Function at 0x1400617a0
Capabilities:
Create process on windows
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movaps xmmword [rsp + 0x300], xmm7
movaps xmmword [rsp + 0x2f0], xmm6
mov rdi, rcx
mov rax, qword [0x140145040]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x140062f6b
xorps xmm0, xmm0
lea rdx, [rsp + 0x190]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [rdi]
call fcn.14006a020
mov r8, qword [rdi]
mov r14, qword [r8 + 0x78]
mov r15, qword [r8 + 0x80]
cmp r14, r15
mov qword [rsp + 0x58], rdi
je 0x1400618b6
lea rsi, [rsp + 0x1a8]
lea rdi, [rsp + 0x180]
lea rbx, [rsp + 0x190]
jmp 0x1400618a0
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1400a9d80
mov rcx, rsi
mov rdx, rbx
call fcn.14006a020
cmp byte [rsp + 0x1bf], 0
jns 0x140061897
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
add r14, 0x18
cmp r14, r15
je 0x1400618ae
movzx eax, byte [r14 + 0x17]
mov rcx, r14
test al, al
jns 0x14006185a
jmp 0x140061853
mov rdi, qword [rsp + 0x58]
mov r8, qword [rdi]
movzx eax, byte [r8 + 0x2f]
test al, al
jns 0x1400618c3
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x140061936
add r8, 0x18
lea rdx, [rsp + 0x80]
mov byte [rdx + 0x17], 8
movabs rax, 0x6573616261746164
mov qword [rdx], rax
mov byte [rdx + 8], 0
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
call fcn.1400631b0
lea rdx, [rsp + 0x190]
mov rcx, rsi
call fcn.14006a020
cmp byte [rsi + 0x17], 0
jns 0x14006191c
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x140061933
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
mov r8, qword [rdi]
movzx eax, byte [r8 + 0x47]
test al, al
jns 0x140061943
mov rax, qword [r8 + 0x38]
test rax, rax
je 0x1400619bd
add r8, 0x30
lea rdx, [rsp + 0x80]
mov byte [rdx + 0x17], 0xb
movabs rax, 0x2d7363697274656d
mov qword [rdx], rax
mov dword [rdx + 7], 0x7269642d
mov byte [rdx + 0xb], 0
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
call fcn.1400631b0
lea rdx, [rsp + 0x190]
mov rcx, rsi
call fcn.14006a020
cmp byte [rsi + 0x17], 0
jns 0x1400619a3
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x1400619ba
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
mov r8, qword [rdi]
movzx eax, byte [r8 + 0x5f]
test al, al
js 0x140061ac6
test rax, rax
je 0x140061a85
add r8, 0x48
lea rdx, [rsp + 0x170]
mov qword [rdx], r8
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.1400a9d80
lea rdx, [rsp + 0x150]
mov byte [rdx + 0x17], 3
movzx eax, word [0x1401309b4]
mov word [rdx], ax
mov al, byte [0x1401309b6]
mov byte [rdx + 2], al
mov byte [rdx + 3], 0
lea rdi, [rsp + 0x1a8]
mov rcx, rdi
mov r8, rsi
call fcn.1400631b0
lea rdx, [rsp + 0x190]
mov rcx, rdi
call fcn.14006a020
cmp byte [rdi + 0x17], 0
jns 0x140061a4f
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x167], 0
mov rsi, qword [rsp + 0x58]
jns 0x140061a6b
mov rcx, qword [rsp + 0x150]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x140061a82
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
mov r8, qword [rsi]
movabs r15, 0x7ffffffffffffff8
mov rdi, qword [r8 + 0x60]
lea rbp, [r8 + 0x68]
cmp rdi, rbp
je 0x140061edf
lea rax, [r15 - 1]
mov qword [rsp + 0x60], rax
movaps xmm6, xmmword [0x1401213c0]
xorps xmm7, xmm7
lea rax, [r15 + 7]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
jmp 0x140061d3a
mov rax, qword [r8 + 0x50]
test rax, rax
je 0x140061a85
mov r8, qword [r8 + 0x48]
jmp 0x1400619d7
lea rbp, [rsi + r13]
mov rcx, rbp
sub rcx, r14
mov r8, r15
sub r8, r14
add r8, 0xfffffffffffffffe
cmp r8, rcx
jb 0x140062f68
lea r15, [rsp + 0x120]
test al, al
jns 0x140061b09
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x78], rdx
mov r12, qword [rsp + 0x60]
movabs rax, 0x3ffffffffffffff2
cmp r14, rax
ja 0x140061b56
lea rax, [r14 + r14]
cmp rbp, rax
cmova rax, rbp
mov r12d, 0x17
cmp rax, 0x17
jb 0x140061b56
mov rcx, rax
and rcx, 0xfffffffffffffff8
add rcx, 8
or rax, 7
cmp rax, 0x17
cmove rax, rcx
inc rax
mov r12, rax
mov rcx, r12
call fcn.1400b4d4c
mov rbx, rax
test rsi, rsi
je 0x140061b74
mov rcx, rbx
mov rdx, r15
mov r8, rsi
call fcn.1400eabe0
add rsi, rbx
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
mov r8, r13
call fcn.1400eabe0
cmp r14, 0x16
je 0x140061b95
mov rcx, r15
call fcn.1400b4d44
mov qword [rsp + 0x120], rbx
movabs r15, 0x7ffffffffffffff8
lea rax, [r15 + 8]
or r12, rax
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x128], rbp
add rbx, rbp
mov rbp, qword [rsp + 0x70]
mov byte [rbx], 0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x160], rax
movaps xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x120], xmm7
mov qword [rsp + 0x130], 0
movzx eax, byte [rsp + 0x167]
test al, al
cmovs rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x150]
lea rdx, [rsp + 0x150]
cmovns rcx, rdx
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea rdx, [rsp + 0x140]
call fcn.1400a9d80
mov byte [rsp + 0x11f], 0xa
movabs rax, 0x697461746f6e6e61
mov qword [rsp + 0x108], rax
mov word [rsp + 0x110], 0x6e6f
mov byte [rsp + 0x112], 0
lea rbx, [rsp + 0x1a8]
mov rcx, rbx
lea rdx, [rsp + 0x108]
mov r8, rsi
call fcn.1400631b0
mov rcx, rbx
lea rdx, [rsp + 0x190]
call fcn.14006a020
cmp byte [rsp + 0x1bf], 0
jns 0x140061cba
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x11f], 0
jns 0x140061cd1
mov rcx, qword [rsp + 0x108]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x140061ce8
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
cmp byte [rsp + 0x167], 0
jns 0x140061cff
mov rcx, qword [rsp + 0x150]
call fcn.1400b4d44
cmp byte [rsp + 0x137], 0
jns 0x140061d16
mov rcx, qword [rsp + 0x120]
call fcn.1400b4d44
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140061da8
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140061d23
mov rdi, rax
cmp rax, rbp
je 0x140061ed7
movzx r14d, byte [rdi + 0x37]
mov rsi, r14
test r14b, r14b
jns 0x140061d4b
mov rsi, qword [rdi + 0x28]
lea r12, [rsi + 1]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x130], rax
movaps xmmword [rsp + 0x120], xmm6
cmp r12, qword [rsp + 0x60]
ja 0x140062f65
cmp r12, 0x17
jae 0x140061db9
movaps xmmword [rsp + 0x120], xmm7
mov qword [rsp + 0x130], 0
mov byte [rsp + 0x137], r12b
lea rbx, [rsp + 0x120]
test rsi, rsi
jne 0x140061e13
jmp 0x140061e2a
mov rax, qword [rdi + 0x10]
cmp qword [rax], rdi
mov rdi, rax
jne 0x140061da8
jmp 0x140061d2e
mov rax, r12
and rax, r15
add rax, 8
mov r15, r12
or r15, 7
cmp r15, 0x17
cmove r15, rax
inc r15
mov rcx, r15
call fcn.1400b4d4c
mov rbx, rax
movabs rax, 0x7ffffffffffffff8
add rax, 8
or rax, r15
movabs r15, 0x7ffffffffffffff8
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], r12
lea rdx, [rdi + 0x20]
test r14b, r14b
jns 0x140061e1f
mov rdx, qword [rdx]
mov rcx, rbx
mov r8, rsi
call fcn.1400eabe0
mov word [rbx + rsi], 0x3d
movzx r13d, byte [rdi + 0x4f]
test r13b, r13b
js 0x140061e40
lea rdx, [rdi + 0x38]
jmp 0x140061e48
mov r13, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x38]
movzx eax, byte [rsp + 0x137]
mov r14d, 0x16
mov rsi, rax
test al, al
jns 0x140061e75
mov r14, qword [rsp + 0x130]
and r14, qword [rsp + 0x68]
dec r14
mov rsi, qword [rsp + 0x128]
mov rcx, r14
sub rcx, rsi
cmp rcx, r13
jb 0x140061ad8
test r13, r13
je 0x140061bc9
lea rbx, [rsp + 0x120]
test al, al
jns 0x140061ea1
mov rbx, qword [rsp + 0x120]
lea rcx, [rbx + rsi]
mov r8, r13
call fcn.1400eabe0
add rsi, r13
cmp byte [rsp + 0x137], 0
js 0x140061ecd
mov eax, esi
and al, 0x7f
mov byte [rsp + 0x137], al
add rbx, rsi
jmp 0x140061bc6
mov qword [rsp + 0x128], rsi
jmp 0x140061ec5
mov rax, qword [rsp + 0x58]
mov r8, qword [rax]
mov rsi, qword [r8 + 0x90]
mov r15, qword [r8 + 0x98]
cmp rsi, r15
je 0x140061f9d
movabs r12, 0x656d686361747461
lea rdi, [rsp + 0x1a8]
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0x190]
jmp 0x140061f30
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
add rsi, 0x18
cmp rsi, r15
je 0x140061f9d
mov byte [rsp + 0x97], 0xa
mov qword [rsp + 0x80], r12
mov word [rsp + 0x88], 0x746e
mov byte [rsp + 0x8a], 0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.1400631b0
mov rcx, rdi
mov rdx, r14
call fcn.14006a020
cmp byte [rsp + 0x1bf], 0
jns 0x140061f82
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x140061f27
jmp 0x140061f1a
movabs rax, 0x16003d617461642d
jmp 0x14006211f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140062a88
mov rdi, rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + 0xc8]
mov rcx, qword [0x1401471ec]
mov r9, qword [0x1401471e4]
mov r8, qword [0x1401471d0]
movsxd rdx, edi
cmp rdx, rdi
jne 0x140062f6e
mov edx, edi
movabs r14, 0x7ffffffffffffff8
movsxd r10, eax
cmp r10, rax
jne 0x140062f76
movsxd r10, ecx
cmp r10, rcx
jne 0x140062f7e
movsxd r10, r9d
cmp r10, r9
jne 0x140062f86
movsxd r10, r8d
cmp r10, r8
jne 0x140062f8f
lea r10, [0x1401575c0]
mov qword [rsp + 0x48], r10
lea r10, [0x1401575b0]
mov qword [rsp + 0x40], r10
lea r10, [0x1401575a0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_llx_0x_llx_0x_llx
lea rbx, [rsp + 0x150]
mov rcx, rbx
call fcn.140086320
movzx esi, byte [rbx + 0x17]
test sil, sil
jns 0x14006208e
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
movabs r12, 0x616974696e692d2d
movabs rbp, 0x746e65696c632d6c
test rsi, rsi
je 0x140061f8e
mov qword [rsp + 0x60], rdi
lea rax, [r14 - 0x18]
cmp rsi, rax
ja 0x140062f98
mov rdi, r14
lea r13, [rsi + 0x16]
cmp r13, 0x2d
mov r14d, 0x2c
cmovae r14, r13
or r14, 7
inc r14
mov rcx, r14
call fcn.1400b4d4c
mov r15, rax
mov qword [rax], r12
mov qword [rax + 8], rbp
mov word [rax + 0x14], 0x3d61
mov dword [rax + 0x10], 0x7461642d
lea rcx, [rax + 0x16]
mov rdx, rbx
mov r8, rsi
call fcn.1400eabe0
lea rax, [rdi + 8]
or rax, r14
mov byte [r15 + rsi + 0x16], 0
mov r12, r15
mov rbp, r13
mov rdi, qword [rsp + 0x60]
lea r13, [rsp + 0x80]
mov qword [r13], r12
mov qword [r13 + 8], rbp
mov rcx, rax
shr rcx, 0x38
test rax, rax
cmovs rcx, rbp
cmovns r12, r13
mov qword [r13 + 0x10], rax
lea rdx, [rsp + 0xf8]
mov qword [rdx], r12
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
call fcn.1400a9d80
lea r14, [rsp + 0x190]
mov rcx, rsi
mov rdx, r14
call fcn.14006a020
cmp byte [rsi + 0x17], 0
jns 0x14006218a
mov rcx, qword [rsp + 0x1a8]
call fcn.1400b4d44
cmp byte [rsp + 0x97], 0
jns 0x1400621a1
mov rcx, qword [rsp + 0x80]
call fcn.1400b4d44
cmp byte [rsp + 0x167], 0
jns 0x1400621b8
mov rcx, qword [rsp + 0x150]
call fcn.1400b4d44
xorps xmm6, xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0xbc], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x160], 0
mov eax, dword [0x140157600]
mov ecx, dword [0x140153d98]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140062ead
mov eax, dword [0x140157610]
mov ecx, dword [0x140153d98]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140062f04
cmp qword [0x1401575f8], 0
je 0x140062766
cmp qword [0x140157608], 0
je 0x140062766
lea rsi, [rsp + 0x1ac]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400eb280
mov dword [rsi - 4], 0x11c
mov rbx, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 1
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rbx
mov qword [rsi], 6
mov word [rsi + 0x110], 0
lea rcx, [rsp + 0x1a8]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140062766
mov dword [rsp + 0x80], 0x70
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x120]
mov qword [r9], rax
mov rax, qword [0x1401575f8]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x14013a9a8]
test eax, eax
jne 0x140062d1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140062cad
lea rsi, [rsp + 0x120]
mov rcx, qword [rsi]
call fcn.1400b52fc
mov rbx, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x1401575f8]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [0x14013a9a8]
test eax, eax
je 0x140062e43
movabs rbp, 0x1fffffffffffffff
mov ecx, 0x40
call fcn.1400b4d4c
mov r15, rax
add rax, 0x40
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401471d0]
mov qword [r15], rax
mov rax, qword [0x1401471e4]
mov qword [r15 + 8], rax
lea rsi, [r15 + 0x10]
mov qword [rsp + 0x158], rsi
mov rax, qword [rsp + 0x160]
cmp rsi, rax
jb 0x1400624df
mov r12, qword [rsp + 0x150]
mov r15, rsi
sub r15, r12
sar r15, 3
lea rcx, [r15 + 1]
cmp rcx, rbp
ja 0x140062fa8
mov rdx, rbp
sub rax, r12
mov rbp, rax
sar rbp, 2
cmp rbp, rcx
cmovbe rbp, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae rbp, rdx
test rbp, rbp
je 0x140062a7a
cmp rbp, rdx
ja 0x140063015
lea rcx, [rbp*8]
call fcn.1400b4d4c
lea rdx, [rax + r15*8]
lea rcx, [rax + rbp*8]
mov r8, qword [0x1401471ec]
mov qword [rdx], r8
lea r15, [rax + r15*8]
add r15, 8
cmp rsi, r12
je 0x1400624ae
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
mov qword [rdx - 8], rax
add rdx, 0xfffffffffffffff8
cmp rsi, r12
jne 0x140062491
mov rsi, qword [rsp + 0x150]
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], rcx
test rsi, rsi
je 0x1400624d3
mov rcx, rsi
call fcn.1400b4d44
movabs rdx, 0x1fffffffffffffff
jmp 0x1400624f1
mov rax, qword [0x1401471ec]
mov qword [r15 + 0x10], rax
add r15, 0x18
mov rdx, rbp
mov qword [rsp + 0x158], r15
mov rax, qword [rsp + 0x58]
mov r12, qword [rax]
mov rax, qword [rsp + 0x160]
cmp r15, rax
jb 0x1400625e8
mov rsi, qword [rsp + 0x150]
mov rbp, r15
sub rbp, rsi
sar rbp, 3
lea rcx, [rbp + 1]
cmp rcx, rdx
ja 0x140062fab
sub rax, rsi
mov r13, rax
sar r13, 2
cmp r13, rcx
cmovbe r13, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r13, rdx
test r13, r13
je 0x140062a81
cmp r13, rdx
ja 0x140063018
lea rcx, [r13*8]
call fcn.1400b4d4c
lea rdx, [rax + rbp*8]
lea rcx, [rax + r13*8]
mov r8, qword [r12 + 0xc8]
mov qword [rdx], r8
lea r12, [rax + rbp*8]
add r12, 8
lea r13, [rsp + 0x80]
cmp r15, rsi
je 0x1400625b7
mov rax, qword [r15 - 8]
add r15, 0xfffffffffffffff8
mov qword [rdx - 8], rax
add rdx, 0xfffffffffffffff8
cmp r15, rsi
jne 0x14006259a
mov r15, qword [rsp + 0x150]
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x160], rcx
test r15, r15
je 0x1400625dc
mov rcx, r15
call fcn.1400b4d44
movabs rdx, 0x1fffffffffffffff
jmp 0x1400625fa
mov rax, qword [r12 + 0xc8]
mov qword [r15], rax
add r15, 8
mov r12, r15
mov qword [rsp + 0x158], r12
mov rax, qword [rsp + 0x160]
cmp r12, rax
jb 0x1400626d6
mov rsi, qword [rsp + 0x150]
mov r15, r12
sub r15, rsi
sar r15, 3
lea rcx, [r15 + 1]
cmp rcx, rdx
ja 0x140062fae
mov rbp, r13
sub rax, rsi
mov r13, rax
sar r13, 2
cmp r13, rcx
cmovbe r13, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r13, rdx
test r13, r13
je 0x140062a73
cmp r13, rdx
ja 0x14006301b
lea rcx, [r13*8]
call fcn.1400b4d4c
lea rdx, [rax + r15*8]
lea rcx, [rax + r13*8]
mov qword [rdx], rdi
lea r15, [rax + r15*8]
add r15, 8
mov r13, rbp
cmp r12, rsi
je 0x1400626af
mov rax, qword [r12 - 8]
add r12, 0xfffffffffffffff8
mov qword [rdx - 8], rax
add rdx, 0xfffffffffffffff8
cmp r12, rsi
jne 0x140062691
mov r12, qword [rsp + 0x150]
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], rcx
test r12, r12
je 0x1400626e1
mov rcx, r12
call fcn.1400b4d44
jmp 0x1400626e1
mov qword [r12], rdi
add r12, 8
mov r15, r12
lea rsi, [rsp + 0x150]
mov qword [rsi + 8], r15
mov rdx, qword [rsp + 0xd0]
mov rcx, rsi
call fcn.1400636d0
mov rdx, qword [rsp + 0xd8]
mov rcx, rsi
call fcn.1400636d0
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.1400636d0
mov r9, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r9
je 0x140062fa5
mov rax, qword [0x140157608]
mov rcx, qword [rsp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdx
mov r8d, 0x20002
xor edx, edx
call qword [0x14013a9a8]
test eax, eax
je 0x140062c40
mov ebp, 0x80000
jmp 0x140062775
mov dword [rsp + 0x80], 0x68
xor ebx, ebx
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax]
movzx eax, byte [rsi + 0x17]
test al, al
js 0x1400627d1
mov r12, rax
cmp al, 0xc
jae 0x1400627db
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x130], rax
movaps xmm0, xmmword [0x1401213c0]
movaps xmmword [rsp + 0x120], xmm0
cmp byte [rsp + 0x1a7], 0
js 0x1400627c4
lea r14, [rsp + 0x190]
jmp 0x14006285d
mov r14, qword [rsp + 0x190]
jmp 0x14006285d
mov r12, qword [rsi + 8]
cmp r12, 0xc
jb 0x14006278c
test al, al
jns 0x1400627e2
mov rsi, qword [rsi]
mov ecx, 0x20
call fcn.1400b4d4c
mov r15, rax
mov rax, qword [rsi + r12*2 - 8]
movups xmm0, xmmword [rsi + r12*2 - 0x18]
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rax
mov word [r15 + 0x18], 0
lea rdx, str.rundll32.exe
mov rcx, r15
call fcn.1400b5b24
mov esi, eax
mov rcx, r15
call fcn.1400b4d44
cmp byte [rsp + 0x1a7], 0
jns 0x140062834
mov r14, qword [rsp + 0x190]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x130], rax
movaps xmm0, xmmword [0x1401213c0]
movaps xmmword [rsp + 0x120], xmm0
test esi, esi
je 0x140062a6c
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
cmp byte [rcx + 0x17], 0
jns 0x14006286e
mov rcx, qword [rcx]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140062bce
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140062afa
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140062b64
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400628f9
call fcn.14002fdc0
test al, al
je 0x140062fa2
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x1a8]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x108]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
mov rax, qword [rsp + 0x58]
add rcx, qword [rax]
call fcn.14002fad0
mov ebp, eax
movzx eax, al
mov r14d, 2
sub r14, rax
mov rsi, rbx
test rbx, rbx
je 0x1400629db
mov eax, dword [0x140157620]
mov ecx, dword [0x140153d98]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400629cb
lea rcx, [0x140157620]
call fcn.1400b4df4
cmp dword [0x140157620], 0xffffffff
jne 0x1400629cb
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140062f9b
lea rdx, [0x14012efa3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157618], rax
lea rcx, [0x140157620]
call fcn.1400b4d88
mov rax, qword [0x140157618]
mov rcx, rbx
call qword [0x14013a9a8]
test rsi, rsi
je 0x1400629e8
mov rcx, rsi
call fcn.1400b4ec8
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x1400629fa
call fcn.1400b4d44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140062fb1
mov rsi, qword [rsp + 0x58]
cmp byte [rsp + 0x1a7], 0
jns 0x140062a27
mov rcx, qword [rsp + 0x190]
call fcn.1400b4d44
mov qword [0x1401575f0], r14
mov rcx, rsi
call fcn.140063050
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.1400b7310
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2f0]
movaps xmm7, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14006286e
xor eax, eax
jmp 0x140062676
xor eax, eax
jmp 0x140062472
xor eax, eax
jmp 0x140062572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x1a7
mov r9d, 2
call fcn.1401082d0
lea rdi, [rsp + 0x1b8]
lea rdx, [0x14012f5b5]
mov r8d, 0xb
mov rcx, rdi
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [rdi - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
mov r14d, 2
xor ebp, ebp
jmp 0x140062a0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 1
call fcn.1401082d0
lea r14, [rsp + 0x1b8]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
mov rcx, r14
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [r14 - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
jmp 0x1400628c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x22b
mov r9d, 1
call fcn.1401082d0
lea r14, [rsp + 0x1b8]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
mov rcx, r14
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [r14 - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
jmp 0x1400628d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x223
mov r9d, 2
call fcn.1401082d0
lea r14, [rsp + 0x1b8]
lea rdx, str.CreateProcess
mov r8d, 0xd
mov rcx, r14
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [r14 - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
mov r14d, 2
xor ebp, ebp
jmp 0x140062954
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x201
mov r9d, 2
call fcn.1401082d0
lea r14, [rsp + 0x1b8]
lea rdx, [0x14013146b]
mov r8d, 0x19
mov rcx, r14
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [r14 - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
mov r15, rbx
jmp 0x140062e30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x1dc
mov r9d, 2
call fcn.1401082d0
lea rbx, [rsp + 0x1b8]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
mov rcx, rbx
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [rbx - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
xor r15d, r15d
jmp 0x140062e2e
lea rax, [0x140120628]
lea rsi, [rsp + 0x1b8]
mov qword [rsi - 0x10], rax
mov dword [rsi - 8], 2
lea rax, [0x140121520]
mov qword [rsi], rax
lea rcx, [rsp + 0x228]
lea rbx, [rsp + 0x1c0]
lea rax, [0x140120018]
mov qword [rbx + 0x68], rax
mov rdx, rbx
call fcn.1400a74b0
mov qword [rbx + 0xf0], 0
mov dword [rbx + 0xf8], 0xffffffff
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14011fe70]
mov qword [rsp + rax + 0x1b8], rcx
mov rcx, rbx
call fcn.140096b50
lea rax, [0x14011ffa0]
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov dword [rbx + 0x60], 0x10
lea r14, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
mov qword [rbx + 0x108], r14
mov dword [rbx + 0x110], 0x1d8
call fcn.1400b5430
mov eax, dword [rax]
mov dword [rbx + 0x114], eax
call fcn.1400b5430
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x118], eax
xor r15d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [rsp + 0x1a8]
mov rcx, rbx
mov rdx, r14
mov r8d, 0x1d8
call fcn.140029400
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
mov rcx, rsi
call fcn.1400edbd0
mov rcx, rbx
call fcn.1400080e0
xor ebx, ebx
mov rsi, rbx
mov r14d, 2
xor ebp, ebp
mov rbx, r15
jmp 0x140062957
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r8d, 0x1e7
mov r9d, 2
call fcn.1401082d0
lea r14, [rsp + 0x1b8]
lea rdx, [0x14012ef7f]
mov r8d, 0x21
mov rcx, r14
call fcn.1400edbd0
lea rax, [0x140120630]
mov qword [r14 - 0x10], rax
mov rcx, rsi
call fcn.140108350
mov rcx, rsi
call fcn.1400080e0
xor r15d, r15d
jmp 0x140062e30
lea rcx, [0x140157600]
call fcn.1400b4df4
cmp dword [0x140157600], 0xffffffff
jne 0x14006226b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006301e
lea rdx, [0x14012ef7f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401575f8], rax
lea rcx, [0x140157600]
call fcn.1400b4d88
jmp 0x14006226b
lea rcx, [0x140157610]
call fcn.1400b4df4
cmp dword [0x140157610], 0xffffffff
jne 0x140062290
cmp qword [0x1401575f8], 0
je 0x140062f61
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140062f61
lea rdx, [0x14013146b]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157608], rax
lea rcx, [0x140157610]
call fcn.1400b4d88
jmp 0x140062290
xor eax, eax
jmp 0x140062f49
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x1400629b8
int3
int3
int3
int3
int3
lea rdx, [0x140131ded]
lea r8, str....._third_partycrashpadcrashpadutilwin_scoped_handle.cc
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov r9d, 0x1e
call fcn.1400754d0
lea rdx, [0x14013470f]
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401064f0
mov rcx, qword [rdi]
add rcx, 0x10
lea rdx, [0x140131b49]
mov r8d, 0xb
call fcn.1400edbd0
mov rcx, rdi
call fcn.140106640
jmp 0x140062a0b
int3
int3
int3
xor eax, eax
jmp 0x140062eec