Function at 0x1401067a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x11d8
call fcn.1400cb8f0
sub rsp, rax
mov rax, qword [0x1401c00d8]
xor rax, rsp
mov qword [rsp + 0x11c8], rax
mov dword [rsp + 0x50], 0
call fcn.1400b4200
movzx eax, al
test eax, eax
jne 0x1401067df
jmp 0x140106889
lea rcx, [rsp + 0x84]
call fcn.140004910
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x189
lea r8, [0x14019c730]
lea rdx, [0x14019c7c0]
lea rcx, [rsp + 0x6e8]
call fcn.1400b5f40
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x100], rax
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x100]
call fcn.140004910
lea rdx, str.Check_failed:__IsThreadInLoaderLock__
mov rcx, rax
call fcn.140003dd0
lea rdx, [0x14019c6e8]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x110]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 1
test eax, eax
je 0x1401068a6
and dword [rsp + 0x50], 0xfffffffe
lea rcx, [rsp + 0x6e8]
call fcn.1400b60e0
lea rcx, [rsp + 0x54]
call fcn.140106720
nop
lea rcx, [rsp + 0xf18]
call fcn.140037e30
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
mov rcx, rax
call fcn.140004910
lea rdx, [rsp + 0xf18]
mov rcx, rax
call fcn.140113d90
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x90
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140006040
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xc8]
call fcn.14000f890
mov qword [rsp + 0x118], rax
jmp 0x14010693f
mov rax, qword [rsp + 0xb0]
add rax, 0x20
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x118]
cmp qword [rsp + 0xb0], rax
je 0x1401069f4
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x550]
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x128]
call fcn.140007a10
lea rcx, [rsp + 0x4d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0xfe8]
call fcn.1400b7650
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x138]
call fcn.140113d90
nop
lea rcx, [rsp + 0xfe8]
call fcn.140009190
jmp 0x14010692b
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x20
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.140010eb0
movzx eax, al
test eax, eax
jne 0x140106abc
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x20
mov rcx, rax
call fcn.140004910
mov qword [rsp + 0x140], rax
lea rdx, str.database
lea rcx, [rsp + 0xf48]
call fcn.140008180
nop
mov r8, qword [rsp + 0x140]
lea rdx, [rsp + 0xf48]
lea rcx, [rsp + 0x1088]
call fcn.140105d90
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x150], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x150]
call fcn.140113d90
nop
lea rcx, [rsp + 0x1088]
call fcn.140009190
nop
lea rcx, [rsp + 0xf48]
call fcn.140009160
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x40
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.140010eb0
movzx eax, al
test eax, eax
jne 0x140106b84
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x40
mov rcx, rax
call fcn.140004910
mov qword [rsp + 0x158], rax
lea rdx, str.metrics_dir
lea rcx, [rsp + 0xf68]
call fcn.140008180
nop
mov r8, qword [rsp + 0x158]
lea rdx, [rsp + 0xf68]
lea rcx, [rsp + 0x1068]
call fcn.140105d90
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x168], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x168]
call fcn.140113d90
nop
lea rcx, [rsp + 0x1068]
call fcn.140009190
nop
lea rcx, [rsp + 0xf68]
call fcn.140009160
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x60
mov rcx, rax
call fcn.140010eb0
movzx eax, al
test eax, eax
jne 0x140106cb4
lea rax, [rsp + 0x560]
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x60
mov rdx, rax
mov rcx, qword [rsp + 0x170]
call fcn.140007a10
lea rcx, [rsp + 0x4e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x1048]
call fcn.1400b7650
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x188], rax
lea rdx, [0x14019c6ec]
lea rcx, [rsp + 0xf88]
call fcn.140008180
nop
mov r8, qword [rsp + 0x188]
lea rdx, [rsp + 0xf88]
lea rcx, [rsp + 0x11a8]
call fcn.140105d90
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x198]
call fcn.140113d90
nop
lea rcx, [rsp + 0x11a8]
call fcn.140009190
nop
lea rcx, [rsp + 0xf88]
call fcn.140009160
nop
lea rcx, [rsp + 0x1048]
call fcn.140009190
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0x80
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0xd0]
call fcn.14000f190
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0xd0]
call fcn.14000f210
jmp 0x140106d05
lea rcx, [rsp + 0xc0]
call fcn.14000a370
movzx edx, byte [rsp + 0x5c]
lea rcx, [rsp + 0xc0]
call fcn.14000a0f0
movzx eax, al
test eax, eax
je 0x140106ed7
lea rcx, [rsp + 0xc0]
call fcn.14000a2c0
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0xd8]
add rax, 0x20
mov qword [rsp + 0x1a8], rax
mov rcx, qword [rsp + 0xd8]
mov r8b, 0x3d
mov rdx, rcx
lea rcx, [rsp + 0x10e8]
call fcn.1401088a0
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1a8]
mov r8, rax
mov rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x10c8]
call fcn.14007d0a0
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x1c0], rax
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1c8]
call fcn.140007a10
lea rcx, [rsp + 0x4f0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0x10a8]
call fcn.1400b7650
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x1e0], rax
lea rdx, str.annotation
lea rcx, [rsp + 0xfa8]
call fcn.140008180
nop
mov r8, qword [rsp + 0x1e0]
lea rdx, [rsp + 0xfa8]
lea rcx, [rsp + 0x1108]
call fcn.140105d90
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1f0], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x1f0]
call fcn.140113d90
nop
lea rcx, [rsp + 0x1108]
call fcn.140009190
nop
lea rcx, [rsp + 0xfa8]
call fcn.140009160
nop
lea rcx, [rsp + 0x10a8]
call fcn.140009190
nop
lea rcx, [rsp + 0x10c8]
call fcn.140009160
nop
lea rcx, [rsp + 0x10e8]
call fcn.140009160
jmp 0x140106cf8
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0xa8
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
call fcn.140006040
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xe0]
call fcn.14000f890
mov qword [rsp + 0x1f8], rax
jmp 0x140106f32
mov rax, qword [rsp + 0xb8]
add rax, 0x20
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x1f8]
cmp qword [rsp + 0xb8], rax
je 0x140106fed
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x200], rax
mov rcx, qword [rsp + 0x200]
call fcn.140004910
mov qword [rsp + 0x208], rax
lea rdx, str.attachment
lea rcx, [rsp + 0xfc8]
call fcn.140008180
nop
mov r8, qword [rsp + 0x208]
lea rdx, [rsp + 0xfc8]
lea rcx, [rsp + 0x1128]
call fcn.140105d90
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x218], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x218]
call fcn.140113d90
nop
lea rcx, [rsp + 0x1128]
call fcn.140009190
nop
lea rcx, [rsp + 0xfc8]
call fcn.140009160
jmp 0x140106f1e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov edx, 1
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x220], rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x68]
call fcn.140072d60
nop
lea rcx, [rsp + 0x68]
call fcn.1400734e0
movzx eax, al
test eax, eax
jne 0x140107146
call fcn.1401058a0
cmp eax, 2
jle 0x140107045
jmp 0x1401070e9
lea rcx, [rsp + 0x85]
call fcn.140004910
mov qword [rsp + 0x240], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x1af
lea r8, [0x14019c920]
lea rdx, [0x14019c9b0]
lea rcx, [rsp + 0x8e8]
call fcn.1400b67e0
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x230], rax
mov eax, dword [rsp + 0x50]
or eax, 2
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x230]
call fcn.140004910
lea rdx, [0x14019c910]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x238], rax
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 2
test eax, eax
je 0x140107106
and dword [rsp + 0x50], 0xfffffffd
lea rcx, [rsp + 0x8e8]
call fcn.1400b6840
mov byte [rsp + 0x5d], 0
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x5d]
jmp 0x140108327
lea rcx, [0x1401c51e0]
call fcn.14005fe90
mov qword [rsp + 0x248], rax
lea rcx, [0x1401c51c8]
call fcn.14005fe90
mov qword [rsp + 0x250], rax
lea rcx, [0x1401c51a8]
call fcn.14005fe90
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x68]
call fcn.140004910
mov rax, qword [rax]
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0xe0
mov rcx, rax
call fcn.140004910
mov rax, qword [rax]
mov qword [rsp + 0x268], rax
mov rax, qword [0x1401c0d1c]
mov qword [rsp + 0x270], rax
mov rax, qword [0x1401c0d14]
mov qword [rsp + 0x278], rax
mov rax, qword [0x1401c0d00]
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x270]
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x590]
call fcn.14008f920
lea rax, [rsp + 0x580]
mov qword [rsp + 0x2c8], rax
lea rdx, [rsp + 0x1008]
lea rcx, [rsp + 0x590]
call fcn.14008fd00
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x2a8], rax
lea rdx, str.__initial_client_data
lea rcx, [rsp + 0x1188]
call fcn.140008180
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x2b0], rax
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x1168]
call fcn.1401087f0
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x2c0], rax
mov rdx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2c8]
call fcn.140007a10
lea rcx, [rsp + 0x500]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x500]
lea rcx, [rsp + 0x1148]
call fcn.1400b7650
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x2d8], rax
lea rdx, [rsp + 0xf18]
mov rcx, qword [rsp + 0x2d8]
call fcn.140113d90
nop
lea rcx, [rsp + 0x1148]
call fcn.140009190
nop
lea rcx, [rsp + 0x1168]
call fcn.140009160
nop
lea rcx, [rsp + 0x1188]
call fcn.140009160
nop
lea rcx, [rsp + 0x1008]
call fcn.140009160
lea rax, [rsp + 0x460]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0x49c], 0x100
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x4b0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x4b8], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x4c0], rax
lea rcx, [rsp + 0x90]
call fcn.1400085d0
nop
lea rcx, [rsp + 0x70]
call fcn.140003740
nop
lea rcx, [rsp + 0x78]
call fcn.140108490
nop
mov eax, 4
mov eax, eax
mov ecx, dword [0x1401c3e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1401c5228], eax
jle 0x140107491
lea rcx, [0x1401c5228]
call fcn.1400cb66c
cmp dword [0x1401c5228], 0xffffffff
jne 0x140107491
xor r8d, r8d
lea rdx, str.::InitializeProcThreadAttributeList
lea rcx, [0x14019cae8]
call fcn.1400712e0
mov qword [0x1401c5220], rax
lea rcx, [0x1401c5228]
call fcn.1400cb60c
mov eax, 4
mov eax, eax
mov ecx, dword [0x1401c3e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1401c5238], eax
jle 0x14010751c
lea rcx, [0x1401c5238]
call fcn.1400cb66c
cmp dword [0x1401c5238], 0xffffffff
jne 0x14010751c
cmp qword [0x1401c5220], 0
je 0x1401074f5
xor r8d, r8d
lea rdx, str.::UpdateProcThreadAttribute
lea rcx, [0x14019cb28]
call fcn.1400712e0
mov qword [rsp + 0xe8], rax
jmp 0x140107501
mov qword [rsp + 0xe8], 0
mov rax, qword [rsp + 0xe8]
mov qword [0x1401c5230], rax
lea rcx, [0x1401c5238]
call fcn.1400cb60c
cmp qword [0x1401c5220], 0
je 0x140107530
cmp qword [0x1401c5230], 0
jne 0x14010754b
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0x460], 0x68
jmp 0x140107c59
mov dword [rsp + 0xa8], 0x80000
mov dword [rsp + 0x460], 0x70
mov rax, qword [0x1401c5220]
mov qword [rsp + 0x2e0], rax
lea r9, [rsp + 0xf0]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [rsp + 0x2e0]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401076c8
call fcn.1401058a0
cmp eax, 2
jle 0x1401075a7
jmp 0x140107642
lea rcx, [rsp + 0x86]
call fcn.140004910
mov qword [rsp + 0x300], rax
mov dword [rsp + 0x20], 2
mov r9d, 0x1e0
lea r8, [0x14019cbe0]
lea rdx, [0x14019cc70]
lea rcx, [rsp + 0x7e8]
call fcn.1400b5f40
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x2f0], rax
mov eax, dword [rsp + 0x50]
or eax, 4
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x2f0]
call fcn.140004910
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x2f8], rax
mov rdx, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x300]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 4
test eax, eax
je 0x14010765f
and dword [rsp + 0x50], 0xfffffffb
lea rcx, [rsp + 0x7e8]
call fcn.1400b60e0
mov byte [rsp + 0x5e], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x5e]
jmp 0x140108327
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14010780b
call fcn.1401058a0
cmp eax, 2
jle 0x1401076e6
jmp 0x14010778a
lea rcx, [rsp + 0x87]
call fcn.140004910
mov qword [rsp + 0x320], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x1e4
lea r8, [0x14019cdb0]
lea rdx, [0x14019ce40]
lea rcx, [rsp + 0x5e0]
call fcn.1400b67e0
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x310], rax
mov eax, dword [rsp + 0x50]
or eax, 8
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x310]
call fcn.140004910
lea rdx, str.InitializeProcThreadAttributeList__size_
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x318], rax
mov rdx, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x320]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 8
test eax, eax
je 0x1401077a7
and dword [rsp + 0x50], 0xfffffff7
lea rcx, [rsp + 0x5e0]
call fcn.1400b6840
mov byte [rsp + 0x5f], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x5f]
jmp 0x140108327
mov rcx, qword [rsp + 0xf0]
call fcn.1400cb940
mov qword [rsp + 0x328], rax
mov rdx, qword [rsp + 0x328]
lea rcx, [rsp + 0x70]
call fcn.140072d00
lea rcx, [rsp + 0x70]
call fcn.140006040
mov qword [rsp + 0x4c8], rax
mov rax, qword [0x1401c5220]
mov qword [rsp + 0x330], rax
lea r9, [rsp + 0xf0]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x4c8]
call qword [rsp + 0x330]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x1401079b5
call fcn.1401058a0
cmp eax, 2
jle 0x140107890
jmp 0x140107934
lea rcx, [rsp + 0x88]
call fcn.140004910
mov qword [rsp + 0x350], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x1ef
lea r8, [0x14019cf50]
lea rdx, [0x14019cfe0]
lea rcx, [rsp + 0x9f0]
call fcn.1400b67e0
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x340], rax
mov eax, dword [rsp + 0x50]
or eax, 0x10
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x340]
call fcn.140004910
lea rdx, str.InitializeProcThreadAttributeList
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x348], rax
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x350]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 0x10
test eax, eax
je 0x140107951
and dword [rsp + 0x50], 0xffffffef
lea rcx, [rsp + 0x9f0]
call fcn.1400b6840
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x60]
jmp 0x140108327
lea rdx, [rsp + 0x4c8]
lea rcx, [rsp + 0x78]
call fcn.1401084f0
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.14003e100
lea rdx, [0x1401c0d00]
lea rcx, [rsp + 0x90]
call fcn.140027640
lea rdx, [0x1401c0d14]
lea rcx, [rsp + 0x90]
call fcn.140027640
lea rdx, [0x1401c0d1c]
lea rcx, [rsp + 0x90]
call fcn.140027640
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0xe0
mov rcx, rax
call fcn.140004910
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140027640
lea rcx, [rsp + 0x68]
call fcn.140004910
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140027640
mov rdx, qword [rsp + 0x4b0]
lea rcx, [rsp + 0x90]
call fcn.140106030
mov rdx, qword [rsp + 0x4b8]
lea rcx, [rsp + 0x90]
call fcn.140106030
mov rdx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x90]
call fcn.140106030
mov rax, qword [0x1401c5230]
mov qword [rsp + 0x368], rax
lea rcx, [rsp + 0x90]
call fcn.1400249e0
shl rax, 3
mov qword [rsp + 0x358], rax
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140029d20
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x360]
mov r8d, 0x20002
xor edx, edx
mov rcx, qword [rsp + 0x4c8]
call qword [rsp + 0x368]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x140107c59
call fcn.1401058a0
cmp eax, 2
jle 0x140107b34
jmp 0x140107bd8
lea rcx, [rsp + 0x80]
call fcn.140004910
mov qword [rsp + 0x388], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x209
lea r8, [0x14019d110]
lea rdx, [0x14019d1a0]
lea rcx, [rsp + 0xaf8]
call fcn.1400b67e0
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x378], rax
mov eax, dword [rsp + 0x50]
or eax, 0x20
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x378]
call fcn.140004910
lea rdx, str.UpdateProcThreadAttribute
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x380], rax
mov rdx, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x388]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 0x20
test eax, eax
je 0x140107bf5
and dword [rsp + 0x50], 0xffffffdf
lea rcx, [rsp + 0xaf8]
call fcn.1400b6840
mov byte [rsp + 0x61], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x61]
jmp 0x140108327
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x440]
call fcn.14005b810
mov byte [rsp + 0x55], 0
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.1400128d0
mov qword [rsp + 0x390], rax
lea rcx, [rsp + 0x440]
call fcn.14000f890
mov rcx, qword [rsp + 0x390]
cmp rcx, rax
jb 0x140107d9e
lea rcx, [rsp + 0x440]
call fcn.140006040
mov qword [rsp + 0x3b8], rax
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
mov rcx, rax
call fcn.140004910
mov qword [rsp + 0x3a8], rax
lea rcx, [rsp + 0x440]
call fcn.14000f890
mov qword [rsp + 0x398], rax
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.1400128d0
mov rcx, qword [rsp + 0x398]
sub rax, rcx
mov qword [rsp + 0x3a0], rax
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x3a0]
lea rdx, [rsp + 0x1028]
mov rcx, qword [rsp + 0x3a8]
call fcn.14009e0a0
mov qword [rsp + 0x3b0], rax
mov eax, dword [rsp + 0x50]
or eax, 0x40
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x3b0]
call fcn.14000f840
mov qword [rsp + 0x3c0], rax
mov rdx, qword [rsp + 0x3b8]
mov rcx, qword [rsp + 0x3c0]
call fcn.1400efc40
test eax, eax
jne 0x140107d9e
mov dword [rsp + 0xac], 1
jmp 0x140107da9
mov dword [rsp + 0xac], 0
movzx eax, byte [rsp + 0xac]
mov byte [rsp + 0x62], al
mov eax, dword [rsp + 0x50]
and eax, 0x40
test eax, eax
je 0x140107dd2
and dword [rsp + 0x50], 0xffffffbf
lea rcx, [rsp + 0x1028]
call fcn.140009190
movzx eax, byte [rsp + 0x62]
test eax, eax
je 0x140107de0
mov byte [rsp + 0x55], 1
xor edx, edx
lea rcx, [rsp + 0xf18]
call fcn.1400382b0
mov qword [rsp + 0x3c8], rax
movzx eax, byte [rsp + 0x55]
test eax, eax
je 0x140107e0e
mov qword [rsp + 0xf8], 0
jmp 0x140107e33
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.14000f840
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x510]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x460]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x140107fd7
call fcn.1401058a0
cmp eax, 2
jle 0x140107eac
jmp 0x140107f51
lea rcx, [rsp + 0x81]
call fcn.140004910
mov qword [rsp + 0x3e8], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x22b
lea r8, [0x14019d2d0]
lea rdx, [0x14019d360]
lea rcx, [rsp + 0xc00]
call fcn.1400b67e0
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x3d8], rax
mov eax, dword [rsp + 0x50]
bts eax, 7
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x3d8]
call fcn.140004910
lea rdx, str.CreateProcess
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x3e0], rax
mov rdx, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3e8]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 0x80
test eax, eax
je 0x140107f73
and dword [rsp + 0x50], 0xffffff7f
lea rcx, [rsp + 0xc00]
call fcn.1400b6840
mov byte [rsp + 0x63], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x63]
jmp 0x140108327
mov rcx, qword [rsp + 0x518]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x58], eax
call fcn.1401058a0
cmp eax, 1
jg 0x1401080a7
cmp dword [rsp + 0x58], 0
jne 0x1401080a7
lea rcx, [rsp + 0x82]
call fcn.140004910
mov qword [rsp + 0x408], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r9d, 0x230
lea r8, [0x14019d470]
lea rdx, [0x14019d500]
lea rcx, [rsp + 0xd08]
call fcn.1400b67e0
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x3f8], rax
mov eax, dword [rsp + 0x50]
bts eax, 8
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x3f8]
call fcn.140004910
lea rdx, str.CloseHandle_thread
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x400], rax
mov rdx, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x408]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 0x100
test eax, eax
je 0x1401080c9
and dword [rsp + 0x50], 0xfffffeff
lea rcx, [rsp + 0xd08]
call fcn.1400b6840
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x58], eax
call fcn.1401058a0
cmp eax, 1
jg 0x140108199
cmp dword [rsp + 0x58], 0
jne 0x140108199
lea rcx, [rsp + 0x83]
call fcn.140004910
mov qword [rsp + 0x428], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r9d, 0x233
lea r8, [0x14019d670]
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::StartHandlerProcess_class_std::unique_ptr_struct_crashpad::_anonymous_namespace::BackgroundHandlerStartThreadData_struct_std::default_delete_struct_crashpad::_anonymous_namespace::BackgroundHandlerStartThreadData____
lea rcx, [rsp + 0xe10]
call fcn.1400b67e0
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x418], rax
mov eax, dword [rsp + 0x50]
bts eax, 9
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x418]
call fcn.140004910
lea rdx, str.CloseHandle_process
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x420], rax
mov rdx, qword [rsp + 0x420]
mov rcx, qword [rsp + 0x428]
call fcn.140004830
nop
mov eax, dword [rsp + 0x50]
and eax, 0x200
test eax, eax
je 0x1401081bb
and dword [rsp + 0x50], 0xfffffdff
lea rcx, [rsp + 0xe10]
call fcn.1400b6840
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0xe0
mov qword [rsp + 0x438], rax
call fcn.140027620
mov qword [rsp + 0x430], rax
lea rdx, [rsp + 0x430]
mov rcx, qword [rsp + 0x438]
call fcn.140094800
lea rax, [rsp + 0x528]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
mov dword [rsp + 0x528], 2
lea rax, [rsp + 0xf38]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x11f0]
call fcn.140108420
add rax, 0xc0
lea r8, [rsp + 0xf38]
lea rdx, [rsp + 0x528]
mov rcx, rax
call fcn.1400aee60
movzx eax, al
test eax, eax
jne 0x1401082be
mov byte [rsp + 0x64], 0
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x64]
jmp 0x140108327
lea rcx, [rsp + 0x54]
call fcn.140106780
mov byte [rsp + 0x65], 1
lea rcx, [rsp + 0x78]
call fcn.1401084d0
nop
lea rcx, [rsp + 0x70]
call fcn.14005c0e0
nop
lea rcx, [rsp + 0x90]
call fcn.14001cb10
nop
lea rcx, [rsp + 0x68]
call fcn.140072f30
nop
lea rcx, [rsp + 0xf18]
call fcn.140009190
nop
lea rcx, [rsp + 0x54]
call fcn.140106740
nop
mov rcx, qword [rsp + 0x11f0]
call fcn.1401083a0
movzx eax, byte [rsp + 0x65]
mov rcx, qword [rsp + 0x11c8]
xor rcx, rsp
call fcn.1400cb890
add rsp, 0x11d8
pop rdi
pop rsi
ret