Function at 0x14000ca40
Capabilities:
Check for time delay via queryperformancecounter
Parse pe header
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1401054a8]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12d, 1
cmp qword [rdx + 0x20], 0
je 0x14000cae0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14000cac2
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000cac2
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000cac2
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14000cac2
cmp dword [rax + rcx + 0x50], 0x147
ja 0x14000cbce
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800700c100000028
mov qword [rsi + 8], rax
jmp 0x14000cb55
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWARETor_ProjectFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000cb83
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa8
mov byte [rsi + 0x10], 1
lea rdx, str._var_tmp_build_firefox_1d8abcb1f7a7_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rax, qword [rsp + 0xa0]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000ce5e
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsp + 0x88]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000cb9a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], r14
mov eax, dword [rsp + 0x70]
cmp eax, 1
je 0x14000cbb7
cmp eax, 2
jne 0x14000cbbf
mov r12d, 1
jmp 0x14000ca81
xor r12d, r12d
jmp 0x14000ca81
mov ecx, 0x80070507
mov eax, 0xb7
jmp 0x14000cb41
mov r13d, dword [rax + rcx + 8]
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.14000ce80
cmp byte [rsp + 0x98], 0
je 0x14000cc01
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 1
jmp 0x14000cb55
cmp byte [rsp + 0x8c], 0
je 0x14000cc4a
cmp dword [rsp + 0x88], r13d
jne 0x14000cc4a
cmp ebx, 1
jne 0x14000cc68
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 1
jmp 0x14000cb55
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000cfc0
cmp byte [rsp + 0x80], 0
je 0x14000cca2
movups xmm0, xmmword [rsp + 0x70]
jmp 0x14000cbf5
cmp r12d, 1
je 0x14000ccb2
test r12d, r12d
jne 0x14000cceb
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov byte [rdi + 8], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 0
jmp 0x14000cb55
movzx ecx, byte [rdi + 0x40]
mov eax, ecx
and al, 1
je 0x14000cd0c
mov rcx, qword [rdi + 0x48]
jmp 0x14000cd0f
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000d250
cmp byte [rsp + 0x80], 0
jne 0x14000cc61
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.14000d3a0
cmp byte [rsp + 0x68], 0
je 0x14000cda7
movups xmm0, xmmword [rsp + 0x58]
jmp 0x14000cbf5
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800705070000011c
mov qword [rsi + 8], rax
jmp 0x14000cb55
shr rcx, 1
test rcx, rcx
jne 0x14000cd3f
lea r14, [rdi + 0x40]
lea rdx, [rdi + 0x28]
mov rcx, r14
call fcn.14007f780
lea rdx, str.Image
mov r8d, 6
mov rcx, r14
call fcn.14007e5a0
movzx eax, byte [rdi + 0x40]
and al, 1
mov dword [rsp + 0x58], r13d
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000cd52
mov rdx, qword [rdi + 0x50]
jmp 0x14000cd56
lea rdx, [rdi + 0x42]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cc15
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x7c
jmp 0x14000cb52
movzx ecx, byte [rsp + 0x78]
test cl, cl
setne dl
movzx eax, byte [rsp + 0x60]
test al, al
setne r8b
xor r8b, dl
mov r14d, 1
jne 0x14000cdee
mov r14d, ebx
test ebx, ebx
jne 0x14000cdee
mov r14d, ebx
test cl, cl
je 0x14000cdee
test al, al
je 0x14000ce63
mov rax, qword [rsp + 0x70]
xor r14d, r14d
cmp rax, qword [rsp + 0x58]
setae r14b
cmp ebp, 1
cmove r14d, ebx
test r14d, r14d
je 0x14000ce0e
cmp r14d, 1
jne 0x14000ce3d
mov qword [rdi + 0x10], 0
add rdi, 0x18
jmp 0x14000ce2e
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
add rdi, 8
mov byte [rdi], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], r14d
jmp 0x14000cb55
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007050700000160
mov qword [rsi + 8], rax
jmp 0x14000cb55
call fcn.1400d58e0
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3