Function at 0x140034210
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm7
movaps xmmword [rsp + 0x320], xmm6
mov r12, rcx
mov rax, qword [0x140117028]
xor rax, rsp
mov qword [rsp + 0x318], rax
call fcn.140047b60
test al, al
jne 0x1400352d7
xorps xmm0, xmm0
lea rdx, [rsp + 0x300]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.140047b90
mov rsi, qword [r12]
mov rbp, qword [rsi + 0x78]
mov rdi, qword [rsi + 0x80]
cmp rbp, rdi
je 0x140034302
lea rsi, [rsp + 0x150]
lea r14, [rsp + 0x2f0]
lea rbx, [rsp + 0x300]
movzx eax, byte [rbp + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbp]
cmovns rax, rbp
mov qword [rsp + 0x2f0], rax
cmovs rcx, qword [rbp + 8]
mov qword [rsp + 0x2f8], rcx
mov rcx, rsi
mov rdx, r14
call fcn.140060d00
mov rcx, rsi
mov rdx, rbx
call fcn.140047b90
cmp byte [rsp + 0x167], 0
jns 0x1400342f5
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
add rbp, 0x18
cmp rbp, rdi
jne 0x1400342a0
mov rsi, qword [r12]
movzx eax, byte [rsi + 0x2f]
test al, al
jns 0x14003430e
mov rax, qword [rsi + 0x20]
test rax, rax
jne 0x1400346ec
movzx eax, byte [rsi + 0x47]
test al, al
jns 0x140034323
mov rax, qword [rsi + 0x38]
test rax, rax
jne 0x140034760
movzx eax, byte [rsi + 0x5f]
test al, al
js 0x140034339
mov rcx, rax
jmp 0x14003433d
mov rcx, qword [rsi + 0x50]
test rcx, rcx
jne 0x1400347d4
mov rbx, qword [rsi + 0x60]
lea r13, [rsi + 0x68]
cmp rbx, r13
je 0x1400345bf
mov qword [rsp + 0x58], r12
xorps xmm6, xmm6
lea r12, [rsp + 0x2b0]
movzx esi, byte [rbx + 0x37]
test sil, sil
jns 0x140034376
mov r15, qword [rbx + 0x28]
jmp 0x14003437d
mov r15d, esi
and r15d, 0x7f
lea rbp, [r15 + 1]
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x1400352d2
cmp rbp, 0x16
jbe 0x140034592
lea rdi, [r15 + 0x11]
and rdi, 0xfffffffffffffff0
mov rcx, rdi
call fcn.140080c6c
mov r14, rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rdi
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], rbp
shr rax, 0x38
mov ebp, eax
lea rdx, [rbx + 0x20]
test bpl, bpl
mov rdi, r12
cmovs rdi, r14
test sil, sil
jns 0x1400343f6
mov rdx, qword [rdx]
test r15, r15
je 0x140034406
mov rcx, rdi
mov r8, r15
call fcn.140083a30
test bpl, bpl
cmovns r14, r12
mov byte [rdi + r15], 0x3d
mov byte [r14 + r15 + 1], 0
movzx r8d, byte [rbx + 0x4f]
test r8b, r8b
jns 0x14003442c
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
jmp 0x140034434
lea rdx, [rbx + 0x38]
and r8d, 0x7f
mov rcx, r12
call fcn.14005bc20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x117]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x100]
cmovns rax, rdx
mov qword [rsp + 0x2d0], rax
cmovs rcx, qword [rsp + 0x108]
mov qword [rsp + 0x2d8], rcx
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea rdx, [rsp + 0x2d0]
call fcn.140060d00
lea rdi, [rsp + 0x290]
mov rcx, rdi
lea rdx, str.annotation
call fcn.1400b4430
lea rbp, [rsp + 0x150]
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.1400358e0
mov rcx, rbp
lea rdx, [rsp + 0x300]
call fcn.140047b90
cmp byte [rsp + 0x167], 0
jns 0x140034506
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x2a7], 0
jns 0x14003451d
mov rcx, qword [rsp + 0x290]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x140034534
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
cmp byte [rsp + 0x117], 0
jns 0x14003454b
mov rcx, qword [rsp + 0x100]
call fcn.140080ca8
cmp byte [rsp + 0x2c7], 0
jns 0x140034562
mov rcx, qword [rsp + 0x2b0]
call fcn.140080ca8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140034578
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14003456b
jmp 0x140034584
mov rax, qword [rbx + 0x10]
cmp qword [rax], rbx
mov rbx, rax
jne 0x140034578
mov rbx, rax
cmp rax, r13
jne 0x140034367
jmp 0x1400345b6
movaps xmmword [rsp + 0x2b0], xmm6
mov qword [rsp + 0x2c0], 0
mov byte [rsp + 0x2c7], bpl
xor r14d, r14d
jmp 0x1400343e0
mov r12, qword [rsp + 0x58]
mov rsi, qword [r12]
mov rdi, qword [rsi + 0x90]
mov rsi, qword [rsi + 0x98]
cmp rdi, rsi
je 0x14003464c
lea r14, str.attachment
lea rbx, [rsp + 0x80]
lea rbp, [rsp + 0x150]
lea r15, [rsp + 0x300]
mov rcx, rbx
mov rdx, r14
call fcn.1400b4430
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.1400358e0
mov rcx, rbp
mov rdx, r15
call fcn.140047b90
cmp byte [rsp + 0x167], 0
jns 0x14003462c
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x140034643
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
add rdi, 0x18
cmp rdi, rsi
jne 0x1400345f1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14003488f
mov ecx, 2
call fcn.140067d40
xor esi, esi
mov ebx, 0
test al, al
jne 0x14003495f
cmp byte [rsp + 0x317], 0
jns 0x14003469e
mov rcx, qword [rsp + 0x300]
call fcn.140080ca8
xor eax, eax
cmp bl, 1
adc rax, 1
mov qword [0x140129fc0], rax
mov rcx, r12
call fcn.140035780
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.140081fb0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x320]
movaps xmm7, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x18
lea rdx, str.database
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.1400b4430
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400358e0
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.140047b90
cmp byte [rbx + 0x17], 0
jns 0x140034740
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x140034757
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
mov rsi, qword [r12]
jmp 0x140034317
add rsi, 0x30
lea rdx, str.metrics_dir
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.1400b4430
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400358e0
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.140047b90
cmp byte [rbx + 0x17], 0
jns 0x1400347b4
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x1400347cb
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
mov rsi, qword [r12]
jmp 0x14003432c
lea rcx, [rsi + 0x48]
mov ebp, eax
and ebp, 0x7f
test al, al
cmovs rcx, qword [rsi + 0x48]
lea rdx, [rsp + 0x2e0]
mov qword [rdx], rcx
cmovs rbp, qword [rsi + 0x50]
mov qword [rdx + 8], rbp
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.140060d00
lea rdx, [0x140100fb5]
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.1400b4430
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400358e0
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.140047b90
cmp byte [rbx + 0x17], 0
jns 0x140034858
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x117], 0
jns 0x14003486f
mov rcx, qword [rsp + 0x100]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x140034886
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
mov rsi, qword [r12]
jmp 0x140034346
mov rdi, rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x100]
mov qword [rsi + 0x40], r14
movaps xmm6, xmmword [0x1400fdb10]
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rax, qword [r12]
mov rax, qword [rax + 0xc8]
mov r9, qword [0x14011905c]
mov r8, qword [0x140119054]
mov rdx, qword [0x140119048]
lea rcx, [0x140129f90]
mov qword [rsp + 0x40], rcx
lea rcx, [0x140129f80]
mov qword [rsp + 0x38], rcx
lea rcx, [0x140129f70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.140047d30
lea rbx, [rsp + 0x2b0]
mov rcx, rsi
mov rdx, rbx
call fcn.140047d60
lea rdx, str.__initial_client_data
lea rsi, [rsp + 0x290]
mov rcx, rsi
call fcn.1400b4430
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
mov qword [rsp + 0x58], r12
jns 0x1400349b6
mov r8, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
jmp 0x1400349ba
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x19a
mov r9d, 2
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, [0x140100fcf]
mov r8d, 0xb
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
xor esi, esi
xor ebx, ebx
jmp 0x140034687
and r8d, 0x7f
mov rcx, rsi
mov rdx, rbx
call fcn.14005bc20
mov rcx, qword [rax + 0x10]
lea r15, [rsp + 0x80]
mov qword [r15 + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [r15], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx eax, byte [r15 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r15]
cmovns rax, r15
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
cmovs rcx, qword [r15 + 8]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0x150]
mov rcx, rbx
call fcn.140060d00
lea r12, [rsp + 0x300]
mov rcx, rbx
mov rdx, r12
call fcn.140047b90
cmp byte [rbx + 0x17], 0
jns 0x140034a47
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
cmp byte [rsp + 0x97], 0
jns 0x140034a5e
mov rcx, qword [rsp + 0x80]
call fcn.140080ca8
cmp byte [rsp + 0x2a7], 0
jns 0x140034a75
mov rcx, qword [rsp + 0x290]
call fcn.140080ca8
cmp byte [rsp + 0x2c7], 0
jns 0x140034a8c
mov rcx, qword [rsp + 0x2b0]
call fcn.140080ca8
xorps xmm7, xmm7
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm7
mov dword [rsp + 0xbc], 0x100
mov rbp, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rbp
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rbp
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rbp
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x2b0], xmm7
mov qword [rsp + 0x2c0], 0
mov eax, dword [0x140129fd0]
mov ecx, dword [0x140126b24]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140035236
mov eax, dword [0x140129fe0]
mov ecx, dword [0x140126b24]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003527d
mov rax, qword [0x140129fc8]
test rax, rax
je 0x140034c0c
cmp qword [0x140129fd8], 0
je 0x140034c0c
mov dword [rsp + 0x80], 0x70
lea r9, [rsp + 0x290]
mov qword [r9], r14
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x14013a008]
test eax, eax
je 0x140034c51
mov ecx, 2
call fcn.140067d40
test al, al
je 0x140034f58
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1cb
mov r9d, 2
call fcn.140038a50
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.1400b44d0
mov rcx, rsi
call fcn.140038f40
jmp 0x140034f58
mov rsi, r14
mov dword [rsp + 0x80], 0x68
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x140034c3f
cmp r8b, 0xc
jb 0x140034c4a
jmp 0x140034d94
cmp qword [rdx + 8], 0xc
jae 0x140034d90
xor ebx, ebx
jmp 0x140034ded
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140034f46
lea rbp, [rsp + 0x290]
mov rcx, qword [rbp]
call fcn.140080cdc
mov r13, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x140129fc8]
mov rcx, r13
mov edx, 1
xor r8d, r8d
mov r9, rbp
call qword [0x14013a008]
test eax, eax
je 0x14003500a
mov rsi, r14
mov ecx, 0x40
call fcn.140080c6c
lea rcx, [rax + 0x40]
lea rbp, [rsp + 0x2b0]
mov qword [rbp], rax
mov qword [rbp + 0x10], rcx
mov rcx, qword [0x140119048]
mov qword [rax], rcx
mov rcx, qword [0x140119054]
mov qword [rax + 8], rcx
mov rcx, qword [0x14011905c]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0xc8]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdi
add rax, 0x28
mov qword [rbp + 8], rax
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov r14, qword [rsp + 0xe8]
mov rcx, rbp
call fcn.140035a80
mov rcx, rbp
mov rdx, qword [rsp + 0x60]
call fcn.140035a80
mov rcx, rbp
mov rdx, qword [rsp + 0x68]
call fcn.140035a80
mov rax, qword [0x140129fd8]
mov r9, qword [rbp]
mov rcx, qword [rbp + 8]
sub rcx, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
mov r8d, 0x20002
mov rcx, r14
xor edx, edx
mov r14, r9
call qword [0x14013a008]
test eax, eax
je 0x140035026
mov ebp, 0x80000
jmp 0x140034c22
mov r8, qword [rdx + 8]
add r8, 0xfffffffffffffff4
lea rax, [rdx + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r9, 0xffffffffffffffff
call fcn.1400275a0
cmp byte [rsp + 0x167], 0
jns 0x140034dc2
mov rbx, qword [rsp + 0x150]
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.14009b6f4
test eax, eax
sete bl
cmp byte [rsp + 0x167], 0
jns 0x140034ded
mov rcx, qword [rsp + 0x150]
call fcn.140080ca8
mov qword [rsp + 0x2a0], rsi
movaps xmmword [rsp + 0x290], xmm6
cmp byte [rsp + 0x317], 0
jns 0x140034e0f
mov r12, qword [rsp + 0x300]
test bl, bl
lea rdx, [rsp + 0x290]
je 0x140034e1f
xor ecx, ecx
jmp 0x140034e30
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
cmp byte [rcx + 0x17], 0
jns 0x140034e30
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140034f23
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140067d40
test al, al
mov r12, qword [rsp + 0x58]
je 0x140034e90
test esi, esi
je 0x140035040
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140067d40
test al, al
je 0x140034eb6
test esi, esi
je 0x140035093
mov rsi, qword [r12]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x140034ed7
call fcn.140047930
mov qword [rsi + 0xc8], 0xffffffffffffffff
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x150]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x70]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r12]
call fcn.140046fd0
mov ebx, eax
mov esi, eax
jmp 0x140034f41
mov ecx, 2
call fcn.140067d40
xor ebx, ebx
mov esi, 0
test al, al
mov r12, qword [rsp + 0x58]
jne 0x1400350e6
mov rbp, r13
jmp 0x140034f6f
mov ecx, 2
call fcn.140067d40
test al, al
jne 0x14003513d
xor r14d, r14d
xor eax, eax
xor r13d, r13d
mov r12, qword [rsp + 0x58]
mov rbp, r13
xor ebx, ebx
mov r13, rax
xor esi, esi
test r13, r13
je 0x140034fe3
mov eax, dword [0x140129ff0]
mov ecx, dword [0x140126b24]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140034fd3
lea rcx, [0x140129ff0]
call fcn.140080dc0
cmp dword [0x140129ff0], 0xffffffff
jne 0x140034fd3
lea rcx, str.kernel32.dll
lea rdx, str.::DeleteProcThreadAttributeList
mov r8b, 1
call fcn.140047e00
mov qword [0x140129fe8], rax
lea rcx, [0x140129ff0]
call fcn.140080e58
mov rax, qword [0x140129fe8]
mov rcx, r13
call qword [0x14013a008]
test rbp, rbp
je 0x140034ff0
mov rcx, rbp
call fcn.140080ce4
test r14, r14
je 0x140034ffd
mov rcx, r14
call fcn.140080ca8
mov rcx, rdi
call fcn.140047940
jmp 0x140034687
mov ecx, 2
call fcn.140067d40
test al, al
jne 0x140035190
xor r14d, r14d
xor eax, eax
jmp 0x140034f60
mov ecx, 2
call fcn.140067d40
test al, al
jne 0x1400351e3
mov rax, r13
jmp 0x140034f60
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x21b
mov r9d, 1
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
jmp 0x140034e90
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 1
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
jmp 0x140034eb6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x216
mov r9d, 2
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
xor ebx, ebx
xor esi, esi
jmp 0x140034f41
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1cf
mov r9d, 2
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
jmp 0x140034f58
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1da
mov r9d, 2
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList
mov r8d, 0x21
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
jmp 0x14003501c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1f4
mov r9d, 2
call fcn.1400d1950
lea rcx, [rsp + 0x160]
lea rdx, str.UpdateProcThreadAttribute
mov r8d, 0x19
call fcn.1400b44d0
mov rcx, rsi
call fcn.1400d19d0
jmp 0x140035038
lea rcx, [0x140129fd0]
call fcn.140080dc0
cmp dword [0x140129fd0], 0xffffffff
jne 0x140034b3f
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.140047e00
mov qword [0x140129fc8], rax
lea rcx, [0x140129fd0]
call fcn.140080e58
jmp 0x140034b3f
lea rcx, [0x140129fe0]
call fcn.140080dc0
cmp dword [0x140129fe0], 0xffffffff
jne 0x140034b64
cmp qword [0x140129fc8], 0
je 0x1400352b8
lea rcx, str.kernel32.dll
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.140047e00
jmp 0x1400352ba
xor eax, eax
mov qword [0x140129fd8], rax
lea rcx, [0x140129fe0]
call fcn.140080e58
jmp 0x140034b64
call fcn.1400993b0
int3