Function at 0x14000c7d0
Capabilities:
Accept command line arguments
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x14012d228]
xor rax, rsp
mov qword [rbp + 0x520], rax
mov r15d, ecx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
mov edx, dword [0x140132b68]
mov eax, dword [0x140132b64]
lea rbx, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
add edx, eax
je 0x14000c890
mov dword [rbp - 0x30], r14d
call fcn.14000c6e0
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
mov dword [rsp + 0x50], 1
mov rax, qword [rbp - 0x38]
test rax, rax
jne 0x14000c859
call fcn.14000c6e0
mov qword [rbp - 0x38], rax
lock inc dword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
mov dword [rbp + 0xa4], 0x20
lea rax, str.Entering_KillOrphanedBrowserSubprocesses.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [0x140000000]
lea r8, [rbp + 0xa4]
movsx edx, r14w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
mov r13, 0xffffffffffffffff
test al, 1
je 0x14000c8cd
and eax, 0xfffffffe
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x38], r14
mov eax, r13d
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
js 0x14000c8c9
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x30], eax
cmp eax, 1
jns 0x14000c8b7
lock inc dword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lfence
mov ecx, 0x20
call fcn.14005af10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x58], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000cae7
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x2e4]
call fcn.1400bb2f0
mov dword [rbp + 0x2e0], 0x238
lea rdx, [rbp + 0x2e0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000cade
movabs rsi, 0x7ffffffffffffff
cmp dword [rbp + 0x300], r15d
jne 0x14000ca23
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 8]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], r14d
mov rcx, rbx
mov edx, dword [rbp + 0x2e8]
cmp byte [rax + 0x19], 0
jne 0x14000c9ac
mov qword [rbp + 0x60], rax
cmp dword [rax + 0x1c], edx
jae 0x14000c999
mov dword [rbp + 0x68], r14d
mov rax, qword [rax + 0x10]
jmp 0x14000c9a6
mov dword [rbp + 0x68], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000c986
cmp byte [rcx + 0x19], 0
jne 0x14000c9b7
cmp edx, dword [rcx + 0x1c]
jae 0x14000ca23
cmp qword [rsp + 0x60], rsi
je 0x14000ef1f
lea rax, [rsp + 0x58]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], r14
lfence
mov ecx, 0x20
call fcn.14005af10
nop
mov qword [rbp + 0xe0], r14
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x110], xmm0
lea rdx, [rbp + 0x110]
mov ecx, dword [rbp + 0x2e8]
mov dword [rax + 0x1c], ecx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], 0
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.14000f410
lea rdx, [rbp + 0x2e0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14000cade
cmp dword [rbp + 0x300], r15d
jne 0x14000ca23
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 8]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], r14d
mov rcx, rbx
mov edx, dword [rbp + 0x2e8]
cmp byte [rax + 0x19], 0
jne 0x14000ca89
mov qword [rbp + 0x60], rax
cmp dword [rax + 0x1c], edx
jae 0x14000ca76
mov dword [rbp + 0x68], r14d
mov rax, qword [rax + 0x10]
jmp 0x14000ca83
mov dword [rbp + 0x68], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000ca63
cmp byte [rcx + 0x19], 0
jne 0x14000ca94
cmp edx, dword [rcx + 0x1c]
jae 0x14000ca23
cmp qword [rsp + 0x60], rsi
je 0x14000ef1f
lea rax, [rsp + 0x58]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], r14
lfence
mov ecx, 0x20
call fcn.14005af10
nop
mov qword [rbp + 0xf0], r14
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x120], xmm0
lea rdx, [rbp + 0x120]
jmp 0x14000c9fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov r14, qword [rsp + 0x58]
lea r8, [r14 + 8]
mov rsi, qword [r8]
mov rcx, rsi
mov rbx, r14
mov rdi, r14
cmp byte [rsi + 0x19], 0
jne 0x14000cb35
nop word [rax + rax]
mov eax, dword [rcx + 0x1c]
cmp eax, edx
jae 0x14000cb1d
mov rcx, qword [rcx + 0x10]
jmp 0x14000cb2f
cmp byte [rdi + 0x19], 0
je 0x14000cb29
cmp edx, eax
cmovb rdi, rcx
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x14000cb10
mov rax, rdi
cmp byte [rdi + 0x19], 0
cmovne rax, r8
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000cb67
nop dword [rax]
cmp edx, dword [rcx + 0x1c]
jae 0x14000cb5d
mov rdi, rcx
mov rcx, qword [rcx]
jmp 0x14000cb61
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14000cb50
cmp rbx, qword [r14]
jne 0x14000cbc0
cmp byte [rdi + 0x19], 0
je 0x14000cbc0
cmp byte [rsi + 0x19], 0
jne 0x14000cba9
nop dword [rax + rax]
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rsi
mov rsi, qword [rsi]
mov edx, 0x20
call fcn.14005a920
cmp byte [rsi + 0x19], 0
je 0x14000cb80
mov qword [r14 + 8], r14
mov qword [r14], r14
mov qword [r14 + 0x10], r14
xor eax, eax
mov qword [rsp + 0x60], rax
jmp 0x14000cc8c
cmp rbx, rdi
je 0x14000cc91
nop dword [rax]
mov rdx, rbx
lea r8, [rbx + 0x10]
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
je 0x14000cc28
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000cc03
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x14000cc03
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000cbf0
mov rbx, rax
mov rcx, qword [rdx + 8]
cmp byte [rcx + 0x19], 0
jne 0x14000cc6c
mov rax, rdx
cmp rax, qword [rcx + 0x10]
jne 0x14000cc6c
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x14000cc13
jmp 0x14000cc6c
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000cc4f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000cc40
mov rax, qword [r8]
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000cc6c
nop dword [rax + rax]
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000cc60
lea rcx, [rsp + 0x58]
call fcn.14000f070
mov edx, 0x20
mov rcx, rax
call fcn.14005a920
cmp rbx, rdi
jne 0x14000cbd0
mov r14, qword [rsp + 0x58]
lea rdx, [r14 + 8]
mov rsi, qword [rdx]
mov rax, rsi
mov rbx, r14
mov rdi, r14
cmp byte [rsi + 0x19], 0
jne 0x14000ccce
mov ecx, dword [rax + 0x1c]
cmp ecx, r15d
jae 0x14000ccb5
mov rax, qword [rax + 0x10]
jmp 0x14000ccc8
cmp byte [rdi + 0x19], 0
je 0x14000ccc2
cmp r15d, ecx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000cca7
mov rax, rdi
cmp byte [rdi + 0x19], 0
cmovne rax, rdx
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000ccfa
cmp r15d, dword [rcx + 0x1c]
jae 0x14000ccf0
mov rdi, rcx
mov rcx, qword [rcx]
jmp 0x14000ccf4
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14000cce2
cmp rbx, qword [r14]
jne 0x14000cd50
cmp byte [rdi + 0x19], 0
je 0x14000cd50
cmp byte [rsi + 0x19], 0
jne 0x14000cd39
nop dword [rax + rax]
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rsi
mov rsi, qword [rsi]
mov edx, 0x20
call fcn.14005a920
cmp byte [rsi + 0x19], 0
je 0x14000cd10
mov qword [r14 + 8], r14
mov qword [r14], r14
mov qword [r14 + 0x10], r14
xor ebx, ebx
mov qword [rsp + 0x60], rbx
jmp 0x14000ce2a
cmp rbx, rdi
je 0x14000ce1c
nop dword [rax]
mov rdx, rbx
lea r8, [rbx + 0x10]
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
je 0x14000cdb8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000cd93
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x14000cd93
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000cd80
mov rbx, rax
mov rcx, qword [rdx + 8]
cmp byte [rcx + 0x19], 0
jne 0x14000cdfc
mov rax, rdx
cmp rax, qword [rcx + 0x10]
jne 0x14000cdfc
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x14000cda3
jmp 0x14000cdfc
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000cddf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000cdd0
mov rax, qword [r8]
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000cdfc
nop dword [rax + rax]
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000cdf0
lea rcx, [rsp + 0x58]
call fcn.14000f070
mov edx, 0x20
mov rcx, rax
call fcn.14005a920
cmp rbx, rdi
jne 0x14000cd60
cmp qword [rsp + 0x60], 0
jne 0x14000cf2d
xor ebx, ebx
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000cea7
mov dword [rbp - 0x70], ebx
call fcn.14000c6e0
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
or dword [rsp + 0x50], 2
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x14000ce65
call fcn.14000c6e0
mov qword [rbp - 0x78], rax
lock inc dword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov dword [rbp + 0xa0], 0x20
mov dword [rsp + 0x30], r15d
lea rax, str.No_child_processes_found_for_closing_pid__ld
mov qword [rsp + 0x28], rax
lea rdx, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rdx
lea r9, [0x140000000]
lea r8, [rbp + 0xa0]
movsx edx, bx
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
test al, 2
je 0x14000cedd
and eax, 0xfffffffd
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x78], rbx
mov eax, r13d
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
js 0x14000ced9
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x70], eax
cmp eax, 1
jns 0x14000cec7
lock inc dword [rbp - 0x70]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000cf1e
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005a920
cmp byte [rbx + 0x19], 0
je 0x14000cef0
mov rcx, qword [rsp + 0x58]
mov edx, 0x20
call fcn.14005a920
jmp 0x14000eee9
call fcn.140004bc0
mov rcx, rax
test rax, rax
je 0x14000ef25
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140029715.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
call fcn.140004bc0
mov rcx, rax
test rax, rax
je 0x14000ef30
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140029715.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rbx, qword [rsp + 0x58]
mov rbx, qword [rbx]
xor eax, eax
mov byte [rbp - 0x80], al
cmp byte [rbx + 0x19], al
jne 0x14000d04f
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx + 0x1c]
lea rdx, [0x1400f2c50]
lea rcx, [rsp + 0x78]
call fcn.14000c1e0
cmp dword [rdi - 0x10], 0
je 0x14000cfd2
mov r8d, 1
lea rdx, [0x1400f2c58]
lea rcx, [rsp + 0x68]
call fcn.140005f20
mov rdx, qword [rsp + 0x78]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140005f20
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000d018
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000d013
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x14000d013
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000d000
mov rbx, rax
jmp 0x14000d03f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000d03f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000d030
cmp byte [rbx + 0x19], 0
jne 0x14000d04f
mov rdi, qword [rsp + 0x68]
jmp 0x14000cfa0
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000d0dc
xor r14d, r14d
mov dword [rbp - 0x40], r14d
call fcn.14000c6e0
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
or dword [rsp + 0x50], 4
mov rax, qword [rbp - 0x48]
test rax, rax
jne 0x14000d08e
call fcn.14000c6e0
mov qword [rbp - 0x48], rax
lock inc dword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
mov dword [rbp + 0xa8], 0x20
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
lea rax, str._pid__ld_child_processes:__s
mov qword [rsp + 0x28], rax
lea r15, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp + 0xa8]
movsx edx, r14w
call fcn.14000ef60
jmp 0x14000d0e6
xor r14d, r14d
lea r15, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov eax, dword [rsp + 0x50]
test al, 4
je 0x14000d11c
and eax, 0xfffffffb
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x48], r14
mov eax, r13d
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
js 0x14000d118
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x40], eax
cmp eax, 1
jns 0x14000d106
lock inc dword [rbp - 0x40]
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r14w
lea rcx, [rbp + 0x190]
call fcn.14001bcd0
test al, al
jne 0x14000d25d
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000d197
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d192
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef4d
call fcn.14005a920
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r14w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d1db
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14000d204
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000cf1e
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005a920
cmp byte [rbx + 0x19], 0
je 0x14000d220
mov rcx, qword [rsp + 0x58]
mov edx, 0x20
call fcn.14005a920
jmp 0x14000eee9
cmp qword [rbp + 0x1a0], 0
jne 0x14000d36e
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000d2b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d2ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef4d
call fcn.14005a920
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r14w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d2f5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14000d31e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000cf1e
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005a920
cmp byte [rbx + 0x19], 0
je 0x14000d331
mov rcx, qword [rsp + 0x58]
mov edx, 0x20
call fcn.14005a920
jmp 0x14000eee9
mov qword [rbp + 0x250], r14
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], 7
mov word [rbp + 0x250], r14w
mov r8d, 7
lea rdx, [0x1400f2ca0]
lea rcx, [rbp + 0x250]
call fcn.140004260
nop
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x190]
call fcn.14001b840
test al, al
sete bl
mov rdx, qword [rbp + 0x268]
cmp rdx, 8
jb 0x14000d407
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef3b
call fcn.14005a920
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], 7
mov word [rbp + 0x250], r14w
test bl, bl
je 0x14000d52d
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000d46f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d46a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef4d
call fcn.14005a920
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r14w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d4b3
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14000d4dc
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000cf1e
nop
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005a920
cmp byte [rbx + 0x19], 0
je 0x14000d4f0
mov rcx, qword [rsp + 0x58]
mov edx, 0x20
call fcn.14005a920
jmp 0x14000eee9
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], r14
mov rdi, qword [rbp + 0x1a0]
lea rsi, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rsi, qword [rbp + 0x190]
cmp rdi, 8
jae 0x14000d57d
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c8], 7
jmp 0x14000d5d8
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ef41
lfence
add rcx, rcx
call fcn.140004450
mov qword [rbp + 0x1b0], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400bac40
mov qword [rbp + 0x1c8], rbx
mov qword [rbp + 0x1c0], rdi
lea rcx, [rbp + 0x1b0]
call fcn.14001bfe0
test al, al
jne 0x14000d75d
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x14000d639
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef47
call fcn.14005a920
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r14w
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000d699
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef4d
call fcn.14005a920
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r14w
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d6dd
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14000d706
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000cf1e
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14000bbe0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005a920
cmp byte [rbx + 0x19], 0
je 0x14000d720
mov rcx, qword [rsp + 0x58]
mov edx, 0x20
call fcn.14005a920
jmp 0x14000eee9
cmp qword [rbp + 0x1c0], 0
jne 0x14000d81a
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x14000d7b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d7ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef47
call fcn.14005a920
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r14w
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000e39a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef4d
call fcn.14005a920
jmp 0x14000e39a
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000d8ce
mov dword [rbp - 0x50], r14d
call fcn.14000c6e0
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
or dword [rsp + 0x50], 8
mov rax, qword [rbp - 0x58]
test rax, rax
jne 0x14000d85a
call fcn.14000c6e0
mov qword [rbp - 0x58], rax
lock inc dword [rbp - 0x50]
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rdx, qword [rbp + 0x1b0]
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rax, qword [rbp + 0x190]
mov dword [rbp + 0xac], 0x20
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
lea rax, str.pid_ld_path_s_quoted_s
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp + 0xac]
movsx edx, r14w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
test al, 8
je 0x14000d906
and eax, 0xfffffff7
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x58], r14
mov eax, r13d
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
js 0x14000d902
nop
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x50], eax
cmp eax, 1
jns 0x14000d8f0
lock inc dword [rbp - 0x50]
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r14
lfence
mov ecx, WSACleanup
call fcn.14005af10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x38], rax
mov rbx, qword [rsp + 0x58]
mov rbx, qword [rbx]
xor eax, eax
mov byte [rbp - 0x7f], al
lea r15, [0x14010f014]
cmp byte [rbx + 0x19], al
jne 0x14000e21c
lea rsi, str._pid__ld_szProcPath_curExePath___s____s_
lea rdi, str._adding_pid__ld_path_s_to_orphan_pids_list.
nop dword [rax + rax]
mov r8d, dword [rbx + 0x1c]
xor edx, edx
mov ecx, 0x1010
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14000e1c3
xor eax, eax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], ax
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call fcn.14001be60
test al, al
je 0x14000db1d
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 8
cmovae rcx, qword [rbp + 0x1d0]
call fcn.1400bff60
test eax, eax
je 0x14000db8c
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000daa9
xor eax, eax
mov dword [rbp - 0x60], eax
call fcn.14000c6e0
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
or dword [rsp + 0x50], 0x10
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x14000da32
call fcn.14000c6e0
mov qword [rbp - 0x68], rax
lock inc dword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
lea r8, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae r8, qword [rbp + 0x190]
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 8
cmovae rdx, qword [rbp + 0x1d0]
mov eax, dword [rbx + 0x1c]
mov dword [rbp + 0xb0], 0x20
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0xb0]
xor eax, eax
movsx edx, ax
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
test al, 0x10
je 0x14000dae6
and eax, 0xffffffef
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rbp - 0x68], rax
mov eax, r13d
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
js 0x14000dae2
nop dword [rax + rax]
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x60], eax
cmp eax, 1
jns 0x14000dad0
lock inc dword [rbp - 0x60]
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 8
cmovae rcx, qword [rbp + 0x1d0]
call fcn.1400bff60
test eax, eax
je 0x14000db8c
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 8
jb 0x14000db63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000db5e
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef53
call fcn.14005a920
xor eax, eax
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], ax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e1c3
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000dc27
xor esi, esi
mov dword [rbp - 0x20], esi
call fcn.14000c6e0
mov qword [rbp - 0x28], rax
lock inc dword [rbp - 0x20]
or dword [rsp + 0x50], 0x20
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x14000dbcd
call fcn.14000c6e0
mov qword [rbp - 0x28], rax
lock inc dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 8
cmovae rdx, qword [rbp + 0x1d0]
mov eax, dword [rbx + 0x1c]
mov dword [rbp + 0xb4], 0x20
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0xb4]
movsx edx, si
call fcn.14000ef60
jmp 0x14000dc29
xor esi, esi
mov eax, dword [rsp + 0x50]
test al, 0x20
je 0x14000dc66
and eax, 0xffffffdf
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x28], rsi
mov eax, r13d
lock xadd dword [rbp - 0x20], eax
cmp eax, 1
js 0x14000dc62
nop dword [rax]
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x20], eax
cmp eax, 1
jns 0x14000dc50
lock inc dword [rbp - 0x20]
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], 7
mov word [rbp + 0x230], si
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp + 0x230]
call fcn.140004260
nop
mov eax, dword [rbx + 0x1c]
mov dword [rbp + 0x290], eax
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x298]
call fcn.1400068e0
nop
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x2b8]
call fcn.1400068e0
nop
mov rsi, qword [rbp + 0x38]
mov rax, qword [rsi + 8]
mov qword [rbp + 0x60], rax
xor edx, edx
mov dword [rbp + 0x68], edx
mov rdi, rsi
cmp byte [rax + 0x19], dl
jne 0x14000dd0a
mov ecx, dword [rbx + 0x1c]
mov qword [rbp + 0x60], rax
cmp dword [rax + 0x20], ecx
jae 0x14000dcf8
mov dword [rbp + 0x68], edx
mov rax, qword [rax + 0x10]
jmp 0x14000dd05
mov dword [rbp + 0x68], 1
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], dl
je 0x14000dce6
cmp byte [rdi + 0x19], dl
jne 0x14000dd1e
mov eax, dword [rdi + 0x20]
cmp dword [rbx + 0x1c], eax
jb 0x14000dd1e
xor esi, esi
jmp 0x14000ddb6
movabs rax, 0x249249249249249
cmp qword [rbp + 0x40], rax
je 0x14000ef19
lea rax, [rbp + 0x38]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rdx
lfence
mov ecx, WSACleanup
call fcn.14005af10
nop
mov ecx, dword [rbx + 0x1c]
mov dword [rax + 0x20], ecx
xor ecx, ecx
mov dword [rax + 0x28], ecx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], 7
mov qword [rax + 0x50], rcx
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], 7
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], cx
xor esi, esi
mov qword [rbp + 0x100], rsi
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x130], xmm0
mov r8, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x38]
call fcn.14000f410
mov rdi, rax
mov ecx, dword [rbp + 0x290]
mov dword [rdi + 0x28], ecx
lea rcx, [rdi + 0x30]
lea rax, [rbp + 0x298]
cmp rcx, rax
je 0x14000ddf2
lea rdx, [rbp + 0x298]
cmp qword [rbp + 0x2b0], 8
cmovae rdx, qword [rbp + 0x298]
mov r8, qword [rbp + 0x2a8]
call fcn.140004260
lea rcx, [rdi + 0x50]
lea rax, [rbp + 0x2b8]
cmp rcx, rax
je 0x14000de26
lea rdx, [rbp + 0x2b8]
cmp qword [rbp + 0x2d0], 8
cmovae rdx, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x2c8]
call fcn.140004260
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400040a0
lea rcx, [rbp + 0x298]
call fcn.1400040a0
nop
mov r8, qword [rbp + 0x248]
cmp r8, 8
jb 0x14000de62
inc r8
mov rdx, qword [rbp + 0x230]
lea rcx, [rbp + 0x230]
call fcn.140004410
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], 7
mov word [rbp + 0x230], si
mov r8, qword [rbp + 0x1e8]
cmp r8, 8
jb 0x14000de9e
inc r8
mov rdx, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x1d0]
call fcn.140004410
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], si
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x48], rsi
lea rdx, [rbp + 0x48]
mov ecx, dword [rbx + 0x1c]
call fcn.14000c3d0
mov ecx, dword [0x140132b68]
test al, al
mov eax, dword [0x140132b64]
je 0x14000e0db
add ecx, eax
je 0x14000df50
mov dword [rbp - 0x10], esi
call fcn.14000c6e0
mov qword [rbp - 0x18], rax
lock inc dword [rbp - 0x10]
or dword [rsp + 0x50], 0x40
mov rax, qword [rbp - 0x18]
test rax, rax
jne 0x14000df13
call fcn.14000c6e0
mov qword [rbp - 0x18], rax
lock inc dword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov dword [rbp + 0xb8], 0x20
lea rax, str.GetCmdLineOfPid_succeeds
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0xb8]
movsx edx, si
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
test al, 0x40
je 0x14000df86
and eax, 0xffffffbf
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x18], rsi
mov eax, r13d
lock xadd dword [rbp - 0x10], eax
cmp eax, 1
js 0x14000df82
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp - 0x10], eax
cmp eax, 1
jns 0x14000df70
lock inc dword [rbp - 0x10]
mov rdi, qword [rbp + 0x48]
test rdi, rdi
je 0x14000e19b
mov rdx, qword [rbp + 0x38]
mov rax, qword [rdx + 8]
mov rsi, rdx
cmp byte [rax + 0x19], 0
jne 0x14000dfbe
mov ecx, dword [rbx + 0x1c]
cmp dword [rax + 0x20], ecx
jae 0x14000dfb2
mov rax, qword [rax + 0x10]
jmp 0x14000dfb8
mov rsi, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000dfa7
cmp byte [rsi + 0x19], 0
jne 0x14000dfcc
mov eax, dword [rsi + 0x20]
cmp dword [rbx + 0x1c], eax
jae 0x14000dfcf
mov rsi, rdx
cmp rsi, rdx
je 0x14000e19b
lea r14, [rsi + 0x50]
cmp r14, rdi
je 0x14000dffa
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14000dfef
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r14
call fcn.140004260
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000e094
xor eax, eax
mov dword [rbp], eax
call fcn.14000c6e0
mov qword [rbp - 8], rax
lock inc dword [rbp]
or dword [rsp + 0x50], 0x80
mov rax, qword [rbp - 8]
test rax, rax
jne 0x14000e03e
call fcn.14000c6e0
mov qword [rbp - 8], rax
lock inc dword [rbp]
mov rcx, qword [rbp - 8]
cmp qword [r14 + 0x18], 8
jb 0x14000e04c
mov r14, qword [r14]
mov eax, dword [rsi + 0x20]
mov dword [rbp + 0xbc], 0x20
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], eax
lea rax, str._pid_ld_cmd_s
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0xbc]
xor esi, esi
movsx edx, si
call fcn.14000ef60
jmp 0x14000e096
xor esi, esi
mov eax, dword [rsp + 0x50]
test al, al
jns 0x14000e197
btr eax, 7
mov dword [rsp + 0x50], eax
mov qword [rbp - 8], rsi
mov eax, r13d
lock xadd dword [rbp], eax
cmp eax, 1
js 0x14000e0d2
nop dword [rax + rax]
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp], eax
cmp eax, 1
jns 0x14000e0c0
lock inc dword [rbp]
jmp 0x14000e197
add ecx, eax
je 0x14000e15e
mov dword [rbp + 0x10], esi
call fcn.14000c6e0
mov qword [rbp + 8], rax
lock inc dword [rbp + 0x10]
or dword [rsp + 0x50], 0x100
mov rax, qword [rbp + 8]
test rax, rax
jne 0x14000e10d
call fcn.14000c6e0
mov qword [rbp + 8], rax
lock inc dword [rbp + 0x10]
mov rdi, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 0x1c]
mov dword [rbp + 0xc0], 0x20
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
lea rax, str.GetCmdLineOfPid_pid_ld_failed_error__ld
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0xc0]
movsx edx, si
mov rcx, rdi
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
bt eax, 8
jae 0x14000e197
btr eax, 8
mov dword [rsp + 0x50], eax
mov qword [rbp + 8], rsi
mov eax, r13d
lock xadd dword [rbp + 0x10], eax
cmp eax, 1
js 0x14000e193
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp + 0x10], eax
cmp eax, 1
jns 0x14000e181
lock inc dword [rbp + 0x10]
mov rdi, qword [rbp + 0x48]
test rdi, rdi
je 0x14000e1b5
mov rcx, rdi
call fcn.1400040a0
mov edx, 0x20
mov rcx, rdi
call fcn.14005a920
lea rsi, str._pid__ld_szProcPath_curExePath___s____s_
lea rdi, str._adding_pid__ld_path_s_to_orphan_pids_list.
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000e1ef
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000e1ea
cmp rbx, qword [rax + 0x10]
jne 0x14000e1ea
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000e1d7
mov rbx, rax
jmp 0x14000e20f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000e20f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000e200
cmp byte [rbx + 0x19], 0
je 0x14000d960
xor r14d, r14d
cmp qword [rbp + 0x40], 0
jne 0x14000e416
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000e2dc
mov dword [rbp + 0x58], r14d
call fcn.14000c6e0
mov qword [rbp + 0x50], rax
lock inc dword [rbp + 0x58]
mov ebx, dword [rsp + 0x50]
bts ebx, 9
mov dword [rsp + 0x50], ebx
lea rcx, [rbp + 0x50]
call fcn.14000c110
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rcx, qword [rbp + 0x190]
mov dword [rbp + 0xc4], 0x20
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r12d
lea rcx, str.No_child_processes_found_for_closing_pid__ld_and_the_same_path__s_or__s
mov qword [rsp + 0x28], rcx
lea rdx, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rdx
lea r9, [0x140000000]
lea r8, [rbp + 0xc4]
movsx edx, r14w
mov rcx, rax
call fcn.14000ef60
jmp 0x14000e2e0
mov ebx, dword [rsp + 0x50]
bt ebx, 9
jae 0x14000e316
btr ebx, 9
mov dword [rsp + 0x50], ebx
mov qword [rbp + 0x50], r14
mov eax, r13d
lock xadd dword [rbp + 0x58], eax
cmp eax, 1
js 0x14000e312
nop
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp + 0x58], eax
cmp eax, 1
jns 0x14000e300
lock inc dword [rbp + 0x58]
mov r8, qword [rbp + 0x38]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.14000bc40
mov edx, WSACleanup
mov rcx, qword [rbp + 0x38]
call fcn.14005a920
nop
mov r8, qword [rbp + 0x1c8]
cmp r8, 8
jb 0x14000e35d
inc r8
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
call fcn.140004410
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r14w
mov r8, qword [rbp + 0x1a8]
cmp r8, 8
jb 0x14000e39a
inc r8
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x190]
call fcn.140004410
mov word [rbp + 0x190], r14w
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], r14
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e3de
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14000e407
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140029715.0]
nop
lea rcx, [rsp + 0x58]
call fcn.14000bff0
jmp 0x14000eee9
mov rax, r13
nop dword [rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x14000e420
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140006130
mov rbx, qword [rbp + 0x38]
mov rbx, qword [rbx]
xor eax, eax
mov byte [rbp - 0x7e], al
cmp byte [rbx + 0x19], al
jne 0x14000e509
lea rax, [rbx + 0x50]
cmp qword [rax + 0x18], 8
jb 0x14000e45e
mov rax, qword [rax]
lea r9, [rbx + 0x30]
cmp qword [r9 + 0x18], 8
jb 0x14000e46c
mov r9, qword [r9]
mov qword [rsp + 0x20], rax
mov r8d, dword [rbx + 0x20]
lea rdx, str._tpid_ld_path_s_cmd_s
lea rcx, [rsp + 0x78]
call fcn.14000c1e0
mov rdx, qword [rsp + 0x78]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140005f20
mov r8d, 2
lea rdx, [0x1400f2f30]
lea rcx, [rsp + 0x68]
call fcn.140005f20
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000e4dc
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000e4d7
cmp rbx, qword [rax + 0x10]
jne 0x14000e4d7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000e4c4
mov rbx, rax
jmp 0x14000e4ff
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000e4ff
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000e4f0
cmp byte [rbx + 0x19], 0
je 0x14000e450
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000e595
mov dword [rbp + 0x20], r14d
call fcn.14000c6e0
mov qword [rbp + 0x18], rax
lock inc dword [rbp + 0x20]
or dword [rsp + 0x50], 0x400
mov rax, qword [rbp + 0x18]
test rax, rax
jne 0x14000e548
call fcn.14000c6e0
mov qword [rbp + 0x18], rax
lock inc dword [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
mov dword [rbp + 0x80], 0x20
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
lea rax, str._pid__ld_OBK.exe_child_processes_remained_orphans:_r_n_s
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x80]
movsx edx, r14w
call fcn.14000ef60
nop
mov r12d, dword [rsp + 0x50]
bt r12d, 0xa
jae 0x14000e5db
btr r12d, 0xa
mov dword [rsp + 0x50], r12d
mov qword [rbp + 0x18], r14
mov eax, r13d
lock xadd dword [rbp + 0x20], eax
cmp eax, 1
js 0x14000e5d2
nop dword [rax]
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp + 0x20], eax
cmp eax, 1
jns 0x14000e5c0
lock inc dword [rbp + 0x20]
mov r12d, dword [rsp + 0x50]
mov rbx, qword [rbp + 0x38]
mov rbx, qword [rbx]
mov qword [rbp + 0x78], rbx
xor eax, eax
mov byte [rbp - 0x7d], al
cmp byte [rbx + 0x19], al
jne 0x14000eea5
lea rax, str.__type
mov qword [rbp + 0xd0], rax
lea rdi, str._Child_process_pid_ld_type_s_path_s_cmdline_s
nop dword [rax]
mov qword [rbp + 0x1f0], r14
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x208], 7
mov word [rbp + 0x1f0], r14w
cmp qword [rbx + 0x60], 0
je 0x14000e8f0
mov dword [rbp - 0x7c], r14d
lea rcx, [rbx + 0x50]
cmp qword [rcx + 0x18], 8
jb 0x14000e64e
mov rcx, qword [rcx]
lea rdx, [rbp - 0x7c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x14000e8f0
mov esi, 1
mov dword [rsp + 0x70], esi
mov ecx, dword [rbp - 0x7c]
cmp ecx, esi
jle 0x14000e8e7
lea rdi, [rax + 8]
mov qword [rsp + 0x50], rdi
nop word [rax + rax]
cmp qword [rbp + 0x200], 0
jne 0x14000e8d0
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000e8b9
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], 7
mov word [rbp + 0x210], r14w
mov r8, r13
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000e6d0
lea rcx, [rbp + 0x210]
call fcn.140004260
nop
mov r15, qword [rbp + 0x220]
mov r14, qword [rbp + 0x210]
mov r11, qword [rbp + 0x228]
test r15, r15
je 0x14000e880
lea rdi, [rbp + 0x210]
cmp r11, 8
cmovae rdi, r14
cmp r15, 7
jb 0x14000e87b
lea rsi, [r15 - 6]
lea rsi, [rdi + rsi*2]
mov rcx, rdi
xor ebx, ebx
nop dword [rax]
mov rax, rsi
sub rax, rcx
sar rax, 1
mov rdx, rbx
je 0x14000e75a
cmp word [rcx], 0x2d
je 0x14000e757
cmp rax, 1
je 0x14000e75a
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000e744
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14000e877
mov r9d, 7
lea r8, str.__type
movzx eax, word [rdx]
mov edx, 0x2d
cmp ax, dx
jb 0x14000e7aa
mov r10, rcx
sub r10, qword [rbp + 0xd0]
cmp ax, dx
ja 0x14000e7aa
cmp r9, 1
je 0x14000e7b0
dec r9
add r8, 2
movzx eax, word [r8 + r10]
movzx edx, word [r8]
cmp ax, dx
jae 0x14000e78d
add rcx, 2
jmp 0x14000e730
sub rcx, rdi
sar rcx, 1
jne 0x14000e877
cmp r15, 7
jbe 0x14000e877
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x288], 7
mov r8, r13
lea rax, [r15 - 7]
cmp rax, r13
cmovb r8, rax
lea rdx, [rbp + 0x210]
cmp r11, 8
cmovae rdx, r14
add rdx, 0xe
lea rcx, [rbp + 0x270]
call fcn.140004260
bts r12d, 0x11
mov r8, qword [rbp + 0x208]
cmp r8, 8
jb 0x14000e834
inc r8
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
call fcn.140004410
movups xmm0, xmmword [rbp + 0x270]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rbp + 0x280]
movups xmmword [rbp + 0x200], xmm1
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x288], 7
mov word [rbp + 0x270], bx
mov r11, qword [rbp + 0x228]
mov r14, qword [rbp + 0x210]
mov esi, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
cmp r11, 8
jb 0x14000e899
lea r8, [r11 + 1]
mov rdx, r14
lea rcx, [rbp + 0x210]
call fcn.140004410
xor r14d, r14d
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], 7
mov word [rbp + 0x210], r14w
mov ecx, dword [rbp - 0x7c]
inc esi
mov dword [rsp + 0x70], esi
add rdi, 8
mov qword [rsp + 0x50], rdi
cmp esi, ecx
jl 0x14000e690
mov dword [rsp + 0x50], r12d
mov rbx, qword [rbp + 0x78]
mov rax, qword [rbp + 0xc8]
lea rdi, str._Child_process_pid_ld_type_s_path_s_cmdline_s
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000e9c9
mov dword [rbp + 0x30], r14d
call fcn.14000c6e0
mov qword [rbp + 0x28], rax
lock inc dword [rbp + 0x30]
or dword [rsp + 0x50], 0x800
mov rax, qword [rbp + 0x28]
test rax, rax
jne 0x14000e933
call fcn.14000c6e0
mov qword [rbp + 0x28], rax
lock inc dword [rbp + 0x30]
mov r10, qword [rbp + 0x28]
lea r8, [rbx + 0x50]
cmp qword [r8 + 0x18], 8
jb 0x14000e945
mov r8, qword [r8]
lea rdx, [rbx + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x14000e953
mov rdx, qword [rdx]
cmp qword [rbp + 0x200], 0
jne 0x14000e966
lea rcx, str._empty_
jmp 0x14000e97d
lea rcx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 8
cmovae rcx, qword [rbp + 0x1f0]
mov eax, dword [rbx + 0x20]
mov dword [rbp + 0x84], 0x20
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x84]
movsx edx, r14w
mov rcx, r10
call fcn.14000ef60
nop
mov ecx, dword [rsp + 0x50]
bt ecx, 0xb
jae 0x14000ea06
btr ecx, 0xb
mov dword [rsp + 0x50], ecx
mov qword [rbp + 0x28], r14
mov eax, r13d
lock xadd dword [rbp + 0x30], eax
cmp eax, 1
js 0x14000ea02
nop dword [rax]
call fcn.14000efb0
mov eax, r13d
lock xadd dword [rbp + 0x30], eax
cmp eax, 1
jns 0x14000e9f0
lock inc dword [rbp + 0x30]
cmp qword [rbp + 0x200], 0
je 0x14000ee81
mov r8d, dword [rbx + 0x20]
test r8d, r8d
je 0x14000ee02
xor edx, edx
mov ecx, 0x101001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14000ee02
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000eb11
mov edx, dword [0x140132b68]
mov ecx, dword [0x140132b64]
add edx, ecx
je 0x14000eaeb
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14000bf70
nop
mov r12d, dword [rsp + 0x50]
bts r12d, 0xc
mov dword [rsp + 0x50], r12d
mov rcx, rax
call fcn.14000c110
mov r14, rax
lea rcx, [rbx + 0x30]
call fcn.140004090
mov rdi, rax
mov esi, dword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x88], 0x20
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], eax
lea rax, str._TerminateProcess_failed_with_error__ld_for_pid__ld_path__s
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x88]
xor eax, eax
movsx edx, ax
mov rcx, r14
call fcn.14000ef60
jmp 0x14000eaf0
mov r12d, dword [rsp + 0x50]
bt r12d, 0xc
jae 0x14000edf8
btr r12d, 0xc
mov dword [rsp + 0x50], r12d
lea rcx, [rbp + 0x140]
jmp 0x14000edf3
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14000eb9a
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.14000bf70
nop
mov esi, dword [rsp + 0x50]
bts esi, 0xd
mov dword [rsp + 0x50], esi
mov rcx, rax
call fcn.14000c110
mov rdi, rax
lea rcx, [rbx + 0x30]
call fcn.140004090
mov ecx, dword [rbx + 0x20]
mov dword [rbp + 0x8c], 0x20
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
lea rax, str._TerminateProcess_succeeded_for_pid__ld_path__s._Waiting_for_2_seconds_to_close.
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x8c]
movsx edx, r14w
mov rcx, rdi
call fcn.14000ef60
jmp 0x14000eb9e
mov esi, dword [rsp + 0x50]
bt esi, 0xd
jae 0x14000ebb8
btr esi, 0xd
mov dword [rsp + 0x50], esi
lea rcx, [rbp + 0x150]
call fcn.14000c0b0
mov edx, 0x7d0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r14d, eax
mov edx, dword [0x140132b68]
mov ecx, dword [0x140132b64]
add edx, ecx
je 0x14000ec5e
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.14000bf70
nop
mov esi, dword [rsp + 0x50]
bts esi, 0xe
mov dword [rsp + 0x50], esi
mov rcx, rax
call fcn.14000c110
mov rdi, rax
lea rcx, [rbx + 0x30]
call fcn.140004090
mov ecx, dword [rbx + 0x20]
mov dword [rbp + 0x90], 0x20
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
lea rax, str._termination_WaitForSingleObject_pid__ld_path__s_returned__ld
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x90]
xor r14d, r14d
movsx edx, r14w
mov rcx, rdi
call fcn.14000ef60
jmp 0x14000ec65
mov esi, dword [rsp + 0x50]
xor r14d, r14d
bt esi, 0xe
jae 0x14000ec7f
btr esi, 0xe
mov dword [rsp + 0x50], esi
lea rcx, [rbp + 0x160]
call fcn.14000c0b0
lea rdx, [rbp + 0x94]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x140132b68]
test eax, eax
mov eax, dword [0x140132b64]
je 0x14000ed50
add ecx, eax
je 0x14000ed2e
xor edx, edx
lea rcx, [rbp + 0x170]
call fcn.14000bf70
nop
mov esi, dword [rsp + 0x50]
bts esi, 0xf
mov dword [rsp + 0x50], esi
mov rcx, rax
call fcn.14000c110
mov rdi, rax
lea rcx, [rbx + 0x30]
call fcn.140004090
mov edx, dword [rbx + 0x20]
mov dword [rbp + 0x98], 0x20
mov ecx, dword [rbp + 0x94]
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
lea rax, str.GetExitCodeProcess_succeeded_for_pid__ld_path__s._Exit_code_is__ld.
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x98]
movsx edx, r14w
mov rcx, rdi
call fcn.14000ef60
jmp 0x14000ed32
mov esi, dword [rsp + 0x50]
bt esi, 0xf
jae 0x14000edf8
btr esi, 0xf
mov dword [rsp + 0x50], esi
lea rcx, [rbp + 0x170]
jmp 0x14000edf3
add ecx, eax
je 0x14000edda
xor edx, edx
lea rcx, [rbp + 0x180]
call fcn.14000bf70
nop
or dword [rsp + 0x50], 0x10000
mov rcx, rax
call fcn.14000c110
mov r14, rax
lea rcx, [rbx + 0x30]
call fcn.140004090
mov rdi, rax
mov esi, dword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x9c], 0x20
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], eax
lea rax, str.GetExitCodeProcess_failed_with_error__ld_for_pid__ld_path__s.
mov qword [rsp + 0x28], rax
lea rax, str.obk_subprocess_helper_t::KillOrphanedBrowserSubprocesses
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp + 0x9c]
xor eax, eax
movsx edx, ax
mov rcx, r14
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x50]
bt eax, 0x10
jae 0x14000edf8
btr eax, 0x10
mov dword [rsp + 0x50], eax
lea rcx, [rbp + 0x180]
call fcn.14000c0b0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400040a0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000ee3e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000ee35
cmp rbx, qword [rax + 0x10]
jne 0x14000ee35
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000ee22
mov rbx, rax
mov qword [rbp + 0x78], rax
jmp 0x14000ee63
mov rbx, rax
mov qword [rbp + 0x78], rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000ee63
nop
mov rbx, rcx
mov qword [rbp + 0x78], rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000ee50
cmp byte [rbx + 0x19], 0
mov r12d, dword [rsp + 0x50]
mov r14d, 0
lea rdi, str._Child_process_pid_ld_type_s_path_s_cmdline_s
je 0x14000e610
jmp 0x14000eea5
mov r8, qword [rbp + 0x208]
cmp r8, 8
jb 0x14000eea5
inc r8
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
call fcn.140004410
nop
lea rcx, [rbp + 0x38]
call fcn.14000c050
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400040a0
nop
lea rcx, [rbp + 0x190]
call fcn.1400040a0
nop
lea rcx, [rsp + 0x78]
call fcn.1400059f0
nop
lea rcx, [rsp + 0x68]
call fcn.1400059f0
nop
lea rcx, [rsp + 0x58]
call fcn.14000bff0
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.14005aef0
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f750
nop
call fcn.14000f750
nop
mov ecx, 0x80004005
call fcn.140004950
nop
mov ecx, 0x80004005
call fcn.140004950
nop
call fcn.1400bf5d0
int3
call fcn.140001ea0
int3
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
int3