Function at 0x140006110
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create thread
Get common file path
Get file attributes
Move file
Read file on windows
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf08
movaps xmmword [rsp + 0xef0], xmm6
mov r15, rdx
mov r12d, ecx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xee8], rax
lea rcx, [0x14003c38f]
call fcn.140020c88
test rax, rax
je 0x14000615c
cmp byte [rax], 0
setne al
jmp 0x14000615e
xor eax, eax
mov byte [0x140047a98], al
lea rcx, str.MOZ_USING_SERVICE
call fcn.14001ddbc
cmp r12d, 3
jg 0x140006194
mov ecx, 2
call fcn.1400135c8
lea rdx, str.Usage:_updater_patch_dir_install_dir_apply_to_dir__wait_pid__callback_working_dir_callback_path_args...___n
mov rcx, rax
call fcn.140001260
jmp 0x1400065f8
mov rcx, qword [r15 + 8]
call fcn.1400117f0
mov rbx, qword [r15 + 8]
test al, al
je 0x14000621e
lea rbp, [0x140047260]
mov r8d, 0x104
mov rcx, rbp
mov rdx, rbx
call fcn.140013508
mov word [0x140047466], 0
lea rbx, [rsp + 0xce0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140015960
lea r8, str._supdate_elevated.lock
mov edx, 0x104
mov rcx, rbx
mov r9, rbp
call fcn.140004c30
mov al, 1
cmp byte [0x140047a98], 0
jne 0x14000623c
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x14000623a
call fcn.1400136f4
cmp dword [rax], 2
setne al
jmp 0x14000623c
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
mov r8, rbx
jmp 0x1400065f3
xor eax, eax
mov byte [0x140047ca8], al
mov rcx, qword [r15 + 0x10]
call fcn.1400117f0
test al, al
je 0x14000633e
mov rdx, qword [r15 + 0x10]
lea rbx, [0x140047aa0]
mov r8d, 0x104
mov rcx, rbx
call fcn.140013508
mov word [0x140047ca6], 0
mov rcx, rbx
mov dx, 0x5c
call fcn.140015cc8
test rax, rax
je 0x140006292
cmp word [rax + 2], 0
jne 0x140006292
mov word [rax], 0
lea r8, str._s_update.status
lea r9, [0x140047260]
lea rbx, [rsp + 0x270]
mov edx, 0x104
mov rcx, rbx
call fcn.140004c30
lea rdx, [0x14003da10]
mov rcx, rbx
call fcn.14001edb4
test rax, rax
je 0x140006376
mov rbp, rax
movabs rdi, 0x656369767265732d
xorps xmm0, xmm0
lea rsi, [rsp + 0xad0]
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov edx, 0x20
mov r8d, 1
mov rcx, rsi
mov r9, rax
call fcn.1400206ec
movabs rax, 0x2d676e69646e6570
xor rax, qword [rsi]
mov rcx, qword [rsi + 7]
xor rcx, rdi
or rcx, rax
je 0x14000637b
movabs rax, 0x2d6465696c707061
xor rax, qword [rsp + 0xad0]
xor rdi, qword [rsp + 0xad7]
or rdi, rax
sete r13b
jmp 0x14000637e
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4b
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov rsi, qword [r15 + 0x10]
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application___S__n
jmp 0x1400065ed
xor r13d, r13d
jmp 0x140006386
mov r13b, 1
mov rcx, rbp
call fcn.140020258
xor esi, esi
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov edi, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareClassesApplications
mov rbp, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbp
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
lea rdx, str.SoftwareClassesApplicationsupdater.exe
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbp
test eax, eax
jne 0x140006485
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rdx, str.IsHostApp
mov rdi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
xor r9d, r9d
call rdi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rdx, str.NoOpenWith
xor r8d, r8d
xor r9d, r9d
call rdi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rdx, str.NoStartPage
xor r8d, r8d
xor r9d, r9d
call rdi
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12d, 5
jl 0x1400064bb
mov rcx, qword [r15 + 0x20]
call fcn.14001f078
cmp rax, 0xffffffffffffffff
je 0x1400064c0
mov r14, rax
mov rcx, qword [r15 + 0x20]
lea rdx, str._replace
call fcn.140015d7c
test rax, rax
je 0x1400064ce
mov byte [0x140047ca9], 1
jmp 0x1400064ce
xor r14d, r14d
jmp 0x1400064ce
mov byte [0x140047468], 1
mov r14, 0xffffffffffffffff
mov rcx, qword [r15 + 0x18]
call fcn.1400117f0
test al, al
je 0x1400065ba
mov rdx, qword [r15 + 0x18]
lea rsi, [0x140047470]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013508
mov word [0x140047676], 0
mov rcx, rsi
mov dx, 0x5c
call fcn.140015cc8
test rax, rax
je 0x14000651e
cmp word [rax + 2], 0
jne 0x14000651e
mov word [rax], 0
cmp r12d, 7
jl 0x1400066d7
mov rcx, qword [r15 + 0x30]
call fcn.1400117f0
test al, al
je 0x14000662b
lea rsi, [0x140047aa0]
mov rcx, rsi
call fcn.140013348
mov rbp, rax
lea rbx, [rsp + 0x270]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140015960
mov rdx, qword [r15 + 0x30]
mov rcx, rbx
mov r8, rbp
call fcn.140013508
mov rcx, rsi
mov rdx, rbx
call fcn.140021954
test eax, eax
je 0x140006660
lea rsi, [rsp + 0xad0]
mov rcx, rsi
mov r9d, 0x4e
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov rsi, qword [r15 + 0x30]
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_callback_file_must_be_located_in_the_installation_directory___S__n
jmp 0x1400065ed
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4c
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov rsi, qword [r15 + 0x18]
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
mov r8, rsi
call fcn.140001260
mov ebx, 1
mov rcx, qword [rsp + 0xee8]
xor rcx, rsp
call fcn.140023680
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xef0]
add rsp, 0xf08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4d
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov rsi, qword [r15 + 0x30]
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_callback_file_path_is_not_valid_for_this_application___S__n
jmp 0x1400065ed
cmp r12d, 7
jle 0x1400066d0
mov dword [rsp + 0x48], r13d
lea esi, [r12 - 6]
lea rbp, [rsi - 1]
mov bl, 1
xor r13d, r13d
lea rdi, str.backgroundtask
mov rcx, qword [r15 + r13*8 + 0x38]
movzx eax, word [rcx]
or eax, 2
cmp ax, 0x2f
jne 0x1400066ae
cmp word [rcx + 2], 0x2d
je 0x14000669e
add rcx, 2
jmp 0x1400066a2
add rcx, 4
mov rdx, rdi
call fcn.140021954
test eax, eax
je 0x1400066c0
lea rax, [r13 + 2]
cmp rax, rsi
setb bl
inc r13
cmp rbp, r13
jne 0x140006680
and bl, 1
mov byte [0x140047caa], bl
mov r13d, dword [rsp + 0x48]
jmp 0x1400066d7
mov byte [0x140047caa], 0
lea rcx, [rsp + 0xad0]
mov r8d, 0x20a
xor edx, edx
call fcn.140015960
cmp byte [0x140047ca8], 0
je 0x14000671d
lea rsi, [0x140047260]
mov rcx, rsi
call fcn.140011ec0
lea rdx, [0x14003d78a]
lea r8, [rsp + 0xad0]
mov rcx, rsi
call fcn.140011d20
jmp 0x14000673d
lea r8, str._supdate.log
lea r9, [0x140047260]
lea rcx, [rsp + 0xad0]
mov edx, 0x105
call fcn.140004c30
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008056
lea rcx, [0x140047eb8]
lea rdx, [rsp + 0xad0]
call fcn.140011330
lea rcx, str.applying
call fcn.140008780
test al, al
je 0x1400067b1
cmp byte [0x140047468], 1
jne 0x1400067f3
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
lea rbp, str.Performing_a_staged_update
jmp 0x14000681c
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008097
lea rcx, [0x140047eb8]
lea rdx, str.failed_setting_status_to_applying
call fcn.140011390
call fcn.140008890
jmp 0x1400065f8
cmp byte [0x140047ca9], 1
jne 0x140006837
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
lea rbp, str.Performing_a_replace_request
cmp eax, dword [rcx + 4]
jg 0x14000819b
lea rcx, [0x140047eb8]
mov rdx, rbp
call fcn.140011390
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400080d8
lea rcx, [0x140047eb8]
lea rdx, str.PATCH_DIRECTORY__S
lea r8, [0x140047260]
call fcn.140011390
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008119
lea rcx, [0x140047eb8]
lea rdx, str.INSTALLATION_DIRECTORY__S
lea r8, [0x140047aa0]
call fcn.140011390
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000815a
lea rcx, [0x140047eb8]
lea rdx, str.WORKING_DIRECTORY__S
lea rsi, [0x140047470]
mov r8, rsi
call fcn.140011390
lea rdx, [0x140047aa0]
mov r8d, 0x104
mov rcx, rsi
call fcn.14001ebe0
test eax, eax
je 0x1400069d2
cmp byte [0x140047468], 0
jne 0x14000692a
cmp byte [0x140047ca9], 0
je 0x140006cb3
lea r8, [0x14003d29c]
lea r9, [0x140047470]
lea rsi, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call fcn.140004c30
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140006c4f
lea rdx, [0x140047aa0]
lea rcx, [rsp + 0x270]
mov r8d, 0x104
call fcn.14001ebe0
test eax, eax
je 0x1400069d2
lea rsi, [rsp + 0x8c0]
mov rcx, rsi
mov r9d, 0x48
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400081dc
lea rcx, [0x140047eb8]
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
jmp 0x1400067e4
test r14, r14
jle 0x140006a44
mov ecx, 0x100000
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140006a44
mov rbx, rax
mov rcx, rax
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140006a44
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400082e0
lea rcx, [0x140047eb8]
lea rdx, str.The_parent_process_didnt_exit__Continuing_with_update.
call fcn.140011390
cmp byte [0x140047ca9], 0
jne 0x140006a56
cmp byte [0x140047468], 1
jne 0x140006a8d
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
mov rcx, rsi
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140006a8d
lea rcx, [rsp + 0x270]
call fcn.14001e554
mov ebp, r13d
mov r13, 0xffffffffffffffff
cmp byte [0x140047a98], 0
je 0x140006c12
cmp byte [0x140047468], 1
jne 0x140006abb
lea rcx, [0x140047470]
xor edx, edx
call fcn.140008a80
cmp byte [0x140047ca9], 0
jne 0x140006ae2
lea rcx, [0x140047470]
call fcn.14001eee0
test eax, eax
je 0x140006ae2
call fcn.1400136f4
cmp dword [rax], 0x11
jne 0x1400067e9
lea rcx, [0x140047470]
lea rdx, [rsp + 0x8c0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140006d09
mov rsi, 0xffffffffffffffff
cmp r12d, 7
jl 0x140006e0f
lea rcx, [rsp + 0x680]
mov ebp, 0x208
mov r8d, 0x208
xor edx, edx
call fcn.140015960
lea rdi, [r15 + 0x30]
mov rbx, qword [r15 + 0x30]
lea r14, [rsp + 0x270]
mov r8d, 0x410
mov rcx, r14
xor edx, edx
call fcn.140015960
cmp byte [0x140047ca9], 1
jne 0x140006dd9
mov rcx, rbx
lea rdx, [0x140047aa0]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
movsxd rbx, eax
mov rdx, qword [rdi]
mov rcx, r14
mov r8, rbx
call fcn.140013508
lea rsi, [rsp + rbx*2]
add rsi, 0x270
sub rbp, rbx
mov qword [rsp + 0x48], r13
lea rax, [0x140047aa0]
lea r13, [rax + rbx*2]
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.140013508
mov rcx, r13
call fcn.140013348
lea rsi, [rsi + rax*2]
add rsi, 2
mov dword [rsi - 2], 0x5c
not rax
add rbp, rax
lea r13, [rsp + 0x60]
mov rcx, r13
lea rdx, [0x140047aa0]
call fcn.140013298
mov rcx, qword [rdi]
mov rdx, r13
mov r13, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
movsxd rdx, eax
cmp rdx, rbx
cmovb rdx, rbx
add rdx, rdx
add rdx, qword [rdi]
mov rcx, rsi
mov r8, rbp
call fcn.140013508
jmp 0x140006ddc
mov al, byte [0x140047468]
cmp r12d, 6
jle 0x140006db1
test al, 1
jne 0x140006db9
cmp byte [0x140047ca9], 1
je 0x140007081
lea rcx, [rsp + 0x8c0]
mov r9, qword [r15 + 0x30]
lea r8, str._s.update_in_progress.lock
jmp 0x140006dcf
lea rsi, [rsp + 0x8c0]
mov rcx, rsi
mov r9d, 0x47
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000821d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140047eb8]
lea rdx, str.Error_calling_PathRemoveFileSpecW:__d
mov r8d, eax
call fcn.140011390
jmp 0x1400067e9
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4a
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000825e
lea rcx, [0x140047eb8]
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
jmp 0x1400067e4
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x41
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000829f
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_unable_to_find_apply_to_dir:__S
lea r8, [0x140047470]
call fcn.140011390
call fcn.140008890
cmp r13, 0xffffffffffffffff
je 0x140006d7a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x140007040
call fcn.1400136f4
mov ebx, 1
cmp r12d, 7
jl 0x1400065fd
cmp dword [rax], 2
je 0x14000704f
jmp 0x1400065fd
test al, 1
je 0x14000706d
lea r8, str._s_updated.update_in_progress.lock
lea r9, [0x140047aa0]
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
jmp 0x1400070c0
mov r14, rbx
lea rdx, [rsp + 0x680]
mov rcx, r14
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x14000735c
mov rsi, 0xffffffffffffffff
cmp byte [0x140047ca9], 0
je 0x1400073ff
cmp byte [0x140047468], 0
jne 0x140006e69
cmp byte [0x140047ca9], 0
jne 0x140006e69
lea rax, str.tobedeleted
mov qword [rsp + 0x20], rax
lea rbx, [0x140047cb0]
lea r8, str._s__s
lea r9, [0x140047470]
mov edx, 0x104
mov rcx, rbx
call fcn.140004c30
mov rcx, rbx
xor edx, edx
call fcn.14001e494
test eax, eax
je 0x140006e69
lea rcx, [0x140047cb0]
call fcn.14001eee0
lea rax, [0x140008da0]
lea rbx, [rsp + 0x270]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], 0
lea rax, [rsp + 0x680]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b3c0]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call fcn.14001a26c
mov qword [rbx], rax
test rax, rax
je 0x140006ee0
cmp byte [0x140047468], 0
jne 0x140006ee0
cmp byte [0x140047ca9], 0
jne 0x140006ee0
cmp byte [0x140047caa], 0
jne 0x140006ee0
xor ecx, ecx
mov dl, 1
call fcn.140002380
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 7
jl 0x140006f73
cmp byte [0x140047ca9], 0
jne 0x140006f73
cmp rsi, 0xffffffffffffffff
je 0x140006f1a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140047890]
call fcn.14001eff8
test eax, eax
je 0x140006f73
call fcn.1400136f4
cmp dword [rax], 2
je 0x140006f73
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400084a7
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_non_fatal_error_removing_backup_of_callback_app_file__path:__S
lea r8, [0x140047890]
call fcn.140011390
cmp byte [0x140047468], 0
jne 0x1400076c4
cmp byte [0x140047ca9], 0
jne 0x1400076c4
lea rcx, [0x140047cb0]
call fcn.14001f050
test eax, eax
je 0x1400076c4
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400083e4
call fcn.1400136f4
mov r9d, dword [rax]
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_unable_to_remove_directory:__S__err:__d
lea r8, str.tobedeleted
call fcn.140011390
lea rcx, [0x140047cb0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [0x1400480c8]
mov edx, dword [0x140045e74]
mov rbp, qword gs:[0x58]
mov rdx, qword [rbp + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400076a2
cmp ecx, edx
jg 0x140008466
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x1400076b8
mov ebx, 1
cmp r12d, 7
jl 0x1400065fd
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [r15 + 0x28]
add r15, 0x30
mov edx, r12d
mov r8, r15
jmp 0x1400079c3
mov r13, 0xffffffffffffffff
cmp byte [0x140047ca9], 1
jne 0x140006ac4
lea rdx, [0x140047aa0]
lea rsi, [rsp + 0x270]
mov rcx, rsi
call fcn.140013298
mov rcx, rsi
mov dx, 0x5c
call fcn.140015cc8
mov word [rax], 0
lea r8, str._smoz_update_in_progress.lock
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
mov r9, rsi
call fcn.140004c30
lea rcx, [rsp + 0x8c0]
call fcn.14001eff8
test eax, eax
je 0x1400070e4
call fcn.1400136f4
cmp dword [rax], 2
jne 0x140007343
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0x8c0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
lea rcx, [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007140
lea rdx, str.SeAssignPrimaryTokenPrivilege
mov r8d, 0x22
xor ecx, ecx
call fcn.140011000
cmp r13, 0xffffffffffffffff
jne 0x140006aa4
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x140007169
call fcn.1400136f4
cmp dword [rax], 2
jne 0x140007564
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0xce0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140007564
mov rbx, rax
lea r8, [r15 + 8]
lea edx, [r12 - 1]
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.140001080
mov r14, qword [rsi]
test r14, r14
je 0x14000776a
test bpl, bpl
je 0x140007bfb
lea rcx, [0x140047aa0]
call fcn.1400114b0
test al, al
je 0x140007bfb
lea rdx, [rsp + 0x270]
mov dword [rdx], 0
mov rcx, qword [r15]
call fcn.1400126b0
test eax, eax
je 0x140007bfb
cmp dword [rsp + 0x270], 0
je 0x140007bfb
lea rcx, [rsp + 0x270]
call fcn.140012750
test eax, eax
je 0x140007232
cmp dword [rsp + 0x270], 0
jne 0x140007bfb
lea rcx, [0x140047aa0]
lea rdx, [rsp + 0x270]
call fcn.1400012d0
test eax, eax
je 0x140007bfb
lea rax, [rsp + 0x680]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x270]
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007292
mov rcx, qword [rsp + 0x680]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x690], xmm0
movaps xmmword [rsp + 0x680], xmm0
mov qword [rsp + 0x69d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rcx, [0x140047260]
lea rdx, [0x14003d9b6]
mov r8, rsi
call fcn.140011d20
test eax, eax
je 0x1400079f7
lea rdx, [0x14003da10]
lea rcx, [rsp + 0x270]
call fcn.14001edb4
test rax, rax
je 0x1400079f5
mov rbp, rax
lea rcx, [rsp + 0x680]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400206ec
cmp rax, 1
sete dil
jne 0x140007336
mov byte [rsp + 0x6a4], 0
mov rcx, rbp
call fcn.140020258
jmp 0x1400079f7
cmp byte [0x140047ca9], 1
jne 0x140007505
lea rcx, str.pending
jmp 0x140007527
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x42
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008362
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_unable_to_find_callback_file:__S
mov r8, r14
call fcn.140011390
call fcn.140008890
cmp r13, 0xffffffffffffffff
je 0x1400073c6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x1400073e5
call fcn.1400136f4
cmp dword [rax], 2
jne 0x1400065f8
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [r15 + 0x28]
mov edx, r12d
mov r8, rdi
jmp 0x1400079c3
lea rcx, [rsp + 0x8c0]
call fcn.140013348
cdqe
lea rcx, [rsp + rax*2]
add rcx, 0x680
cmp word [rcx], 0x5c
lea rax, [rsp + rax*2 + 0x682]
cmovne rax, rcx
movzx edx, word [rax]
xor ecx, ecx
lea rbp, [0x140047680]
mov ebx, 0x2f
cmp dx, 0x5c
cmove edx, ebx
mov word [rcx + rbp], dx
movzx edx, word [rax + rcx + 2]
add rcx, 2
test dx, dx
jne 0x14000743a
mov word [rcx + rbp], 0
mov r9, qword [rdi]
lea rcx, [0x140047890]
lea r8, str._s.moz_callback
mov edx, 0x104
call fcn.140004c30
cmp eax, 0x104
jb 0x14000759c
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 3
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008425
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_callback_backup_path_truncated
call fcn.140011390
call fcn.140008890
cmp r13, 0xffffffffffffffff
je 0x1400074e6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x1400065f8
call fcn.1400136f4
jmp 0x1400065f8
cmp byte [0x140047468], 1
jne 0x14000752c
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x2c
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008321
lea rcx, [0x140047eb8]
lea rdx, str.Update_already_in_progress__Exiting
jmp 0x1400067e4
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400083a3
lea rcx, [0x140047eb8]
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting
jmp 0x1400067e4
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rdi
mov rcx, qword [rdi]
lea rdx, [0x140047890]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007778
mov ebx, 1
lea rdi, str.NS_main:_callback_app_file_open_attempt__d_failed._File:__S._Last_error:__d
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0x40010000
mov r8d, 6
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140007797
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007668
mov dword [rsp + 0x20], ebp
lea rcx, [0x140047eb8]
mov rdx, rdi
mov r8d, ebx
mov r9, r14
call fcn.140011390
mov ecx, 0x64
call r13
inc ebx
cmp ebx, 0xb
jne 0x1400075d4
jmp 0x1400077a4
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007637
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007637
cmp ecx, edx
jg 0x1400084e8
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
lea r8, str.tobedeleted
call fcn.140011390
call fcn.140008890
cmp r12d, 7
jl 0x14000775b
cmp byte [0x140047a9a], 1
jne 0x140007713
call fcn.140005b70
test al, al
jne 0x1400076fe
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_post_update_process_was_not_launched
mov rcx, rax
call fcn.140001260
cmp byte [0x140047a98], 0
jne 0x140007713
lea rcx, [0x140047aa0]
call fcn.140012050
cmp r13, 0xffffffffffffffff
je 0x140007722
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x14000773d
call fcn.1400136f4
cmp dword [rax], 2
jne 0x14000775b
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [r15 + 0x28]
add r15, 0x30
mov edx, r12d
mov r8, r15
call fcn.140005f90
movzx ebx, byte [0x140047a9a]
xor ebx, 1
jmp 0x1400065fd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400067e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x60]
mov rcx, rsi
cmp eax, 5
jne 0x14000780f
mov r9d, 0x23
jmp 0x140007815
mov rsi, rax
mov r13, qword [rsp + 0x48]
jmp 0x140006e0f
cmp ebp, 0x20
jne 0x1400078b1
cmp byte [0x140047caa], 0
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
je 0x1400079cd
cmp eax, ecx
jg 0x14000862d
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file_from_background_task:__S
call fcn.140011390
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x6a
jmp 0x14000790c
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008529
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsi]
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_failed_to_copy_callback_file__S_into_place_at__S
lea r9, [0x140047890]
call fcn.140011390
call fcn.140008890
mov rcx, qword [rsp + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14000787f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
je 0x14000789e
call fcn.1400136f4
cmp dword [rax], 2
jne 0x1400065f8
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [rsi]
jmp 0x1400079bd
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400085ec
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file:__S
call fcn.140011390
lea rsi, [rsp + 0x60]
mov rcx, rsi
cmp ebp, 5
jne 0x140007906
mov r9d, 0x23
jmp 0x14000790c
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.140008780
lea rcx, [0x140047890]
call fcn.14001eff8
test eax, eax
je 0x140007972
call fcn.1400136f4
cmp dword [rax], 2
je 0x140007972
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000866e
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_unable_to_remove_backup_of_callback_app_file__path:__S
lea r8, [0x140047890]
call fcn.140011390
call fcn.140008890
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x14000798a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001eff8
test eax, eax
mov rsi, qword [rsp + 0x50]
je 0x1400079ae
call fcn.1400136f4
cmp dword [rax], 2
jne 0x1400065f8
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [r15 + 0x28]
mov edx, r12d
mov r8, rsi
call fcn.140005f90
jmp 0x1400065f8
cmp eax, ecx
jg 0x1400086af
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140047eb8]
lea rdx, str.NS_main:_callback_app_file_in_use__continuing_without_exclusive_access_for_executable_file:__S
call fcn.140011390
jmp 0x14000779a
xor edi, edi
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x3a
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov ecx, r12d
mov rdx, r15
call fcn.140012560
test eax, eax
jne 0x140007bfb
xor ebp, ebp
cmp byte [0x140047468], 0
jne 0x140007a47
cmp byte [0x140047caa], 0
jne 0x140007a47
call fcn.1400022c0
test eax, eax
sete bpl
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.140012350
cmp eax, 1
je 0x140007adc
lea rax, [0x140008a50]
lea rsi, [rsp + 0x270]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b3c0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.14001a26c
mov qword [rsi], rax
test rax, rax
sete cl
xor bpl, 1
or bpl, cl
jne 0x140007ac0
mov cl, 1
xor edx, edx
call fcn.140002380
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.MozillaMaintenance
mov edx, 1
call fcn.140012350
cmp eax, 1
jne 0x140007bfb
mov byte [0x140047a99], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x7d], 0
test dil, dil
je 0x140007f3d
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rcx, [0x140047260]
lea rdx, [0x14003d9b6]
mov r8, rsi
call fcn.140011d20
test eax, eax
je 0x140007f3d
lea rdx, [0x14003da10]
lea rcx, [rsp + 0x270]
call fcn.14001edb4
test rax, rax
je 0x140007f3d
mov rbp, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400206ec
cmp rax, 1
jne 0x140008049
lea rsi, [rsp + 0x60]
mov byte [rsi + 0x24], 0
mov rcx, rbp
call fcn.140020258
lea rcx, [rsp + 0x680]
mov r8d, 0x25
mov rdx, rsi
call fcn.140021200
test eax, eax
jne 0x140007f3d
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008731
lea rcx, [0x140047eb8]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_the_service
jmp 0x140007f0a
cmp byte [0x140047468], 1
jne 0x140007c64
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x2b
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000856a
lea rcx, [0x140047eb8]
lea rdx, str.Non_critical_update_staging_error__Falling_back_to_non_staged_updates_and_exiting
call fcn.140011390
call fcn.140008890
jmp 0x14000803a
cmp byte [0x140047caa], 0
je 0x140007ccd
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x69
call fcn.140001000
mov rcx, rsi
call fcn.140008780
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400085ab
lea rcx, [0x140047eb8]
lea rdx, str.Skipping_update_to_avoid_UAC_prompt_from_background_task.
call fcn.140011390
call fcn.140008890
jmp 0x14000801c
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x7d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rcx, [0x140047260]
lea rdx, [0x14003d9b6]
mov r8, rsi
call fcn.140011d20
test eax, eax
je 0x140007d69
lea rdx, [0x14003da10]
lea rcx, [rsp + 0x270]
call fcn.14001edb4
test rax, rax
je 0x140007d67
mov rbp, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400206ec
cmp rax, 1
sete dil
jne 0x140007d5d
mov byte [rsp + 0x84], 0
mov rcx, rbp
call fcn.140020258
jmp 0x140007d69
xor edi, edi
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 0x4f
call fcn.140001000
mov rcx, rsi
call fcn.140008780
xor eax, eax
lea rcx, [rsp + 0x680]
mov qword [rcx + 0x68], rax
movups xmmword [rcx + 0x58], xmm6
movups xmmword [rcx + 0x48], xmm6
movups xmmword [rcx + 0x38], xmm6
movups xmmword [rcx + 0x28], xmm6
movabs rdx, 0x54000000070
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov rax, qword [r15]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], r14
lea rax, str.runas
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140007f18
mov rcx, qword [rsp + 0x6e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x140047a99], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x8a0], xmm0
movaps xmmword [rsp + 0x890], xmm0
mov qword [rsp + 0x8ad], 0
test dil, dil
je 0x140007f3d
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rcx, [0x140047260]
lea rdx, [0x14003d9b6]
mov r8, rsi
call fcn.140011d20
test eax, eax
je 0x140007f3d
lea rdx, [0x14003da10]
lea rcx, [rsp + 0x270]
call fcn.14001edb4
test rax, rax
je 0x140007f3d
mov rbp, rax
lea rcx, [rsp + 0x890]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400206ec
cmp rax, 1
jne 0x140008049
lea rsi, [rsp + 0x890]
mov byte [rsi + 0x24], 0
mov rcx, rbp
call fcn.140020258
lea rcx, [rsp + 0x60]
mov r8d, 0x25
mov rdx, rsi
call fcn.140021200
test eax, eax
jne 0x140007f3d
mov eax, dword [0x1400480c8]
mov ecx, dword [0x140045e74]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400086f0
lea rcx, [0x140047eb8]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_runas
call fcn.140011390
mov byte [0x140047a99], 0
jmp 0x140007f3d
mov byte [0x140047a99], 0
lea rsi, [rsp + 0x270]
mov rcx, rsi
mov r9d, 9
call fcn.140001000
mov rcx, rsi
call fcn.140008780
cmp byte [0x140047468], 0
jne 0x140008008
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rcx, [0x140047260]
lea rdx, [0x14003d212]
mov r8, rsi
call fcn.140011d20
test eax, eax
je 0x140008008
lea rdx, [0x14003da10]
lea rcx, [rsp + 0x270]
call fcn.14001edb4
test rax, rax
je 0x140008008
mov rbp, rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x680]
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov edx, 0x20
mov r8d, 1
mov rcx, rsi
mov r9, rax
call fcn.1400206ec
movabs rdi, 0x6564656563637573
xor rdi, qword [rsi]
movzx esi, byte [rsi + 8]
xor rsi, 0x64
mov rcx, rbp
call fcn.140020258
or rsi, rdi
jne 0x140008008
call fcn.140005b70
test al, al
jne 0x140008008
mov ecx, 2
call fcn.1400135c8
lea rdx, str.The_post_update_process_which_runs_as_the_user_for_service_update_could_not_be_launched.
mov rcx, rax
call fcn.140001260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140008890
cmp r12d, 7
jl 0x14000803a
mov r9b, byte [0x140047a98]
add r12d, 0xfffffffa
mov rcx, qword [r15 + 0x28]
add r15, 0x30
mov edx, r12d
mov r8, r15
call fcn.140005f90
mov rcx, r14
call fcn.140013500
xor ebx, ebx
jmp 0x1400065fd
mov rcx, rbp
call fcn.140020258
jmp 0x140007f3d
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006762
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006762
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400067d6
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400067d6
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x14000685c
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x14000685c
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x14000689b
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x14000689b
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400068da
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400068da
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006828
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006828
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400069bf
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400069bf
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006c92
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006c92
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006cf6
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006cf6
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006d4c
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006d4c
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006a31
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006a31
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007551
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007551
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x14000739c
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x14000739c
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007589
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007589
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006fc6
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006fc6
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400074bf
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400074bf
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x14000702d
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x14000702d
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140006f59
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140006f59
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400076aa
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400076aa
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007847
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007847
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007c47
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007c47
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007cb0
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007cb0
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400078d6
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400078d6
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400077e1
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400077e1
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007958
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007958
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x1400079d5
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x1400079d5
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007efc
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007efc
lea rcx, [0x1400480c8]
call fcn.140013880
cmp dword [0x1400480c8], 0xffffffff
jne 0x140007be8
mov qword [0x140047eb8], 0
lea rcx, [0x14000afc0]
call fcn.140013a38
lea rcx, [0x1400480c8]
call fcn.1400138e8
jmp 0x140007be8