Function at 0x1400b5140
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movdqa xmmword [rsp + 0x300], xmm6
mov r15, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea rdx, [rsp + 0x2d8]
movdqu xmmword [rdx + 0x10], xmm0
mov word [rdx], 0
mov rcx, qword [r15]
call fcn.1400bea60
mov rsi, qword [r15]
mov rbp, qword [rsi + 0x90]
mov rdi, qword [rsi + 0x98]
cmp rbp, rdi
je 0x1400b5214
lea rsi, [rsp + 0x180]
lea r14, [rsp + 0xb0]
lea rbx, [rsp + 0x2d8]
cmp qword [rbp + 0x18], 0xf
mov rax, rbp
jbe 0x1400b51d6
mov rax, qword [rbp]
mov qword [rsp + 0xb0], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xb8], rax
mov rcx, rsi
mov rdx, r14
call fcn.140018840
mov rcx, rsi
mov rdx, rbx
call fcn.1400bea60
mov rcx, rsi
call fcn.140001a70
add rbp, 0x20
cmp rdi, rbp
jne 0x1400b51c8
mov rsi, qword [r15]
cmp qword [rsi + 0x30], 0
je 0x1400b528c
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x20
mov byte [rdi], 0
lea rdx, str.database
mov r8d, 8
mov rcx, rdi
call fcn.140002130
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400b61b0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.1400bea60
mov rcx, rbx
call fcn.140001a70
mov rcx, rdi
call fcn.140001c80
mov rsi, qword [r15]
cmp qword [rsi + 0x50], 0
je 0x1400b5304
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x40
mov byte [rdi], 0
lea rdx, str.metrics_dir
mov r8d, 0xb
mov rcx, rdi
call fcn.140002130
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400b61b0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.1400bea60
mov rcx, rbx
call fcn.140001a70
mov rcx, rdi
call fcn.140001c80
mov rsi, qword [r15]
mov rax, qword [rsi + 0x70]
test rax, rax
mov qword [rsp + 0x58], r15
je 0x1400b53bb
cmp qword [rsi + 0x78], 0xf
jbe 0x1400b5323
mov rsi, qword [rsi + 0x60]
jmp 0x1400b5327
add rsi, 0x60
lea rdx, [rsp + 0xa0]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.140018840
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x130]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, [0x14016fcf3]
mov r8d, 3
mov rcx, rdi
call fcn.140002130
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400b61b0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.1400bea60
mov rcx, rbx
call fcn.140001a70
mov rcx, rdi
call fcn.140001c80
mov rcx, rsi
call fcn.140001a70
mov rsi, qword [r15]
mov r15, qword [rsi + 0x80]
mov r12, qword [r15]
mov qword [rsp + 0x60], r12
cmp r12, r15
je 0x1400b5562
mov r14d, 0xf
movq xmm6, r14
pslldq xmm6, 8
xor r13d, r13d
lea rdi, [rsp + 0x2b0]
lea rsi, [rsp + 0xc0]
lea rbx, [rsp + 0x290]
lea rbp, [rsp + 0x180]
movdqu xmmword [rsp + 0x2c0], xmm6
mov byte [rsp + 0x2b0], r13b
mov rdx, qword [r12 + 0x30]
inc rdx
mov rcx, rdi
call fcn.140003aa0
mov r8, qword [r12 + 0x30]
cmp qword [r12 + 0x38], r14
jbe 0x1400b543a
mov rdx, qword [r12 + 0x20]
jmp 0x1400b543f
lea rdx, [r12 + 0x20]
mov rcx, rdi
call fcn.1400024c0
mov edx, 0x3d
mov rcx, rdi
call fcn.140086df0
mov r8, qword [r12 + 0x50]
cmp qword [r12 + 0x58], r14
jbe 0x1400b5467
mov r12, qword [r12 + 0x40]
jmp 0x1400b546b
add r12, 0x40
mov rcx, rdi
mov rdx, r12
call fcn.1400024c0
movdqu xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x130], xmm0
movdqu xmmword [rax + 0x10], xmm6
mov byte [rax], r13b
mov rax, qword [rsp + 0x140]
cmp qword [rsp + 0x148], r14
lea rcx, [rsp + 0x130]
jbe 0x1400b54b9
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov rcx, rsi
lea rdx, [rsp + 0x90]
call fcn.140018840
movdqu xmmword [rsp + 0x2a0], xmm6
mov byte [rsp + 0x290], r13b
mov r8d, 0xa
mov rcx, rbx
lea rdx, str.annotation
call fcn.140002130
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call fcn.1400b61b0
mov rcx, rbp
lea rdx, [rsp + 0x2d8]
call fcn.1400bea60
mov rcx, rbp
call fcn.140001a70
mov rcx, rbx
call fcn.140001c80
mov rcx, rsi
call fcn.140001a70
lea rcx, [rsp + 0x130]
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
lea rcx, [rsp + 0x60]
call fcn.1400a5440
mov r12, qword [rsp + 0x60]
cmp r12, r15
jne 0x1400b5406
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400b5687
mov r15, qword [rsp + 0x58]
mov rcx, qword [r15]
mov rcx, qword [rcx + 0xc8]
mov r9, qword [0x1401929a0]
mov r8, qword [0x140192998]
mov rdx, qword [0x140192990]
lea rbp, [0x140197c10]
mov qword [rsp + 0x40], rbp
lea rbp, [0x140197c00]
mov qword [rsp + 0x38], rbp
lea rbp, [0x140197bf0]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x130]
mov rcx, rdi
call fcn.1400b8630
lea rsi, [rsp + 0x2b0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400b89c0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x290]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, str.__initial_client_data
mov r8d, 0x16
mov rcx, rdi
call fcn.140002130
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov r9, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov rdx, rcx
sub rdx, r9
cmp r8, rdx
jbe 0x1400b56ef
mov rdx, rax
sub rdx, r8
cmp rdx, r9
jb 0x1400b56ef
cmp rcx, 0xf
cmova rdi, qword [rsp + 0x290]
lea rcx, [rsp + 0x2b0]
xor edx, edx
mov r8, rdi
call fcn.140005350
jmp 0x1400b570c
mov ecx, 2
call fcn.140015cf0
xor ebx, ebx
test al, al
mov r15, qword [rsp + 0x58]
je 0x1400b5d07
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x180
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, [0x140182ef1]
call fcn.140001700
mov rcx, rsi
call fcn.140017200
xor ebx, ebx
jmp 0x1400b5d07
cmp rax, 0xf
cmova rsi, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x290]
mov rdx, rsi
call fcn.1400024c0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x10], xmm0
mov byte [rax], 0
lea rsi, [rsp + 0xc0]
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
jbe 0x1400b5758
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x180]
mov rcx, rdi
call fcn.140018840
lea rbx, [rsp + 0x2d8]
mov rcx, rdi
mov rdx, rbx
call fcn.1400bea60
mov rcx, rdi
call fcn.140001a70
mov rcx, rsi
call fcn.140001c80
lea r14, [rsp + 0x290]
mov rcx, r14
call fcn.140001c80
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.140001c80
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xf0], xmm6
movdqa xmmword [rsp + 0x120], xmm6
movdqa xmmword [rsp + 0x110], xmm6
movdqa xmmword [rsp + 0x100], xmm6
movdqa xmmword [rsp + 0xe0], xmm6
movdqa xmmword [rsp + 0xd0], xmm6
movdqa xmmword [rsp + 0xc0], xmm6
mov dword [rsp + 0xfc], 0x100
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov qword [rsp + 0x110], rax
mov ecx, 0xfffffff5
call rdi
mov qword [rsp + 0x118], rax
mov ecx, 0xfffffff4
call rdi
mov qword [rsp + 0x120], rax
xor eax, eax
mov qword [rsi + 0x10], rax
movdqa xmmword [rsi], xmm6
mov qword [rsp + 0x70], rax
mov eax, dword [0x140197c50]
mov ecx, dword [0x140195c08]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x1400b5e1f
mov eax, dword [0x140197c60]
mov ecx, dword [0x140195c08]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x1400b5e68
mov rbp, qword [0x140197c48]
test rbp, rbp
je 0x1400b592b
mov rax, qword [0x140197c58]
test rax, rax
je 0x1400b592b
mov dword [rsp + 0xc0], 0x70
lea r9, [rsp + 0x290]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call rbp
test eax, eax
je 0x1400b5b37
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5cdf
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b1
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x188]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
call fcn.140001700
mov rcx, rsi
call fcn.140015290
jmp 0x1400b5cdf
mov dword [rsp + 0xc0], 0x68
xor edi, edi
xor eax, eax
cmp qword [rsp + 0x2f0], 7
jbe 0x1400b594d
mov rbx, qword [rsp + 0x2d8]
mov rcx, qword [r15]
cmp qword [rcx + 0x18], 8
jb 0x1400b595a
mov rcx, qword [rcx]
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x40], rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400b5ad4
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140015cf0
test esi, esi
jne 0x1400b5a03
test al, al
je 0x1400b5a03
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f0
mov r9d, 1
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_thread
call fcn.140001700
mov rcx, rsi
call fcn.140017200
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140015cf0
test esi, esi
jne 0x1400b5a6d
test al, al
je 0x1400b5a6d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f3
mov r9d, 1
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_process
call fcn.140001700
mov rcx, rsi
call fcn.140017200
mov rcx, qword [r15]
add rcx, 0xc8
lea rsi, [rsp + 0x180]
mov qword [rsi], 0xffffffffffffffff
mov rdx, rsi
call fcn.1400b6020
pxor xmm0, xmm0
movdqu xmmword [rsi + 0x14], xmm0
movdqu xmmword [rsi + 4], xmm0
mov dword [rsi], 2
lea r8, [rsp + 0x60]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov rcx, qword [r15]
add rcx, 0xa8
lea rdx, [rsp + 0x180]
call fcn.1400be510
mov ebx, eax
jmp 0x1400b5ce3
mov ecx, 2
call fcn.140015cf0
xor ebx, ebx
test al, al
je 0x1400b5ce3
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1eb
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.CreateProcess
call fcn.140001700
mov rcx, rsi
call fcn.140017200
xor ebx, ebx
jmp 0x1400b5ce3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400b5c89
lea rsi, [rsp + 0x290]
mov rcx, qword [rsi]
call fcn.1400edce0
mov rdi, rax
mov qword [rsp + 0x128], rdi
mov edx, 1
xor r8d, r8d
mov rcx, rdi
mov r9, rsi
call qword [0x140197c48]
test eax, eax
je 0x1400b5d7b
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400b6410
mov rax, qword [rsp + 0x128]
mov qword [rsi], rax
mov rax, qword [rsp + 0x2c0]
sub rax, qword [rsp + 0x2b0]
sar rax, 3
cmp rax, 7
ja 0x1400b5bc1
lea rcx, [rsp + 0x2b0]
mov edx, 8
call fcn.1400e14c0
lea rdx, [0x140192990]
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.1400d3840
lea rdx, [0x140192998]
mov rcx, rsi
call fcn.1400d3840
lea rdx, [0x1401929a0]
mov rcx, rsi
call fcn.1400d3840
mov rdx, qword [r15]
add rdx, 0xc8
mov rcx, rsi
call fcn.1400d3840
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.1400d3840
mov rdx, qword [rsp + 0x110]
mov rcx, rsi
call fcn.1400b6390
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call fcn.1400b6390
mov rdx, qword [rsp + 0x120]
mov rcx, rsi
call fcn.1400b6390
mov r9, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r9
mov rcx, qword [rsp + 0x128]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x20002
call qword [0x140197c58]
test eax, eax
je 0x1400b5dcd
mov eax, 0x80000
jmp 0x1400b593a
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5cdf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b5
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList__size_
call fcn.140001700
mov rcx, rsi
call fcn.140017200
xor ebx, ebx
xor edi, edi
lea rcx, [rsp + 0x70]
call fcn.1400b6410
test rdi, rdi
je 0x1400b5cfa
mov rcx, rdi
call fcn.1400edcf0
lea rcx, [rsp + 0x2b0]
call fcn.1400d2130
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400b5d25
call fcn.14008b9a0
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x2d8]
call fcn.140001a70
cmp bl, 1
mov eax, 1
adc rax, 0
xchg qword [0x140197c40], rax
mov rcx, r15
call fcn.1400b60f0
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.1400edc60
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5b30
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1c0
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList
jmp 0x1400b5b23
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5b30
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1da
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x190]
lea rdx, str.UpdateProcThreadAttribute
jmp 0x1400b5b23
lea rcx, [0x140197c50]
call fcn.1400ee1f0
mov eax, dword [0x140197c50]
cmp eax, 0xffffffff
jne 0x1400b586d
lea rcx, [0x140155a9e]
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.1400beb70
mov qword [0x140197c48], rax
lea rcx, [0x140197c50]
call fcn.1400ee190
jmp 0x1400b586d
lea rcx, [0x140197c60]
call fcn.1400ee1f0
mov eax, dword [0x140197c60]
cmp eax, 0xffffffff
jne 0x1400b5892
cmp qword [0x140197c48], 0
je 0x1400b5ea5
lea rcx, [0x140155a9e]
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.1400beb70
jmp 0x1400b5ea7
xor eax, eax
mov qword [0x140197c58], rax
lea rcx, [0x140197c60]
call fcn.1400ee190
jmp 0x1400b5892