
mov rcx, rbx
call fcn.140111880
test r13, r13
je 0x1400c852d
sub r14, r13
mov rdx, r13
sar r14, 3
mov r8, r14
call fcn.140057490
lea rcx, [rsp + 0x58]
call fcn.1400c8d3c
xor r8d, r8d
lea rcx, [rbp + 0x940]
mov dl, 1
call fcn.140029bc0
xchg qword [0x14017a928], rdi
jmp 0x1400c85a4
call fcn.1400c8df8
test rbx, rbx
je 0x1400c8563
mov rcx, rbx
call fcn.140111880
test r13, r13
je 0x1400c857a
sub r14, r13
mov rdx, r13
sar r14, 3
mov r8, r14
call fcn.140057490
lea rcx, [rsp + 0x58]
call fcn.1400c8d3c
xor r8d, r8d
lea rcx, [rbp + 0x940]
mov dl, 1
call fcn.140029bc0
mov eax, 1
mov sil, 1
xchg qword [0x14017a928], rax
mov rcx, r12
call fcn.1400c8b50
mov al, sil
mov rcx, qword [rbp + 0xb90]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [0x14017c54c]
call fcn.140111a38
cmp dword [0x14017c54c], 0xffffffff
jne 0x1400c7f78
lea rdx, str.::InitializeProcThreadAttributeList
lea rcx, str.kernel32.dll
call fcn.1400b64b4
lea rcx, [0x14017c54c]
mov qword [0x14017c550], rax
call fcn.1401119d8
jmp 0x1400c7f78
lea rcx, [0x14017c578]
call fcn.140111a38
cmp dword [0x14017c578], 0xffffffff
jne 0x1400c7f8c
cmp qword [0x14017c550], rsi
je 0x1400c8661
lea rdx, str.::UpdateProcThreadAttribute
lea rcx, str.kernel32.dll
call fcn.1400b64b4
mov qword [0x14017c570], rax
jmp 0x1400c8668
mov qword [0x14017c570], rsi
lea rcx, [0x14017c578]
call fcn.1401119d8
jmp 0x1400c7f8c