Function at 0x14005c4f0
Capabilities:
Create process on windows
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
movaps xmmword [rsp + 0x2f0], xmm6
mov r12, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x14005daf6
xorps xmm0, xmm0
lea rdx, [rsp + 0x2d0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, qword [r12]
call fcn.14013d190
mov r8, qword [r12]
mov rsi, qword [r8 + 0x78]
mov r15, qword [r8 + 0x80]
cmp rsi, r15
je 0x14005c620
lea rdi, [rsp + 0x108]
lea rbx, [rsp + 0x2c0]
lea r14, [rsp + 0x2d0]
jmp 0x14005c5f3
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rax
mov rcx, rsi
test rcx, rcx
jne 0x14005c5bd
test rax, rax
jne 0x14005dae7
mov rcx, rdi
mov rdx, rbx
call fcn.140172cd0
mov rcx, rdi
mov rdx, r14
call fcn.14013d190
cmp byte [rsp + 0x11f], 0
jns 0x14005c5ea
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
add rsi, 0x18
cmp rsi, r15
je 0x14005c61c
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14005c59c
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x2c0], rcx
mov qword [rsp + 0x2c8], rax
test rax, rax
jns 0x14005c5af
jmp 0x14005daea
mov r8, qword [r12]
movzx eax, byte [r8 + 0x2f]
test al, al
jns 0x14005c62d
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x14005c6ca
lea rcx, [rsp + 0x80]
mov byte [rcx + 0x17], 8
lea rax, str.database
cmp rcx, rax
ja 0x14005c65f
lea rcx, [rsp + 0x88]
cmp rcx, rax
ja 0x14005db02
add r8, 0x18
movabs rax, 0x6573616261746164
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov byte [rdx + 8], 0
lea rsi, [rsp + 0x108]
mov rcx, rsi
call fcn.140069bc0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.14013d190
cmp byte [rsi + 0x17], 0
jns 0x14005c6af
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005c6c6
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
mov r8, qword [r12]
movzx eax, byte [r8 + 0x47]
test al, al
jns 0x14005c6d7
mov rax, qword [r8 + 0x38]
test rax, rax
je 0x14005c77a
lea rcx, [rsp + 0x80]
mov byte [rcx + 0x17], 0xb
lea rax, str.metrics_dir
cmp rcx, rax
ja 0x14005c709
lea rcx, [rsp + 0x8b]
cmp rcx, rax
ja 0x14005db05
add r8, 0x30
mov eax, dword [0x1402b39b0]
lea rdx, [rsp + 0x80]
mov dword [rdx + 7], eax
mov rax, qword [str.metrics_dir]
mov qword [rdx], rax
mov byte [rdx + 0xb], 0
lea rsi, [rsp + 0x108]
mov rcx, rsi
call fcn.140069bc0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.14013d190
cmp byte [rsi + 0x17], 0
jns 0x14005c75f
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005c776
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
mov r8, qword [r12]
movzx eax, byte [r8 + 0x5f]
test al, al
mov qword [rsp + 0x58], r12
js 0x14005c8e4
test rax, rax
je 0x14005c87c
add r8, 0x48
mov qword [rsp + 0x2b0], r8
mov qword [rsp + 0x2b8], rax
test r8, r8
je 0x14005daf9
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2b0]
call fcn.140172cd0
lea rcx, [rsp + 0x290]
mov byte [rcx + 0x17], 3
lea rax, [0x1402a4870]
cmp rcx, rax
ja 0x14005c7f0
lea rcx, [rsp + 0x293]
cmp rcx, rax
ja 0x14005db08
mov al, byte [0x1402a4872]
lea rdx, [rsp + 0x290]
mov byte [rdx + 2], al
movzx eax, word [0x1402a4870]
mov word [rdx], ax
mov byte [rdx + 3], 0
lea rsi, [rsp + 0x108]
lea r8, [rsp + 0x80]
mov rcx, rsi
call fcn.140069bc0
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call fcn.14013d190
cmp byte [rsi + 0x17], 0
jns 0x14005c84a
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x2a7], 0
jns 0x14005c861
mov rcx, qword [rsp + 0x290]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005c878
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
mov r8, qword [r12]
mov rdi, qword [r8 + 0x60]
lea rax, [r8 + 0x68]
mov qword [rsp + 0x60], rax
cmp rdi, rax
je 0x14005cba6
movabs r8, 0x7ffffffffffffff8
lea rax, str.annotation
lea rcx, [rsp + 0x248]
cmp rcx, rax
seta cl
lea rdx, [rsp + 0x252]
cmp rdx, rax
setbe r14b
or r14b, cl
lea rax, [r8 - 1]
mov qword [rsp + 0x68], rax
xorps xmm6, xmm6
lea rbx, [rsp + 0x260]
lea r13, [rsp + 0x80]
jmp 0x14005cb77
mov rax, qword [r8 + 0x50]
test rax, rax
je 0x14005c87c
mov r8, qword [r8 + 0x48]
mov qword [rsp + 0x2b0], r8
mov qword [rsp + 0x2b8], rax
jns 0x14005c7a9
jmp 0x14005db0b
mov rsi, rbx
mov rax, r15
and rax, 0xfffffffffffffff8
add rax, 8
mov byte [rsp + 0x70], r14b
mov r14, r15
or r14, 7
cmp r14, 0x17
cmove r14, rax
inc r14
mov rcx, r14
call fcn.1401cbbc4
mov rbx, rax
movabs rax, 0x7ffffffffffffff8
add rax, 8
or rax, r14
mov r14b, byte [rsp + 0x70]
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x268], r15
jmp 0x14005c9a4
mov rbp, qword [rdi + 0x28]
lea r15, [rbp + 1]
cmp r15, qword [rsp + 0x68]
ja 0x14005daed
cmp r15, 0x16
ja 0x14005c90c
movaps xmmword [rsp + 0x260], xmm6
mov qword [rsp + 0x270], 0
mov byte [rsp + 0x277], r15b
mov rsi, rbx
lea rdx, [rdi + 0x20]
test r12b, r12b
jns 0x14005c9b0
mov rdx, qword [rdx]
cmp rdx, rbx
jb 0x14005c9c2
lea rax, [rbx + rbp]
cmp rax, rdx
ja 0x14005dafc
test rbp, rbp
je 0x14005c9d2
mov rcx, rbx
mov r8, rbp
call fcn.1401d0030
mov word [rbx + rbp], 0x3d
movzx r8d, byte [rdi + 0x4f]
test r8b, r8b
js 0x14005c9ec
lea rdx, [rdi + 0x38]
and r8d, 0x7f
jmp 0x14005c9f4
mov r8, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x38]
mov rbx, rsi
mov rcx, rsi
call fcn.140005e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2a0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x290], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx ecx, byte [rsp + 0x2a7]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x290]
lea rdx, [rsp + 0x290]
cmovns rcx, rdx
mov qword [rsp + 0x280], rcx
mov qword [rsp + 0x288], rax
test rax, rax
js 0x14005daf0
test rcx, rcx
jne 0x14005ca74
test rax, rax
jne 0x14005daff
mov rcx, r13
lea rdx, [rsp + 0x280]
call fcn.140172cd0
mov byte [rsp + 0x25f], 0xa
test r14b, r14b
je 0x14005daf3
movzx eax, word [0x1402b39bd]
mov word [rsp + 0x250], ax
mov rax, qword [str.annotation]
mov qword [rsp + 0x248], rax
mov byte [rsp + 0x252], 0
lea r15, [rsp + 0x108]
mov rcx, r15
lea rdx, [rsp + 0x248]
mov r8, r13
call fcn.140069bc0
mov rcx, r15
lea rdx, [rsp + 0x2d0]
call fcn.14013d190
cmp byte [rsp + 0x11f], 0
jns 0x14005cafd
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x25f], 0
jns 0x14005cb14
mov rcx, qword [rsp + 0x248]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005cb2b
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
cmp byte [rsp + 0x2a7], 0
jns 0x14005cb42
mov rcx, qword [rsp + 0x290]
call fcn.1401cbbbc
cmp byte [rsp + 0x277], 0
jns 0x14005cb59
mov rcx, qword [rsp + 0x260]
call fcn.1401cbbbc
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005cb90
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14005cb62
mov rdi, rax
cmp rax, qword [rsp + 0x60]
je 0x14005cb9e
movzx r12d, byte [rdi + 0x37]
test r12b, r12b
js 0x14005c96c
mov ebp, r12d
and ebp, 0x7f
jmp 0x14005c970
mov rax, qword [rdi + 0x10]
cmp qword [rax], rdi
mov rdi, rax
jne 0x14005cb90
jmp 0x14005cb6d
mov rax, qword [rsp + 0x58]
mov r8, qword [rax]
mov rdi, qword [r8 + 0x90]
mov rsi, qword [r8 + 0x98]
cmp rdi, rsi
je 0x14005cc82
lea rax, [0x1402b39c0]
lea rbx, [rsp + 0x80]
cmp rbx, rax
seta cl
lea rdx, [rsp + 0x8a]
cmp rdx, rax
setbe bpl
or bpl, cl
lea r14, [rsp + 0x108]
lea r15, [rsp + 0x2d0]
jmp 0x14005cc0c
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
add rdi, 0x18
cmp rdi, rsi
je 0x14005cc82
mov byte [rsp + 0x97], 0xa
test bpl, bpl
je 0x14005dae4
movzx eax, word [0x1402b39c8]
mov word [rsp + 0x88], ax
mov rax, qword [0x1402b39c0]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x8a], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140069bc0
mov rcx, r14
mov rdx, r15
call fcn.14013d190
cmp byte [rsp + 0x11f], 0
jns 0x14005cc73
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005cc03
jmp 0x14005cbf6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, qword [rsp + 0x58]
jne 0x14005cd5d
mov r14d, 2
cmp dword [0x1402e5a28], 2
jg 0x14005cd07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1a6
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, [0x1402b615e]
mov r8d, 0xb
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
xor ebp, ebp
cmp byte [rsp + 0x2e7], 0
jns 0x14005cd20
mov rcx, qword [rsp + 0x2d0]
call fcn.1401cbbbc
mov qword [0x1402e6100], r14
mov rcx, rbx
call fcn.140069a60
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2f0]
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, rax
mov rax, qword [rbx]
mov rax, qword [rax + 0xc8]
mov rcx, qword [0x1402daa60]
mov r9, qword [0x1402daa50]
mov r8, qword [0x1402daa48]
movsxd rdx, edi
cmp rdx, rdi
jne 0x14005db11
mov edx, edi
movsxd r10, eax
cmp r10, rax
jne 0x14005db19
movsxd r10, ecx
cmp r10, rcx
jne 0x14005db21
movsxd r10, r9d
cmp r10, r9
jne 0x14005db29
movsxd r10, r8d
cmp r10, r8
jne 0x14005db32
lea r10, [0x1402e60d0]
mov qword [rsp + 0x48], r10
lea r10, [0x1402e60c4]
mov qword [rsp + 0x40], r10
lea r10, [0x1402e60b8]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.0x_x_0x_x_0x_x_0x_x_0x_x_0x_llx_0x_llx_0x_llx
lea rsi, [rsp + 0x290]
mov rcx, rsi
call fcn.140172990
lea rcx, [rsp + 0x260]
mov byte [rcx + 0x17], 0x16
lea rax, str.__initial_client_data
cmp rcx, rax
ja 0x14005ce2d
lea rcx, [rsp + 0x276]
cmp rcx, rax
ja 0x14005db3b
movups xmm0, xmmword [str.__initial_client_data]
lea r15, [rsp + 0x260]
movaps xmmword [r15], xmm0
movabs rax, 0x3d617461642d746e
mov qword [r15 + 0xe], rax
movzx eax, byte [rsp + 0x2a7]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0x298]
mov byte [r15 + 0x16], 0
cmovs rsi, qword [rsp + 0x290]
mov rcx, r15
mov rdx, rsi
call fcn.140005e90
mov rcx, qword [rax + 0x10]
lea r14, [rsp + 0x80]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [r14], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx ecx, byte [r14 + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [r14 + 8]
mov rcx, qword [r14]
cmovns rcx, r14
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x100], rax
test rax, rax
js 0x14005db0e
test rcx, rcx
jne 0x14005cee5
test rax, rax
jne 0x14005db3e
lea r13, [rsp + 0x108]
lea rdx, [rsp + 0xf8]
mov rcx, r13
call fcn.140172cd0
lea r12, [rsp + 0x2d0]
mov rcx, r13
mov rdx, r12
call fcn.14013d190
cmp byte [r13 + 0x17], 0
jns 0x14005cf24
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x97], 0
jns 0x14005cf3b
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
cmp byte [rsp + 0x277], 0
jns 0x14005cf52
mov rcx, qword [rsp + 0x260]
call fcn.1401cbbbc
cmp byte [rsp + 0x2a7], 0
jns 0x14005cf69
mov rcx, qword [rsp + 0x290]
call fcn.1401cbbbc
xorps xmm6, xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0xbc], 0x100
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0xd8], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0x290], xmm6
mov qword [rsp + 0x2a0], 0
mov eax, dword [0x1402e6110]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da2c
mov eax, dword [0x1402e6120]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005da83
mov rax, qword [0x1402e6108]
movabs rcx, 0xaaaaaaaaaaaaaaaa
test rax, rax
je 0x14005d1c2
cmp qword [0x1402e6118], 0
je 0x14005d1c2
mov dword [rsp + 0x80], 0x70
lea r9, [rsp + 0x260]
mov qword [r9], rcx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [0x1402f5008]
test eax, eax
je 0x14005d461
cmp dword [0x1402e5a28], 2
jg 0x14005d0e5
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1d7
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x118]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
mov r8d, 0x44
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
xor r12d, r12d
xor r15d, r15d
mov rbx, qword [rsp + 0x58]
mov r14d, 2
xor ebp, ebp
test r12, r12
je 0x14005d17c
mov eax, dword [0x1402e6130]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14005d16c
lea rcx, [0x1402e6130]
call fcn.1401cc16c
cmp dword [0x1402e6130], 0xffffffff
jne 0x14005d16c
lea rcx, [0x1402a4d98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14005db41
lea rdx, [0x1402b62bd]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e6128], rax
lea rcx, [0x1402e6130]
call fcn.1401cc1d4
mov rax, qword [0x1402e6128]
mov rcx, r12
call qword [0x1402f5008]
test r15, r15
je 0x14005d189
mov rcx, r15
call fcn.1401cbf84
mov rcx, qword [rsp + 0x290]
test rcx, rcx
je 0x14005d1ac
mov rax, qword [rsp + 0x298]
cmp rax, rcx
jne 0x14005d977
call fcn.1401cbbbc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14005cd09
jmp 0x14005db4b
mov dword [rsp + 0x80], 0x68
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
js 0x14005d348
cmp r8b, 0xc
jae 0x14005d356
mov qword [rsp + 0x270], rcx
movaps xmm0, xmmword [0x14029ca60]
movaps xmmword [rsp + 0x260], xmm0
cmp byte [rsp + 0x2e7], 0
jns 0x14005d228
mov r12, qword [rsp + 0x2d0]
jmp 0x14005d230
lea r12, [rsp + 0x2d0]
mov rbx, qword [rsp + 0x58]
cmp byte [rdx + 0x17], 0
jns 0x14005d23e
mov rdx, qword [rdx]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rcx, rdx
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14005d3f0
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402e5a28], 1
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jg 0x14005d2a8
cmp dword [0x1402da9cc], 0
je 0x14005d2a8
test eax, eax
je 0x14005d984
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1402e5a28], 1
jg 0x14005d2d0
cmp dword [0x1402da9cc], 0
je 0x14005d2d0
test eax, eax
je 0x14005d9d8
mov rsi, qword [rbx]
mov rcx, qword [rsi + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x14005d2ed
call fcn.140025530
test al, al
je 0x14005db48
mov qword [rsi + 0xc8], 0xffffffffffffffff
xorps xmm0, xmm0
lea rdx, [rsp + 0x108]
movups xmmword [rdx + 0x14], xmm0
movups xmmword [rdx + 4], xmm0
mov dword [rdx], 2
lea r8, [rsp + 0x248]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [rbx]
call fcn.1400510b0
mov ebp, eax
movzx eax, al
mov r14d, 2
sub r14, rax
jmp 0x14005d0f8
mov r8, qword [rdx + 8]
cmp r8, 0xc
jb 0x14005d1fd
add r8, 0xfffffffffffffff4
mov qword [rsp + 0x20], r15
mov rcx, r13
mov r9, 0xffffffffffffffff
call fcn.14001e050
cmp byte [rsp + 0x11f], 0
jns 0x14005d380
mov r13, qword [rsp + 0x108]
lea rdx, str.rundll32.exe
mov rcx, r13
call fcn.1401e906c
mov esi, eax
cmp byte [rsp + 0x11f], 0
jns 0x14005d3a8
mov rcx, qword [rsp + 0x108]
call fcn.1401cbbbc
cmp byte [rsp + 0x2e7], 0
mov rbx, qword [rsp + 0x58]
jns 0x14005d3bf
mov r12, qword [rsp + 0x2d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
movaps xmm0, xmmword [0x14029ca60]
movaps xmmword [rsp + 0x260], xmm0
test esi, esi
je 0x14005d970
mov rdx, qword [rbx]
jmp 0x14005d235
mov r14d, 2
cmp dword [0x1402e5a28], 2
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jg 0x14005d0f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x222
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, str.CreateProcess
mov r8d, 0xd
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
jmp 0x14005d0f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14005d4cd
cmp dword [0x1402e5a28], 2
jg 0x14005d0e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1db
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, str.InitializeProcThreadAttributeList__size_
mov r8d, 0x28
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
jmp 0x14005d0e5
lea rsi, [rsp + 0x260]
mov rcx, qword [rsi]
call fcn.1401cbf8c
mov rcx, rax
mov qword [rsp + 0xe8], rax
mov rax, qword [0x1402e6108]
mov qword [rsp + 0x60], rcx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [0x1402f5008]
test eax, eax
je 0x14005d8dd
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov ecx, 0x40
call fcn.1401cbbc4
mov rbp, rax
add rax, 0x40
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x2a0], rax
test rbp, rbp
je 0x14005d95a
mov rax, qword [0x1402daa48]
mov qword [rbp], rax
mov rax, rbp
add rax, 8
mov qword [rsp + 0x298], rax
je 0x14005d95d
mov rax, qword [0x1402daa50]
mov qword [rbp + 8], rax
cmp rbp, 0xfffffffffffffff0
je 0x14005d960
mov rax, qword [0x1402daa60]
mov qword [rbp + 0x10], rax
lea rsi, [rbp + 0x18]
mov qword [rsp + 0x298], rsi
mov rax, qword [rsp + 0x58]
mov r9, qword [rax]
mov rax, qword [rsp + 0x2a0]
cmp rsi, rax
jb 0x14005d6ac
mov r8, qword [rsp + 0x290]
mov rbx, rsi
sub rbx, r8
sar rbx, 3
lea rdx, [rbx + 1]
mov rcx, rdx
shr rcx, 0x3d
jne 0x14005dba4
movabs rcx, 0x1fffffffffffffff
sub rax, r8
mov rbp, rax
sar rbp, 2
cmp rbp, rdx
cmovbe rbp, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae rbp, rcx
test rbp, rbp
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
je 0x14005dba7
cmp rbp, rcx
ja 0x14005dbae
lea rcx, [rbp*8]
call fcn.1401cbbc4
shl rbx, 3
add rbx, rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
je 0x14005dbb1
lea rax, [rax + rbp*8]
mov rcx, qword [rcx + 0xc8]
mov qword [rbx], rcx
lea rbp, [rbx + 8]
cmp rsi, rdx
je 0x14005d94f
mov rcx, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
mov qword [rbx - 8], rcx
add rbx, 0xfffffffffffffff8
cmp rsi, rdx
jne 0x14005d653
mov rcx, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rax
cmp rsi, rcx
je 0x14005d6a0
add rsi, 0xfffffffffffffff8
jne 0x14005d690
jmp 0x14005db9e
test rcx, rcx
je 0x14005d6c4
call fcn.1401cbbbc
jmp 0x14005d6c4
test rsi, rsi
je 0x14005d963
mov rax, qword [r9 + 0xc8]
mov qword [rbp + 0x18], rax
add rbp, 0x20
mov qword [rsp + 0x298], rbp
mov rax, qword [rsp + 0x2a0]
cmp rbp, rax
jb 0x14005d7cf
mov r8, qword [rsp + 0x290]
mov rsi, rbp
sub rsi, r8
sar rsi, 3
lea rdx, [rsi + 1]
mov rcx, rdx
shr rcx, 0x3d
jne 0x14005dbb4
movabs rcx, 0x1fffffffffffffff
sub rax, r8
mov rbx, rax
sar rbx, 2
cmp rbx, rdx
cmovbe rbx, rdx
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
cmovae rbx, rcx
test rbx, rbx
mov qword [rsp + 0x70], r8
je 0x14005d969
cmp rbx, rcx
ja 0x14005dbb7
lea rcx, [rbx*8]
call fcn.1401cbbc4
shl rsi, 3
add rsi, rax
mov rdx, qword [rsp + 0x70]
je 0x14005dbba
lea rax, [rax + rbx*8]
mov qword [rsi], rdi
lea rbx, [rsi + 8]
cmp rbp, rdx
je 0x14005d947
mov rcx, qword [rbp - 8]
add rbp, 0xfffffffffffffff8
mov qword [rsi - 8], rcx
add rsi, 0xfffffffffffffff8
cmp rbp, rdx
jne 0x14005d776
mov rcx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x298]
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rbx
mov qword [rsp + 0x2a0], rax
cmp rbp, rcx
je 0x14005d7c3
add rbp, 0xfffffffffffffff8
jne 0x14005d7b3
jmp 0x14005dba1
test rcx, rcx
je 0x14005d7e3
call fcn.1401cbbbc
jmp 0x14005d7e3
test rbp, rbp
je 0x14005d966
mov qword [rbp], rdi
add rbp, 8
mov rbx, rbp
lea rsi, [rsp + 0x290]
mov qword [rsi + 8], rbx
mov rdx, qword [rsp + 0xd0]
mov rcx, rsi
call fcn.14012ffc0
mov rdx, qword [rsp + 0xd8]
mov rcx, rsi
call fcn.14012ffc0
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.14012ffc0
mov r9, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r9
je 0x14005d957
mov rax, qword [0x1402e6118]
mov rcx, qword [rsp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdx
mov r8d, 0x20002
xor edx, edx
call qword [0x1402f5008]
test eax, eax
movabs rcx, 0xaaaaaaaaaaaaaaaa
je 0x14005d871
mov ebp, 0x80000
jmp 0x14005d1dd
cmp dword [0x1402e5a28], 2
jg 0x14005d8c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x200
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, [0x1402b6251]
mov r8d, 0x19
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jmp 0x14005d0f0
cmp dword [0x1402e5a28], 2
jg 0x14005d935
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x1e6
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, [0x1402b622f]
mov r8d, 0x21
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
xor r12d, r12d
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
jmp 0x14005d0f0
mov rcx, rbp
jmp 0x14005d79b
mov rcx, rsi
jmp 0x14005d678
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x14005d750
xor edx, edx
jmp 0x14005d23e
add rax, 0xfffffffffffffff8
jne 0x14005d19e
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 1
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, str.CloseHandle_thread
mov r8d, 0x12
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
jmp 0x14005d2a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r8d, 0x22a
mov r9d, 1
call fcn.14023ca20
lea rcx, [rsp + 0x118]
lea rdx, str.CloseHandle_process
mov r8d, 0x13
call fcn.140206b20
mov rcx, rsi
call fcn.14023caa0
jmp 0x14005d2d0
lea rcx, [0x1402e6110]
call fcn.1401cc16c
cmp dword [0x1402e6110], 0xffffffff
jne 0x14005d01c
lea rcx, [0x1402a4d98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14005da7f
lea rdx, [0x1402b6183]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e6108], rax
lea rcx, [0x1402e6110]
call fcn.1401cc1d4
jmp 0x14005d01c
xor eax, eax
jmp 0x14005da67
lea rcx, [0x1402e6120]
call fcn.1401cc16c
cmp dword [0x1402e6120], 0xffffffff
jne 0x14005d041
cmp qword [0x1402e6108], 0
je 0x14005dae0
lea rcx, [0x1402a4d98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14005dae0
lea rdx, [0x1402b61a7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e6118], rax
lea rcx, [0x1402e6120]
call fcn.1401cc1d4
jmp 0x14005d041
xor eax, eax
jmp 0x14005dac8
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor eax, eax
jmp 0x14005d159
int3
lea rdx, str.Free
lea r8, str.scoped_handle.cc
lea rsi, [rsp + 0x108]
mov rcx, rsi
mov r9d, 0x1e
call fcn.140158eb0
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, rsi
call fcn.14023e730
lea rdx, [0x1402b7b74]
mov rcx, rdi
call fcn.1402586d0
mov rcx, rdi
call fcn.14023e760
jmp 0x14005cd09
int3
int3
int3
xor eax, eax
jmp 0x14005d621
int3
int3
int3
int3
int3