Function at 0x14003c830
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov edi, 0x80070057
cmp ecx, 2
jl 0x14003cad8
mov rsi, rdx
cmp qword [rdx + 8], 0
je 0x14003cad8
mov ebx, ecx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003c996
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c99d
mov rcx, qword [rsi + 8]
lea rdx, str.unregister_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003ca41
mov rcx, qword [rsi + 8]
lea rdx, str.debug_remote_disabled
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003d077
lea rcx, [0x1400a0413]
lea rdx, str.DisableDefaultBrowserAgent
call fcn.140031fb0
mov edi, 0x800704ec
test al, al
jne 0x14003ca5d
mov rcx, qword [rsi + 8]
lea rdx, [0x1400a24ea]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cb06
mov rcx, qword [rsi + 8]
lea rdx, str.update_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cb7f
mov rcx, qword [rsi + 8]
lea rdx, str.do_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cd94
mov rcx, qword [rsi + 8]
lea rdx, str.set_default_browser_user_choice
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
test eax, eax
jne 0x14003ca5d
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003ca5d
add rsi, 0x18
mov rdx, rsi
call fcn.140035580
jmp 0x14003ca5b
mov edi, eax
jmp 0x14003cad8
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
cmp qword [rsi + 0x10], 0
je 0x14003ca5d
lea rcx, [rsp + 0x68]
call fcn.14003e350
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400024f0
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003ca18
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20107
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003cd2e
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
test rcx, rcx
je 0x14003ca36
call fcn.140057960
mov rcx, qword [rsi + 0x10]
mov edx, 1
jmp 0x14003ca56
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003ca5d
xor edx, edx
call fcn.140034f70
mov edi, eax
cmp byte [rsp + 0x70], 0
mov rsi, qword [rsp + 0x68]
je 0x14003cabf
test rsi, rsi
je 0x14003ca9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14003cabf
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_release_registry_mutex
lea r8, str.Release
mov r9d, 0xc8
call fcn.14002d330
jmp 0x14003cabf
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpectedly_missing_registry_mutex
lea r8, str.Release
mov r9d, 0xc3
call fcn.14002d330
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003cad2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.140058a80
mov eax, edi
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
cmp qword [rsi + 0x10], 0
je 0x14003ca5d
lea rcx, [rsp + 0x68]
call fcn.14003e350
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032aa0
mov eax, dword [rdi]
test eax, eax
je 0x14003cb6f
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002d330
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.140033830
jmp 0x14003ca5b
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
cmp qword [rsi + 0x10], 0
je 0x14003ca5d
lea rcx, [rsp + 0x68]
call fcn.14003e350
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032aa0
mov eax, dword [rdi]
test eax, eax
je 0x14003cbe8
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002d330
mov rbx, qword [rsi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140065030]
lea r9, [0x140065020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003d1ef
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
lea rbp, [rsp + 0x2e0]
movaps xmmword [rbp], xmm0
xor eax, eax
mov qword [rbp + 0x10], rax
lea r9, [rsp + 0x2b0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x330]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x310]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], rbp
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d209
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
lea rcx, [0x1400a2df4]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
test rcx, rcx
je 0x14003ccce
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x140057c5e.0]
test eax, eax
jns 0x14003d253
mov rcx, rbx
xor edx, edx
call fcn.140033830
mov edi, eax
test rsi, rsi
je 0x14003cd0b
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14003d226
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
jmp 0x14003d226
mov r15, qword [rsp + 0x2e0]
lea rax, [rsp + 0x2b0]
mov dword [rax], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x58], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14003d0cd
test r15, r15
je 0x14003ca18
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003ca18
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003ca5d
cmp qword [rsi + 0x10], 0
je 0x14003ca5d
lea rcx, [rsp + 0x68]
call fcn.14003e350
mov edi, 0x80070020
test al, al
je 0x14003ca5d
lea r8, str.AppLastRunTime
lea rbp, [rsp + 0xb0]
mov rcx, rbp
xor edx, edx
call fcn.140032c80
cmp dword [rbp + 0x10], 0
jne 0x14003d249
cmp byte [rsp + 0xb8], 0
je 0x14003d249
mov rdi, qword [rsp + 0xb0]
lea rbx, [rsp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x14003ce2e
mov edi, 0x80041324
movabs rcx, 0x46b8e92d7fff
cmp rax, rcx
ja 0x14003ca5d
xor edi, edi
call fcn.1400330c0
test al, al
jne 0x14003ca5d
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x20], rbx
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor r15d, r15d
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003d2eb
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rbp
lea rdx, str.http
mov r8d, 1
mov r9d, 1
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d421
mov r14, qword [rsp + 0xb0]
xor r15d, r15d
mov r8d, 0x200
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2b0]
mov dword [rax], 0x100
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov edx, 4
mov r8, r14
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003d457
lea rdx, [0x1400a1648]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d487
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0xb0]
mov r8d, 0xd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d574
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0xb0]
mov r8d, 0xe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d57b
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0xb0]
mov r8d, 0x11
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d582
lea rdx, [0x1400a2de8]
lea rcx, [rsp + 0xb0]
mov edi, 5
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d589
lea rdx, str.Brave
lea rcx, [rsp + 0xb0]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d58e
lea rdx, str.Yandex
lea rcx, [rsp + 0xb0]
mov edi, 6
mov r8d, 6
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d58e
lea rdx, str.QQBrowser
lea rcx, [rsp + 0xb0]
mov r8d, 9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003db3a
lea rdx, str.360
lea rcx, [rsp + 0xb0]
mov edi, 8
mov r8d, 8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d58e
lea rdx, [0x1400a1430]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
xor r15d, r15d
mov edi, 0
test eax, eax
jne 0x14003d5c4
mov edi, 9
jmp 0x14003d58e
call fcn.1400330c0
movzx esi, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_IsAgentRemoteDisabled:
call fcn.14005b980
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor edi, edi
jmp 0x14003ca5d
mov edi, dword [rsp + 0x2b0]
inc edi
mov dword [rsp + 0x2b0], edi
lea r14, [rdi + rdi]
mov rcx, r14
call fcn.140057a8c
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x330]
mov dword [r9], edi
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
xor edx, edx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0
test eax, eax
jne 0x14003d1ba
xorps xmm6, xmm6
lea r14, [rsp + 0x330]
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
mov rdi, qword [rsp + 0xb0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d183
inc r12d
mov rcx, rbx
mov dx, 0x7c
call sub.VCRUNTIME140.dll_wcschr
test rax, rax
movzx ebp, bpl
mov eax, 1
cmovne ebp, eax
jmp 0x14003d18f
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsp + 0x2b0]
mov dword [rsp + 0x330], eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov edx, r12d
mov r8, rbx
mov r9, r14
call r13
test eax, eax
je 0x14003d140
test r15, r15
je 0x14003d1c8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, 1
jne 0x14003d1e2
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, rbx
call fcn.140057960
jmp 0x14003ca18
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfc
jmp 0x14003d221
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfe
call fcn.14002d220
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14003ca5d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
jmp 0x14003ca5d
mov edi, 0x80041324
jmp 0x14003ca5d
lea rdi, [rsp + 0xb0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [0x1400a3984]
mov edx, 0x1e
mov rcx, rdi
call fcn.14005b880
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rdi + 0x10]
mov rbp, qword [rdi + 0x18]
mov rdx, rbp
sub rdx, rcx
cmp rdx, rax
jb 0x14003d557
lea r14, [rcx + rax]
mov qword [rsp + 0xc0], r14
cmp rbp, 8
jb 0x14003d2bd
mov rdi, qword [rsp + 0xb0]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rbx
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], 0
cmp qword [rsp + 0xc8], 8
jb 0x14003d30d
mov rcx, qword [rsp + 0xb0]
jmp 0x14003d315
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x41
call fcn.14002d220
jmp 0x14003d5d2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x98]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov rdx, r14
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d446
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d479
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d4b6
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov edx, 1
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d48e
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x78]
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003d48e
mov rbp, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, rbp
call fcn.140033830
mov edi, eax
test rbp, rbp
je 0x14003d49a
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003d49a
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x4c
call fcn.14002d220
xor r15d, r15d
jmp 0x14003d5d2
mov rcx, rbx
xor edx, edx
call fcn.140033830
mov edi, eax
jmp 0x14003d4f6
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x5c
call fcn.14002d220
jmp 0x14003d5c4
mov rcx, rbx
xor edx, edx
call fcn.140033830
mov edi, eax
jmp 0x14003d4dc
xor edi, edi
jmp 0x14003d58e
mov rcx, rbx
xor edx, edx
call fcn.140033830
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14003d4c2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
jmp 0x14003d4c2
mov rcx, rbx
xor edx, edx
call fcn.140033830
mov edi, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14003d4dc
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14003d4f6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14003d510
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
test r14, r14
je 0x14003d51e
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x14003ccfd
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003dc56
call fcn.140057960
jmp 0x14003ccfd
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
mov rdx, rax
mov r9, rbx
call fcn.14005b730
jmp 0x14003d2d6
mov edi, 1
jmp 0x14003d58e
mov edi, 2
jmp 0x14003d58e
mov edi, 3
jmp 0x14003d58e
mov edi, 4
lea rax, [rdi + rdi*2]
lea rcx, [0x14006ae40]
mov r15d, dword [rcx + rax*8 + 0x10]
cmp r15d, 4
jne 0x14003d5c2
lea rdx, str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
mov r8d, 0x24
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d647
xor edi, edi
test r14, r14
je 0x14003d5d2
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003d5ec
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
test edi, edi
jne 0x14003ca5d
cmp r15d, 0xb
ja 0x14003d654
movsxd rax, r15d
lea rcx, [0x14006b0a0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov r9, qword [rax]
mov rdi, qword [rax + 8]
lea rcx, [rsp + 0x330]
cmp rdi, 0xf
jbe 0x14003d676
mov rdx, rdi
call fcn.1400011a0
jmp 0x14003d68d
xor edi, edi
mov r15d, 3
jmp 0x14003d5c4
mov qword [rsp + 0x348], 0xf
mov qword [rsp + 0x340], 0
mov byte [rsp + 0x330], 0
jmp 0x14003d68d
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x330], 0
lea r8, [0x1400a1a40]
lea rcx, [rsp + 0xb0]
mov edx, 1
xor r9d, r9d
call fcn.14002fb50
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov rbp, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d6d1
mov r14, qword [rsp + 0x330]
jmp 0x14003d6d9
lea r14, [rsp + 0x330]
cmp rbp, 0xf
ja 0x14003dbc2
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x2b0], xmm0
mov edi, 0xf
mov qword [rsp + 0x2c0], rbp
mov qword [rsp + 0x2c8], rdi
mov byte [rsp + 0x2d0], 1
cmp dword [rsp + 0xd8], 0
lea rcx, [rsp + 0x308]
jne 0x14003e245
lea rdx, [rsp + 0xd8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2f0], xmm0
movaps xmmword [rsp + 0x2e0], xmm0
mov byte [rsp + 0x300], 0
call fcn.14005bc20
cmp byte [rsp + 0x2d0], 0
je 0x14003d786
mov rax, qword [rsp + 0x2c8]
cmp rax, 0x10
jae 0x14003dad1
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2c8], 0xf
mov byte [rsp + 0x2b0], 0
cmp byte [rsp + 0x300], 0
je 0x14003d7ad
mov rdi, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x14003d7d2
mov rbx, qword [rsp + 0x2e0]
jmp 0x14003d7d2
mov rdi, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d7ca
mov rbx, qword [rsp + 0x330]
jmp 0x14003d7d2
lea rbx, [rsp + 0x330]
cmp rdi, 0xf
ja 0x14003dc0c
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x310], xmm0
mov ebp, 0xf
cmp byte [rsp + 0x300], 0
je 0x14003d828
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jae 0x14003daf4
mov qword [rsp + 0x2f0], 0
mov qword [rsp + 0x2f8], 0xf
mov byte [rsp + 0x2e0], 0
cmp dword [rsp + 0xd8], 0
jne 0x14003d84e
cmp byte [rsp + 0xd0], 0
je 0x14003d84e
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x14003db17
cmp qword [rsp + 0x348], 0x10
jb 0x14003d863
mov r8, qword [rsp + 0x330]
jmp 0x14003d86b
lea r8, [rsp + 0x330]
lea rdx, [0x1400a1a40]
lea rcx, [rsp + 0xb0]
xor r9d, r9d
call fcn.14002f050
cmp rbp, 0x10
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
cmovae rax, rcx
cmp rdi, 0xb
ja case.0x14003d8ad.1
lea rdx, [0x14003e320]
movsxd rbx, dword [rdx + rdi*4]
add rbx, rdx
jmp rbx
movzx eax, word [rax]
rol ax, 8
movzx eax, ax
cmp eax, 0x6965
jne case.0x14003d8ad.1
movabs rdi, 0x500000000
jmp case.0x14003d8ad.0
mov edx, dword [rax]
bswap edx
mov ebx, 0x66697265
cmp edx, 0x66697265
jne 0x14003d8f8
mov edx, dword [rax + 3]
bswap edx
mov ebx, 0x65666f78
xor eax, eax
cmp edx, 0x65666f78
je 0x14003d903
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d8ad.1
movabs rdi, 0x100000000
jmp case.0x14003d8ad.0
movabs rbx, 0x71712d62726f7773
mov rdx, qword [rax]
bswap rdx
cmp rdx, rbx
jne 0x14003d949
movzx eax, word [rax + 8]
rol ax, 8
movzx edx, ax
xor eax, eax
cmp edx, 0x6572
je 0x14003d955
mov ebx, 0x6572
xor eax, eax
cmp rdx, rbx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d8ad.1
movabs rdi, 0x900000000
jmp case.0x14003d8ad.0
movabs rdx, 0x656467652d636872
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d999
movabs rdx, 0x652d6368726f6d65
mov rbx, qword [rax + 3]
bswap rbx
xor edi, edi
cmp rbx, rdx
je 0x14003d9a6
xor edi, edi
cmp rbx, rdx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003db67
movabs rdx, 0x3336302d62726f77
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d9db
movabs rdx, 0x2d62726f77736572
mov rbx, qword [rax + 3]
bswap rbx
xor eax, eax
cmp rbx, rdx
je 0x14003d9e7
xor eax, eax
cmp rbx, rdx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d8ad.1
movabs rdi, 0xa00000000
jmp case.0x14003d8ad.0
mov eax, dword [rax]
bswap eax
xor edx, edx
cmp eax, 0x65646766
setae dl
cmp eax, 0x65646765
sbb edx, 0
jne case.0x14003d8ad.1
movabs rdi, 0x300000000
jmp case.0x14003d8ad.0
mov edx, dword [rax]
bswap edx
cmp edx, 0x6f706572
jne 0x14003db44
movzx edx, byte [rax + 4]
add edx, 0xffffff9f
jmp 0x14003db4e
mov edx, dword [rax]
bswap edx
mov ebx, 0x6368726f
cmp edx, 0x6368726f
jne 0x14003da70
movzx edx, word [rax + 4]
rol dx, 8
movzx edx, dx
mov ebx, 0x6d65
xor edi, edi
cmp edx, 0x6d65
je 0x14003da7c
xor edi, edi
cmp edx, ebx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003db85
mov edx, dword [rax]
bswap edx
mov ebx, 0x79616e64
cmp edx, 0x79616e64
jne 0x14003daaf
movzx eax, word [rax + 4]
rol ax, 8
movzx edx, ax
mov ebx, 0x6578
xor eax, eax
cmp edx, 0x6578
je 0x14003daba
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d8ad.1
movabs rdi, 0x800000000
jmp case.0x14003d8ad.0
mov rcx, qword [rsp + 0x2b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003e2b7
call fcn.140057960
jmp 0x14003d766
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003e2d7
call fcn.140057960
jmp 0x14003d808
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003e2f7
call fcn.140057960
jmp 0x14003d84e
mov edi, 7
jmp 0x14003d58e
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003db76
mov edx, dword [rax]
bswap edx
cmp edx, 0x62726176
jne 0x14003db94
movzx edx, byte [rax + 4]
add edx, 0xffffff9b
jmp 0x14003db9e
movabs rdi, 0x400000000
jmp case.0x14003d8ad.0
movabs rdi, 0x600000000
jmp case.0x14003d8ad.0
movabs rdi, 0x200000000
jmp case.0x14003d8ad.0
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003dc7d
mov edx, dword [rax]
bswap edx
cmp edx, 0x736f676f
jne 0x14003dc89
movzx eax, byte [rax + 4]
add eax, 0xffffff8b
jmp 0x14003dc93
mov rdi, rbp
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003e211
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x2b0], rcx
lea r8, [rbp + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d6f4
mov rbp, rdi
or rbp, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
cmovae rbp, rax
cmp rbp, 0xfff
jae 0x14003e22b
lea rcx, [rbp + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x310], rcx
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d7ec
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003e317
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003d54d
movabs rdi, 0x700000000
jmp case.0x14003d8ad.0
setae al
movzx eax, al
add eax, eax
dec eax
test eax, eax
je 0x14003e202
xor edi, edi
cmp rbp, 0x10
jae 0x14003de60
mov rax, qword [rsp + 0x348]
cmp rax, 0x10
jae 0x14003de7d
mov eax, r15d
or rdi, rax
mov qword [rsp + 0x330], rdi
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003ddd1
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea r14, [rsp + 0x2b0]
mov qword [rsp + 0x20], r14
lea rdx, str..pdf
xor r8d, r8d
mov r9d, 1
call qword [case.0x140057c5e.0]
test eax, eax
js 0x14003ddeb
mov rdi, qword [rsp + 0x2b0]
mov dword [rsp + 0x2b0], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003de27
mov ebp, dword [rsp + 0x2b0]
add rbp, rbp
mov rcx, rbp
call fcn.140057a8c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003dea0
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.1400326c0
jmp 0x14003ded7
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x1d
jmp 0x14003de03
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x27
call fcn.14002d220
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], edi
jmp 0x14003deed
mov ebx, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x36
call fcn.14002d220
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebx
jmp 0x14003dedf
cmp rbp, 0xfff
jae 0x14003e252
inc rbp
mov rdx, rbp
call fcn.140057960
jmp 0x14003dca7
mov rcx, qword [rsp + 0x330]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003e273
call fcn.140057960
jmp 0x14003dcb9
mov ebp, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x3f
call fcn.14002d220
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebp
mov rcx, rbx
call fcn.140057960
test rdi, rdi
je 0x14003deed
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003df07
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140057c5e.0]
mov edi, dword [rsp + 0xd0]
test edi, edi
jne 0x14003ca5d
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x2e0], xmm0
movups xmmword [rsp + 0x2f0], xmm1
mov rsi, qword [rsi + 0x10]
mov eax, dword [0x1400aa4c0]
cmp eax, 0x9ffffff
ja 0x14003dfec
mov eax, dword [0x1400aa088]
cmp eax, 0xa000001
jb 0x14003e169
lea rdi, [rsp + 0xbc]
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0xa0000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rdi
lea rcx, [rsp + 0xb0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14003e15e
mov eax, 0xa000000
xchg dword [0x1400aa4c0], eax
lea r8, str.InitialNotificationShown
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.1400328a0
cmp dword [rdi + 4], 0
jne 0x14003e136
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003e136
movzx eax, al
test ax, ax
je 0x14003e136
lea r8, str.FollowupRequestTime
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032c80
xor ebp, ebp
cmp byte [rdi + 8], 0
mov ebx, 0
je 0x14003e062
mov rbx, qword [rsp + 0xb0]
lea rdi, [rsp + 0xb0]
cmp dword [rdi + 0x10], 0
cmovne rbx, rbp
lea r8, str.FollowupNotificationShown
mov rcx, rdi
mov edx, 1
call fcn.1400328a0
cmp dword [rdi + 4], 0
jne 0x14003e0a5
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
setae cl
test al, al
setne bpl
and bpl, cl
test rbx, rbx
je 0x14003e192
test bpl, bpl
jne 0x14003e192
lea r8, str.FollowupNotificationSuppressed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.1400328a0
cmp dword [rdi + 4], 0
jne 0x14003e0f4
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003e0f4
movzx eax, al
test ax, ax
jne 0x14003e192
lea rdi, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rdi]
sub rax, rbx
jbe 0x14003e192
shr rax, 0xe
cmp rax, 0x1600a391
jb 0x14003e192
cmp dword [rsp + 0x330], 4
jne 0x14003e176
lea rcx, [rsp + 0xb0]
mov edx, 1
jmp 0x14003e154
cmp dword [rsp + 0x330], 4
jne 0x14003e169
cmp dword [rsp + 0x334], 1
jne 0x14003e169
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rsi
call fcn.1400304e0
jmp 0x14003e1af
mov eax, 0xa000000
xchg dword [0x1400aa088], eax
mov dword [rsp + 0xb0], 0
jmp 0x14003e19d
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0xb0]
mov edx, 1
mov r9b, 1
call fcn.140032aa0
mov dword [rsp + 0xb0], 1
movabs rax, 0x700000000
mov qword [rsp + 0xb4], rax
lea rcx, [rsp + 0x330]
lea rsi, [rsp + 0x2e0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
call fcn.140036da0
mov edi, eax
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14003ca5d
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003e297
call fcn.140057960
jmp 0x14003ca5d
movabs rdi, 0xb00000000
jmp case.0x14003d8ad.0
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003dbf3
lea rcx, [rbp + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003dc3d
lea rdx, [rsp + 0x2d8]
jmp 0x14003d72a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003e317
add rbp, 0x28
mov rcx, rax
jmp 0x14003de70
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003e317
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003de96
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003e317
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003e1f8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003e317
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003daea
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003e317
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003db0d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003e317
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003db30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3