Function at 0x140039460
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movdqa xmmword [rsp + 0x300], xmm6
mov r15, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea rdx, [rsp + 0x2d8]
movdqu xmmword [rdx + 0x10], xmm0
mov word [rdx], 0
mov rcx, qword [rcx]
call fcn.14003f070
mov rsi, qword [r15]
mov rbp, qword [rsi + 0x90]
mov rdi, qword [rsi + 0x98]
cmp rbp, rdi
je 0x140039534
lea rsi, [rsp + 0x180]
lea r14, [rsp + 0xb0]
lea rbx, [rsp + 0x2d8]
cmp qword [rbp + 0x18], 0xf
mov rax, rbp
jbe 0x1400394f6
mov rax, qword [rbp]
mov qword [rsp + 0xb0], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0xb8], rax
mov rcx, rsi
mov rdx, r14
call fcn.14000bcd0
mov rcx, rsi
mov rdx, rbx
call fcn.14003f070
mov rcx, rsi
call fcn.140001450
add rbp, 0x20
cmp rdi, rbp
jne 0x1400394e8
mov rsi, qword [r15]
cmp qword [rsi + 0x30], 0
je 0x1400395ac
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x20
mov byte [rdi], 0
lea rdx, str.database
mov r8d, 8
mov rcx, rdi
call fcn.1400012d0
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14003a9d0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14003f070
mov rcx, rbx
call fcn.140001450
mov rcx, rdi
call fcn.140001260
mov rsi, qword [r15]
cmp qword [rsi + 0x50], 0
je 0x140039624
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0xc0]
movdqu xmmword [rdi + 0x10], xmm0
add rsi, 0x40
mov byte [rdi], 0
lea rdx, str.metrics_dir
mov r8d, 0xb
mov rcx, rdi
call fcn.1400012d0
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14003a9d0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14003f070
mov rcx, rbx
call fcn.140001450
mov rcx, rdi
call fcn.140001260
mov rsi, qword [r15]
mov rax, qword [rsi + 0x70]
test rax, rax
mov qword [rsp + 0x58], r15
je 0x1400396db
cmp qword [rsi + 0x78], 0xf
jbe 0x140039643
mov rsi, qword [rsi + 0x60]
jmp 0x140039647
add rsi, 0x60
lea rdx, [rsp + 0xa0]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.14000bcd0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x130]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, [0x14006a9f6]
mov r8d, 3
mov rcx, rdi
call fcn.1400012d0
lea rbx, [rsp + 0x180]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14003a9d0
lea rdx, [rsp + 0x2d8]
mov rcx, rbx
call fcn.14003f070
mov rcx, rbx
call fcn.140001450
mov rcx, rdi
call fcn.140001260
mov rcx, rsi
call fcn.140001450
mov rsi, qword [r15]
mov r15, qword [rsi + 0x80]
mov r12, qword [r15]
mov qword [rsp + 0x60], r12
cmp r12, r15
je 0x14003987f
mov r14d, 0xf
movq xmm6, r14
pslldq xmm6, 8
xor r13d, r13d
lea rdi, [rsp + 0x2b0]
lea rsi, [rsp + 0xc0]
lea rbx, [rsp + 0x290]
lea rbp, [rsp + 0x180]
movdqu xmmword [rsp + 0x2c0], xmm6
mov byte [rsp + 0x2b0], r13b
mov rdx, qword [r12 + 0x30]
inc rdx
mov rcx, rdi
call fcn.14000cd30
mov r8, qword [r12 + 0x30]
cmp qword [r12 + 0x38], r14
jbe 0x14003975a
mov rdx, qword [r12 + 0x20]
jmp 0x14003975f
lea rdx, [r12 + 0x20]
mov rcx, rdi
call fcn.1400343b0
mov dl, 0x3d
mov rcx, rdi
call fcn.140036e00
mov r8, qword [r12 + 0x50]
cmp qword [r12 + 0x58], r14
jbe 0x140039784
mov r12, qword [r12 + 0x40]
jmp 0x140039788
add r12, 0x40
mov rcx, rdi
mov rdx, r12
call fcn.1400343b0
movdqu xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x130], xmm0
movdqu xmmword [rax + 0x10], xmm6
mov byte [rax], r13b
mov rax, qword [rsp + 0x140]
cmp qword [rsp + 0x148], r14
lea rcx, [rsp + 0x130]
jbe 0x1400397d6
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov rcx, rsi
lea rdx, [rsp + 0x90]
call fcn.14000bcd0
movdqu xmmword [rsp + 0x2a0], xmm6
mov byte [rsp + 0x290], r13b
mov r8d, 0xa
mov rcx, rbx
lea rdx, str.annotation
call fcn.1400012d0
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call fcn.14003a9d0
mov rcx, rbp
lea rdx, [rsp + 0x2d8]
call fcn.14003f070
mov rcx, rbp
call fcn.140001450
mov rcx, rbx
call fcn.140001260
mov rcx, rsi
call fcn.140001450
lea rcx, [rsp + 0x130]
call fcn.140001260
mov rcx, rdi
call fcn.140001260
lea rcx, [rsp + 0x60]
call fcn.140034360
mov r12, qword [rsp + 0x60]
cmp r12, r15
jne 0x140039726
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1f0fff
mov edx, 1
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400399a5
mov r15, qword [rsp + 0x58]
mov rcx, qword [r15]
mov rcx, qword [rcx + 0xc8]
mov r9, qword [0x140081328]
mov r8, qword [0x140081320]
mov rdx, qword [0x140081318]
lea rbp, [0x140085070]
mov qword [rsp + 0x40], rbp
lea rbp, [0x140085060]
mov qword [rsp + 0x38], rbp
lea rbp, [0x140085050]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x130]
mov rcx, rdi
call fcn.14003f180
lea rsi, [rsp + 0x2b0]
mov rcx, rdi
mov rdx, rsi
call fcn.14003f1b0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x290]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, str.__initial_client_data
mov r8d, 0x16
mov rcx, rdi
call fcn.1400012d0
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov r9, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov rdx, rcx
sub rdx, r9
cmp r8, rdx
jbe 0x140039a0d
mov rdx, rax
sub rdx, r8
cmp rdx, r9
jb 0x140039a0d
cmp rcx, 0xf
jbe 0x14003998e
mov rdi, qword [rsp + 0x290]
lea rcx, [rsp + 0x2b0]
xor edx, edx
mov r8, rdi
call fcn.14003a720
jmp 0x140039a2b
mov ecx, 2
call fcn.14001a340
xor ebx, ebx
test al, al
mov r15, qword [rsp + 0x58]
je 0x14003a020
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x180
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, [0x14006aa05]
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
xor ebx, ebx
jmp 0x14003a020
cmp rax, 0xf
jbe 0x140039a1b
mov rsi, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x290]
mov rdx, rsi
call fcn.1400343b0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x10], xmm0
mov byte [rax], 0
lea rsi, [rsp + 0xc0]
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
jbe 0x140039a77
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x180]
mov rcx, rdi
call fcn.14000bcd0
lea rbx, [rsp + 0x2d8]
mov rcx, rdi
mov rdx, rbx
call fcn.14003f070
mov rcx, rdi
call fcn.140001450
mov rcx, rsi
call fcn.140001260
lea r14, [rsp + 0x290]
mov rcx, r14
call fcn.140001260
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.140001260
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xf0], xmm6
movdqa xmmword [rsp + 0x120], xmm6
movdqa xmmword [rsp + 0x110], xmm6
movdqa xmmword [rsp + 0x100], xmm6
movdqa xmmword [rsp + 0xe0], xmm6
movdqa xmmword [rsp + 0xd0], xmm6
movdqa xmmword [rsp + 0xc0], xmm6
mov dword [rsp + 0xfc], 0x100
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov qword [rsp + 0x110], rax
mov ecx, 0xfffffff5
call rdi
mov qword [rsp + 0x118], rax
mov ecx, 0xfffffff4
call rdi
mov qword [rsp + 0x120], rax
xor eax, eax
mov qword [rsi + 0x10], rax
movdqa xmmword [rsi], xmm6
mov qword [rsp + 0x70], rax
mov eax, dword [0x1400850b0]
mov ecx, dword [0x140085118]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003a138
mov eax, dword [0x1400850c0]
mov ecx, dword [0x140085118]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003a181
mov rbp, qword [0x1400850a8]
test rbp, rbp
je 0x140039c4a
mov rax, qword [0x1400850b8]
test rax, rax
je 0x140039c4a
mov dword [rsp + 0xc0], 0x70
lea r9, [rsp + 0x290]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call rbp
test eax, eax
je 0x140039e52
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140039ff8
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b1
mov r9d, 2
mov rcx, rsi
call fcn.14001a3f0
lea rcx, [rsp + 0x188]
lea rdx, str.InitializeProcThreadAttributeList__size__succeeded__expected_failure
call fcn.140003420
mov rcx, rsi
call fcn.14001a880
jmp 0x140039ff8
mov dword [rsp + 0xc0], 0x68
xor edi, edi
xor eax, eax
cmp qword [rsp + 0x2f0], 7
jbe 0x140039c6c
mov rbx, qword [rsp + 0x2d8]
mov rcx, qword [r15]
cmp qword [rcx + 0x18], 8
jb 0x140039c79
mov rcx, qword [rcx]
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x40], rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140039def
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14001a340
test esi, esi
jne 0x140039d22
test al, al
je 0x140039d22
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f0
mov r9d, 1
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_thread
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov ecx, 1
call fcn.14001a340
test esi, esi
jne 0x140039d8c
test al, al
je 0x140039d8c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1f3
mov r9d, 1
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.CloseHandle_process
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
mov ecx, 0xc8
add rcx, qword [r15]
lea rsi, [rsp + 0x180]
mov qword [rsi], 0xffffffffffffffff
mov rdx, rsi
call fcn.14003a6e0
pxor xmm0, xmm0
movdqu xmmword [rsi + 0x14], xmm0
movdqu xmmword [rsi + 4], xmm0
mov dword [rsi], 2
lea r8, [rsp + 0x60]
mov dword [r8 + 8], 0
mov qword [r8], 0
mov ecx, 0xa8
add rcx, qword [r15]
lea rdx, [rsp + 0x180]
call fcn.14003eb60
mov ebx, eax
jmp 0x140039ffc
mov ecx, 2
call fcn.14001a340
xor ebx, ebx
test al, al
je 0x140039ffc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1eb
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.CreateProcess
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
xor ebx, ebx
jmp 0x140039ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140039fa2
lea rsi, [rsp + 0x290]
mov rcx, qword [rsi]
call fcn.1400418b0
mov rdi, rax
mov qword [rsp + 0x128], rax
mov edx, 1
xor r8d, r8d
mov rcx, rax
mov r9, rsi
call qword [0x1400850a8]
test eax, eax
je 0x14003a094
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14003ac30
mov rax, qword [rsp + 0x128]
mov qword [rsi], rax
mov rax, qword [rsp + 0x2c0]
sub rax, qword [rsp + 0x2b0]
sar rax, 3
cmp rax, 7
ja 0x140039edc
lea rcx, [rsp + 0x2b0]
mov edx, 8
call fcn.14003acc0
lea rdx, [0x140081318]
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.140038aa0
lea rdx, [0x140081320]
mov rcx, rsi
call fcn.140038aa0
lea rdx, [0x140081328]
mov rcx, rsi
call fcn.140038aa0
mov edx, 0xc8
add rdx, qword [r15]
mov rcx, rsi
call fcn.140038aa0
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.140038aa0
mov rdx, qword [rsp + 0x110]
mov rcx, rsi
call fcn.14003abb0
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
call fcn.14003abb0
mov rdx, qword [rsp + 0x120]
mov rcx, rsi
call fcn.14003abb0
mov r9, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, r9
mov rcx, qword [rsp + 0x128]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x20002
call qword [0x1400850b8]
test eax, eax
je 0x14003a0e6
mov eax, CoAddRefServerProcess
jmp 0x140039c59
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140039ff8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1b5
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList__size_
call fcn.140003420
mov rcx, rsi
call fcn.14001b9f0
xor ebx, ebx
xor edi, edi
lea rcx, [rsp + 0x70]
call fcn.14003ac30
test rdi, rdi
je 0x14003a013
mov rcx, rdi
call fcn.140042540
lea rcx, [rsp + 0x2b0]
call fcn.140038a30
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14003a03e
call fcn.14003ea80
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x2d8]
call fcn.140001450
cmp bl, 1
mov eax, 1
adc rax, 0
xchg qword [0x1400850a0], rax
mov rcx, r15
call fcn.14003a910
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.140041210
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140039e4b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1c0
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.InitializeProcThreadAttributeList
jmp 0x140039e3e
mov ecx, 2
call fcn.14001a340
test al, al
je 0x140039e4b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x180]
mov r8d, 0x1da
mov r9d, 2
mov rcx, rsi
call fcn.14001b8b0
lea rcx, [rsp + 0x190]
lea rdx, str.UpdateProcThreadAttribute
jmp 0x140039e3e
lea rcx, [0x1400850b0]
call fcn.140041470
mov eax, dword [0x1400850b0]
cmp eax, 0xffffffff
jne 0x140039b8c
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeProcThreadAttributeList
xor r8d, r8d
call fcn.14003f250
mov qword [0x1400850a8], rax
lea rcx, [0x1400850b0]
call fcn.140041410
jmp 0x140039b8c
lea rcx, [0x1400850c0]
call fcn.140041470
mov eax, dword [0x1400850c0]
cmp eax, 0xffffffff
jne 0x140039bb1
cmp qword [0x1400850a8], 0
je 0x14003a1be
lea rcx, str.kernel32.dll
lea rdx, str.::UpdateProcThreadAttribute
xor r8d, r8d
call fcn.14003f250
jmp 0x14003a1c0
xor eax, eax
mov qword [0x1400850b8], rax
lea rcx, [0x1400850c0]
call fcn.140041410
jmp 0x140039bb1