Function at 0x1402701d4
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
movaps xmmword [rsp + 0x370], xmm7
movaps xmmword [rsp + 0x360], xmm6
mov r12, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x1402714ac
xorps xmm0, xmm0
lea rdx, [rsp + 0x340]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.140299f4f
mov r8, qword [r12]
mov rsi, qword [r8 + 0x78]
mov r15, qword [r8 + 0x80]
cmp rsi, r15
je 0x14027030c
lea rdi, [rsp + 0x190]
lea rbx, [rsp + 0x330]
lea r14, [rsp + 0x340]
jmp 0x1402702df
mov qword [rsp + 0x330], rsi
mov qword [rsp + 0x338], rax
mov rcx, rsi
test rcx, rcx
jne 0x1402702a9
test rax, rax
jne 0x140271497
mov rcx, rdi
mov rdx, rbx
call fcn.140130ba0
mov rcx, rdi
mov rdx, r14
call fcn.140299f4f
cmp byte [rsp + 0x1a7], 0
jns 0x1402702d6
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
add rsi, 0x18
cmp rsi, r15
je 0x140270308
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140270288
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x330], rcx
mov qword [rsp + 0x338], rax
test rax, rax
jns 0x14027029b
jmp 0x14027149a
mov r8, qword [r12]
movzx eax, byte [r8 + 0x2f]
test al, al
jns 0x140270319
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x1402703b6
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], 8
lea rax, str.database
cmp rcx, rax
ja 0x14027034b
lea rcx, [rsp + 0xa8]
cmp rcx, rax
ja 0x1402714c7
add r8, 0x18
movabs rax, 0x6573616261746164
lea rdx, [rsp + 0xa0]
mov qword [rdx], rax
mov byte [rdx + 8], 0
lea rdi, [rsp + 0x190]
mov rcx, rdi
call fcn.1402717f5
lea rdx, [rsp + 0x340]
mov rcx, rdi
call fcn.140299f4f
cmp byte [rdi + 0x17], 0
jns 0x14027039b
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x1402703b2
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
mov r8, qword [r12]
movzx eax, byte [r8 + 0x47]
test al, al
jns 0x1402703c3
mov rax, qword [r8 + 0x38]
test rax, rax
je 0x140270466
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], 0xb
lea rax, str.metrics_dir
cmp rcx, rax
ja 0x1402703f5
lea rcx, [rsp + 0xab]
cmp rcx, rax
ja 0x1402714ca
add r8, 0x30
mov eax, dword [0x14031bd7d]
lea rdx, [rsp + 0xa0]
mov dword [rdx + 7], eax
mov rax, qword [str.metrics_dir]
mov qword [rdx], rax
mov byte [rdx + 0xb], 0
lea rdi, [rsp + 0x190]
mov rcx, rdi
call fcn.1402717f5
lea rdx, [rsp + 0x340]
mov rcx, rdi
call fcn.140299f4f
cmp byte [rdi + 0x17], 0
jns 0x14027044b
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x140270462
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
mov r8, qword [r12]
movzx eax, byte [r8 + 0x5f]
test al, al
jns 0x140270497
mov rax, qword [r8 + 0x50]
test rax, rax
je 0x140270587
mov r8, qword [r8 + 0x48]
mov qword [rsp + 0x320], r8
mov qword [rsp + 0x328], rax
jns 0x1402704b4
jmp 0x1402714c4
test rax, rax
je 0x140270587
add r8, 0x48
mov qword [rsp + 0x320], r8
mov qword [rsp + 0x328], rax
test r8, r8
je 0x1402714b2
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x320]
call fcn.140130ba0
lea rcx, [rsp + 0x140]
mov byte [rcx + 0x17], 3
lea rax, [0x14030b87c]
cmp rcx, rax
ja 0x1402704fb
lea rcx, [rsp + 0x143]
cmp rcx, rax
ja 0x1402714cd
mov al, byte [0x14030b87e]
lea rdx, [rsp + 0x140]
mov byte [rdx + 2], al
movzx eax, word [0x14030b87c]
mov word [rdx], ax
mov byte [rdx + 3], 0
lea rdi, [rsp + 0x190]
lea r8, [rsp + 0xa0]
mov rcx, rdi
call fcn.1402717f5
lea rdx, [rsp + 0x340]
mov rcx, rdi
call fcn.140299f4f
cmp byte [rdi + 0x17], 0
jns 0x140270555
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0x157], 0
jns 0x14027056c
mov rcx, qword [rsp + 0x140]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x140270583
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
mov r8, qword [r12]
mov rsi, qword [r8 + 0x60]
lea rbp, [r8 + 0x68]
cmp rsi, rbp
mov qword [rsp + 0x60], r12
je 0x1402707b4
lea rax, str.annotation
lea rcx, [rsp + 0x2d0]
cmp rcx, rax
seta cl
lea rdx, [rsp + 0x2da]
cmp rdx, rax
setbe dil
or dil, cl
lea rbx, [rsp + 0x2f0]
xorps xmm6, xmm6
lea r14, [rsp + 0xa0]
lea r15, [rsp + 0x310]
lea r12, [rsp + 0x190]
lea r13, [rsp + 0x340]
jmp 0x140270609
mov rax, qword [rsi + 0x10]
cmp qword [rax], rsi
mov rsi, rax
jne 0x1402705f1
mov rsi, rax
cmp rax, rbp
je 0x1402707ab
lea rdx, [rsi + 0x20]
mov rcx, rbx
mov r8b, 0x3d
call fcn.1400ee4b9
movzx r8d, byte [rsi + 0x4f]
test r8b, r8b
js 0x14027062c
lea rdx, [rsi + 0x38]
and r8d, 0x7f
jmp 0x140270634
mov r8, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x38]
mov rcx, rbx
call fcn.1400bf918
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x150], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x140], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx ecx, byte [rsp + 0x157]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x140]
cmovns rcx, rdx
mov qword [rsp + 0x310], rcx
mov qword [rsp + 0x318], rax
test rax, rax
js 0x14027149d
test rcx, rcx
jne 0x1402706b1
test rax, rax
jne 0x1402714a9
mov rcx, r14
mov rdx, r15
call fcn.140130ba0
mov byte [rsp + 0x2e7], 0xa
test dil, dil
je 0x1402714a0
movzx eax, word [0x14031bd68]
mov word [rsp + 0x2d8], ax
mov rax, qword [str.annotation]
mov qword [rsp + 0x2d0], rax
mov byte [rsp + 0x2da], 0
mov rcx, r12
lea rdx, [rsp + 0x2d0]
mov r8, r14
call fcn.1402717f5
mov rcx, r12
mov rdx, r13
call fcn.140299f4f
cmp byte [rsp + 0x1a7], 0
jns 0x140270728
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0x2e7], 0
jns 0x14027073f
mov rcx, qword [rsp + 0x2d0]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x140270756
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
cmp byte [rsp + 0x157], 0
jns 0x14027076d
mov rcx, qword [rsp + 0x140]
call fcn.140153bcc
cmp byte [rsp + 0x307], 0
jns 0x140270784
mov rcx, qword [rsp + 0x2f0]
call fcn.140153bcc
test rsi, rsi
je 0x1402714a3
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1402705f1
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1402705fd
jmp 0x14027079a
mov r12, qword [rsp + 0x60]
mov r8, qword [r12]
mov rdi, qword [r8 + 0x90]
mov rsi, qword [r8 + 0x98]
cmp rdi, rsi
je 0x140270890
lea rax, [0x14031bd6b]
lea rbx, [rsp + 0xa0]
cmp rbx, rax
seta cl
lea rdx, [rsp + 0xaa]
cmp rdx, rax
setbe bpl
or bpl, cl
lea r14, [rsp + 0x190]
lea r15, [rsp + 0x340]
jmp 0x14027081a
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
add rdi, 0x18
cmp rdi, rsi
je 0x140270890
mov byte [rsp + 0xb7], 0xa
test bpl, bpl
je 0x1402714a6
movzx eax, word [0x14031bd73]
mov word [rsp + 0xa8], ax
mov rax, qword [0x14031bd6b]
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0xaa], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1402717f5
mov rcx, r14
mov rdx, r15
call fcn.140299f4f
cmp byte [rsp + 0x1a7], 0
jns 0x140270881
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x140270811
jmp 0x140270804
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x300], rbx
movaps xmm6, xmmword [0x1402fccc0]
movaps xmmword [rsp + 0x2f0], xmm6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r15, [0x1402ff0e0]
mov qword [rsp + 0x2f0], r15
mov qword [rsp + 0x2f8], rax
mov byte [rsp + 0x300], 0
test rax, rax
jne 0x140270aa0
cmp dword [0x1403629c0], 2
jg 0x1402714bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rdi, [rsp + 0x190]
mov rcx, rdi
mov r8d, 0x1a6
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, [0x14031fc24]
mov r8d, 0xb
call fcn.140097cc9
mov rcx, rdi
call fcn.14009c720
xor ebx, ebx
xor ebp, ebp
jmp 0x140270a13
cmp dword [0x1403629c0], 2
jg 0x1402709a5
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rdi, [rsp + 0x190]
mov rcx, rdi
mov r8d, 0x1d7
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x1a0]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.140097cc9
mov rcx, rdi
call fcn.14009caf0
xor r13d, r13d
mov r12, qword [rsp + 0x60]
lea r15, [0x1402ff0e0]
xor ebx, ebx
xor ebp, ebp
mov qword [rsp + 0x110], rsi
cmp byte [rsp + 0x120], 0
jne 0x1402714b8
lea rcx, [rsp + 0x110]
call fcn.140271a9a
test r13, r13
je 0x1402709e8
mov rcx, r13
call fcn.1401541d4
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
je 0x140270a13
mov rax, qword [rsp + 0x2d8]
cmp rax, rcx
jne 0x1402713ee
mov qword [rsp + 0x2d8], rcx
call fcn.140153bcc
mov qword [rsp + 0x2f0], r15
cmp byte [rsp + 0x300], 0
jne 0x1402714af
mov rcx, qword [rsp + 0x2f8]
test rcx, rcx
je 0x140270a3b
call fcn.14005ec2a
cmp byte [rsp + 0x357], 0
jns 0x140270a52
mov rcx, qword [rsp + 0x340]
call fcn.140153bcc
xor eax, eax
cmp bl, 1
adc rax, 1
mov qword [0x1403633b8], rax
mov rcx, r12
call fcn.1402716aa
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x360]
movaps xmm7, xmmword [rsp + 0x370]
add rsp, 0x388
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x140]
mov qword [rcx + 0x40], rbx
mov rdx, qword [r12]
mov rdx, qword [rdx + 0xc8]
movups xmm0, xmmword [0x1403565f4]
mov r8, qword [0x1403565e0]
lea r9, [0x140363368]
mov qword [rcx], r9
lea r9, [0x140363378]
mov qword [rcx + 8], r9
lea r9, [0x140363388]
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r8
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rdx
mov qword [rcx + 0x38], rax
mov byte [rcx + 0x40], 1
lea rdi, [rsp + 0x2d0]
mov rdx, rdi
call fcn.140248ae8
lea rcx, [rsp + 0x110]
mov byte [rcx + 0x17], 0x16
lea rax, str.__initial_client_data
cmp rcx, rax
ja 0x140270b32
lea rcx, [rsp + 0x126]
cmp rcx, rax
ja 0x1402714d0
movups xmm0, xmmword [str.__initial_client_data]
lea rcx, [rsp + 0x110]
movaps xmmword [rcx], xmm0
movabs rax, 0x3d617461642d746e
mov qword [rcx + 0xe], rax
movzx eax, byte [rsp + 0x2e7]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0x2d8]
mov byte [rcx + 0x16], 0
cmovs rdi, qword [rsp + 0x2d0]
mov rdx, rdi
call fcn.1400bf918
mov rcx, qword [rax + 0x10]
lea rdi, [rsp + 0xa0]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rdi], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx ecx, byte [rdi + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rdi + 8]
mov rcx, qword [rdi]
cmovns rcx, rdi
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rax
test rax, rax
js 0x1402714b5
test rcx, rcx
jne 0x140270be3
test rax, rax
jne 0x1402714d3
lea r14, [rsp + 0x190]
lea rdx, [rsp + 0x130]
mov rcx, r14
call fcn.140130ba0
lea rbp, [rsp + 0x340]
mov rcx, r14
mov rdx, rbp
call fcn.140299f4f
cmp byte [r14 + 0x17], 0
jns 0x140270c22
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
cmp byte [rsp + 0xb7], 0
jns 0x140270c39
mov rcx, qword [rsp + 0xa0]
call fcn.140153bcc
cmp byte [rsp + 0x127], 0
jns 0x140270c50
mov rcx, qword [rsp + 0x110]
call fcn.140153bcc
cmp byte [rsp + 0x2e7], 0
jns 0x140270c67
mov rcx, qword [rsp + 0x2d0]
call fcn.140153bcc
xorps xmm7, xmm7
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0x100], xmm7
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov dword [rsp + 0xdc], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov r15, rax
mov qword [rsp + 0xf0], rax
mov ecx, 0xfffffff5
call rsi
mov r12, rax
mov qword [rsp + 0xf8], rax
mov ecx, 0xfffffff4
call rsi
mov r13, rax
mov qword [rsp + 0x100], rax
xor eax, eax
mov qword [rsp + 0x2e0], rax
movaps xmmword [rsp + 0x2d0], xmm7
lea rcx, [rbx - 0xaa]
mov qword [rsp + 0x120], rcx
lea rsi, [0x1402ff0e8]
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rax
mov eax, dword [0x1403633c8]
mov ecx, dword [0x1403576e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140271450
mov eax, dword [0x1403633d8]
mov ecx, dword [0x1403576e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402713fb
mov rax, qword [0x1403633c0]
test rax, rax
je 0x140270ed3
cmp qword [0x1403633d0], 0
je 0x140270ed3
mov dword [rsp + 0xa0], 0x70
lea r9, [rsp + 0x80]
mov qword [r9], rbx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x14037e008]
test eax, eax
jne 0x140270957
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140270e24
cmp dword [0x1403629c0], 2
jg 0x1402709a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rdi, [rsp + 0x190]
mov rcx, rdi
mov r8d, 0x1db
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.140097cc9
mov rcx, rdi
call fcn.14009c720
jmp 0x1402709a5
lea rax, [rsp + 0x80]
mov rcx, qword [rax]
call fcn.140153d54
mov rbp, rax
mov qword [rsp + 0x108], rax
mov rax, qword [0x1403633c0]
mov rcx, rbp
mov edx, 1
xor r8d, r8d
lea r9, [rsp + 0x80]
call qword [0x14037e008]
test eax, eax
jne 0x1402711de
cmp dword [0x1403629c0], 2
jg 0x140270ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov r8d, 0x1e6
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, [0x14031fcf5]
mov r8d, 0x21
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
mov r12, qword [rsp + 0x60]
lea r15, [0x1402ff0e0]
mov r13, rbp
jmp 0x1402709b4
mov dword [rsp + 0xa0], 0x68
xor eax, eax
mov qword [rsp + 0x68], rax
xor esi, esi
mov r12, qword [rsp + 0x60]
lea r15, [0x1402ff0e0]
mov rdx, qword [r12]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x140270f6a
cmp r8b, 0xc
jb 0x140270f74
mov r13, rbp
add r8, 0xfffffffffffffff4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov r9, 0xffffffffffffffff
call fcn.1400dffce
cmp byte [rsp + 0x1a7], 0
jns 0x140270f3c
mov r14, qword [rsp + 0x190]
lea rdx, str.rundll32.exe
mov rcx, r14
call fcn.1401740e4
test eax, eax
sete bpl
cmp byte [rsp + 0x1a7], 0
jns 0x140270f79
mov rcx, qword [rsp + 0x190]
call fcn.140153bcc
jmp 0x140270f79
mov r8, qword [rdx + 8]
cmp r8, 0xc
jae 0x140270f07
mov r13, rbp
xor ebp, ebp
mov qword [rsp + 0x90], rbx
movaps xmmword [rsp + 0x80], xmm6
call fcn.1402999ac
test al, al
jne 0x140270f97
xor r14d, r14d
jmp 0x140270f9f
call fcn.140299a29
mov r14, rax
cmp byte [rsp + 0x357], 0
jns 0x140270fb1
mov r13, qword [rsp + 0x340]
test bpl, bpl
jne 0x140270fc5
mov rdx, qword [r12]
cmp byte [rdx + 0x17], 0
jns 0x140270fc7
mov rdx, qword [rdx]
jmp 0x140270fc7
xor edx, edx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, r14
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140271160
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1403629c0], 1
lea rsi, [0x1402ff0e8]
jg 0x140271087
cmp dword [0x140356398], 0
je 0x140271087
test eax, eax
jne 0x140271087
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov r8d, 0x22f
mov r9d, 1
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1403629c0], 1
mov r13, qword [rsp + 0x68]
jg 0x1402710ff
cmp dword [0x140356398], 0
je 0x1402710ff
test eax, eax
jne 0x1402710ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov r8d, 0x232
mov r9d, 1
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
mov ecx, 0xc0
add rcx, qword [r12]
lea rbx, [rsp + 0x190]
mov qword [rbx], 0xffffffffffffffff
mov rdx, rbx
call fcn.14005d254
xorps xmm0, xmm0
movups xmmword [rbx + 0x14], xmm0
movups xmmword [rbx + 4], xmm0
mov dword [rbx], 2
lea r8, [rsp + 0x70]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r12]
lea rdx, [rsp + 0x190]
call fcn.14005ee1c
mov ebx, eax
mov ebp, eax
jmp 0x1402711c8
cmp dword [0x1403629c0], 2
lea rsi, [0x1402ff0e8]
jg 0x1402711bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov r8d, 0x22a
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
xor ebx, ebx
xor ebp, ebp
mov r13, qword [rsp + 0x68]
test r14, r14
je 0x1402709b8
mov rcx, r14
call fcn.14005ec2a
jmp 0x1402709b8
lea rcx, [rsp + 0x110]
call fcn.140271a9a
mov rax, rbp
mov qword [rsp + 0x68], rbp
lea rax, [rsp + 0x110]
mov qword [rax + 8], rbp
mov rbp, qword [rsp + 0x2d0]
mov rax, qword [rsp + 0x2e0]
sub rax, rbp
cmp rax, 0x3f
ja 0x14027127f
mov rsi, qword [rsp + 0x2d8]
mov ecx, 0x40
call fcn.140153bd4
mov rcx, rsi
sub rcx, rbp
and rcx, 0xfffffffffffffff8
add rcx, rax
add rax, 0x40
mov rdx, rcx
cmp rsi, rbp
jne 0x1402713ca
mov qword [rsp + 0x2d0], rdx
mov qword [rsp + 0x2d8], rcx
mov qword [rsp + 0x2e0], rax
cmp rsi, rbp
je 0x14027126f
add rsi, 0xfffffffffffffff8
jne 0x14027125f
jmp 0x1402714d6
test rbp, rbp
lea rsi, [0x1402ff0e8]
jne 0x1402713bd
lea rdx, [0x1403565e0]
lea rbp, [rsp + 0x2d0]
mov rcx, rbp
call fcn.1401f879c
lea rdx, [0x1403565f4]
mov rcx, rbp
call fcn.1401f879c
lea rdx, [0x1403565fc]
mov rcx, rbp
call fcn.1401f879c
mov edx, 0xc8
mov rax, qword [rsp + 0x60]
add rdx, qword [rax]
mov rcx, rbp
call fcn.1401f879c
mov rcx, rbp
lea rdx, [rsp + 0x2f8]
call fcn.1401f879c
mov rcx, rbp
mov rdx, r15
call fcn.1402719cd
mov rcx, rbp
mov rdx, r12
call fcn.1402719cd
mov rcx, rbp
mov rdx, r13
call fcn.1402719cd
mov r9, qword [rbp]
mov rcx, qword [rbp + 8]
sub rcx, r9
je 0x1402713eb
mov rax, qword [0x1403633d0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
mov r8d, 0x20002
mov r13, qword [rsp + 0x68]
mov rcx, r13
xor edx, edx
call qword [0x14037e008]
test eax, eax
lea r15, [0x1402ff0e0]
lea rbp, [rsp + 0x340]
je 0x140271357
mov esi, 0x80000
mov r12, qword [rsp + 0x60]
jmp 0x140270ef3
cmp dword [0x1403629c0], 2
mov r12, qword [rsp + 0x60]
jg 0x1402709b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov r8d, 0x200
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x1a0]
lea rdx, [0x14031fd17]
mov r8d, 0x19
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
jmp 0x1402709b4
mov rcx, rbp
call fcn.140153bcc
jmp 0x14027127f
mov rdx, rcx
mov r8, rsi
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [rdx - 8], r9
add rdx, 0xfffffffffffffff8
cmp r8, rbp
je 0x140271247
jmp 0x1402713d0
int3
add rax, 0xfffffffffffffff8
jne 0x1402709fd
int3
lea rcx, [0x1403633d8]
call fcn.1401547b8
cmp dword [0x1403633d8], 0xffffffff
jne 0x140270d6c
cmp qword [0x1403633c0], 0
je 0x140271436
lea rcx, [0x140303a40]
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.1400950ce
jmp 0x140271438
xor eax, eax
mov qword [0x1403633d0], rax
lea rcx, [0x1403633d8]
call fcn.140153cf4
jmp 0x140270d6c
lea rcx, [0x1403633c8]
call fcn.1401547b8
cmp dword [0x1403633c8], 0xffffffff
jne 0x140270d47
lea rcx, [0x140303a40]
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.1400950ce
mov qword [0x1403633c0], rax
lea rcx, [0x1403633c8]
call fcn.140153cf4
jmp 0x140270d47
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor ebx, ebx
xor ebp, ebp
jmp 0x140270a3b
int3
int3
int3
int3
int3
int3
int3