Function at 0x140020ea0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Create process on windows
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb78
movaps xmmword [rsp + 0xb60], xmm6
mov rsi, r9
mov r15, r8
mov r13, rdx
mov r14, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0xb58], rax
mov ecx, dword [rdx]
mov rdx, r8
call fcn.140023690
test al, al
je 0x140022bc6
mov qword [0x140061cd8], rsi
lea r12, [r15 + 8]
mov r8, qword [r15 + 8]
test r8, r8
je 0x140021079
lea rcx, [r15 + 0x10]
mov r9d, 0xff
mov rax, r8
mov rbp, r12
movzx ebx, word [rax]
cmp ebx, 0x2d
je 0x140020f3a
cmp ebx, 0x2f
je 0x140022bba
mov rax, qword [rbp + 8]
add rbp, 8
add rcx, 8
test rax, rax
jne 0x140020f13
jmp 0x140020fcf
lea rbx, [rax + 2]
lea rdi, [rax + 4]
cmp word [rax + 2], 0x2d
cmove rbx, rdi
mov sil, 0x6c
xor r10d, r10d
movzx edi, word [rbx + r10*2]
test di, di
je 0x140020f24
cmp sil, 0x2d
je 0x140020f71
lea edx, [rsi - 0x30]
cmp dl, 0xa
jb 0x140020f71
lea edx, [rsi - 0x61]
cmp dl, 0x19
ja 0x140020f24
movzx edx, di
cmp edx, r9d
cmovae edi, r9d
lea edx, [rdi - 0x41]
mov eax, edi
or al, 0x20
cmp dl, 0x1a
movzx eax, al
cmovae eax, edi
cmp al, sil
jne 0x140020f24
lea rax, str.log_launcher_error
mov sil, byte [r10 + rax + 1]
inc r10
cmp r10, 0x12
jne 0x140020f51
cmp word [rbx + 0x24], 0
jne 0x140020f24
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140020fb0
dec dword [r13]
mov byte [0x140061ce0], 1
mov r8, qword [r12]
test r8, r8
je 0x140021079
mov ebp, 0xff
lea r9, str.contentproc
mov r10, r12
movzx eax, word [r8]
cmp eax, 0x2d
jne 0x14002105f
lea rax, [r8 + 2]
lea rbx, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rax, rbx
mov dil, 0x63
xor ebx, ebx
movzx esi, word [rax + rbx*2]
test si, si
je 0x140021068
cmp dil, 0x2d
je 0x140021026
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x140021026
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x140021068
movzx edx, si
cmp edx, ebp
cmovae esi, ebp
lea edx, [rsi - 0x41]
mov ecx, esi
or cl, 0x20
cmp dl, 0x1a
movzx ecx, cl
cmovae ecx, esi
cmp cl, dil
jne 0x140021068
mov dil, byte [rbx + r9 + 1]
inc rbx
cmp rbx, 0xb
jne 0x140021007
cmp word [rax + 0x16], 0
je 0x140021400
jmp 0x140021068
cmp eax, 0x2f
je 0x140022c23
mov r8, qword [r10 + 8]
add r10, 8
test r8, r8
jne 0x140020fe7
lea rcx, [rsp + 0x1d8]
call fcn.140023e30
pxor xmm0, xmm0
lea r8, [rsp + 0x700]
movdqa xmmword [r8 + 0x20], xmm0
movdqa xmmword [r8 + 0x10], xmm0
movdqa xmmword [r8], xmm0
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x90], r13
js 0x140022c3b
mov r8, qword [rsp + 0x728]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140022c71
lea rsi, [rsp + 0x720]
mov dword [rsi - 0x20], 0
mov byte [rsi - 8], 0
lea r9, [rsp + 0x2c0]
mov dword [r9], 0x209
mov rcx, rbp
mov edx, 1
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140022ca6
cmp byte [rsp + 0x718], 1
je 0x140022ccd
mov r8d, dword [rsp + 0x700]
lea rdi, [rsp + 0x140]
mov rcx, rdi
mov rdx, rsi
call fcn.140024400
cmp byte [rdi + 0x18], 1
je 0x140022cec
lea rsi, [rsp + 0x2e0]
mov dword [rsi - 0x20], 1
mov byte [rsi - 8], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x14002119b
test eax, eax
jne 0x140022812
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r13d, 0x29
mov sil, 1
lea rdi, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, rbp
inc rax
cmp rax, 2
jb 0x1400211d4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x140022c50
test dil, dil
sete r14b
lea rcx, [0x140056f19]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140022d4c
mov rbx, qword [r12]
test rbx, rbx
je 0x140021436
lea rcx, [r15 + 0x10]
mov esi, 0xff
mov rax, rbx
movzx ebp, word [rax]
cmp ebp, 0x2d
je 0x140021235
cmp ebp, 0x2f
je 0x140022c2f
mov rax, qword [rcx]
add rcx, 8
test rax, rax
jne 0x140021213
jmp 0x140021436
lea rbp, [rax + 2]
lea rdi, [rax + 4]
cmp word [rax + 2], 0x2d
cmove rbp, rdi
movzx eax, word [rbp]
test ax, ax
je 0x140021224
movzx edi, ax
cmp edi, esi
cmovae eax, esi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x6c
jne 0x140021224
movzx eax, word [rbp + 2]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x61
jne 0x140021224
movzx eax, word [rbp + 4]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x75
jne 0x140021224
movzx eax, word [rbp + 6]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x6e
jne 0x140021224
movzx eax, word [rbp + 8]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x63
jne 0x140021224
movzx eax, word [rbp + 0xa]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x68
jne 0x140021224
movzx eax, word [rbp + 0xc]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x65
jne 0x140021224
movzx eax, word [rbp + 0xe]
test ax, ax
je 0x140021224
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x72
jne 0x140021224
cmp word [rbp + 0x10], 0
jne 0x140021224
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400213e0
mov rax, qword [rsp + 0x90]
dec dword [rax]
mov rbx, qword [r12]
jmp 0x140021445
mov qword [r14], 0
mov rcx, qword [rsp + 0xb58]
xor rcx, rsp
call fcn.14002f4d0
mov rax, r14
movaps xmm6, xmmword [rsp + 0xb60]
add rsp, 0xb78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13b, 1
mov r10b, 1
test r14b, r14b
je 0x1400214de
mov r10b, 1
test rbx, rbx
je 0x1400214db
lea rcx, [r15 + 0x10]
mov r8d, 0xff
mov rbp, r12
movzx eax, word [rbx]
cmp eax, 0x2d
jne 0x1400214c1
lea rdx, [rbx + 2]
lea rax, [rbx + 4]
cmp word [rbx + 2], 0x2d
cmove rdx, rax
mov dil, 0x66
xor r9d, r9d
movzx esi, word [rdx + r9*2]
test si, si
je 0x1400214ca
cmp dil, 0x2d
je 0x14002149d
lea ebx, [rdi - 0x30]
cmp bl, 0xa
jb 0x14002149d
lea ebx, [rdi - 0x61]
cmp bl, 0x19
ja 0x1400214ca
movzx ebx, si
cmp ebx, r8d
cmovae esi, r8d
lea ebx, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x1400214ca
jmp 0x140022d69
cmp eax, 0x2f
je 0x140022db2
mov rbx, qword [rbp + 8]
add rbp, 8
add rcx, 8
test rbx, rbx
jne 0x14002145e
xor r13d, r13d
mov dword [rsp + 0x80], r10d
mov r14d, 1
cmp qword [rsp + 0x1f8], 0
lea rbx, [rsp + 0x700]
je 0x140022895
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x140022bd1
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140022bd1
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140022bd1
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x140022bd1
cmp dword [rax + rcx + 0x50], 0x148
jb 0x140022bd1
mov esi, dword [rax + rcx + 8]
lea rdi, [rsp + 0x220]
cmp qword [rdi + 0x10], 0
jne 0x140021633
mov rbp, qword [rsp + 0x210]
cmp qword [rsp + 0x218], 8
jb 0x140021588
mov r9, qword [rsp + 0x200]
jmp 0x140021590
lea r9, [rsp + 0x200]
mov rax, qword [rsp + 0x238]
cmp rax, rbp
jb 0x140022802
mov rbx, rdi
cmp rax, 8
jb 0x1400215b2
mov rbx, qword [rsp + 0x220]
mov qword [rsp + 0x230], rbp
mov r8, rbp
add r8, rbp
mov rcx, rbx
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rbx + rbp*2], 0
lea rbx, [rsp + 0x700]
mov rax, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jb 0x140022b6a
lea rdx, [rax + 6]
mov qword [rsp + 0x230], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x140021616
mov rdx, qword [rsp + 0x220]
movabs rcx, 0x61006d0049007c
mov qword [rdx + rax*2], rcx
mov dword [rdx + rax*2 + 8], 0x650067
mov word [rdx + rax*2 + 0xc], 0
mov dword [rsp + 0x2c0], 4
mov rcx, qword [rsp + 0x1f8]
cmp qword [rsp + 0x238], 8
jb 0x140021659
mov rdi, qword [rsp + 0x220]
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x140]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022aa3
cmp dword [rsp + 0x140], 4
jne 0x140022de2
cmp dword [rsp + 0x700], esi
jne 0x140022aac
test r13b, r13b
je 0x1400216ff
lea rsi, [rsp + 0x700]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1f0]
mov qword [rcx - 8], rax
mov eax, 1
mov byte [rcx], 1
mov byte [rsp + 0x150], 0
mov dword [rsp + 0x140], eax
mov cl, 1
mov qword [rsp + 0x80], rcx
test eax, eax
jne 0x1400217dd
mov r13b, 1
jmp 0x14002180c
cmp r14d, 1
jne 0x140022b01
lea rcx, [rsp + 0x1d8]
lea rsi, [rsp + 0x700]
mov rdx, rsi
call fcn.140031c70
cmp byte [rsi + 0x10], 0
jne 0x14002330f
lea rcx, [rsp + 0x1d8]
lea rsi, [rsp + 0x2c0]
mov rdx, rsi
call fcn.140031c10
cmp byte [rsi + 0x10], 0
jne 0x140022af3
mov dl, byte [rsp + 0x708]
test dl, dl
setne bl
mov cl, byte [rsp + 0x2c8]
test cl, cl
setne al
xor al, bl
test dl, dl
mov edx, dword [rsp + 0x80]
je 0x140023448
test cl, cl
lea rbx, [rsp + 0x700]
je 0x140021795
mov rax, qword [rsp + 0x700]
cmp rax, qword [rsp + 0x2c0]
setae al
and dl, al
mov edi, edx
cmp dl, 1
je 0x140023455
lea rsi, [rsp + 0x140]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1e0]
mov qword [rcx - 8], rax
movzx eax, dil
mov byte [rcx], 1
mov byte [rsp + 0x150], 0
jmp 0x1400216e5
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140022e66
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
jne 0x140022e7a
xor r13d, r13d
cmp qword [rsp + 0x1f8], 0
je 0x14002291e
lea rbp, [rsp + 0x2a0]
cmp qword [rbp + 0x10], 0
jne 0x1400218eb
mov rsi, qword [rsp + 0x210]
cmp qword [rsp + 0x218], 8
jb 0x14002184b
mov r9, qword [rsp + 0x200]
jmp 0x140021853
lea r9, [rsp + 0x200]
mov rax, qword [rsp + 0x2b8]
cmp rax, rsi
jb 0x1400227f2
mov rdi, rbp
cmp rax, 8
jb 0x140021875
mov rdi, qword [rsp + 0x2a0]
mov qword [rsp + 0x2b0], rsi
lea r8, [rsi + rsi]
mov rcx, rdi
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rdi + rsi*2], 0
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2b8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xa
jb 0x140022b48
lea rdx, [rax + 0xa]
mov qword [rsp + 0x2b0], rdx
mov rdx, rbp
cmp rcx, 8
jb 0x1400218cf
mov rdx, qword [rsp + 0x2a0]
movdqa xmm0, xmmword [str.Blocklist]
movdqu xmmword [rdx + rax*2], xmm0
mov dword [rdx + rax*2 + 0x10], 0x740073
mov word [rdx + rax*2 + 0x14], 0
mov rcx, qword [rsp + 0x1f8]
cmp qword [rsp + 0x2b8], 8
mov r8, rbp
jb 0x140021909
mov r8, qword [rsp + 0x2a0]
mov qword [rsp + 0x30], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400229c7
mov edi, dword [rsp + 0x700]
and edi, 0xfffffffe
mov rcx, rdi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x1f8]
cmp qword [rsp + 0x2b8], 8
jb 0x14002196c
mov rbp, qword [rsp + 0x2a0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rbp
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140022e2e
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 7
mov word [rsp + 0x700], 0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rbx, rax
lea rcx, [rsp + 0x700]
cmp rax, 7
ja 0x140022b38
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rdx, rsi
call sub.ntdll.dll_memcpy
mov word [rsp + rbx*2 + 0x700], 0
mov rbp, qword [rsp + 0x700]
mov r14, qword [rsp + 0x708]
mov rbx, qword [rsp + 0x710]
mov rdi, qword [rsp + 0x718]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
mov qword [rsp + 0x1b0], rbp
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rdi
mov bl, 1
mov al, 1
mov byte [rsp + 0x1d0], al
test byte [rsp + 0x80], r13b
je 0x1400220f3
call fcn.140023d20
test al, al
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rbx
jne 0x140022eb8
call fcn.140031bb0
call fcn.140024040
test r15, r15
mov r13, qword [rsp + 0x90]
je 0x140022f23
mov qword [rsp + 0x98], rbp
lea rsi, [rsp + 0x700]
mov rcx, rsi
call fcn.140023f50
mov rax, qword [rsi]
test rax, rax
je 0x140022f1b
mov qword [r15], rax
mov r14, qword [r15 + 8]
test r14, r14
mov qword [rsp + 0x78], r15
je 0x140021fca
lea rax, [r15 + 0x10]
mov r10d, 0xff
lea r9, str.wait_for_browser
mov rbp, r14
mov r8, r12
movzx ebx, word [rbp]
cmp ebx, 0x2d
jne 0x140021b50
lea rbx, [rbp + 2]
lea rdi, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rbx, rdi
mov dil, 0x77
xor esi, esi
movzx ebp, word [rbx + rsi*2]
test bp, bp
je 0x140021b59
cmp dil, 0x2d
je 0x140021b15
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x140021b15
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x140021b59
movzx edx, bp
cmp edx, r10d
cmovae ebp, r10d
lea edx, [rbp - 0x41]
mov ecx, ebp
or cl, 0x20
cmp dl, 0x1a
movzx ecx, cl
cmovae ecx, ebp
cmp cl, dil
jne 0x140021b59
mov dil, byte [rsi + r9 + 1]
inc rsi
cmp rsi, 0x10
jne 0x140021af6
cmp word [rbx + 0x20], 0
je 0x140021ffb
jmp 0x140021b59
cmp ebx, 0x2f
je 0x140022f58
mov rbp, qword [r8 + 8]
add r8, 8
add rax, 8
test rbp, rbp
jne 0x140021ad7
mov r11, r12
mov r10, r13
lea rax, [r15 + 0x10]
mov edi, 0xff
mov rdx, r14
movzx ebp, word [rdx]
cmp ebp, 0x2f
je 0x140021ba4
cmp ebp, 0x2d
jne 0x140021cdc
lea rbp, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rbp, rbx
jmp 0x140021bab
add rdx, 2
mov rbp, rdx
movzx edx, word [rbp]
test dx, dx
je 0x140021cdc
movzx ebx, dx
cmp ebx, edi
cmovae edx, edi
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x6d
jne 0x140021cdc
movzx edx, word [rbp + 2]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x61
jne 0x140021cdc
movzx edx, word [rbp + 4]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x72
jne 0x140021cdc
movzx edx, word [rbp + 6]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x69
jne 0x140021cdc
movzx edx, word [rbp + 8]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6f
jne 0x140021cdc
movzx edx, word [rbp + 0xa]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6e
jne 0x140021cdc
movzx edx, word [rbp + 0xc]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
je 0x140023546
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140021b80
mov r9d, 0xff
lea r8, str.backgroundtask
mov rbp, r14
mov rdx, r11
movzx ecx, word [rbp]
cmp ecx, 0x2f
je 0x140021d20
cmp ecx, 0x2d
jne 0x140021d86
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
jmp 0x140021d27
add rbp, 2
mov rcx, rbp
mov dil, 0x62
xor ebx, ebx
movzx esi, word [rcx + rbx*2]
test si, si
je 0x140021d86
cmp dil, 0x2d
je 0x140021d4d
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x140021d4d
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x140021d86
movzx ebp, si
cmp ebp, r9d
cmovae esi, r9d
lea ebp, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bpl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x140021d86
mov dil, byte [rbx + r8 + 1]
inc rbx
cmp rbx, 0xe
jne 0x140021d2c
cmp word [rcx + 0x1c], 0
je 0x14002361f
mov rbp, qword [rdx + 8]
add rdx, 8
test rbp, rbp
jne 0x140021cff
mov rax, qword [rsp + 0x78]
add rax, 0x10
mov edi, 0xff
mov rdx, r14
movzx ebp, word [rdx]
cmp ebp, 0x2f
je 0x140021dcc
cmp ebp, 0x2d
jne 0x140021f04
lea rbp, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rbp, rbx
jmp 0x140021dd3
add rdx, 2
mov rbp, rdx
movzx edx, word [rbp]
test dx, dx
je 0x140021f04
movzx ebx, dx
cmp ebx, edi
cmovae edx, edi
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x68
jne 0x140021f04
movzx edx, word [rbp + 2]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140021f04
movzx edx, word [rbp + 4]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x61
jne 0x140021f04
movzx edx, word [rbp + 6]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x64
jne 0x140021f04
movzx edx, word [rbp + 8]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6c
jne 0x140021f04
movzx edx, word [rbp + 0xa]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140021f04
movzx edx, word [rbp + 0xc]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x73
je 0x1400235e5
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140021da8
mov r9d, 0xff
lea r8, str.remote_debugging_port
mov rbp, r14
mov rdx, r11
mov r15, qword [rsp + 0x78]
movzx ecx, word [rbp]
cmp ecx, 0x2f
je 0x140021f4d
cmp ecx, 0x2d
jne 0x140021fb3
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
jmp 0x140021f54
add rbp, 2
mov rcx, rbp
mov dil, 0x72
xor ebx, ebx
movzx esi, word [rcx + rbx*2]
test si, si
je 0x140021fb3
cmp dil, 0x2d
je 0x140021f7a
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x140021f7a
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x140021fb3
movzx ebp, si
cmp ebp, r9d
cmovae esi, r9d
lea ebp, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bpl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x140021fb3
mov dil, byte [rbx + r8 + 1]
inc rbx
cmp rbx, 0x15
jne 0x140021f59
cmp word [rcx + 0x2a], 0
je 0x14002361f
mov rbp, qword [rdx + 8]
add rdx, 8
test rbp, rbp
mov r13, r10
mov r12, r11
jne 0x140021f2c
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140021fe1
cmp byte [rax], 0
jne 0x140022013
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400233e2
xor edi, edi
jmp 0x140022018
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140021ffb
dec dword [r13]
mov r14, qword [r12]
mov edi, 1
test r14, r14
je 0x140022210
mov r11, rdi
lea rax, [r15 + 0x10]
mov r8d, 0xff
mov rbp, r14
mov rdx, r12
movzx ecx, word [rbp]
cmp ecx, 0x2d
je 0x14002205c
cmp ecx, 0x2f
je 0x140022dbe
mov rbp, qword [rdx + 8]
add rdx, 8
add rax, 8
test rbp, rbp
jne 0x140022034
jmp 0x140022126
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
mov dil, 0x6e
xor r9d, r9d
movzx esi, word [rcx + r9*2]
test si, si
je 0x140022046
cmp dil, 0x2d
je 0x140022095
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x140022095
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x140022046
movzx ebp, si
cmp ebp, r8d
cmovae esi, r8d
lea ebp, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp bpl, 0x1a
movzx ebp, bl
cmovae ebp, esi
cmp bpl, dil
jne 0x140022046
lea rbp, str.no_deelevate
mov dil, byte [r9 + rbp + 1]
inc r9
cmp r9, 0xc
jne 0x140022073
cmp word [rcx + 0x18], 0
jne 0x140022046
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x1400220d6
dec dword [r13]
mov r14, qword [r12]
xor r8d, r8d
jmp 0x140022129
lea rcx, [rsp + 0x1d8]
lea rsi, [rsp + 0x700]
mov rdx, rsi
call fcn.140024150
cmp byte [rsi + 0x10], 1
mov r14, qword [rsp + 0x60]
je 0x140022f64
mov qword [r14], 0
jmp 0x1400227ce
mov r8b, 1
test r14, r14
je 0x140022205
lea rcx, [r15 + 0x10]
mov r9d, 0xff
mov rbp, r12
movzx eax, word [r14]
cmp eax, 0x2d
je 0x140022167
cmp eax, 0x2f
je 0x140022dca
mov r14, qword [rbp + 8]
add rbp, 8
add rcx, 8
test r14, r14
jne 0x14002213f
jmp 0x140022205
lea rsi, [r14 + 2]
lea rax, [r14 + 4]
cmp word [r14 + 2], 0x2d
cmove rsi, rax
mov dil, 0x61
xor r10d, r10d
movzx eax, word [rsi + r10*2]
test ax, ax
je 0x140022151
cmp dil, 0x2d
je 0x14002219f
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x14002219f
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x140022151
movzx edx, ax
cmp edx, r9d
cmovae eax, r9d
lea edx, [rax - 0x41]
mov ebx, eax
or bl, 0x20
cmp dl, 0x1a
movzx edx, bl
cmovae edx, eax
cmp dl, dil
jne 0x140022151
lea rax, str.attempting_deelevation
mov dil, byte [r10 + rax + 1]
inc r10
cmp r10, 0x16
jne 0x14002217f
cmp word [rsi + 0x2c], 0
jne 0x140022151
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400221df
dec dword [r13]
lea eax, [r11 + 2]
test r8b, r8b
cmovne eax, r11d
or eax, 4
mov edi, eax
jmp 0x140022210
test r8b, r8b
mov rdi, r11
jne 0x140022210
or edi, 2
lea r9, [rsp + 0xd8]
mov qword [r9], 0
mov rdx, qword [r15]
lea rsi, [rsp + 0x198]
mov rcx, rsi
mov r8d, edi
call fcn.140032b80
cmp byte [rsi + 0x10], 1
je 0x140022f78
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x140022fb2
mov eax, dword [rsp + 0x198]
test eax, eax
jne 0x140022fbc
xor eax, eax
cmp edi, 4
setae al
lea ebx, [rax + rax]
inc ebx
lea rcx, [rsp + 0x1d8]
lea rsi, [rsp + 0x180]
mov rdx, rsi
call fcn.140024150
cmp byte [rsi + 0x10], 1
je 0x140023027
mov edx, dword [r13]
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0xd0]
mov rcx, rsi
mov r8, r15
xor r9d, r9d
call fcn.140024fb0
mov rdx, r15
mov r15, qword [rsi]
test r15, r15
je 0x140023061
lea rsi, [rsp + 0xc8]
mov rcx, rsi
call fcn.140024cb0
cmp byte [rsi + 1], 0
je 0x1400230af
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xa4], ebx
mov qword [rsp + 0x80], rdi
xor eax, eax
lea rcx, [rsp + 0x160]
mov qword [rcx - 0x20], rax
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], 3
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
call fcn.140023d20
test al, al
jne 0x1400230eb
lea rdi, [rsp + 0x148]
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov r14, rax
mov ecx, 0xfffffff5
call rsi
mov r12, rax
mov ecx, 0xfffffff4
call rsi
mov rsi, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x1400223a8
mov rcx, r14
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400223a8
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x140023346
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], r14
inc qword [rsp + 0x150]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x1400223fb
mov rcx, r12
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400223fb
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x140023363
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], r12
inc qword [rsp + 0x150]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14002244e
mov rcx, rsi
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14002244e
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x140023380
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], rsi
inc qword [rsp + 0x150]
lea rcx, [rsp + 0x140]
lea rdi, [rsp + 0x128]
lea rbx, [rsp + 0x700]
mov rdx, rdi
mov r8, rbx
call fcn.140032650
cmp byte [rdi + 0x10], 1
je 0x1400230f8
mov qword [rsp + 0x90], r15
xor edi, edi
cmp byte [rsp + 0x128], 0
je 0x140023105
mov r13d, 0x80404
cmp qword [rsp + 0x150], 0
mov r15, qword [rsp + 0x78]
je 0x1400224ce
or byte [rsp + 0x73d], 1
mov qword [rsp + 0x750], r14
mov qword [rsp + 0x758], r12
mov qword [rsp + 0x760], rsi
mov edi, 1
xorps xmm6, xmm6
lea rsi, [rsp + 0x2c0]
movaps xmmword [rsi], xmm6
movaps xmmword [rsi + 0x50], xmm6
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
mov qword [rsi + 0x60], 0
mov dword [rsi], 0x68
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsi + 0x3d], 8
mov rbp, qword [rsp + 0xa8]
je 0x140022526
mov rax, qword [rsp + 0x2d8]
test rax, rax
jne 0x14002346a
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], 0
mov rdx, qword [r15]
cmp qword [rsp + 0x88], 0
jne 0x140023115
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
mov rcx, rdx
mov r15, qword [rsp + 0x90]
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140023164
mov r13, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
test byte [rsp + 0x80], 1
je 0x1400231cf
lea rsi, [rsp + 0xb40]
mov rcx, rsi
mov rdx, r13
call fcn.140031d30
mov r12, qword [rsi]
mov r15, qword [rsp + 0x78]
mov rdx, qword [rbp]
test rdx, rdx
je 0x140022673
mov r8d, 0xff
movzx ecx, word [rdx]
cmp ecx, 0x2d
je 0x1400225ff
cmp ecx, 0x2f
je 0x140022dd6
mov rdx, qword [rbp + 8]
add rbp, 8
test rdx, rdx
jne 0x1400225df
jmp 0x140022673
lea rcx, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, rbx
mov bl, 0x64
xor edx, edx
movzx edi, word [rcx + rdx*2]
test di, di
je 0x1400225f0
cmp bl, 0x2d
je 0x140022634
lea esi, [rbx - 0x30]
cmp sil, 0xa
jb 0x140022634
lea esi, [rbx - 0x61]
cmp sil, 0x19
ja 0x1400225f0
movzx esi, di
cmp esi, r8d
cmovae edi, r8d
lea esi, [rdi - 0x41]
mov eax, edi
or al, 0x20
cmp sil, 0x1a
movzx eax, al
cmovae eax, edi
cmp al, bl
jne 0x1400225f0
lea rax, str.disabledynamicblocklist
mov bl, byte [rdx + rax + 1]
inc rdx
cmp rdx, 0x17
jne 0x140022614
cmp word [rcx + 0x2e], 0
jne 0x1400225f0
mov sil, 1
jmp 0x140022675
xor esi, esi
cmp byte [rsp + 0xc8], 0
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x1d8]
pxor xmm0, xmm0
movdqa xmmword [rcx - 0x28], xmm0
movdqa xmmword [rcx - 0x18], xmm0
mov byte [rcx - 8], 0
setne bl
call fcn.140023c20
or bl, sil
mov rdx, qword [r15]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea rsi, [rsp + 0x110]
mov rcx, rsi
mov r8, r13
mov r9d, dword [rsp + 0xa4]
call fcn.140031f70
cmp byte [rsi + 0x10], 1
je 0x1400231d7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
je 0x140023205
test byte [rsp + 0x80], 1
je 0x14002325f
mov rcx, r13
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400232e3
lea rdx, [rsp + 0xb40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400232e3
mov eax, dword [rsp + 0xb40]
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rcx + 4], 1
lea rax, [r12 + 1]
cmp rax, 2
jb 0x140022762
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140022775
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
jb 0x14002279d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x140]
call fcn.140031bc0
test r15, r15
je 0x1400227b8
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
mov rbp, qword [rsp + 0x98]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140023301
cmp rdi, 8
setae al
and bl, al
cmp bl, 1
je 0x1400229a3
lea rcx, [rsp + 0x1d8]
call fcn.140024750
jmp 0x140021407
mov rcx, rbp
mov rdx, rsi
call fcn.14000cb10
jmp 0x140021892
mov rcx, rdi
mov rdx, rbp
call fcn.14000cb10
jmp 0x1400215d9
cmp byte [rsp + 0x2d8], 1
je 0x14002339d
mov r8d, dword [rsp + 0x2c0]
lea rdi, [rsp + 0x1b0]
mov rcx, rdi
mov rdx, rsi
call fcn.140024400
cmp byte [rdi + 0x18], 1
je 0x1400233bc
cmp byte [rsp + 0x158], 0
jne 0x1400233db
movdqu xmm0, xmmword [rsp + 0x1b0]
movq xmm1, qword [rsp + 0x150]
movq xmm2, qword [rsp + 0x1c0]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x140]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor edi, edi
cmp eax, 0xffff
sete dil
xor esi, esi
jmp 0x1400211bf
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400233f5
mov rsi, qword [rsp + 0x700]
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
jne 0x140023432
mov qword [rsp + 0x1f8], rsi
mov eax, dword [rsp + 0x2c0]
cmp eax, 2
jne 0x140022b8c
mov r14d, 1
jmp 0x140021503
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022e37
mov rsi, qword [rsp + 0x700]
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
jne 0x14002343d
mov qword [rsp + 0x1f8], rsi
mov eax, dword [rsp + 0x2c0]
dec eax
cmp eax, 1
jbe 0x14002181b
jmp 0x140022e37
inc rdi
movabs rax, 0x7ffffffffffff800
test rdi, rax
jne 0x140022b9d
mov rcx, rbp
call qword [sym.imp.mozglue.dll_free]
jmp 0x1400227e0
cmp eax, 2
jne 0x140022e37
lea rcx, [rsp + 0x1d8]
lea rsi, [rsp + 0x700]
mov rdx, rsi
call fcn.140025b50
cmp byte [rsi + 0x20], 0
jne 0x140022e37
cmp qword [rsp + 0x2b0], 0
je 0x14002347f
mov eax, dword [rsp + 0x710]
cmp qword [rsp + 0x718], 8
jb 0x140022a1b
mov rsi, qword [rsp + 0x700]
add eax, eax
add eax, 2
mov rcx, qword [rsp + 0x1f8]
cmp qword [rsp + 0x2b8], 8
jb 0x140022a3b
mov rbp, qword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rbp
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov cl, byte [rsp + 0x720]
test eax, eax
jne 0x1400234a9
test cl, cl
jne 0x140022e37
lea rcx, [rsp + 0x700]
mov rbp, qword [rcx]
mov r14, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
call fcn.14001ea50
jmp 0x140021a1c
cmp eax, 2
jne 0x1400234c3
lea rcx, [rsp + 0x1d8]
lea rdi, [rsp + 0x700]
mov rdx, rdi
call fcn.140032270
cmp byte [rdi + 0x10], 0
jne 0x14002330f
lea rcx, [rsp + 0x1d8]
lea rdi, [rsp + 0x2c0]
mov rdx, rdi
mov r8d, esi
call fcn.140031cd0
cmp byte [rdi + 0x10], 0
je 0x1400216a2
movdqu xmm0, xmmword [rsp + 0x2c0]
jmp 0x140023318
test r14d, r14d
jne 0x1400234db
lea rsi, [rsp + 0x700]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1e0]
mov qword [rcx - 8], rax
xor eax, eax
jmp 0x1400216d3
mov rdx, rbx
mov r9, rsi
call fcn.14000cb10
jmp 0x1400219f3
mov qword [rsp + 0x20], 0xa
lea r9, str.Blocklist
mov edx, 0xa
mov rcx, rbp
call fcn.14000a250
jmp 0x1400218eb
mov qword [rsp + 0x20], 6
lea r9, str.Image
mov edx, 6
mov rcx, rdi
call fcn.14000a250
jmp 0x140021633
cmp eax, 1
jne 0x140023537
xor r14d, r14d
jmp 0x140021503
mov rax, qword [rbp - 8]
add rbp, 0xfffffffffffffff8
sub rbp, rax
cmp rbp, 0x20
jae 0x14002364d
mov rbp, rax
jmp 0x1400229b9
add rax, 2
mov rbx, rax
jmp 0x140020f4b
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [rsp + 0x150], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rax
movabs rax, 0x800700c100000024
mov qword [rsp + 0x148], rax
xor eax, eax
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.140033b20
xor r13d, r13d
lea rbx, [rsp + 0x700]
jmp 0x14002180c
add r8, 2
mov rax, r8
jmp 0x140021002
add rax, 2
mov rbp, rax
jmp 0x140021246
mov ebx, eax
or ebx, 0x10000000
lea rdi, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
mov r13d, 0x502
lea rcx, [rsp + 0x700]
mov qword [rcx], rdi
mov dword [rcx + 8], r13d
mov dword [rcx + 0xc], ebx
xor r14d, r14d
xor edx, edx
call fcn.140033b20
jmp 0x1400211e4
xor edi, edi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400211bf
cmp eax, 0x57
je 0x1400211bf
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r13d, 0x5c
jmp 0x1400211b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov byte [rsp + 0x718], 1
mov r13d, 0x1e
jmp 0x1400211b5
mov rdi, qword [rsp + 0x708]
mov r13d, dword [rsp + 0x710]
mov sil, 1
mov ebx, dword [rsp + 0x714]
jmp 0x1400211bf
mov ebx, dword [rsp + 0x14c]
cmp ebx, 0xd000003a
jne 0x14002332e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
lea rdx, [rsp + 0x140]
mov qword [rdx], rax
lea rdi, [rsp + 0x2c0]
mov rcx, rdi
call fcn.140038a20
cmp byte [rdi + 0x18], 1
jne 0x140023501
mov rdi, qword [rsp + 0x2c8]
mov r13d, dword [rsp + 0x2d0]
mov sil, 1
mov ebx, dword [rsp + 0x2d4]
jmp 0x14002351b
cmp byte [rax], 0
je 0x1400211fa
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov r14b, 1
jmp 0x1400211fa
lea rax, str.force_launcher
mov dil, byte [r9 + rax + 1]
inc r9
cmp r9, 0xe
jne 0x14002147d
cmp word [rdx + 0x1c], 0
jne 0x1400214ca
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140022d8d
mov rax, qword [rsp + 0x90]
dec dword [rax]
xor r13d, r13d
xor r10d, r10d
jmp 0x1400214de
add rbx, 2
mov rdx, rbx
jmp 0x140021477
add rbp, 2
mov rcx, rbp
jmp 0x14002206d
add r14, 2
mov rsi, r14
jmp 0x140022179
add rdx, 2
mov rcx, rdx
jmp 0x140022610
mov eax, 0x42
mov ecx, 0x8007065d
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs rbp, 0xffffff0000000000
and rbp, rdx
mov ebx, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, rbp
or rbx, rdx
mov qword [rsp + 0x140], rbx
mov dword [rsp + 0x148], eax
mov dword [rsp + 0x14c], ecx
jmp 0x140023321
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1d0], 0
xor ebp, ebp
xor edi, edi
xor ebx, ebx
xor eax, eax
jmp 0x140021a40
cmp byte [rax], 0
je 0x1400217f3
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140021809
cmp word [rax], 0
je 0x140022c13
xor r13d, r13d
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul esi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140038b40
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140022c16
mov eax, dword [0x140061cf8]
mov ecx, dword [0x1400614b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140023653
mov rax, qword [0x140061cf0]
test rax, rax
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
je 0x140021a6c
lea rdx, [rsp + 0x700]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [case.0x14002eb7e.0]
jmp 0x140021a6c
mov rbp, qword [rsp + 0x98]
lea rcx, [rsp + 0x700]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000158
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
jmp 0x14002211a
add rbp, 2
mov rbx, rbp
jmp 0x140021af1
lea rcx, [rsp + 0x700]
xor edx, edx
call fcn.140033b20
jmp 0x14002211a
lea rcx, [rsp + 0x198]
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rsi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
jmp 0x1400227c0
mov ebx, 4
jmp 0x140022274
xor ebx, ebx
cmp eax, 1
jne 0x140022274
mov ebx, 2
test dil, 3
jne 0x140022274
mov ebx, 5
cmp edi, 3
ja 0x140022274
mov edx, dword [r13]
lea rsi, [rsp + 0x700]
mov rcx, rsi
mov r8, r15
call fcn.140033de0
cmp byte [rsi + 0x10], 1
jne 0x14002362f
xor esi, esi
lea rcx, [rsp + 0x700]
xor edx, edx
call fcn.140033b20
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x14002363d
lea rcx, [rsp + 0x180]
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
jmp 0x1400227c0
lea rcx, [rsp + 0x700]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x80070507000001a0
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
jmp 0x1400227b8
lea rcx, [rsp + 0x700]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x80070057000001a7
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
jmp 0x1400231b8
or byte [rsp + 0x147], 0x10
jmp 0x140022328
lea rcx, [rsp + 0x128]
jmp 0x140023198
mov r13d, 0x404
mov r15, qword [rsp + 0x78]
jmp 0x1400224ce
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov r8, r15
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14002258b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb40]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1e6
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.140033b20
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
lea rcx, [rsp + 0x140]
call fcn.140031bc0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
jmp 0x1400227af
xor r12d, r12d
jmp 0x1400225c7
lea rcx, [rsp + 0x110]
xor edx, edx
call fcn.140033b20
mov rcx, r13
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x1400232f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb40]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x201
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.140033b20
mov rcx, r13
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x14002274e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
xor edi, edi
neg eax
mov esi, 0
sbb esi, esi
mov dword [rsp + 0x80], 0
test ebp, ebp
jne 0x14002328e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x80], eax
or esi, 0x2710
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
test ebp, ebp
jne 0x1400232ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [rsp + 0x80]
mov ebx, esi
sub ebx, edi
jbe 0x1400232e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r13
mov edx, ebx
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x1400232e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x1400232e3
mov ecx, 0xa
call r15
jmp 0x14002329b
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov byte [rax + 4], 1
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
jmp 0x14002274e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400227ce
movdqu xmm0, xmmword [rsp + 0x700]
movdqa xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x150], 1
jmp 0x140022bfa
mov rdi, qword [rsp + 0x140]
mov sil, 1
mov r13d, dword [rsp + 0x148]
jmp 0x1400211bf
mov rcx, rdi
call fcn.140038ce0
test al, al
je 0x1400223a8
mov rax, qword [rsp + 0x150]
jmp 0x140022394
mov rcx, rdi
call fcn.140038ce0
test al, al
je 0x1400223fb
mov rax, qword [rsp + 0x150]
jmp 0x1400223e7
mov rcx, rdi
call fcn.140038ce0
test al, al
je 0x14002244e
mov rax, qword [rsp + 0x150]
jmp 0x14002243a
mov rdi, qword [rsp + 0x2c8]
mov r13d, dword [rsp + 0x2d0]
mov sil, 1
mov ebx, dword [rsp + 0x2d4]
jmp 0x1400211bf
mov rdi, qword [rsp + 0x1b0]
mov r13d, dword [rsp + 0x1b8]
mov sil, 1
mov ebx, dword [rsp + 0x1bc]
jmp 0x1400211bf
xor edi, edi
jmp 0x14002288e
cmp byte [rax], 0
mov edi, 0
jne 0x140022013
jmp 0x140022018
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa4
mov byte [rsp + 0x150], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rdx
mov dword [rsp + 0x148], eax
mov dword [rsp + 0x14c], ecx
jmp 0x140022bfa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400228fb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140022984
lea rbx, [rsp + 0x700]
jmp 0x140021795
lea rcx, [rsp + 0x1f0]
mov qword [rcx - 8], 0
jmp 0x1400217c9
or byte [rsp + 0x73d], 8
mov qword [rsp + 0x718], rax
jmp 0x140022526
lea rdx, [rsp + 0x200]
mov rcx, rbp
call fcn.1400242f0
lea rdx, str.Blocklist
mov r8d, 0xa
mov rcx, rbp
call fcn.14000a1e0
jmp 0x140022a01
test cl, cl
jne 0x140022e37
lea rcx, [rsp + 0x700]
call fcn.14001ea50
jmp 0x140022e37
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3e
jmp 0x140022dec
mov byte [rsp + 0x150], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rax
movabs rax, 0x8007050700000118
jmp 0x140022bf2
lea rcx, [rsp + 0x700]
lea rdx, [rsp + 0x2c0]
call fcn.140038ab0
movzx edi, al
xor esi, esi
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400211bf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400211bf
mov eax, 0xb3
mov ecx, 0x80070507
jmp 0x140023408
movzx edx, word [rbp + 0xe]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x74
jne 0x140021cdc
movzx edx, word [rbp + 0x10]
test dx, dx
je 0x140021cdc
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x74
jne 0x140021cdc
movzx edx, word [rbp + 0x12]
test dx, dx
je 0x140021cdc
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140021cdc
cmp word [rbp + 0x14], 0
jne 0x140021cdc
jmp 0x14002361f
movzx edx, word [rbp + 0xe]
test dx, dx
je 0x140021f04
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x73
jne 0x140021f04
cmp word [rbp + 0x10], 0
jne 0x140021f04
mov r13, r10
mov r12, r11
mov r15, qword [rsp + 0x78]
jmp 0x140022013
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov sil, 1
mov r14, qword [rsp + 0x60]
mov byte [r14 + 4], sil
xor esi, esi
jmp 0x140022f9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [0x140061cf8]
call fcn.14002e2bc
cmp dword [0x140061cf8], 0xffffffff
jne 0x140022edd
call fcn.140038c70
lea rcx, [0x140061cf8]
call fcn.14002e25c
jmp 0x140022edd