Function at 0x1400a88b0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm7
movaps xmmword [rsp + 0x320], xmm6
mov r12, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x318], rax
call fcn.1400eb720
test al, al
jne 0x1400a9977
xorps xmm0, xmm0
lea rdx, [rsp + 0x300]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.1400eb750
mov rsi, qword [r12]
mov rbp, qword [rsi + 0x78]
mov rdi, qword [rsi + 0x80]
cmp rbp, rdi
je 0x1400a89a2
lea rsi, [rsp + 0x150]
lea r14, [rsp + 0x2f0]
lea rbx, [rsp + 0x300]
movzx eax, byte [rbp + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbp]
cmovns rax, rbp
mov qword [rsp + 0x2f0], rax
cmovs rcx, qword [rbp + 8]
mov qword [rsp + 0x2f8], rcx
mov rcx, rsi
mov rdx, r14
call fcn.140169fc0
mov rcx, rsi
mov rdx, rbx
call fcn.1400eb750
cmp byte [rsp + 0x167], 0
jns 0x1400a8995
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
add rbp, 0x18
cmp rbp, rdi
jne 0x1400a8940
mov rsi, qword [r12]
movzx eax, byte [rsi + 0x2f]
test al, al
jns 0x1400a89ae
mov rax, qword [rsi + 0x20]
test rax, rax
jne 0x1400a8d8c
movzx eax, byte [rsi + 0x47]
test al, al
jns 0x1400a89c3
mov rax, qword [rsi + 0x38]
test rax, rax
jne 0x1400a8e00
movzx eax, byte [rsi + 0x5f]
test al, al
js 0x1400a89d9
mov rcx, rax
jmp 0x1400a89dd
mov rcx, qword [rsi + 0x50]
test rcx, rcx
jne 0x1400a8e74
mov rbx, qword [rsi + 0x60]
lea r13, [rsi + 0x68]
cmp rbx, r13
je 0x1400a8c5f
mov qword [rsp + 0x58], r12
xorps xmm6, xmm6
lea r12, [rsp + 0x2b0]
movzx esi, byte [rbx + 0x37]
test sil, sil
jns 0x1400a8a16
mov r15, qword [rbx + 0x28]
jmp 0x1400a8a1d
mov r15d, esi
and r15d, 0x7f
lea rbp, [r15 + 1]
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x1400a9972
cmp rbp, 0x16
jbe 0x1400a8c32
lea rdi, [r15 + 0x11]
and rdi, 0xfffffffffffffff0
mov rcx, rdi
call fcn.1401b9cac
mov r14, rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rdi
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x2b8], rbp
shr rax, 0x38
mov ebp, eax
lea rdx, [rbx + 0x20]
test bpl, bpl
mov rdi, r12
cmovs rdi, r14
test sil, sil
jns 0x1400a8a96
mov rdx, qword [rdx]
test r15, r15
je 0x1400a8aa6
mov rcx, rdi
mov r8, r15
call fcn.1401bcb50
test bpl, bpl
cmovns r14, r12
mov byte [rdi + r15], 0x3d
mov byte [r14 + r15 + 1], 0
movzx r8d, byte [rbx + 0x4f]
test r8b, r8b
jns 0x1400a8acc
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
jmp 0x1400a8ad4
lea rdx, [rbx + 0x38]
and r8d, 0x7f
mov rcx, r12
call fcn.14015be00
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx eax, byte [rsp + 0x117]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x100]
cmovns rax, rdx
mov qword [rsp + 0x2d0], rax
cmovs rcx, qword [rsp + 0x108]
mov qword [rsp + 0x2d8], rcx
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea rdx, [rsp + 0x2d0]
call fcn.140169fc0
lea rdi, [rsp + 0x290]
mov rcx, rdi
lea rdx, str.annotation
call fcn.1401f9c10
lea rbp, [rsp + 0x150]
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.1400a9f80
mov rcx, rbp
lea rdx, [rsp + 0x300]
call fcn.1400eb750
cmp byte [rsp + 0x167], 0
jns 0x1400a8ba6
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x2a7], 0
jns 0x1400a8bbd
mov rcx, qword [rsp + 0x290]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a8bd4
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
cmp byte [rsp + 0x117], 0
jns 0x1400a8beb
mov rcx, qword [rsp + 0x100]
call fcn.1401b9ce8
cmp byte [rsp + 0x2c7], 0
jns 0x1400a8c02
mov rcx, qword [rsp + 0x2b0]
call fcn.1401b9ce8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400a8c18
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400a8c0b
jmp 0x1400a8c24
mov rax, qword [rbx + 0x10]
cmp qword [rax], rbx
mov rbx, rax
jne 0x1400a8c18
mov rbx, rax
cmp rax, r13
jne 0x1400a8a07
jmp 0x1400a8c56
movaps xmmword [rsp + 0x2b0], xmm6
mov qword [rsp + 0x2c0], 0
mov byte [rsp + 0x2c7], bpl
xor r14d, r14d
jmp 0x1400a8a80
mov r12, qword [rsp + 0x58]
mov rsi, qword [r12]
mov rdi, qword [rsi + 0x90]
mov rsi, qword [rsi + 0x98]
cmp rdi, rsi
je 0x1400a8cec
lea r14, [0x14033f149]
lea rbx, [rsp + 0x80]
lea rbp, [rsp + 0x150]
lea r15, [rsp + 0x300]
mov rcx, rbx
mov rdx, r14
call fcn.1401f9c10
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.1400a9f80
mov rcx, rbp
mov rdx, r15
call fcn.1400eb750
cmp byte [rsp + 0x167], 0
jns 0x1400a8ccc
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a8ce3
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
add rdi, 0x18
cmp rdi, rsi
jne 0x1400a8c91
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x1400a8f2f
mov ecx, 2
call fcn.140160660
xor esi, esi
mov ebx, 0
test al, al
jne 0x1400a8fff
cmp byte [rsp + 0x317], 0
jns 0x1400a8d3e
mov rcx, qword [rsp + 0x300]
call fcn.1401b9ce8
xor eax, eax
cmp bl, 1
adc rax, 1
mov qword [0x1403b76d8], rax
mov rcx, r12
call fcn.1400a9e20
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x320]
movaps xmm7, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x18
lea rdx, str.database
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.1401f9c10
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400a9f80
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1400eb750
cmp byte [rbx + 0x17], 0
jns 0x1400a8de0
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a8df7
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
mov rsi, qword [r12]
jmp 0x1400a89b7
add rsi, 0x30
lea rdx, str.metrics_dir
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.1401f9c10
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400a9f80
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1400eb750
cmp byte [rbx + 0x17], 0
jns 0x1400a8e54
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a8e6b
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
mov rsi, qword [r12]
jmp 0x1400a89cc
lea rcx, [rsi + 0x48]
mov ebp, eax
and ebp, 0x7f
test al, al
cmovs rcx, qword [rsi + 0x48]
lea rdx, [rsp + 0x2e0]
mov qword [rdx], rcx
cmovs rbp, qword [rsi + 0x50]
mov qword [rdx + 8], rbp
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.140169fc0
lea rdx, [0x140333ba5]
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.1401f9c10
lea rbx, [rsp + 0x150]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400a9f80
lea rdx, [rsp + 0x300]
mov rcx, rbx
call fcn.1400eb750
cmp byte [rbx + 0x17], 0
jns 0x1400a8ef8
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x117], 0
jns 0x1400a8f0f
mov rcx, qword [rsp + 0x100]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a8f26
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
mov rsi, qword [r12]
jmp 0x1400a89e6
mov rdi, rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x100]
mov qword [rsi + 0x40], r14
movaps xmm6, xmmword [0x14032f5c0]
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rax, qword [r12]
mov rax, qword [rax + 0xc8]
mov r9, qword [0x1403a38ec]
mov r8, qword [0x1403a38e4]
mov rdx, qword [0x1403a38d0]
lea rcx, [0x1403b76a8]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1403b7698]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1403b7688]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.1400eb920
lea rbx, [rsp + 0x2b0]
mov rcx, rsi
mov rdx, rbx
call fcn.1400ebd30
lea rdx, str.__initial_client_data
lea rsi, [rsp + 0x290]
mov rcx, rsi
call fcn.1401f9c10
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
mov qword [rsp + 0x58], r12
jns 0x1400a9056
mov r8, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
jmp 0x1400a905a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x19a
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, [0x14033f154]
mov r8d, ntohl
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
xor esi, esi
xor ebx, ebx
jmp 0x1400a8d27
and r8d, 0x7f
mov rcx, rsi
mov rdx, rbx
call fcn.14015be00
mov rcx, qword [rax + 0x10]
lea r15, [rsp + 0x80]
mov qword [r15 + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [r15], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx eax, byte [r15 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r15]
cmovns rax, r15
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
cmovs rcx, qword [r15 + 8]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0x150]
mov rcx, rbx
call fcn.140169fc0
lea r12, [rsp + 0x300]
mov rcx, rbx
mov rdx, r12
call fcn.1400eb750
cmp byte [rbx + 0x17], 0
jns 0x1400a90e7
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
cmp byte [rsp + 0x97], 0
jns 0x1400a90fe
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
cmp byte [rsp + 0x2a7], 0
jns 0x1400a9115
mov rcx, qword [rsp + 0x290]
call fcn.1401b9ce8
cmp byte [rsp + 0x2c7], 0
jns 0x1400a912c
mov rcx, qword [rsp + 0x2b0]
call fcn.1401b9ce8
xorps xmm7, xmm7
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm7
mov dword [rsp + 0xbc], 0x100
mov rbp, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rbp
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rbp
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rbp
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x2b0], xmm7
mov qword [rsp + 0x2c0], 0
mov eax, dword [0x1403b76e8]
mov ecx, dword [0x1403b1c84]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a98d6
mov eax, dword [0x1403b76f8]
mov ecx, dword [0x1403b1c84]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a991d
mov rax, qword [0x1403b76e0]
test rax, rax
je 0x1400a92ac
cmp qword [0x1403b76f0], 0
je 0x1400a92ac
mov dword [rsp + 0x80], 0x70
lea r9, [rsp + 0x290]
mov qword [r9], r14
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x1403de008]
test eax, eax
je 0x1400a92f1
mov ecx, 2
call fcn.140160660
test al, al
je 0x1400a95f8
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1cb
mov r9d, 2
call fcn.140076020
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140076510
jmp 0x1400a95f8
mov rsi, r14
mov dword [rsp + 0x80], 0x68
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x1400a92df
cmp r8b, 0xc
jb 0x1400a92ea
jmp 0x1400a9434
cmp qword [rdx + 8], 0xc
jae 0x1400a9430
xor ebx, ebx
jmp 0x1400a948d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a95e6
lea rbp, [rsp + 0x290]
mov rcx, qword [rbp]
call fcn.1401b9d1c
mov r13, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x1403b76e0]
mov rcx, r13
mov edx, 1
xor r8d, r8d
mov r9, rbp
call qword [0x1403de008]
test eax, eax
je 0x1400a96aa
mov rsi, r14
mov ecx, 0x40
call fcn.1401b9cac
lea rcx, [rax + 0x40]
lea rbp, [rsp + 0x2b0]
mov qword [rbp], rax
mov qword [rbp + 0x10], rcx
mov rcx, qword [0x1403a38d0]
mov qword [rax], rcx
mov rcx, qword [0x1403a38e4]
mov qword [rax + 8], rcx
mov rcx, qword [0x1403a38ec]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0xc8]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdi
add rax, 0x28
mov qword [rbp + 8], rax
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov r14, qword [rsp + 0xe8]
mov rcx, rbp
call fcn.1400aa120
mov rcx, rbp
mov rdx, qword [rsp + 0x60]
call fcn.1400aa120
mov rcx, rbp
mov rdx, qword [rsp + 0x68]
call fcn.1400aa120
mov rax, qword [0x1403b76f0]
mov r9, qword [rbp]
mov rcx, qword [rbp + 8]
sub rcx, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
mov r8d, 0x20002
mov rcx, r14
xor edx, edx
mov r14, r9
call qword [0x1403de008]
test eax, eax
je 0x1400a96c6
mov ebp, 0x80000
jmp 0x1400a92c2
mov r8, qword [rdx + 8]
add r8, 0xfffffffffffffff4
lea rax, [rdx + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r9, 0xffffffffffffffff
call fcn.14005d000
cmp byte [rsp + 0x167], 0
jns 0x1400a9462
mov rbx, qword [rsp + 0x150]
lea rdx, str.rundll32.exe
mov rcx, rbx
call fcn.1401d76d4
test eax, eax
sete bl
cmp byte [rsp + 0x167], 0
jns 0x1400a948d
mov rcx, qword [rsp + 0x150]
call fcn.1401b9ce8
mov qword [rsp + 0x2a0], rsi
movaps xmmword [rsp + 0x290], xmm6
cmp byte [rsp + 0x317], 0
jns 0x1400a94af
mov r12, qword [rsp + 0x300]
test bl, bl
lea rdx, [rsp + 0x290]
je 0x1400a94bf
xor ecx, ecx
jmp 0x1400a94d0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
cmp byte [rcx + 0x17], 0
jns 0x1400a94d0
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400a95c3
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140160660
test al, al
mov r12, qword [rsp + 0x58]
je 0x1400a9530
test esi, esi
je 0x1400a96e0
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.140160660
test al, al
je 0x1400a9556
test esi, esi
je 0x1400a9733
mov rsi, qword [r12]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400a9577
call fcn.1400eb4f0
mov qword [rsi + 0xc8], 0xffffffffffffffff
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x150]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x70]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r12]
call fcn.1400e8e90
mov ebx, eax
mov esi, eax
jmp 0x1400a95e1
mov ecx, 2
call fcn.140160660
xor ebx, ebx
mov esi, 0
test al, al
mov r12, qword [rsp + 0x58]
jne 0x1400a9786
mov rbp, r13
jmp 0x1400a960f
mov ecx, 2
call fcn.140160660
test al, al
jne 0x1400a97dd
xor r14d, r14d
xor eax, eax
xor r13d, r13d
mov r12, qword [rsp + 0x58]
mov rbp, r13
xor ebx, ebx
mov r13, rax
xor esi, esi
test r13, r13
je 0x1400a9683
mov eax, dword [0x1403b7708]
mov ecx, dword [0x1403b1c84]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400a9673
lea rcx, [0x1403b7708]
call fcn.1401b9e00
cmp dword [0x1403b7708], 0xffffffff
jne 0x1400a9673
lea rcx, [0x140333e72]
lea rdx, str.::DeleteProcThreadAttributeList
mov r8b, 1
call fcn.1400ebdd0
mov qword [0x1403b7700], rax
lea rcx, [0x1403b7708]
call fcn.1401b9e98
mov rax, qword [0x1403b7700]
mov rcx, r13
call qword [0x1403de008]
test rbp, rbp
je 0x1400a9690
mov rcx, rbp
call fcn.1401b9d24
test r14, r14
je 0x1400a969d
mov rcx, r14
call fcn.1401b9ce8
mov rcx, rdi
call fcn.1400eb500
jmp 0x1400a8d27
mov ecx, 2
call fcn.140160660
test al, al
jne 0x1400a9830
xor r14d, r14d
xor eax, eax
jmp 0x1400a9600
mov ecx, 2
call fcn.140160660
test al, al
jne 0x1400a9883
mov rax, r13
jmp 0x1400a9600
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x21b
mov r9d, 1
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
jmp 0x1400a9530
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 1
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
jmp 0x1400a9556
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x216
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, str.CreateProcess
mov r8d, ntohl
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
xor ebx, ebx
xor esi, esi
jmp 0x1400a95e1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1cf
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
jmp 0x1400a95f8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1da
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, [0x14033f225]
mov r8d, 0x21
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
jmp 0x1400a96bc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x1f4
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x160]
lea rdx, [0x14033f247]
mov r8d, 0x19
call fcn.1401f9cc0
mov rcx, rsi
call fcn.140224690
jmp 0x1400a96d8
lea rcx, [0x1403b76e8]
call fcn.1401b9e00
cmp dword [0x1403b76e8], 0xffffffff
jne 0x1400a91df
lea rcx, [0x140333e72]
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.1400ebdd0
mov qword [0x1403b76e0], rax
lea rcx, [0x1403b76e8]
call fcn.1401b9e98
jmp 0x1400a91df
lea rcx, [0x1403b76f8]
call fcn.1401b9e00
cmp dword [0x1403b76f8], 0xffffffff
jne 0x1400a9204
cmp qword [0x1403b76e0], 0
je 0x1400a9958
lea rcx, [0x140333e72]
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.1400ebdd0
jmp 0x1400a995a
xor eax, eax
mov qword [0x1403b76f0], rax
lea rcx, [0x1403b76f8]
call fcn.1401b9e98
jmp 0x1400a9204
call fcn.1401d3c50
int3