Function at 0x140068d70
Capabilities:
Create process on windows
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm6
mov r13, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x14006a00c
xorps xmm0, xmm0
lea rdx, [rsp + 0x2c0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r13]
call fcn.1400cd230
mov rdi, qword [r13]
mov r14, qword [rdi + 0x78]
mov r15, qword [rdi + 0x80]
cmp r14, r15
je 0x140068eef
lea rsi, [rsp + 0xf8]
lea rdi, [rsp + 0x2b0]
lea rbx, [rsp + 0x2c0]
jmp 0x140068e36
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
add r14, 0x18
cmp r14, r15
je 0x140068eeb
movzx eax, byte [r14 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r14]
cmovns rax, r14
mov qword [rsp + 0x2b0], rax
cmovs rcx, qword [r14 + 8]
mov qword [rsp + 0x2b8], rcx
mov rcx, rsi
mov rdx, rdi
call fcn.140109a70
mov rcx, rsi
mov rdx, rbx
call fcn.1400cd230
cmp byte [rsp + 0x10f], 0
jns 0x140068e29
jmp 0x140068e1c
add rdi, 0x18
lea rdx, str.database
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401beb80
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140075670
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cd230
cmp byte [rbx + 0x17], 0
jns 0x140068ed1
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140068ee5
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
mov rdi, qword [r13]
jmp 0x140068f00
mov rdi, qword [r13]
movzx eax, byte [rdi + 0x2f]
test al, al
jns 0x140068efb
mov rax, qword [rdi + 0x20]
test rax, rax
jne 0x140068e80
movzx eax, byte [rdi + 0x47]
test al, al
jns 0x140068f0c
mov rax, qword [rdi + 0x38]
test rax, rax
jne 0x140069d81
movzx eax, byte [rdi + 0x5f]
test al, al
js 0x140068f5e
mov rcx, rax
test rcx, rcx
jne 0x140069def
mov r14, qword [rdi + 0x60]
lea rbp, [rdi + 0x68]
cmp r14, rbp
je 0x1400691a6
mov qword [rsp + 0x58], r13
movabs r12, 0x7fffffffffffffef
xorps xmm6, xmm6
lea r13, [rsp + 0x250]
mov qword [rsp + 0x60], rbp
jmp 0x140069179
mov rcx, qword [rdi + 0x50]
jmp 0x140068f20
mov rbp, r13
mov r13, r12
mov r12, r15
or r12, 0xf
inc r12
mov rcx, r12
call fcn.1401803a4
mov rdi, rax
lea rax, [r13 + 0x11]
or rax, r12
mov r12, r13
mov r13, rbp
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r15
jmp 0x140068fe1
mov rsi, qword [r14 + 0x28]
lea r15, [rsi + 1]
cmp r15, r12
ja 0x14006a006
cmp r15, 0x16
ja 0x140068f64
movaps xmmword [rsp + 0x250], xmm6
mov qword [rsp + 0x260], 0
mov byte [rsp + 0x267], r15b
mov rdi, r13
lea rdx, [r14 + 0x20]
test bl, bl
jns 0x140068fec
mov rdx, qword [rdx]
cmp rdx, rdi
jb 0x140068ffe
lea rax, [rdi + rsi]
cmp rax, rdx
ja 0x14006a00f
mov rcx, rdi
mov r8, rsi
call fcn.140184b40
mov word [rdi + rsi], 0x3d
movzx r8d, byte [r14 + 0x4f]
test r8b, r8b
js 0x140069023
lea rdx, [r14 + 0x38]
and r8d, 0x7f
jmp 0x14006902b
mov r8, qword [r14 + 0x40]
mov rdx, qword [r14 + 0x38]
mov rcx, r13
call fcn.1401554f0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x290], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x280], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x297]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x280]
lea rdx, [rsp + 0x280]
cmovns rax, rdx
mov qword [rsp + 0x270], rax
cmovs rcx, qword [rsp + 0x288]
mov qword [rsp + 0x278], rcx
lea rsi, [rsp + 0x70]
mov rcx, rsi
lea rdx, [rsp + 0x270]
call fcn.140109a70
lea rdi, [rsp + 0x238]
mov rcx, rdi
lea rdx, str.annotation
call fcn.1401beb80
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140075670
mov rcx, rbx
lea rdx, [rsp + 0x2c0]
call fcn.1400cd230
cmp byte [rsp + 0x10f], 0
jns 0x1400690fa
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x24f], 0
jns 0x140069111
mov rcx, qword [rsp + 0x238]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140069125
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
cmp byte [rsp + 0x297], 0
jns 0x14006913c
mov rcx, qword [rsp + 0x280]
call fcn.14018039c
cmp byte [rsp + 0x267], 0
jns 0x140069153
mov rcx, qword [rsp + 0x250]
call fcn.14018039c
test r14, r14
je 0x14006a009
mov rcx, qword [r14 + 8]
test rcx, rcx
jne 0x140069190
mov rax, qword [r14 + 0x10]
cmp qword [rax], r14
mov r14, rax
jne 0x140069165
mov r14, rax
cmp rax, rbp
je 0x14006919d
movzx ebx, byte [r14 + 0x37]
test bl, bl
js 0x140068fab
mov esi, ebx
and esi, 0x7f
jmp 0x140068faf
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140069171
jmp 0x140069190
mov r13, qword [rsp + 0x58]
mov rdi, qword [r13]
mov rsi, qword [rdi + 0x90]
mov r12, qword [rdi + 0x98]
cmp rsi, r12
je 0x14006922d
lea rdi, [0x14027f180]
lea rbx, [rsp + 0x70]
lea r14, [rsp + 0xf8]
lea r15, [rsp + 0x2c0]
mov rcx, rbx
mov rdx, rdi
call fcn.1401beb80
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call fcn.140075670
mov rcx, r14
mov rdx, r15
call fcn.1400cd230
cmp byte [rsp + 0x10f], 0
jns 0x140069210
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140069224
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
add rsi, 0x18
cmp rsi, r12
jne 0x1400691d5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14006930a
cmp dword [0x1402acb48], 2
jg 0x1400692a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x19a
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, [0x140281ae7]
mov r8d, 0xb
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
xor ebp, ebp
xor r15d, r15d
cmp byte [rsp + 0x2d7], 0
jns 0x1400692c3
mov rcx, qword [rsp + 0x2c0]
call fcn.14018039c
xor eax, eax
cmp r15b, 1
adc rax, 1
mov qword [0x1402b2bf0], rax
mov rcx, r13
call fcn.1400754d0
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, rax
mov rax, qword [r13]
mov rax, qword [rax + 0xc8]
mov rcx, qword [0x1402a7060]
mov r9, qword [0x1402a7050]
mov r8, qword [0x1402a7048]
movsxd rdx, edi
cmp rdx, rdi
jne 0x14006a012
mov edx, edi
movsxd r10, eax
cmp r10, rax
jne 0x14006a01a
movsxd r10, ecx
cmp r10, rcx
jne 0x14006a022
movsxd r10, r9d
cmp r10, r9
jne 0x14006a02a
movsxd r10, r8d
cmp r10, r8
jne 0x14006a033
lea r10, [0x1402b2bc0]
mov qword [rsp + 0x48], r10
lea r10, [0x1402b2bb0]
mov qword [rsp + 0x40], r10
lea r10, [0x1402b2ba0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_I64x_0x_I64x_0x_I64x
lea rsi, [rsp + 0x280]
mov rcx, rsi
call fcn.140109730
lea rdx, str.__initial_client_data
lea rbx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401beb80
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1400693d9
and r8d, 0x7f
jmp 0x1400693e9
mov r8, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
mov rdx, rsi
call fcn.1401554f0
mov rcx, qword [rax + 0x10]
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx eax, byte [rbp + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbp]
cmovns rax, rbp
lea rdx, [rsp + 0xe8]
mov qword [rdx], rax
cmovs rcx, qword [rbp + 8]
mov qword [rdx + 8], rcx
lea r12, [rsp + 0xf8]
mov rcx, r12
call fcn.140109a70
lea r15, [rsp + 0x2c0]
mov rcx, r12
mov rdx, r15
call fcn.1400cd230
cmp byte [r12 + 0x17], 0
jns 0x140069475
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140069489
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
cmp byte [rsp + 0x267], 0
jns 0x1400694a0
mov rcx, qword [rsp + 0x250]
call fcn.14018039c
cmp byte [rsp + 0x297], 0
jns 0x1400694b7
mov rcx, qword [rsp + 0x280]
call fcn.14018039c
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0xac], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xc0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xd0], rax
mov eax, dword [0x1402b2c00]
mov ecx, dword [0x1402a76e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140069f4e
mov eax, dword [0x1402b2c10]
mov ecx, dword [0x1402a76e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140069fa5
mov rax, qword [0x1402b2bf8]
movabs rcx, 0xaaaaaaaaaaaaaaaa
test rax, rax
je 0x140069630
cmp qword [0x1402b2c08], 0
je 0x140069630
mov dword [rsp + 0x70], 0x70
lea r9, [rsp + 0x280]
mov qword [r9], rcx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [case.0x1401e9be0.0]
test eax, eax
je 0x140069952
cmp dword [0x1402acb48], 2
jg 0x140069619
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1cb
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x108]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.1401bd290
mov rcx, rsi
call fcn.140004bf0
xor r14d, r14d
xor eax, eax
xor ebx, ebx
mov r12, rbx
xor r15d, r15d
mov rbx, rax
xor ebp, ebp
jmp 0x14006983c
mov dword [rsp + 0x70], 0x68
xor r14d, r14d
xor ebx, ebx
xor esi, esi
mov rdx, qword [r13]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x140069685
cmp r8b, 0xc
jae 0x14006968f
mov qword [rsp + 0x290], rcx
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rsp + 0x280], xmm0
cmp byte [rsp + 0x2d7], 0
js 0x14006972c
lea r15, [rsp + 0x2c0]
jmp 0x140069734
mov r8, qword [rdx + 8]
cmp r8, 0xc
jb 0x140069653
add r8, 0xfffffffffffffff4
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov rcx, r12
mov r9, 0xffffffffffffffff
call fcn.14001e1e0
cmp byte [rsp + 0x10f], 0
jns 0x1400696c1
mov r12, qword [rsp + 0xf8]
lea rdx, str.rundll32.exe
mov rcx, r12
call fcn.14019d104
mov r12d, eax
cmp byte [rsp + 0x10f], 0
jns 0x1400696ea
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x2d7], 0
jns 0x1400696fc
mov r15, qword [rsp + 0x2c0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x290], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rsp + 0x280], xmm0
test r12d, r12d
je 0x140069e9f
mov rdx, qword [r13]
jmp 0x140069734
mov r15, qword [rsp + 0x2c0]
cmp byte [rdx + 0x17], 0
jns 0x14006973d
mov rdx, qword [rdx]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
mov rcx, rdx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400698f0
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402acb48], 1
jg 0x1400697a5
cmp dword [0x14029ae10], 0
je 0x1400697a5
test eax, eax
je 0x140069ea6
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402acb48], 1
jg 0x1400697cd
cmp dword [0x14029ae10], 0
je 0x1400697cd
test eax, eax
je 0x140069efa
mov rsi, qword [r13]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400697eb
call fcn.1400617a0
test al, al
je 0x14006a043
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0xf8]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x250]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r13]
call fcn.140062d80
mov r15d, eax
mov ebp, eax
mov r12, rbx
test rbx, rbx
je 0x1400698c0
mov eax, dword [0x1402b2c20]
mov ecx, dword [0x1402a76e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400698b0
lea rcx, [0x1402b2c20]
call fcn.1401805cc
cmp dword [0x1402b2c20], 0xffffffff
jne 0x1400698b0
lea rcx, [0x140272d0a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006a03c
lea rdx, [0x140281c45]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402b2c18], rax
lea rcx, [0x1402b2c20]
call fcn.140180634
mov rax, qword [0x1402b2c18]
mov rcx, rbx
call qword [case.0x1401e9be0.0]
test r12, r12
je 0x1400698cd
mov rcx, r12
call fcn.1401805c4
test r14, r14
je 0x1400698da
mov rcx, r14
call fcn.14018039c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400692ac
jmp 0x14006a046
cmp dword [0x1402acb48], 2
jg 0x140069948
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x216
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
xor r15d, r15d
xor ebp, ebp
jmp 0x140069839
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400699be
cmp dword [0x1402acb48], 2
jg 0x140069619
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1cf
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
jmp 0x140069619
lea rsi, [rsp + 0x280]
mov rcx, qword [rsi]
call fcn.140180694
mov rbx, rax
mov qword [rsp + 0xd8], rax
mov rax, qword [0x1402b2bf8]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [case.0x1401e9be0.0]
test eax, eax
je 0x140069b68
mov ecx, 0x40
call fcn.1401803a4
test rax, rax
je 0x140069d72
mov r14, rax
mov rax, qword [0x1402a7048]
mov qword [r14], rax
cmp r14, 0xfffffffffffffff8
je 0x140069d75
mov rax, qword [0x1402a7050]
mov qword [r14 + 8], rax
cmp r14, 0xfffffffffffffff0
je 0x140069d78
mov rax, qword [0x1402a7060]
mov qword [r14 + 0x10], rax
cmp r14, 0xffffffffffffffe8
je 0x140069d6c
mov rax, qword [r13]
mov rax, qword [rax + 0xc8]
mov qword [r14 + 0x18], rax
cmp r14, 0xffffffffffffffe0
je 0x140069d6f
mov qword [r14 + 0x20], rdi
mov rsi, qword [rsp + 0xc0]
mov r8d, 5
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140069c84
mov rsi, qword [rsp + 0xc8]
lea rax, [rsi + 1]
cmp rax, 2
mov qword [rsp + 0x58], r13
jae 0x140069bca
lea rsi, [r14 + r8*8]
mov r13, qword [rsp + 0xd0]
lea rax, [r13 + 1]
cmp rax, 2
jae 0x140069b11
mov r13, qword [rsp + 0x58]
sub rsi, r14
je 0x140069d69
mov rax, qword [0x1402b2c08]
mov rcx, qword [rsp + 0xd8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rsi
mov r8d, 0x20002
xor edx, edx
mov r9, r14
call qword [case.0x1401e9be0.0]
test eax, eax
je 0x140069c24
mov esi, 0x80000
movabs rcx, 0xaaaaaaaaaaaaaaaa
jmp 0x14006963f
mov qword [rsp + 0x60], r8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140069aba
mov r8, qword [rsp + 0x60]
lea r9, [r8*8]
xor eax, eax
cmp qword [r14 + rax], r13
je 0x140069aba
add rax, 8
cmp r9, rax
jne 0x140069b36
cmp r8d, 8
je 0x140069cd6
test rsi, rsi
je 0x14006a09f
mov qword [rsi], r13
add rsi, 8
jmp 0x140069aba
cmp dword [0x1402acb48], 2
jg 0x140069bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1da
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, [0x140281bb8]
mov r8d, 0x21
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
xor r14d, r14d
xor eax, eax
jmp 0x140069620
mov qword [rsp + 0x60], r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
je 0x140069bea
mov r8, qword [rsp + 0x60]
jmp 0x140069aa4
mov r8, qword [rsp + 0x60]
lea rax, [r14 + r8*8]
lea rcx, [r8*8]
xor edx, edx
cmp qword [r14 + rdx], rsi
je 0x140069aa4
add rdx, 8
cmp rcx, rdx
jne 0x140069bfd
test rax, rax
je 0x140069d7e
mov qword [rax], rsi
inc r8
jmp 0x140069aa4
cmp dword [0x1402acb48], 2
jg 0x140069c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x1f4
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, [0x140281bda]
mov r8d, 0x19
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
mov rax, rbx
jmp 0x140069620
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
je 0x140069ca0
mov r8d, 5
jmp 0x140069a89
lea rax, [r14 + 0x28]
xor ecx, ecx
mov r8d, 5
cmp qword [r14 + rcx*8], rsi
je 0x140069a89
inc rcx
cmp rcx, 5
jne 0x140069cac
test rax, rax
je 0x140069d7b
mov qword [rax], rsi
mov r8d, 6
jmp 0x140069a89
mov al, 1
test al, al
je 0x14006a096
movabs rax, 0x1fffffffffffffff
lea rcx, [r8 + 1]
movabs rdx, 0x7fffffffffffffef
add rdx, 9
mov rsi, r8
add r8, r8
cmp r8, rcx
cmova rcx, r8
mov qword [rsp + 0x68], r9
cmp r9, rdx
cmovae rcx, rax
cmp rcx, rax
ja 0x14006a099
shl rcx, 3
call fcn.1401803a4
shl rsi, 3
add rsi, rax
je 0x14006a09c
mov qword [rsi], r13
add rsi, 8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r14 + rdx - 8]
mov qword [rax + rdx - 8], rcx
add rdx, 0xfffffffffffffff8
jne 0x140069d40
mov r13, rax
mov rcx, r14
mov r14, rdx
call fcn.14018039c
add r13, r14
mov r14, r13
jmp 0x140069aba
int3
int3
int3
int3
int3
int3
int3
int3
add rdi, 0x30
lea rdx, str.metrics_dir
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401beb80
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140075670
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cd230
cmp byte [rbx + 0x17], 0
jns 0x140069dd2
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140069de6
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
mov rdi, qword [r13]
jmp 0x140068f15
lea rcx, [rdi + 0x48]
test al, al
cmovs rcx, qword [rdi + 0x48]
lea rdx, [rsp + 0x2a0]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 0x50]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.140109a70
lea rdx, [0x140272ce6]
lea rdi, [rsp + 0x280]
mov rcx, rdi
call fcn.1401beb80
lea rbx, [rsp + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140075670
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400cd230
cmp byte [rbx + 0x17], 0
jns 0x140069e6b
mov rcx, qword [rsp + 0xf8]
call fcn.14018039c
cmp byte [rsp + 0x297], 0
jns 0x140069e82
mov rcx, qword [rsp + 0x280]
call fcn.14018039c
cmp byte [rsp + 0x87], 0
jns 0x140069e96
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
mov rdi, qword [r13]
jmp 0x140068f29
xor edx, edx
jmp 0x14006973d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x21b
mov r9d, 1
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
jmp 0x1400697a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 1
call fcn.1401ed840
lea rcx, [rsp + 0x108]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
jmp 0x1400697cd
lea rcx, [0x1402b2c00]
call fcn.1401805cc
cmp dword [0x1402b2c00], 0xffffffff
jne 0x140069553
lea rcx, [0x140272d0a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140069fa1
lea rdx, [0x140281b0c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402b2bf8], rax
lea rcx, [0x1402b2c00]
call fcn.140180634
jmp 0x140069553
xor eax, eax
jmp 0x140069f89
lea rcx, [0x1402b2c10]
call fcn.1401805cc
cmp dword [0x1402b2c10], 0xffffffff
jne 0x140069578
cmp qword [0x1402b2bf8], 0
je 0x14006a002
lea rcx, [0x140272d0a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14006a002
lea rdx, [0x140281b30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402b2c08], rax
lea rcx, [0x1402b2c10]
call fcn.140180634
jmp 0x140069578
xor eax, eax
jmp 0x140069fea
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x14006989d
int3
lea rdx, str.Free
lea r8, str....._third_partycrashpadcrashpadutilwin_scoped_handle.cc
lea rsi, [rsp + 0xf8]
mov rcx, rsi
mov r9d, 0x1e
call fcn.1400e92c0
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, rsi
call fcn.1401eedc0
lea rdx, [0x1402836e1]
mov rcx, rdi
call fcn.140209aa0
mov rcx, rdi
call fcn.1401eedf0
jmp 0x1400692ac
int3
int3
int3
int3