Function at 0x14006a850
Capabilities:
Create process on windows
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
movaps xmmword [rsp + 0x2f0], xmm7
movaps xmmword [rsp + 0x2e0], xmm6
mov r13, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x14006bb37
xorps xmm0, xmm0
lea rdx, [rsp + 0x2c0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r13]
call fcn.1400cf060
mov rdi, qword [r13]
mov r14, qword [rdi + 0x78]
mov r15, qword [rdi + 0x80]
cmp r14, r15
je 0x14006a95b
lea rsi, [rsp + 0xf8]
lea rdi, [rsp + 0x2b0]
lea rbx, [rsp + 0x2c0]
movzx eax, byte [r14 + 0x17]
test al, al
mov rcx, qword [r14]
cmovns rcx, r14
mov qword [rsp + 0x2b0], rcx
cmovs rax, qword [r14 + 8]
mov qword [rsp + 0x2b8], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1401253a0
mov rcx, rsi
mov rdx, rbx
call fcn.1400cf060
cmp byte [rsp + 0x10f], 0
jns 0x14006a94e
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
add r14, 0x18
cmp r14, r15
jne 0x14006a8fe
mov rdi, qword [r13]
movzx eax, byte [rdi + 0x2f]
test al, al
jns 0x14006a967
mov rax, qword [rdi + 0x20]
test rax, rax
jne 0x14006ad92
movzx eax, byte [rdi + 0x47]
test al, al
jns 0x14006a97c
mov rax, qword [rdi + 0x38]
test rax, rax
jne 0x14006ae00
movzx eax, byte [rdi + 0x5f]
test al, al
js 0x14006a992
mov rcx, rax
jmp 0x14006a996
mov rcx, qword [rdi + 0x50]
test rcx, rcx
jne 0x14006ae6e
mov r14, qword [rdi + 0x60]
lea rbp, [rdi + 0x68]
cmp r14, rbp
je 0x14006ac26
mov qword [rsp + 0x58], r13
movabs r12, 0x7fffffffffffffef
movabs r13, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1402724c0]
xorps xmm7, xmm7
mov qword [rsp + 0x60], rbp
movzx esi, byte [r14 + 0x37]
mov rbx, rsi
test sil, sil
jns 0x14006a9e9
mov rbx, qword [r14 + 0x28]
lea r15, [rbx + 1]
mov qword [rsp + 0x260], r13
movaps xmmword [rsp + 0x250], xmm6
cmp r15, r12
ja 0x14006bb31
cmp r15, 0x16
ja 0x14006aa32
movaps xmmword [rsp + 0x250], xmm7
mov qword [rsp + 0x260], 0
mov byte [rsp + 0x267], r15b
lea rdi, [rsp + 0x250]
jmp 0x14006aa77
mov rbp, r13
mov r13, r12
mov r12, r15
or r12, 0xf
inc r12
mov rcx, r12
call fcn.140184834
mov rdi, rax
lea rax, [r13 + 0x11]
or rax, r12
mov r12, r13
mov r13, rbp
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r15
lea rdx, [r14 + 0x20]
test sil, sil
jns 0x14006aa83
mov rdx, qword [rdx]
cmp rdx, rdi
jb 0x14006aa95
lea rax, [rdi + rbx]
cmp rax, rdx
ja 0x14006bb3a
mov rcx, rdi
mov r8, rbx
call fcn.140188f50
mov word [rdi + rbx], 0x3d
movzx r8d, byte [r14 + 0x4f]
test r8b, r8b
jns 0x14006aaba
mov r8, qword [r14 + 0x40]
mov rdx, qword [r14 + 0x38]
jmp 0x14006aabe
lea rdx, [r14 + 0x38]
lea rcx, [rsp + 0x250]
call fcn.140154330
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x290], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x280], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x297]
test al, al
mov rcx, qword [rsp + 0x280]
lea rdx, [rsp + 0x280]
cmovns rcx, rdx
mov qword [rsp + 0x270], rcx
cmovs rax, qword [rsp + 0x288]
mov qword [rsp + 0x278], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
lea rdx, [rsp + 0x270]
call fcn.1401253a0
lea rdi, [rsp + 0x238]
mov rcx, rdi
lea rdx, str.annotation
call fcn.1401c45c0
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140076210
mov rcx, rbx
lea rdx, [rsp + 0x2c0]
call fcn.1400cf060
cmp byte [rsp + 0x10f], 0
jns 0x14006ab8d
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x24f], 0
jns 0x14006aba4
mov rcx, qword [rsp + 0x238]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006abb8
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
cmp byte [rsp + 0x297], 0
jns 0x14006abcf
mov rcx, qword [rsp + 0x280]
call fcn.14018482c
cmp byte [rsp + 0x267], 0
jns 0x14006abe6
mov rcx, qword [rsp + 0x250]
call fcn.14018482c
test r14, r14
je 0x14006bb34
mov rcx, qword [r14 + 8]
test rcx, rcx
jne 0x14006ac06
mov rax, qword [r14 + 0x10]
cmp qword [rax], r14
mov r14, rax
je 0x14006ac11
jmp 0x14006abf8
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14006ac06
mov r14, rax
cmp rax, rbp
jne 0x14006a9d8
mov r13, qword [rsp + 0x58]
mov rdi, qword [r13]
mov rsi, qword [rdi + 0x90]
mov r12, qword [rdi + 0x98]
cmp rsi, r12
je 0x14006acad
lea rdi, [0x1402832d0]
lea rbx, [rsp + 0x70]
lea r14, [rsp + 0xf8]
lea r15, [rsp + 0x2c0]
mov rcx, rbx
mov rdx, rdi
call fcn.1401c45c0
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call fcn.140076210
mov rcx, r14
mov rdx, r15
call fcn.1400cf060
cmp byte [rsp + 0x10f], 0
jns 0x14006ac90
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006aca4
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
add rsi, 0x18
cmp rsi, r12
jne 0x14006ac55
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14006af1e
cmp dword [0x1402b0c58], 2
jg 0x14006ad27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x19a
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, [0x140285bc4]
mov r8d, 0xb
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor ebp, ebp
xor r15d, r15d
cmp byte [rsp + 0x2d7], 0
jns 0x14006ad43
mov rcx, qword [rsp + 0x2c0]
call fcn.14018482c
xor eax, eax
cmp r15b, 1
adc rax, 1
mov qword [0x1402b6d88], rax
mov rcx, r13
call fcn.140066170
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.1401874c0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2e0]
movaps xmm7, xmmword [rsp + 0x2f0]
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rdi, 0x18
lea rdx, str.database
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401c45c0
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140076210
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cf060
cmp byte [rbx + 0x17], 0
jns 0x14006ade3
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006adf7
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
mov rdi, qword [r13]
jmp 0x14006a970
add rdi, 0x30
lea rdx, str.metrics_dir
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401c45c0
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140076210
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cf060
cmp byte [rbx + 0x17], 0
jns 0x14006ae51
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006ae65
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
mov rdi, qword [r13]
jmp 0x14006a985
lea rcx, [rdi + 0x48]
test al, al
cmovs rcx, qword [rdi + 0x48]
lea rdx, [rsp + 0x2a0]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 0x50]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401253a0
lea rdx, [0x1402764da]
lea rdi, [rsp + 0x280]
mov rcx, rdi
call fcn.1401c45c0
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140076210
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cf060
cmp byte [rbx + 0x17], 0
jns 0x14006aeea
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x297], 0
jns 0x14006af01
mov rcx, qword [rsp + 0x280]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006af15
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
mov rdi, qword [r13]
jmp 0x14006a99f
mov rdi, rax
mov rax, qword [r13]
mov rax, qword [rax + 0xc8]
mov rcx, qword [0x1402ab120]
mov r9, qword [0x1402ab110]
mov r8, qword [0x1402ab108]
movsxd rdx, edi
cmp rdx, rdi
jne 0x14006bb3d
mov edx, edi
movsxd r10, eax
cmp r10, rax
jne 0x14006bb45
movsxd r10, ecx
cmp r10, rcx
jne 0x14006bb4d
movsxd r10, r9d
cmp r10, r9
jne 0x14006bb55
movsxd r10, r8d
cmp r10, r8
jne 0x14006bb5e
lea r10, [0x1402b6d58]
mov qword [rsp + 0x48], r10
lea r10, [0x1402b6d48]
mov qword [rsp + 0x40], r10
lea r10, [0x1402b6d38]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_I64x_0x_I64x_0x_I64x
lea rsi, [rsp + 0x280]
mov rcx, rsi
call fcn.1400f0a40
lea rdx, str.__initial_client_data
lea rbx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401c45c0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14006aff7
mov r8, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
mov rdx, rsi
call fcn.140154330
mov rcx, qword [rax + 0x10]
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
lea rdx, [rsp + 0xe8]
mov qword [rdx], rcx
cmovs rax, qword [rbp + 8]
mov qword [rdx + 8], rax
lea r12, [rsp + 0xf8]
mov rcx, r12
call fcn.1401253a0
lea r15, [rsp + 0x2c0]
mov rcx, r12
mov rdx, r15
call fcn.1400cf060
cmp byte [r12 + 0x17], 0
jns 0x14006b07e
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x87], 0
jns 0x14006b092
mov rcx, qword [rsp + 0x70]
call fcn.14018482c
cmp byte [rsp + 0x267], 0
jns 0x14006b0a9
mov rcx, qword [rsp + 0x250]
call fcn.14018482c
cmp byte [rsp + 0x297], 0
jns 0x14006b0c0
mov rcx, qword [rsp + 0x280]
call fcn.14018482c
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0xac], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xc0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xd0], rax
mov eax, dword [0x1402b6d98]
mov ecx, dword [0x1402ab7ac]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006ba79
mov eax, dword [0x1402b6da8]
mov ecx, dword [0x1402ab7ac]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006bad0
mov rax, qword [0x1402b6d90]
test rax, rax
je 0x14006b22b
cmp qword [0x1402b6da0], 0
je 0x14006b22b
mov dword [rsp + 0x70], 0x70
movabs rcx, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x280]
mov qword [r9], rcx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [case.0x1401eda70.0]
test eax, eax
je 0x14006b4b0
cmp dword [0x1402b0c58], 2
jg 0x14006b664
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1cb
mov r9d, 2
call fcn.1400049c0
lea rcx, [rsp + 0x108]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.1401c17b0
mov rcx, rsi
call fcn.140004ab0
jmp 0x14006b664
mov dword [rsp + 0x70], 0x68
xor r14d, r14d
xor ebx, ebx
xor esi, esi
mov rdx, qword [r13]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x14006b39d
cmp r8b, 0xc
jae 0x14006b3ab
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x290], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rsp + 0x280], xmm0
cmp byte [rsp + 0x2d7], 0
jns 0x14006b28b
mov r15, qword [rsp + 0x2c0]
jmp 0x14006b293
lea r15, [rsp + 0x2c0]
cmp byte [rdx + 0x17], 0
jns 0x14006b29c
mov rdx, qword [rdx]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
mov rcx, rdx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14006b44b
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402b0c58], 1
jg 0x14006b304
cmp dword [0x14029ee60], 0
je 0x14006b304
test eax, eax
je 0x14006b820
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402b0c58], 1
jg 0x14006b32c
cmp dword [0x14029ee60], 0
je 0x14006b32c
test eax, eax
je 0x14006b874
mov rsi, qword [r13]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x14006b34a
call fcn.140063750
test al, al
je 0x14006bb6e
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0xf8]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x250]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r13]
call fcn.140062140
mov r15d, eax
mov ebp, eax
jmp 0x14006b4a8
mov r8, qword [rdx + 8]
cmp r8, 0xc
jb 0x14006b256
add r8, 0xfffffffffffffff4
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov rcx, r12
mov r9, 0xffffffffffffffff
call fcn.14001f4e0
cmp byte [rsp + 0x10f], 0
jns 0x14006b3dd
mov r12, qword [rsp + 0xf8]
lea rdx, str.rundll32.exe
mov rcx, r12
call fcn.1401a1514
mov r12d, eax
cmp byte [rsp + 0x10f], 0
jns 0x14006b406
mov rcx, qword [rsp + 0xf8]
call fcn.14018482c
cmp byte [rsp + 0x2d7], 0
jns 0x14006b418
mov r15, qword [rsp + 0x2c0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x290], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rsp + 0x280], xmm0
test r12d, r12d
je 0x14006ba48
mov rdx, qword [r13]
jmp 0x14006b293
cmp dword [0x1402b0c58], 2
jg 0x14006b4a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x216
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor r15d, r15d
xor ebp, ebp
mov r12, rbx
jmp 0x14006b676
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14006b60c
lea rsi, [rsp + 0x280]
mov rcx, qword [rsi]
call fcn.140184cf8
mov rbx, rax
mov qword [rsp + 0xd8], rax
mov rax, qword [0x1402b6d90]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [case.0x1401eda70.0]
test eax, eax
je 0x14006b75e
mov ecx, 0x40
call fcn.140184834
test rax, rax
je 0x14006bb71
mov r14, rax
mov rax, qword [0x1402ab108]
mov qword [r14], rax
cmp r14, 0xfffffffffffffff8
je 0x14006bb74
mov rax, qword [0x1402ab110]
mov qword [r14 + 8], rax
cmp r14, 0xfffffffffffffff0
je 0x14006bb77
mov rax, qword [0x1402ab120]
mov qword [r14 + 0x10], rax
cmp r14, 0xffffffffffffffe8
je 0x14006bb7a
mov rax, qword [r13]
mov rax, qword [rax + 0xc8]
mov qword [r14 + 0x18], rax
cmp r14, 0xffffffffffffffe0
je 0x14006bb7d
mov qword [r14 + 0x20], rdi
mov rsi, qword [rsp + 0xc0]
mov r8d, 5
lea rax, [rsi + 1]
cmp rax, 2
jae 0x14006b8c8
mov rsi, qword [rsp + 0xc8]
lea rax, [rsi + 1]
cmp rax, 2
mov qword [rsp + 0x58], r13
jae 0x14006b913
lea rsi, [r14 + r8*8]
mov r13, qword [rsp + 0xd0]
lea rax, [r13 + 1]
cmp rax, 2
jae 0x14006b967
mov r13, qword [rsp + 0x58]
sub rsi, r14
je 0x14006bb80
mov rax, qword [0x1402b6da0]
mov rcx, qword [rsp + 0xd8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rsi
mov r8d, 0x20002
xor edx, edx
mov r9, r14
call qword [case.0x1401eda70.0]
test eax, eax
je 0x14006b7c0
mov esi, 0x80000
jmp 0x14006b23a
cmp dword [0x1402b0c58], 2
jg 0x14006b664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1cf
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor r14d, r14d
xor eax, eax
xor ebx, ebx
mov r12, rbx
xor r15d, r15d
mov rbx, rax
xor ebp, ebp
test rbx, rbx
je 0x14006b6fa
mov eax, dword [0x1402b6db8]
mov ecx, dword [0x1402ab7ac]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14006b6ea
lea rcx, [0x1402b6db8]
call fcn.140184b80
cmp dword [0x1402b6db8], 0xffffffff
jne 0x14006b6ea
lea rcx, [0x1402764fe]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006bb67
lea rdx, [0x140285d23]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402b6db0], rax
lea rcx, [0x1402b6db8]
call fcn.140184be8
mov rax, qword [0x1402b6db0]
mov rcx, rbx
call qword [case.0x1401eda70.0]
test r12, r12
je 0x14006b707
mov rcx, r12
call fcn.1401849a0
test r14, r14
je 0x14006b714
mov rcx, r14
call fcn.14018482c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14006ad2c
lea rdx, str....._third_partycrashpadcrashpadutilwin_scoped_handle.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1e
call fcn.1401f2b20
lea rdx, [0x1402877fc]
mov rcx, rsi
call fcn.14020dd60
mov rcx, rsi
call fcn.1401f2b50
jmp 0x14006ad2c
cmp dword [0x1402b0c58], 2
jg 0x14006b7b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1da
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, [0x140285c95]
mov r8d, 0x21
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor r14d, r14d
xor eax, eax
jmp 0x14006b66b
cmp dword [0x1402b0c58], 2
jg 0x14006b818
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1f4
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, [0x140285cb7]
mov r8d, 0x19
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
mov rax, rbx
jmp 0x14006b66b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x21b
mov r9d, 1
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
jmp 0x14006b304
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 1
call fcn.1401f17c0
lea rcx, [rsp + 0x108]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
jmp 0x14006b32c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14006ba4f
lea rax, [r14 + 0x28]
xor ecx, ecx
mov r8d, 5
cmp qword [r14 + rcx*8], rsi
je 0x14006b58a
inc rcx
cmp rcx, 5
jne 0x14006b8e9
test rax, rax
je 0x14006bb83
mov qword [rax], rsi
mov r8d, 6
jmp 0x14006b58a
mov qword [rsp + 0x60], r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14006ba5a
mov r8, qword [rsp + 0x60]
lea rax, [r14 + r8*8]
lea rcx, [r8*8]
xor edx, edx
cmp qword [r14 + rdx], rsi
je 0x14006b5a5
add rdx, 8
cmp rcx, rdx
jne 0x14006b940
test rax, rax
je 0x14006bb86
mov qword [rax], rsi
inc r8
jmp 0x14006b5a5
mov qword [rsp + 0x60], r8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14006b5bf
mov r8, qword [rsp + 0x60]
lea r9, [r8*8]
xor eax, eax
cmp qword [r14 + rax], r13
je 0x14006b5bf
add rax, 8
cmp r9, rax
jne 0x14006b990
cmp r8d, 8
jne 0x14006ba64
mov al, 1
test al, al
je 0x14006bb89
movabs rax, 0x1fffffffffffffff
inc r8
movabs rdx, 0x7fffffffffffffef
add rdx, 9
mov rcx, r9
shr rcx, 2
cmp rcx, r8
cmovbe rcx, r8
cmp r9, rdx
cmovae rcx, rax
test rcx, rcx
mov qword [rsp + 0x68], r9
je 0x14006bb8c
cmp rcx, rax
ja 0x14006bb93
shl rcx, 3
call fcn.140184834
mov rsi, rax
mov rdx, qword [rsp + 0x68]
add rsi, rdx
je 0x14006bb96
mov qword [rsi], r13
add rsi, 8
mov rcx, qword [r14 + rdx - 8]
mov qword [rax + rdx - 8], rcx
add rdx, 0xfffffffffffffff8
jne 0x14006ba1f
mov r13, rax
mov rcx, r14
mov r14, rdx
call fcn.14018482c
add r13, r14
mov r14, r13
jmp 0x14006b5bf
xor edx, edx
jmp 0x14006b29c
mov r8d, 5
jmp 0x14006b58a
mov r8, qword [rsp + 0x60]
jmp 0x14006b5a5
test rsi, rsi
je 0x14006bb99
mov qword [rsi], r13
add rsi, 8
jmp 0x14006b5bf
lea rcx, [0x1402b6d98]
call fcn.140184b80
cmp dword [0x1402b6d98], 0xffffffff
jne 0x14006b15c
lea rcx, [0x1402764fe]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006bb9c
lea rdx, [0x140285be9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402b6d90], rax
lea rcx, [0x1402b6d98]
call fcn.140184be8
jmp 0x14006b15c
lea rcx, [0x1402b6da8]
call fcn.140184b80
cmp dword [0x1402b6da8], 0xffffffff
jne 0x14006b181
cmp qword [0x1402b6d90], 0
je 0x14006bb17
lea rcx, [0x1402764fe]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006bb17
lea rdx, [0x140285c0d]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14006bb19
xor eax, eax
mov qword [0x1402b6da0], rax
lea rcx, [0x1402b6da8]
call fcn.140184be8
jmp 0x14006b181
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x14006b6d7
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x14006ba07
int3
int3
int3
xor eax, eax
jmp 0x14006bab8