Function at 0x1400ad2f0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm7
movaps xmmword [rsp + 0x320], xmm6
mov r12, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x318], rax
call fcn.1401039a0
test al, al
jne 0x1400ae7de
xorps xmm0, xmm0
lea rdx, [rsp + 0x300]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.1401039d0
mov rsi, qword [r12]
mov rbp, qword [rsi + 0x78]
mov rdi, qword [rsi + 0x80]
cmp rbp, rdi
je 0x1400ad3dd
lea rsi, [rsp + 0x150]
lea r14, [rsp + 0x2f0]
lea rbx, [rsp + 0x300]
movzx eax, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp]
cmovns rcx, rbp
mov qword [rsp + 0x2f0], rcx
cmovs rax, qword [rbp + 8]
mov qword [rsp + 0x2f8], rax
mov rcx, rsi
mov rdx, r14
call fcn.1401859c0
mov rcx, rsi
mov rdx, rbx
call fcn.1401039d0
cmp byte [rsp + 0x167], 0
jns 0x1400ad3d0
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
add rbp, 0x18
cmp rbp, rdi
jne 0x1400ad380
mov rsi, qword [r12]
movzx eax, byte [rsi + 0x2f]
test al, al
jns 0x1400ad3e9
mov rax, qword [rsi + 0x20]
test rax, rax
jne 0x1400ad70d
movzx eax, byte [rsi + 0x47]
test al, al
jns 0x1400ad3fe
mov rax, qword [rsi + 0x38]
test rax, rax
jne 0x1400ad781
movzx eax, byte [rsi + 0x5f]
test al, al
js 0x1400ad414
mov rcx, rax
jmp 0x1400ad418
mov rcx, qword [rsi + 0x50]
test rcx, rcx
jne 0x1400ad7f5
mov r14, qword [rsi + 0x60]
lea r13, [rsi + 0x68]
cmp r14, r13
je 0x1400ad5e0
mov qword [rsp + 0x58], r12
lea r12, [rsp + 0x2b0]
xorps xmm6, xmm6
lea rbx, [rsp + 0x80]
lea r15, str.annotation
lea rsi, [rsp + 0x290]
lea rdi, [rsp + 0x150]
lea rbp, [rsp + 0x300]
lea rdx, [r14 + 0x20]
mov rcx, r12
mov r8b, 0x3d
call fcn.140216640
movzx r8d, byte [r14 + 0x4f]
test r8b, r8b
jns 0x1400ad48c
mov r8, qword [r14 + 0x40]
mov rdx, qword [r14 + 0x38]
jmp 0x1400ad490
lea rdx, [r14 + 0x38]
mov rcx, r12
call fcn.14017a290
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x117]
test al, al
mov rcx, qword [rsp + 0x100]
lea rdx, [rsp + 0x100]
cmovns rcx, rdx
mov qword [rsp + 0x2d0], rcx
cmovs rax, qword [rsp + 0x108]
mov qword [rsp + 0x2d8], rax
mov rcx, rbx
lea rdx, [rsp + 0x2d0]
call fcn.1401859c0
mov rcx, rsi
mov rdx, r15
call fcn.14020f860
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.1400aed20
mov rcx, rdi
mov rdx, rbp
call fcn.1401039d0
cmp byte [rsp + 0x167], 0
jns 0x1400ad53c
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x2a7], 0
jns 0x1400ad553
mov rcx, qword [rsp + 0x290]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ad56a
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
cmp byte [rsp + 0x117], 0
jns 0x1400ad581
mov rcx, qword [rsp + 0x100]
call fcn.1401cfdbc
cmp byte [rsp + 0x2c7], 0
jns 0x1400ad598
mov rcx, qword [rsp + 0x2b0]
call fcn.1401cfdbc
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400ad5ae
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400ad5a1
jmp 0x1400ad5cb
mov rax, qword [r14 + 0x10]
cmp qword [rax], r14
je 0x1400ad5cb
add r14, 0x10
mov rcx, qword [r14]
lea r14, [rcx + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rax], rcx
jne 0x1400ad5bb
mov r14, rax
cmp rax, r13
jne 0x1400ad469
mov r12, qword [rsp + 0x58]
mov rsi, qword [r12]
mov rdi, qword [rsi + 0x90]
mov rsi, qword [rsi + 0x98]
cmp rdi, rsi
je 0x1400ad66d
lea r14, [0x14034bd51]
lea rbx, [rsp + 0x80]
lea rbp, [rsp + 0x150]
lea r15, [rsp + 0x300]
mov rcx, rbx
mov rdx, r14
call fcn.14020f860
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.1400aed20
mov rcx, rbp
mov rdx, r15
call fcn.1401039d0
cmp byte [rsp + 0x167], 0
jns 0x1400ad64d
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ad664
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
add rdi, 0x18
cmp rdi, rsi
jne 0x1400ad612
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x1400ad8ab
mov ecx, 2
call fcn.14017e5e0
xor esi, esi
mov ebx, 0
test al, al
jne 0x1400adbcb
cmp byte [rsp + 0x317], 0
jns 0x1400ad6bf
mov rcx, qword [rsp + 0x300]
call fcn.1401cfdbc
xor eax, eax
cmp bl, 1
adc rax, 1
mov qword [0x1403bb668], rax
mov rcx, r12
call fcn.1400aebc0
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
movaps xmm6, xmmword [rsp + 0x320]
movaps xmm7, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x18
lea rdx, str.database
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.14020f860
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400aed20
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1401039d0
cmp byte [rbx + 0x17], 0
jns 0x1400ad761
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ad778
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
mov rsi, qword [r12]
jmp 0x1400ad3f2
add rsi, 0x30
lea rdx, str.metrics_dir
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.14020f860
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400aed20
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1401039d0
cmp byte [rbx + 0x17], 0
jns 0x1400ad7d5
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ad7ec
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
mov rsi, qword [r12]
jmp 0x1400ad407
lea rcx, [rsi + 0x48]
test al, al
cmovs rcx, qword [rsi + 0x48]
lea rdx, [rsp + 0x2e0]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 0x50]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.1401859c0
lea rdx, [0x14034075a]
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.14020f860
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400aed20
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1401039d0
cmp byte [rbx + 0x17], 0
jns 0x1400ad874
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x117], 0
jns 0x1400ad88b
mov rcx, qword [rsp + 0x100]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ad8a2
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
mov rsi, qword [r12]
jmp 0x1400ad421
mov rdi, rax
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x100]
mov qword [rbx + 0x40], rbp
movaps xmm6, xmmword [0x14033b990]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov qword [rsp + 0x58], r12
mov rax, qword [r12]
mov rax, qword [rax + 0xc8]
mov r9, qword [0x1403b0b18]
mov r8, qword [0x1403b0b10]
mov rdx, qword [0x1403b0b08]
lea rcx, [0x1403bb638]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1403bb628]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1403bb618]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140103b80
lea rsi, [rsp + 0x2b0]
mov rcx, rbx
mov rdx, rsi
call fcn.140103f80
lea rdx, str.__initial_client_data
lea r15, [rsp + 0x290]
mov rcx, r15
call fcn.14020f860
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ad979
mov r8, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2b0]
mov rcx, r15
mov rdx, rsi
call fcn.14017a290
mov rcx, qword [rax + 0x10]
lea r12, [rsp + 0x80]
mov qword [r12 + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [r12], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx eax, byte [r12 + 0x17]
test al, al
mov rcx, qword [r12]
cmovns rcx, r12
lea rdx, [rsp + 0xf0]
mov qword [rdx], rcx
cmovs rax, qword [r12 + 8]
mov qword [rdx + 8], rax
lea rbx, [rsp + 0x150]
mov rcx, rbx
call fcn.1401859c0
lea r13, [rsp + 0x300]
mov rcx, rbx
mov rdx, r13
call fcn.1401039d0
cmp byte [rbx + 0x17], 0
jns 0x1400ada06
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
cmp byte [rsp + 0x97], 0
jns 0x1400ada1d
mov rcx, qword [rsp + 0x80]
call fcn.1401cfdbc
cmp byte [rsp + 0x2a7], 0
jns 0x1400ada34
mov rcx, qword [rsp + 0x290]
call fcn.1401cfdbc
cmp byte [rsp + 0x2c7], 0
jns 0x1400ada4b
mov rcx, qword [rsp + 0x2b0]
call fcn.1401cfdbc
xorps xmm7, xmm7
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm7
mov dword [rsp + 0xbc], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x2b0], xmm7
mov qword [rsp + 0x2c0], 0
mov eax, dword [0x1403bb678]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ae730
mov eax, dword [0x1403bb688]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ae777
mov rax, qword [0x1403bb670]
test rax, rax
je 0x1400adc22
cmp qword [0x1403bb680], 0
je 0x1400adc22
mov dword [rsp + 0x80], 0x70
lea r9, [rsp + 0x290]
mov qword [r9], rbp
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x1403db008]
test eax, eax
je 0x1400adc61
mov ecx, 2
call fcn.14017e5e0
test al, al
je 0x1400adf9a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1c4
mov r9d, 2
call fcn.14007d0b0
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.14020f8f0
mov rcx, rsi
call fcn.14007d550
jmp 0x1400adf9a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x193
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, [0x14034bd5c]
mov r8d, ntohl
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
xor esi, esi
xor ebx, ebx
jmp 0x1400ad6a8
mov dword [rsp + 0x80], 0x68
xor r14d, r14d
xor esi, esi
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x1400adc4f
cmp r8b, 0xc
jb 0x1400adc5a
jmp 0x1400add60
cmp qword [rdx + 8], 0xc
jae 0x1400add5c
xor ebx, ebx
jmp 0x1400addb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400adf88
lea rsi, [rsp + 0x290]
mov rcx, qword [rsi]
call fcn.1401cfdfc
mov r14, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x1403bb670]
mov rcx, r14
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [0x1403db008]
test eax, eax
je 0x1400adfca
mov qword [rsp + 0x68], r14
mov r14, qword [rsp + 0x2b0]
mov r15, qword [rsp + 0x2c0]
mov rax, r15
sub rax, r14
cmp rax, 0x3f
ja 0x1400add1c
mov rsi, qword [rsp + 0x2b8]
sub rsi, r14
mov ecx, 0x40
call fcn.1401cfd80
mov rbp, rax
lea r13, [rax + rsi]
mov r15, rax
add r15, 0x40
test rsi, rsi
jg 0x1400ae7e1
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2b8], r13
mov qword [rsp + 0x2c0], r15
test r14, r14
jne 0x1400ae7f4
movabs r13, 0x7ffffffffffffff8
movabs r14, 0x1fffffffffffffff
mov rsi, qword [rsp + 0x2b8]
cmp rsi, r15
je 0x1400adfe7
mov rax, qword [0x1403b0b08]
mov qword [rsi], rax
add rsi, 8
mov qword [rsp + 0x2b8], rsi
jmp 0x1400ae1c0
mov r8, qword [rdx + 8]
add r8, 0xfffffffffffffff4
lea rax, [rdx + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r9, 0xffffffffffffffff
call fcn.140063f00
cmp byte [rsp + 0x167], 0
jns 0x1400add8e
mov rbx, qword [rsp + 0x150]
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.1401ed994
test eax, eax
sete bl
cmp byte [rsp + 0x167], 0
jns 0x1400addb9
mov rcx, qword [rsp + 0x150]
call fcn.1401cfdbc
mov qword [rsp + 0x2a0], rbp
movaps xmmword [rsp + 0x290], xmm6
cmp byte [rsp + 0x317], 0
jns 0x1400adddb
mov r13, qword [rsp + 0x300]
test bl, bl
je 0x1400adde3
xor ecx, ecx
jmp 0x1400addf4
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
cmp byte [rcx + 0x17], 0
jns 0x1400addf4
mov rcx, qword [rcx]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400adee7
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14017e5e0
test al, al
mov r12, qword [rsp + 0x58]
je 0x1400ade54
test esi, esi
je 0x1400ae052
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14017e5e0
test al, al
je 0x1400ade7a
test esi, esi
je 0x1400ae0a5
mov rsi, qword [r12]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400ade9b
call fcn.140103770
mov qword [rsi + 0xc8], 0xffffffffffffffff
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x150]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x70]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r12]
call fcn.140100f10
mov ebx, eax
mov esi, eax
jmp 0x1400adf05
mov ecx, 2
call fcn.14017e5e0
xor ebx, ebx
mov esi, 0
test al, al
mov r12, qword [rsp + 0x58]
jne 0x1400ae0f8
test r14, r14
je 0x1400adf79
mov eax, dword [0x1403bb698]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400adf69
lea rcx, [0x1403bb698]
call fcn.1401cfee0
cmp dword [0x1403bb698], 0xffffffff
jne 0x1400adf69
lea rcx, [0x1403443d6]
lea rdx, str.::DeleteProcThreadAttributeList
mov r8b, 1
call fcn.140104020
mov qword [0x1403bb690], rax
lea rcx, [0x1403bb698]
call fcn.1401cff78
mov rax, qword [0x1403bb690]
mov rcx, r14
call qword [0x1403db008]
test r14, r14
je 0x1400adfa3
mov rcx, r14
call fcn.1401cfe04
jmp 0x1400adfa3
mov ecx, 2
call fcn.14017e5e0
test al, al
jne 0x1400ae637
xor ebx, ebx
xor esi, esi
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x2b0]
test rcx, rcx
je 0x1400adfbd
mov qword [rsp + 0x2b8], rcx
call fcn.1401cfdbc
mov rcx, rdi
call fcn.140103780
jmp 0x1400ad6a8
mov ecx, 2
call fcn.14017e5e0
test al, al
jne 0x1400ae68a
xor esi, esi
xor ebx, ebx
mov r12, qword [rsp + 0x58]
jmp 0x1400adf79
mov rdx, qword [rsp + 0x2b0]
sub r15, rdx
mov rsi, r15
sar rsi, 3
lea rax, [rsi + 1]
cmp rax, r14
ja 0x1400ae7cc
mov rbp, r15
sar rbp, 2
cmp rbp, rax
cmovbe rbp, rax
cmp r15, r13
cmovae rbp, r14
test rbp, rbp
je 0x1400ae14f
cmp rbp, r14
ja 0x1400ae7d9
mov r13, rdx
lea rcx, [rbp*8]
call fcn.1401cfd80
mov r14, rax
mov rdx, r13
movabs r13, 0x7ffffffffffffff8
jmp 0x1400ae152
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x214
mov r9d, 1
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x1400ade54
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x217
mov r9d, 1
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x1400ade7a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x20f
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, str.CreateProcess
mov r8d, ntohl
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
xor ebx, ebx
xor esi, esi
jmp 0x1400adf05
xor r14d, r14d
lea rbp, [r14 + rbp*8]
mov rax, qword [0x1403b0b08]
lea rsi, [r14 + rsi*8]
add rsi, 8
mov qword [rsi - 8], rax
test r15, r15
jle 0x1400ae189
mov rcx, r14
mov r13, rdx
mov r8, r15
call fcn.1401d2e10
mov rdx, r13
movabs r13, 0x7ffffffffffffff8
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2c0], rbp
test rdx, rdx
movabs r14, 0x1fffffffffffffff
je 0x1400ae1c0
mov rcx, rdx
call fcn.1401cfdbc
mov rsi, qword [rsp + 0x2b8]
cmp rsi, qword [rsp + 0x2c0]
je 0x1400ae1e8
mov rax, qword [0x1403b0b10]
mov qword [rsi], rax
add rsi, 8
mov qword [rsp + 0x2b8], rsi
mov rbp, rsi
jmp 0x1400ae2aa
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x60], rax
sub rsi, rax
mov r15, rsi
sar r15, 3
lea rax, [r15 + 1]
cmp rax, r14
ja 0x1400ae7cc
mov rbp, rsi
sar rbp, 2
cmp rbp, rax
cmovbe rbp, rax
cmp rsi, r13
cmovae rbp, r14
test rbp, rbp
je 0x1400ae241
cmp rbp, r14
ja 0x1400ae7d9
lea rcx, [rbp*8]
call fcn.1401cfd80
mov r14, rax
jmp 0x1400ae244
xor r14d, r14d
lea r13, [r14 + rbp*8]
mov rax, qword [0x1403b0b10]
lea rbp, [r14 + r15*8]
add rbp, 8
mov qword [rbp - 8], rax
test rsi, rsi
mov r15, qword [rsp + 0x60]
jle 0x1400ae273
mov rcx, r14
mov rdx, r15
mov r8, rsi
call fcn.1401d2e10
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], rbp
mov qword [rsp + 0x2c0], r13
test r15, r15
movabs r14, 0x1fffffffffffffff
je 0x1400ae2aa
mov rcx, r15
call fcn.1401cfdbc
mov rbp, qword [rsp + 0x2b8]
cmp rbp, qword [rsp + 0x2c0]
je 0x1400ae2d3
mov rax, qword [0x1403b0b18]
mov qword [rbp], rax
add rbp, 8
mov qword [rsp + 0x2b8], rbp
mov r13, rbp
jmp 0x1400ae3a5
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x60], rax
sub rbp, rax
mov r15, rbp
sar r15, 3
lea rax, [r15 + 1]
cmp rax, r14
ja 0x1400ae7cc
mov rsi, rbp
sar rsi, 2
cmp rsi, rax
cmovbe rsi, rax
movabs rax, 0x7ffffffffffffff8
cmp rbp, rax
cmovae rsi, r14
test rsi, rsi
je 0x1400ae336
cmp rsi, r14
ja 0x1400ae7d9
lea rcx, [rsi*8]
call fcn.1401cfd80
mov r14, rax
jmp 0x1400ae339
xor r14d, r14d
lea rcx, [r14 + rsi*8]
mov rax, qword [0x1403b0b18]
lea r13, [r14 + r15*8]
add r13, 8
mov qword [r13 - 8], rax
test rbp, rbp
mov rsi, qword [rsp + 0x60]
jle 0x1400ae36e
mov r15, rcx
mov rcx, r14
mov rdx, rsi
mov r8, rbp
call fcn.1401d2e10
mov rcx, r15
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], r13
mov qword [rsp + 0x2c0], rcx
test rsi, rsi
movabs r14, 0x1fffffffffffffff
je 0x1400ae3a5
mov rcx, rsi
call fcn.1401cfdbc
mov r13, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x58]
mov r15, qword [rax]
cmp r13, qword [rsp + 0x2c0]
je 0x1400ae3d6
mov rax, qword [r15 + 0xc8]
mov qword [r13], rax
add r13, 8
mov qword [rsp + 0x2b8], r13
mov r15, r13
jmp 0x1400ae4a2
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x60], rax
sub r13, rax
mov rbp, r13
sar rbp, 3
lea rax, [rbp + 1]
cmp rax, r14
ja 0x1400ae7cc
mov rsi, r13
sar rsi, 2
cmp rsi, rax
cmovbe rsi, rax
movabs rax, 0x7ffffffffffffff8
cmp r13, rax
cmovae rsi, r14
test rsi, rsi
je 0x1400ae439
cmp rsi, r14
ja 0x1400ae7d9
lea rcx, [rsi*8]
call fcn.1401cfd80
mov r14, rax
jmp 0x1400ae43c
xor r14d, r14d
lea rsi, [r14 + rsi*8]
mov rax, qword [r15 + 0xc8]
lea r15, [r14 + rbp*8]
add r15, 8
mov qword [r15 - 8], rax
test r13, r13
mov rbp, qword [rsp + 0x60]
jle 0x1400ae46b
mov rcx, r14
mov rdx, rbp
mov r8, r13
call fcn.1401d2e10
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], r15
mov qword [rsp + 0x2c0], rsi
test rbp, rbp
movabs r14, 0x1fffffffffffffff
je 0x1400ae4a2
mov rcx, rbp
call fcn.1401cfdbc
mov r15, qword [rsp + 0x2b8]
cmp r15, qword [rsp + 0x2c0]
lea r13, [rsp + 0x300]
je 0x1400ae4c8
mov qword [r15], rdi
add r15, 8
mov qword [rsp + 0x2b8], r15
jmp 0x1400ae581
mov rcx, r14
mov r14, qword [rsp + 0x2b0]
sub r15, r14
mov r13, r15
sar r13, 3
lea rax, [r13 + 1]
cmp rax, rcx
ja 0x1400ae7cc
mov rbp, r15
sar rbp, 2
cmp rbp, rax
cmovbe rbp, rax
movabs rax, 0x7ffffffffffffff8
cmp r15, rax
cmovae rbp, rcx
test rbp, rbp
je 0x1400ae529
cmp rbp, rcx
ja 0x1400ae7d9
lea rcx, [rbp*8]
call fcn.1401cfd80
mov rsi, rax
jmp 0x1400ae52b
xor esi, esi
lea rax, [rsi + rbp*8]
lea rbp, [rsi + r13*8]
add rbp, 8
mov qword [rbp - 8], rdi
test r15, r15
jle 0x1400ae554
mov rcx, rsi
mov rdx, r14
mov r8, r15
mov r15, rax
call fcn.1401d2e10
mov rax, r15
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2b8], rbp
mov qword [rsp + 0x2c0], rax
test r14, r14
lea r13, [rsp + 0x300]
je 0x1400ae581
mov rcx, r14
call fcn.1401cfdbc
mov rdx, qword [rsp + 0xd0]
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.1400aeeb0
mov rdx, qword [rsp + 0xd8]
mov rcx, rsi
call fcn.1400aeeb0
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.1400aeeb0
mov rax, qword [0x1403bb680]
mov r9, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r9
mov rcx, qword [rsp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdx
mov r8d, 0x20002
xor edx, edx
call qword [0x1403db008]
test eax, eax
lea r15, [rsp + 0x290]
je 0x1400ae612
mov esi, 0x80000
mov r14, qword [rsp + 0x68]
movabs rbp, 0xaaaaaaaaaaaaaaaa
jmp 0x1400adc32
mov ecx, 2
call fcn.14017e5e0
test al, al
mov r14, qword [rsp + 0x68]
jne 0x1400ae6dd
xor ebx, ebx
xor esi, esi
mov r12, qword [rsp + 0x58]
jmp 0x1400adf05
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1c8
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x1400adf9a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1d3
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, [0x14034be2d]
mov r8d, 0x21
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x1400adfdc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1ed
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x160]
lea rdx, [0x14034be4f]
mov r8d, 0x19
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x1400ae629
lea rcx, [0x1403bb678]
call fcn.1401cfee0
cmp dword [0x1403bb678], 0xffffffff
jne 0x1400adafe
lea rcx, [0x1403443d6]
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.140104020
mov qword [0x1403bb670], rax
lea rcx, [0x1403bb678]
call fcn.1401cff78
jmp 0x1400adafe
lea rcx, [0x1403bb688]
call fcn.1401cfee0
cmp dword [0x1403bb688], 0xffffffff
jne 0x1400adb23
cmp qword [0x1403bb670], 0
je 0x1400ae7b2
lea rcx, [0x1403443d6]
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.140104020
jmp 0x1400ae7b4
xor eax, eax
mov qword [0x1403bb680], rax
lea rcx, [0x1403bb688]
call fcn.1401cff78
jmp 0x1400adb23
lea rcx, [rsp + 0x2b0]
call fcn.14020f6b0
call fcn.1401e9f10
int3
mov rcx, rbp
mov rdx, r14
mov r8, rsi
call fcn.1401d2e10
jmp 0x1400adcfb
mov rcx, r14
call fcn.1401cfdbc
mov r15, qword [rsp + 0x2c0]
jmp 0x1400add1c