Function at 0x140005d20
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create thread
Get common file path
Get file attributes
Move file
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf08
movaps xmmword [rsp + 0xef0], xmm6
mov r13, rdx
mov r12d, ecx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xee8], rax
lea rcx, [0x14003c3ab]
call fcn.1400210a4
test rax, rax
je 0x140005d6c
cmp byte [rax], 0
setne al
jmp 0x140005d6e
xor eax, eax
mov byte [0x140047a88], al
lea rcx, str.MOZ_USING_SERVICE
call fcn.14001e0ac
cmp r12d, 3
jg 0x140005daf
mov ecx, 2
call fcn.140016378
lea rcx, str.Usage:_updater_patch_dir_install_dir_apply_to_dir__wait_pid__callback_working_dir_callback_path_args...___n
mov edx, 0x6a
mov r8d, 1
mov r9, rax
call fcn.140020dcc
jmp 0x1400062e2
lea r15, [r13 + 8]
mov rdx, qword [r13 + 8]
lea rsi, [0x140047250]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
mov word [0x140047456], 0
lea rdi, [rsp + 0xce0]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.140015b80
lea r8, str._supdate_elevated.lock
mov edx, 0x104
mov rcx, rdi
mov r9, rsi
call fcn.140004840
mov al, 1
cmp byte [0x140047a88], 0
jne 0x140005e2f
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x140005e2d
call fcn.14001b3d4
cmp dword [rax], 2
setne al
jmp 0x140005e2f
xor eax, eax
mov byte [0x140047c98], al
mov rcx, qword [r15]
call fcn.140011b60
test al, al
je 0x140005f14
mov rcx, qword [r13 + 0x10]
call fcn.140011b60
test al, al
je 0x140005f2d
mov rdx, qword [r13 + 0x10]
lea rsi, [0x140047a90]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
mov word [0x140047c96], 0
mov rcx, rsi
mov dx, 0x5c
call fcn.140015ee8
test rax, rax
je 0x140005e95
cmp word [rax + 2], 0
jne 0x140005e95
mov word [rax], 0
lea r8, str._s_update.status
lea r9, [0x140047250]
lea rsi, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call fcn.140004840
lea rdx, [0x14003da44]
mov rcx, rsi
call fcn.14001f0a4
test rax, rax
je 0x140005f65
mov rbp, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0xad0]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.140020b08
mov rdi, rax
mov rcx, rbp
call fcn.14002065c
test eax, eax
je 0x140005f72
mov dword [rsp + 0x48], 0
jmp 0x14000606c
mov rsi, qword [r15]
mov ecx, 2
call fcn.140016378
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application___S__n
jmp 0x1400062d7
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4b
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov rsi, qword [r13 + 0x10]
mov ecx, 2
call fcn.140016378
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application___S__n
jmp 0x1400062d7
mov dword [rsp + 0x48], 0
jmp 0x140006074
mov byte [rsp + rdi + 0xad0], 0
lea r14, [rsp + 0xad0]
mov rcx, r14
mov edx, 0x3a
call fcn.140015d10
mov rdi, rax
test rax, rax
jne 0x140005fc4
lea rcx, [rsp + 0xad0]
mov edx, 0xa
call fcn.140015d10
test rax, rax
jne 0x140005fc4
lea rcx, [rsp + 0xad0]
call fcn.140021560
add rax, rsp
add rax, 0xad0
sub rax, r14
cmp rax, 0xf
jne 0x140005ff6
movabs rax, 0x2d676e69646e6570
xor rax, qword [rsp + 0xad0]
movabs rcx, 0x656369767265732d
xor rcx, qword [rsp + 0xad7]
or rcx, rax
je 0x140006066
test rdi, rdi
jne 0x14000602d
lea rcx, [rsp + 0xad0]
mov edx, 0xa
call fcn.140015d10
mov rdi, rax
test rax, rax
jne 0x14000602d
lea rcx, [rsp + 0xad0]
call fcn.140021560
lea rdi, [rsp + rax]
add rdi, 0xad0
sub rdi, r14
cmp rdi, 0xf
jne 0x140005f07
movabs rax, 0x2d6465696c707061
xor rax, qword [rsp + 0xad0]
movabs rcx, 0x656369767265732d
xor rcx, qword [rsp + 0xad7]
or rcx, rax
sete al
jmp 0x140006068
mov al, 1
mov dword [rsp + 0x48], eax
mov rcx, rbp
call fcn.140020548
xor edi, edi
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebp, 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareClassesApplications
mov rbx, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbx
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
lea rdx, str.SoftwareClassesApplicationsupdater.exe
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x140006173
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.IsHostApp
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoOpenWith
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoStartPage
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12d, 5
jb 0x1400061a9
mov rcx, qword [r13 + 0x20]
call fcn.14001f368
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400061ae
mov rcx, qword [r13 + 0x20]
lea rdx, str._replace
call fcn.140015f9c
test rax, rax
je 0x1400061b8
lea rax, [0x140047c99]
jmp 0x1400061b5
xor r14d, r14d
jmp 0x1400061b8
lea rax, [0x140047458]
mov byte [rax], 1
mov rcx, qword [r13 + 0x18]
call fcn.140011b60
test al, al
je 0x1400062a4
mov rdx, qword [r13 + 0x18]
lea rsi, [0x140047460]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
mov word [0x140047666], 0
mov rcx, rsi
mov dx, 0x5c
call fcn.140015ee8
test rax, rax
je 0x140006208
cmp word [rax + 2], 0
jne 0x140006208
mov word [rax], 0
cmp r12d, 7
jb 0x1400063bc
mov rcx, qword [r13 + 0x30]
call fcn.140011b60
test al, al
je 0x140006315
lea rsi, [0x140047a90]
mov rcx, rsi
call fcn.1400136b0
mov rdi, rax
lea rbp, [rsp + 0x270]
mov r8d, 0x208
mov rcx, rbp
xor edx, edx
call fcn.140015b80
mov rdx, qword [r13 + 0x30]
mov rcx, rbp
mov r8, rdi
call fcn.140013870
mov rcx, rsi
mov rdx, rbp
call fcn.140021d74
test eax, eax
je 0x14000634a
lea rsi, [rsp + 0xad0]
mov rcx, rsi
mov r9d, 0x4e
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov rsi, qword [r13 + 0x30]
mov ecx, 2
call fcn.140016378
lea rdx, str.The_callback_file_must_be_located_in_the_installation_directory___S__n
jmp 0x1400062d7
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4c
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov rsi, qword [r13 + 0x18]
mov ecx, 2
call fcn.140016378
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
mov r8, rsi
call fcn.140001260
mov esi, 1
mov rcx, qword [rsp + 0xee8]
xor rcx, rsp
call fcn.140023af0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xef0]
add rsp, 0xf08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4d
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov rsi, qword [r13 + 0x30]
mov ecx, 2
call fcn.140016378
lea rdx, str.The_callback_file_path_is_not_valid_for_this_application___S__n
jmp 0x1400062d7
cmp r12d, 8
jb 0x140006397
lea edi, [r12 - 6]
dec rdi
xor ebp, ebp
lea rsi, str.backgroundtask
mov rcx, qword [r13 + rbp*8 + 0x38]
movzx eax, word [rcx]
or eax, 2
cmp ax, 0x2f
jne 0x14000638f
cmp word [rcx + 2], 0x2d
je 0x14000637f
add rcx, 2
jmp 0x140006383
add rcx, 4
mov rdx, rsi
call fcn.140021d74
test eax, eax
je 0x1400063b4
inc rbp
cmp rdi, rbp
jne 0x140006361
lea rcx, str.MOZ_APP_SILENT_START
call fcn.1400210a4
test rax, rax
je 0x1400063b0
cmp byte [rax], 0
setne al
jmp 0x1400063b6
xor eax, eax
jmp 0x1400063b6
mov al, 1
mov byte [0x140047c9a], al
lea rcx, [rsp + 0xad0]
mov r8d, 0x20a
xor edx, edx
call fcn.140015b80
cmp byte [0x140047c98], 0
je 0x140006402
lea rsi, [0x140047250]
mov rcx, rsi
call fcn.140012230
lea rdx, [0x14003d7be]
lea r8, [rsp + 0xad0]
mov rcx, rsi
call fcn.140012090
jmp 0x140006422
lea r8, str._supdate.log
lea r9, [0x140047250]
lea rcx, [rsp + 0xad0]
mov edx, 0x105
call fcn.140004840
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007d59
lea rcx, [0x140047ea8]
lea rdx, [rsp + 0xad0]
call fcn.140011670
lea rcx, str.applying
call fcn.140008470
test al, al
je 0x1400064a2
cmp byte [0x140047458], 1
jne 0x1400064e4
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007e9e
lea rsi, str.Performing_a_staged_update
jmp 0x140006519
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007d9a
lea rcx, [0x140047ea8]
lea rdx, str.failed_setting_status_to_applying
call fcn.1400116d0
call fcn.140008580
jmp 0x1400062e2
cmp byte [0x140047c99], 1
jne 0x140006528
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007eb3
lea rsi, str.Performing_a_replace_request
lea rcx, [0x140047ea8]
mov rdx, rsi
call fcn.1400116d0
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007ddb
lea rcx, [0x140047ea8]
lea rdx, str.PATCH_DIRECTORY__S
lea r8, [0x140047250]
call fcn.1400116d0
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007e1c
lea rcx, [0x140047ea8]
lea rdx, str.INSTALLATION_DIRECTORY__S
lea r8, [0x140047a90]
call fcn.1400116d0
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007e5d
lea rcx, [0x140047ea8]
lea rdx, str.WORKING_DIRECTORY__S
lea rsi, [0x140047460]
mov r8, rsi
call fcn.1400116d0
lea rdx, [0x140047a90]
mov r8d, 0x104
mov rcx, rsi
call fcn.14001eed0
test eax, eax
je 0x1400066c3
cmp byte [0x140047458], 0
jne 0x14000661b
cmp byte [0x140047c99], 0
je 0x140006999
lea r8, [0x14003d2d0]
lea r9, [0x140047460]
lea rsi, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call fcn.140004840
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140006935
lea rdx, [0x140047a90]
lea rcx, [rsp + 0x270]
mov r8d, 0x104
call fcn.14001eed0
test eax, eax
je 0x1400066c3
lea rsi, [rsp + 0x8c0]
mov rcx, rsi
mov r9d, 0x48
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007efb
lea rcx, [0x140047ea8]
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
jmp 0x1400064d5
test r14, r14
jle 0x140006735
mov ecx, 0x100000
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140006735
mov rsi, rax
mov rcx, rax
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140006735
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007fff
lea rcx, [0x140047ea8]
lea rdx, str.The_parent_process_didnt_exit__Continuing_with_update.
call fcn.1400116d0
cmp byte [0x140047c99], 0
jne 0x140006747
cmp byte [0x140047458], 1
jne 0x14000677e
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
mov rcx, rsi
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000677e
lea rcx, [rsp + 0x270]
call fcn.14001e844
mov r14, 0xffffffffffffffff
cmp byte [0x140047a88], 0
je 0x140006900
cmp byte [0x140047458], 1
jne 0x1400067a9
lea rcx, [0x140047460]
xor edx, edx
call fcn.140008770
cmp byte [0x140047c99], 0
jne 0x1400067d0
lea rcx, [0x140047460]
call fcn.14001f1d0
test eax, eax
je 0x1400067d0
call fcn.14001b3d4
cmp dword [rax], 0x11
jne 0x1400064da
lea rcx, [0x140047460]
lea rdx, [rsp + 0x8c0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400069ef
mov rdi, 0xffffffffffffffff
cmp r12d, 7
jb 0x140006af0
lea rcx, [rsp + 0x680]
mov ebp, 0x208
mov r8d, 0x208
xor edx, edx
call fcn.140015b80
lea r15, [r13 + 0x30]
mov rsi, qword [r13 + 0x30]
lea rbx, [rsp + 0x270]
mov r8d, 0x410
mov rcx, rbx
xor edx, edx
call fcn.140015b80
cmp byte [0x140047c99], 1
jne 0x140006aba
mov rcx, rsi
lea rdx, [0x140047a90]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
movsxd rsi, eax
mov rdx, qword [r15]
mov rcx, rbx
mov r8, rsi
call fcn.140013870
lea rdi, [rsp + rsi*2]
add rdi, 0x270
sub rbp, rsi
mov qword [rsp + 0x48], r14
lea rax, [0x140047a90]
lea r14, [rax + rsi*2]
mov rcx, rdi
mov rdx, r14
mov r8, rbp
call fcn.140013870
mov rcx, r14
call fcn.1400136b0
lea rdi, [rdi + rax*2]
add rdi, 2
mov dword [rdi - 2], 0x5c
not rax
add rbp, rax
lea r14, [rsp + 0x60]
mov rcx, r14
lea rdx, [0x140047a90]
call fcn.140013600
mov rcx, qword [r15]
mov rdx, r14
mov r14, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
movsxd rdx, eax
cmp rdx, rsi
cmovb rdx, rsi
add rdx, rdx
add rdx, qword [r15]
mov rcx, rdi
mov r8, rbp
call fcn.140013870
jmp 0x140006abd
mov al, byte [0x140047458]
cmp r12d, 6
jbe 0x140006a92
test al, 1
jne 0x140006a9a
cmp byte [0x140047c99], 1
je 0x140006d56
mov r9, qword [r13 + 0x30]
lea r8, str._s.update_in_progress.lock
jmp 0x140006aa8
lea rsi, [rsp + 0x8c0]
mov rcx, rsi
mov r9d, 0x47
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140047ea8]
lea rdx, str.Error_calling_PathRemoveFileSpecW:__lu
mov r8d, eax
call fcn.1400116d0
jmp 0x1400064da
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4a
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f7d
lea rcx, [0x140047ea8]
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
jmp 0x1400064d5
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x41
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007fbe
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_unable_to_find_apply_to_dir:__S
lea r8, [0x140047460]
call fcn.1400116d0
call fcn.140008580
cmp r14, 0xffffffffffffffff
je 0x140006a60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x140006d1a
call fcn.14001b3d4
cmp r12d, 7
jb 0x1400062e2
cmp dword [rax], 2
je 0x140006d24
jmp 0x1400062e2
test al, 1
je 0x140006d42
lea r8, str._s_updated.update_in_progress.lock
lea r9, [0x140047a90]
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
jmp 0x140006d95
mov rbx, rsi
lea rdx, [rsp + 0x680]
mov rcx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140007033
mov rdi, 0xffffffffffffffff
cmp byte [0x140047c99], 0
je 0x1400070d6
cmp byte [0x140047458], 0
jne 0x140006b4a
cmp byte [0x140047c99], 0
jne 0x140006b4a
lea rax, str.tobedeleted
mov qword [rsp + 0x20], rax
lea rsi, [0x140047ca0]
lea r8, str._s__s
lea r9, [0x140047460]
mov edx, 0x104
mov rcx, rsi
call fcn.140004840
mov rcx, rsi
xor edx, edx
call fcn.14001e784
test eax, eax
je 0x140006b4a
lea rcx, [0x140047ca0]
call fcn.14001f1d0
lea rax, [0x140008a90]
lea rsi, [rsp + 0x270]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
lea rax, [rsp + 0x680]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b0f0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.14001a538
mov qword [rsi], rax
test rax, rax
je 0x140006bc1
cmp byte [0x140047458], 0
jne 0x140006bc1
cmp byte [0x140047c99], 1
je 0x140006bc1
cmp byte [0x140047c9a], 0
jne 0x140006bc1
xor ecx, ecx
mov dl, 1
call fcn.140001fc0
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 7
jb 0x140006c54
cmp byte [0x140047c99], 0
jne 0x140006c54
cmp rdi, 0xffffffffffffffff
je 0x140006bfb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140047880]
call fcn.14001f2e8
test eax, eax
je 0x140006c54
call fcn.14001b3d4
cmp dword [rax], 2
je 0x140006c54
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000819a
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_non_fatal_error_removing_backup_of_callback_app_file__path:__S
lea r8, [0x140047880]
call fcn.1400116d0
cmp byte [0x140047458], 0
jne 0x1400073a5
cmp byte [0x140047c99], 0
jne 0x1400073a5
lea rcx, [0x140047ca0]
call fcn.14001f340
test eax, eax
je 0x1400073a5
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008103
call fcn.14001b3d4
mov r9d, dword [rax]
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_unable_to_remove_directory:__S__err:__d
lea r8, str.tobedeleted
call fcn.1400116d0
lea rcx, [0x140047ca0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [0x1400480b8]
mov edx, dword [0x140045e5c]
mov rbp, qword gs:[0x58]
mov rdx, qword [rbp + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140007380
cmp ecx, edx
jg 0x140008185
lea rsi, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x14000738f
cmp r12d, 7
jb 0x1400062e2
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
jmp 0x1400076af
mov r14, 0xffffffffffffffff
cmp byte [0x140047c99], 1
jne 0x1400067b2
lea rdx, [0x140047a90]
lea rsi, [rsp + 0x270]
mov rcx, rsi
call fcn.140013600
mov rcx, rsi
mov dx, 0x5c
call fcn.140015ee8
mov word [rax], 0
lea r8, str._smoz_update_in_progress.lock
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
mov r9, rsi
call fcn.140004840
lea rcx, [rsp + 0x8c0]
call fcn.14001f2e8
test eax, eax
je 0x140006db9
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x14000701a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0x8c0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
lea rcx, [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006e15
lea rdx, str.SeAssignPrimaryTokenPrivilege
mov r8d, 0x22
xor ecx, ecx
call fcn.140011340
cmp r14, 0xffffffffffffffff
jne 0x140006792
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x140006e3e
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x140007242
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0xce0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140007242
mov r14, rax
lea edx, [r12 - 1]
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov r8, r15
call fcn.140001080
mov rbx, qword [rsi]
test rbx, rbx
je 0x140007456
cmp byte [rsp + 0x48], 0
je 0x140007965
lea rcx, [0x140047a90]
call fcn.140011800
test al, al
je 0x140007965
lea rdx, [rsp + 0x270]
mov dword [rdx], 0
mov rcx, qword [r13]
call fcn.140012a20
test eax, eax
je 0x140007965
cmp dword [rsp + 0x270], 0
je 0x140007965
lea rcx, [rsp + 0x270]
call fcn.140012ac0
test eax, eax
je 0x140006f09
cmp dword [rsp + 0x270], 0
jne 0x140007965
lea rcx, [0x140047a90]
lea rdx, [rsp + 0x270]
call fcn.1400012d0
test eax, eax
je 0x140007965
lea rax, [rsp + 0x680]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x270]
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006f69
mov rcx, qword [rsp + 0x680]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x690], xmm0
movaps xmmword [rsp + 0x680], xmm0
mov qword [rsp + 0x69d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d9ea]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x1400076e3
lea rdx, [0x14003da44]
lea rcx, [rsp + 0x270]
call fcn.14001f0a4
test rax, rax
je 0x1400076e1
mov rsi, rax
lea rcx, [rsp + 0x680]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140020b08
cmp rax, 1
sete dil
jne 0x14000700d
mov byte [rsp + 0x6a4], 0
mov rcx, rsi
call fcn.140020548
jmp 0x1400076e3
cmp byte [0x140047c99], 1
jne 0x1400071e3
lea rcx, str.pending
jmp 0x140007205
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x42
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008081
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_unable_to_find_callback_file:__S
mov r8, rbx
call fcn.1400116d0
call fcn.140008580
cmp r14, 0xffffffffffffffff
je 0x14000709d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x1400070bc
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x1400062e2
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
mov edx, r12d
mov r8, r15
jmp 0x1400076af
lea rcx, [rsp + 0x8c0]
call fcn.1400136b0
movsxd rcx, eax
lea rax, [rsp + rcx*2]
add rax, 0x680
xor edx, edx
cmp word [rax], 0x5c
sete dl
movzx eax, word [rax + rdx*2]
add rcx, rdx
lea rdx, [rsp + rcx*2]
add rdx, 0x682
xor ecx, ecx
lea rbp, [0x140047670]
mov esi, 0x2f
cmp ax, 0x5c
cmove eax, esi
mov word [rcx + rbp], ax
movzx eax, word [rdx + rcx]
add rcx, 2
test ax, ax
jne 0x140007119
mov word [rcx + rbp], 0
mov r9, qword [r15]
lea rcx, [0x140047880]
lea r8, str._s.moz_callback
mov edx, 0x104
call fcn.140004840
cmp eax, 0x104
jb 0x14000727a
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 3
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008144
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_callback_backup_path_truncated
call fcn.1400116d0
call fcn.140008580
cmp r14, 0xffffffffffffffff
je 0x1400071c4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x1400062e2
call fcn.14001b3d4
jmp 0x1400062e2
cmp byte [0x140047458], 1
jne 0x14000720a
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x2c
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008040
lea rcx, [0x140047ea8]
lea rdx, str.Update_already_in_progress__Exiting
jmp 0x1400064d5
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400080c2
lea rcx, [0x140047ea8]
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting
jmp 0x1400064d5
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov rcx, qword [r15]
lea rdx, [0x140047880]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007464
mov esi, 1
lea r15, str.NS_main:_callback_app_file_open_attempt__d_failed._File:__S._Last_error:__lu
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x40010000
mov r8d, 6
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140007483
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007346
mov dword [rsp + 0x20], ebp
lea rcx, [0x140047ea8]
mov rdx, r15
mov r8d, esi
mov r9, rbx
call fcn.1400116d0
mov ecx, 0x64
call r14
inc esi
cmp esi, 0xb
jne 0x1400072b2
jmp 0x140007490
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007315
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007315
cmp ecx, edx
jg 0x1400081db
lea rsi, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
lea rcx, [0x140047ea8]
lea r8, str.tobedeleted
mov rdx, rsi
call fcn.1400116d0
call fcn.140008580
cmp r12d, 7
jb 0x140007447
cmp byte [0x140047a8a], 1
jne 0x1400073ff
call fcn.140005780
test al, al
jne 0x1400073ea
mov ecx, 2
call fcn.140016378
lea rcx, str.The_post_update_process_was_not_launched
mov edx, 0x28
mov r8d, 1
mov r9, rax
call fcn.140020dcc
cmp byte [0x140047a88], 0
jne 0x1400073ff
lea rcx, [0x140047a90]
call fcn.1400123c0
cmp r14, 0xffffffffffffffff
je 0x14000740e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x140007429
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x140007447
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
call fcn.140005ba0
movzx esi, byte [0x140047a8a]
xor esi, 1
jmp 0x1400062e7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400064da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x60]
mov rcx, rsi
cmp eax, 5
jne 0x1400074fb
mov r9d, 0x23
jmp 0x140007501
mov rdi, rax
mov r14, qword [rsp + 0x48]
jmp 0x140006af0
cmp ebp, 0x20
jne 0x14000759d
cmp byte [0x140047c9a], 0
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
je 0x1400076b9
cmp eax, ecx
jg 0x140008327
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file_from_background_task:__S
call fcn.1400116d0
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x6a
jmp 0x1400075f8
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008223
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsi]
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_failed_to_copy_callback_file__S_into_place_at__S
lea r9, [0x140047880]
call fcn.1400116d0
call fcn.140008580
mov rcx, qword [rsp + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14000756b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
je 0x14000758a
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x1400062e2
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [rsi]
jmp 0x1400076a9
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400082e6
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file:__S
call fcn.1400116d0
lea rsi, [rsp + 0x60]
mov rcx, rsi
cmp ebp, 5
jne 0x1400075f2
mov r9d, 0x23
jmp 0x1400075f8
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.140008470
lea rcx, [0x140047880]
call fcn.14001f2e8
test eax, eax
je 0x14000765e
call fcn.14001b3d4
cmp dword [rax], 2
je 0x14000765e
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008368
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_unable_to_remove_backup_of_callback_app_file__path:__S
lea r8, [0x140047880]
call fcn.1400116d0
call fcn.140008580
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x140007676
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001f2e8
test eax, eax
mov rsi, qword [rsp + 0x50]
je 0x14000769a
call fcn.14001b3d4
cmp dword [rax], 2
jne 0x1400062e2
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
mov edx, r12d
mov r8, rsi
call fcn.140005ba0
jmp 0x1400062e2
cmp eax, ecx
jg 0x1400083a9
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047ea8]
lea rdx, str.NS_main:_callback_app_file_in_use__continuing_without_exclusive_access_for_executable_file:__S
call fcn.1400116d0
jmp 0x140007486
xor edi, edi
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x3a
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov ecx, r12d
mov rdx, r13
call fcn.1400128d0
test eax, eax
jne 0x140007965
xor ebp, ebp
cmp byte [0x140047458], 1
je 0x140007733
cmp byte [0x140047c9a], 0
jne 0x140007733
call fcn.140001f00
test eax, eax
sete bpl
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.1400126c0
cmp eax, 1
je 0x1400077c8
lea rax, [0x140008740]
lea rsi, [rsp + 0x270]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b0f0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.14001a538
mov qword [rsi], rax
test rax, rax
sete cl
xor bpl, 1
or bpl, cl
jne 0x1400077ac
mov cl, 1
xor edx, edx
call fcn.140001fc0
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.MozillaMaintenance
mov edx, 1
call fcn.1400126c0
cmp eax, 1
jne 0x140007965
mov byte [0x140047a89], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x7d], 0
test dil, dil
je 0x1400078f4
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d9ea]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x1400078e7
lea rdx, [0x14003da44]
lea rcx, [rsp + 0x270]
call fcn.14001f0a4
test rax, rax
je 0x1400078e7
mov rsi, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140020b08
cmp rax, 1
jne 0x1400078df
lea rdi, [rsp + 0x60]
mov byte [rdi + 0x24], 0
mov rcx, rsi
call fcn.140020548
lea rcx, [rsp + 0x680]
mov r8d, 0x25
mov rdx, rdi
call fcn.140021620
test eax, eax
jne 0x1400078e7
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000842b
lea rcx, [0x140047ea8]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_the_service
jmp 0x140007c75
mov rcx, rsi
call fcn.140020548
cmp byte [0x140047a89], 1
jne 0x140007ca8
cmp byte [0x140047458], 0
jne 0x140007ca8
xor eax, eax
lea r8, [rsp + 0x270]
mov byte [r8], al
mov byte [r8 + 4], al
lea rcx, [0x14003b41f]
lea rdx, [rsp + 0x890]
call fcn.14000b110
test al, al
je 0x140007ca8
cmp byte [rsp + 0x890], 0
je 0x140007ca8
cmp byte [rsp + 0x274], 0
je 0x140007ca8
mov eax, dword [rsp + 0x270]
lea ecx, [rax - 0x18]
cmp ecx, 0xa
jb 0x140007965
add eax, 0xffffffcf
cmp eax, 9
ja 0x140007ca8
cmp byte [0x140047458], 1
jne 0x1400079ce
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x2b
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008264
lea rcx, [0x140047ea8]
lea rdx, str.Non_critical_update_staging_error__Falling_back_to_non_staged_updates_and_exiting
call fcn.1400116d0
call fcn.140008580
jmp 0x140007ce3
cmp byte [0x140047c9a], 0
je 0x140007a37
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x69
call fcn.140001000
mov rcx, rsi
call fcn.140008470
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400082a5
lea rcx, [0x140047ea8]
lea rdx, str.Skipping_update_to_avoid_UAC_prompt_from_background_task.
call fcn.1400116d0
call fcn.140008580
jmp 0x140007cc5
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x7d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d9ea]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x140007ad3
lea rdx, [0x14003da44]
lea rcx, [rsp + 0x270]
call fcn.14001f0a4
test rax, rax
je 0x140007ad1
mov rsi, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140020b08
cmp rax, 1
sete dil
jne 0x140007ac7
mov byte [rsp + 0x84], 0
mov rcx, rsi
call fcn.140020548
jmp 0x140007ad3
xor edi, edi
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4f
call fcn.140001000
mov rcx, rsi
call fcn.140008470
xor eax, eax
lea rcx, [rsp + 0x680]
mov qword [rcx + 0x68], rax
movups xmmword [rcx + 0x58], xmm6
movups xmmword [rcx + 0x48], xmm6
movups xmmword [rcx + 0x38], xmm6
movups xmmword [rcx + 0x28], xmm6
movabs rdx, 0x54000000070
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov rax, qword [r13]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rbx
lea rax, str.runas
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140007c83
mov rcx, qword [rsp + 0x6e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x140047a89], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x8a0], xmm0
movaps xmmword [rsp + 0x890], xmm0
mov qword [rsp + 0x8ad], 0
test dil, dil
je 0x140007ca8
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d9ea]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x140007ca8
lea rdx, [0x14003da44]
lea rcx, [rsp + 0x270]
call fcn.14001f0a4
test rax, rax
je 0x140007ca8
mov rsi, rax
lea rcx, [rsp + 0x890]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140020b08
cmp rax, 1
jne 0x140007d4c
lea rdi, [rsp + 0x890]
mov byte [rdi + 0x24], 0
mov rcx, rsi
call fcn.140020548
lea rcx, [rsp + 0x60]
mov r8d, 0x25
mov rdx, rdi
call fcn.140021620
test eax, eax
jne 0x140007ca8
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400083ea
lea rcx, [0x140047ea8]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_runas
call fcn.1400116d0
mov byte [0x140047a89], 0
jmp 0x140007ca8
mov byte [0x140047a89], 0
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 9
call fcn.140001000
mov rcx, rsi
call fcn.140008470
cmp byte [0x140047458], 0
je 0x140007cf2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140008580
cmp r12d, 7
jb 0x140007ce3
mov r9b, byte [0x140047a88]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
call fcn.140005ba0
mov rcx, rbx
call fcn.140013868
xor esi, esi
jmp 0x1400062e7
lea rdx, [rsp + 0x270]
mov byte [rdx], 0
lea rcx, str.succeeded
xor r8d, r8d
call fcn.14000b110
test al, al
je 0x140007cb1
cmp byte [rsp + 0x270], 0
je 0x140007cb1
call fcn.140005780
test al, al
jne 0x140007cb1
mov ecx, 2
call fcn.140016378
lea rcx, str.The_post_update_process_which_runs_as_the_user_for_service_update_could_not_be_launched.
mov edx, 0x58
mov r8d, 1
mov r9, rax
call fcn.140020dcc
jmp 0x140007cb1
mov rcx, rsi
call fcn.140020548
jmp 0x140007ca8
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006447
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006447
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400064c7
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400064c7
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x14000654d
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x14000654d
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x14000658c
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x14000658c
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400065cb
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400065cb
lea rcx, [0x1400480b8]
call fcn.140013ae0
lea rsi, str.Performing_a_staged_update
jmp 0x140007ec6
lea rcx, [0x1400480b8]
call fcn.140013ae0
lea rsi, str.Performing_a_replace_request
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006519
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006519
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400066b0
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400066b0
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006978
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006978
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400069dc
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400069dc
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006a32
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006a32
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006722
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006722
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x14000722f
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x14000722f
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007073
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007073
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007267
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007267
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006ca7
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006ca7
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x14000719d
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x14000719d
lea rcx, [0x1400480b8]
call fcn.140013ae0
lea rsi, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x1400081ee
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140006c3a
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140006c3a
lea rcx, [0x1400480b8]
call fcn.140013ae0
lea rsi, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
cmp dword [0x1400480b8], 0xffffffff
jne 0x14000738f
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x14000738f
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007533
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007533
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400079b1
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400079b1
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007a1a
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007a1a
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400075c2
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400075c2
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400074cd
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400074cd
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007644
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007644
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400076c1
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400076c1
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140007c67
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140007c67
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400078cc
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400078cc