Function at 0x140034af0
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov rdi, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140064030]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov eax, 0x800401f0
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140027600
add rsp, 0x20
mov dword [rbp - 0x10], eax
test eax, eax
je 0x140034d39
mov dword [rbp - 0x18], eax
test eax, eax
js 0x140034d55
sub rsp, 0x20
mov ecx, ebx
mov rdx, rdi
call fcn.140024010
add rsp, 0x20
test al, al
je 0x14003514e
lea r14, [rdi + 8]
mov r8, qword [rdi + 8]
test r8, r8
je 0x140034ca4
lea rax, [rdi + 0x10]
mov ecx, 0xff
movzx edx, word [r8]
cmp edx, 0x2f
je 0x140034ba7
cmp edx, 0x2d
jne 0x140034c94
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x140034bae
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x140034c94
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x140034c94
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x140034c94
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x140034c94
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x140034c94
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x69
jne 0x140034c94
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x140034c94
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6e
jne 0x140034c94
movzx r8d, word [rdx + 8]
test r8w, r8w
jne 0x140034d6f
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x140034b81
lea rax, str.__attempting_deelevation
lea rcx, [rbp - 8]
mov qword [rcx], rax
dec ebx
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov edx, ebx
mov r8, r14
mov r9d, 1
call fcn.1400256d0
add rsp, 0x30
mov rbx, qword [rbp - 0x20]
test rbx, rbx
jne 0x140034e53
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
movabs rax, 0x80070507000000ac
mov qword [rsi + 8], rax
cmp dword [rbp - 0x10], 0
js 0x140034d11
sub rsp, 0x20
call fcn.1400276e0
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
sub rsp, 0x20
call fcn.140030050
add rsp, 0x20
mov rax, rsi
lea rsp, [rbp + 0x18]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
lea r14, [rbp - 0x18]
mov rcx, r14
call fcn.1400277b0
add rsp, 0x20
mov eax, dword [r14]
jmp 0x140034b45
mov byte [rsi + 0x10], 1
lea rcx, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rcx
mov dword [rsi + 8], 0x89
mov dword [rsi + 0xc], eax
jmp 0x140034cfe
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x140034c94
cmp word [rdx + 0xa], 0
jne 0x140034c94
lea eax, [rbx + 1]
shl rax, 3
cmp ebx, 0xffffffff
mov r12, 0xffffffffffffffff
cmovge r12, rax
sub rsp, 0x20
mov rcx, r12
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r15, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.ntdll.dll_memset
add rsp, 0x20
mov rax, qword [r14]
mov qword [r15], rax
lea rax, str.__attempting_deelevation
mov qword [r15 + 8], rax
cmp ebx, 3
jl 0x140034e1a
mov rcx, r15
add rcx, 0x10
lea rdx, [rdi + 0x10]
lea r8d, [rbx - 2]
shl r8, 3
sub rsp, 0x20
call sub.ntdll.dll_memcpy
add rsp, 0x20
movsxd rax, ebx
xor ecx, ecx
mov qword [r15 + rax*8], rcx
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov edx, ebx
mov r8, r15
xor r9d, r9d
call fcn.1400256d0
add rsp, 0x10
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
jmp 0x140034cd5
sub rsp, 0x20
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x20
test rax, rax
je 0x140034f9f
sub rsp, 0x20
lea rdx, str.GetCurrentPackageFamilyName
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x140034f9f
mov r15, rax
lea rcx, [rbp - 8]
mov dword [rcx], 0
sub rsp, 0x20
xor edx, edx
call qword [0x14006a010]
add rsp, 0x20
cmp eax, 0x7a
jne 0x140034f9f
lea r12, [rbp - 8]
mov r13d, dword [r12]
add r13, r13
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r14, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.ntdll.dll_memset
mov rcx, r12
mov r12, r14
mov rdx, r14
mov rax, r15
call qword [0x14006a010]
add rsp, 0x20
sub rsp, 0x20
test eax, eax
jne 0x140034f92
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add rsp, 0x20
mov rcx, rax
mov r14, rsp
add ecx, 0x16
lea rax, [rcx + rcx]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14002fff0
sub rsp, rax
mov r15, rsp
movsxd rdx, ecx
sub rsp, 0x20
mov rcx, r15
mov r9, r12
call fcn.1400312b0
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rdi, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rdi], rax
test rax, rax
je 0x140035140
mov rsp, r14
mov qword [rbp - 0x28], rdi
xor r14d, r14d
jmp 0x140034ff3
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
mov r14, qword [rdi]
sub rsp, 0x20
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rdi, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rdi], rax
test r14, r14
je 0x140034fe9
test rax, rax
je 0x140035140
mov qword [rbp - 0x28], rdi
mov r14b, 1
xor r12d, r12d
mov word [rbp - 8], 8
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rbp], rax
test rax, rax
je 0x140035140
mov dword [rbp - 0x74], r14d
mov qword [rbp - 0x80], r12
mov word [rbp - 0x40], 8
sub rsp, 0x20
lea rcx, str.open
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140035140
sub rsp, 0x20
lea rbx, [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
add rsp, 0x20
lea r15, [rbp - 0x70]
mov word [r15], 0x16
mov dword [r15 + 8], 1
sub rsp, 0x30
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x28]
lea r12, [rbp - 8]
lea r13, [rbp - 0x40]
mov rcx, rsi
mov r8, r12
mov r9, r13
call fcn.140035160
add rsp, 0x10
mov r14, qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, r15
call r14
mov rcx, rbx
call r14
mov rcx, r13
call r14
mov rcx, r12
call r14
add rsp, 0x20
cmp byte [rbp - 0x74], 0
jne 0x1400350d5
sub rsp, 0x20
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
lock dec dword [rdi + 0x10]
jne 0x140035120
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400350f8
sub rsp, 0x20
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
add rsp, 0x20
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003510f
sub rsp, 0x20
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140034cfe
sub rsp, 0x20
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
jmp 0x140034cfe
sub rsp, 0x20
mov ecx, 0x8007000e
call fcn.14002fa30
sub rsp, 0x20
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3