Function at 0x140021190
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check os version
Create process on windows
Encrypt data using speck
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb58
movaps xmmword [rsp + 0xb40], xmm6
mov r14, r9
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0xb38], rax
mov ecx, dword [rdx]
mov rdx, r8
call fcn.140023f70
test al, al
je 0x1400232b9
mov qword [0x140064ce8], r14
lea r14, [rdi + 8]
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002137d
lea rcx, [rdi + 0x10]
mov edx, 0xff
mov r10, rax
mov r8, r14
movzx r9d, word [r10]
cmp r9d, 0x2d
je 0x14002122c
cmp r9d, 0x2f
je 0x1400232ad
mov r10, qword [r8 + 8]
add r8, 8
add rcx, 8
test r10, r10
jne 0x140021202
jmp 0x1400212c5
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x6c
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x140021216
cmp r11b, 0x2d
je 0x140021266
lea ebx, [r11 - 0x30]
cmp bl, 0xa
jb 0x140021266
lea ebx, [r11 - 0x61]
cmp bl, 0x19
ja 0x140021216
movzx ebx, si
cmp ebx, edx
cmovae esi, edx
lea ebx, [rsi - 0x41]
mov ebp, esi
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
cmovae ebx, esi
cmp bl, r11b
jne 0x140021216
lea r11, str.log_launcher_error
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x12
jne 0x140021244
cmp word [r9 + 0x24], 0
jne 0x140021216
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400212a7
dec dword [r13]
mov byte [0x140064cf0], 1
mov rax, qword [r14]
test rax, rax
je 0x14002137d
mov ecx, 0xff
lea rdx, str.contentproc
mov r8, r14
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x140021362
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x63
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x14002136c
cmp r10b, 0x2d
je 0x140021322
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x140021322
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14002136c
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14002136c
mov r10b, byte [rax + rdx + 1]
inc rax
cmp rax, 0xb
jne 0x1400212fd
cmp word [r9 + 0x16], 0
je 0x140021778
jmp 0x14002136c
cmp r9d, 0x2f
je 0x140023303
mov rax, qword [r8 + 8]
add r8, 8
test rax, rax
jne 0x1400212dd
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x1b8]
call fcn.1400245a0
pxor xmm0, xmm0
lea rsi, [rsp + 0x6e0]
movdqa xmmword [rsi + 0x20], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi], xmm0
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rsi
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
mov ebp, eax
mov eax, dword [rsi + 0x28]
lea r12, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
test ebp, ebp
cmovns r12, rax
mov qword [rsp + 0x68], r13
js 0x14002331b
mov ecx, 0x1000
xor edx, edx
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140023347
lea r12, [rsp + 0x700]
mov dword [r12 - 0x20], 0
mov byte [r12 - 8], 0
lea r9, [rsp + 0x2a0]
mov dword [r9], 0x209
mov rcx, r15
mov edx, 1
mov r8, r12
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14002337d
cmp byte [rsp + 0x6f8], 0
jne 0x1400233a4
mov r8d, dword [rsp + 0x6e0]
lea r13, [rsp + 0x120]
mov rcx, r13
mov rdx, r12
call fcn.140024e70
cmp byte [r13 + 0x18], 0
jne 0x1400233c2
lea r12, [rsp + 0x2c0]
mov dword [r12 - 0x20], 1
mov byte [r12 - 8], 0
xor ecx, ecx
mov rdx, r12
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x1400214b0
test eax, eax
jne 0x140022f37
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r13d, 0x29
mov bl, 1
lea r12, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, r15
inc rax
cmp rax, 2
jb 0x1400214e8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x140023327
test r12b, r12b
sete bl
lea rcx, [0x1400594b2]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14002343a
mov rax, qword [r14]
test rax, rax
je 0x1400217af
lea rcx, [rdi + 0x10]
mov edx, 0xff
mov r9, rax
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x140021549
cmp r8d, 0x2f
je 0x14002330f
mov r9, qword [rcx]
add rcx, 8
test r9, r9
jne 0x140021524
jmp 0x1400217af
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
movzx r9d, word [r8]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
cmp r10d, edx
cmovae r9d, edx
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6c
jne 0x140021538
movzx r9d, word [r8 + 2]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x61
jne 0x140021538
movzx r9d, word [r8 + 4]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x75
jne 0x140021538
movzx r9d, word [r8 + 6]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6e
jne 0x140021538
movzx r9d, word [r8 + 8]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x63
jne 0x140021538
movzx r9d, word [r8 + 0xa]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x68
jne 0x140021538
movzx r9d, word [r8 + 0xc]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x65
jne 0x140021538
movzx r9d, word [r8 + 0xe]
test r9w, r9w
je 0x140021538
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x72
jne 0x140021538
cmp word [r8 + 0x10], 0
jne 0x140021538
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14002175c
mov rax, qword [rsp + 0x68]
dec dword [rax]
mov rax, qword [r14]
jmp 0x1400217bd
mov qword [r12], 0
mov rcx, qword [rsp + 0xb38]
xor rcx, rsp
call fcn.140030090
mov rax, r12
movaps xmm6, xmmword [rsp + 0xb40]
add rsp, 0xb58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13b, 1
mov bpl, 1
test bl, bl
je 0x140021865
mov bpl, 1
test rax, rax
je 0x140021862
lea rcx, [rdi + 0x10]
mov edx, 0xff
mov r8, r14
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x140021843
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x66
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x14002184d
cmp r10b, 0x2d
je 0x14002181a
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14002181a
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14002184d
movzx esi, r11w
cmp esi, edx
cmovae r11d, edx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14002184d
jmp 0x140023456
cmp r9d, 0x2f
je 0x14002349c
mov rax, qword [r8 + 8]
add r8, 8
add rcx, 8
test rax, rax
jne 0x1400217d5
xor r13d, r13d
mov ebx, 1
cmp qword [rsp + 0x1d8], 0
mov qword [rsp + 0x70], r14
je 0x140022fbc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x1400232c4
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400232c4
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400232c4
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x1400232c4
cmp dword [rax + rcx + 0x50], 0x148
jb 0x1400232c4
mov r14d, dword [rax + rcx + 8]
lea r15, [rsp + 0x200]
cmp qword [r15 + 0x10], 0
jne 0x140021961
mov r12, qword [rsp + 0x1f0]
cmp qword [rsp + 0x1f8], 8
jb 0x140021900
mov r9, qword [rsp + 0x1e0]
jmp 0x140021908
lea r9, [rsp + 0x1e0]
mov rax, qword [rsp + 0x218]
cmp rax, r12
jae 0x14002352a
mov rcx, r15
mov rdx, r12
call fcn.140008b40
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x218]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jae 0x14002355e
mov qword [rsp + 0x20], 6
lea r9, str.Image
mov edx, 6
mov rcx, r15
call fcn.140008c60
mov dword [rsp + 0x2a0], 4
mov rcx, qword [rsp + 0x1d8]
cmp qword [rsp + 0x218], 8
jb 0x140021987
mov r15, qword [rsp + 0x200]
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x120]
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400231b0
cmp dword [rsp + 0x120], 4
jne 0x140023610
cmp dword [rsp + 0x6e0], r14d
jne 0x1400231b9
test r13b, r13b
je 0x140021a2e
lea r15, [rsp + 0x6e0]
mov qword [r15], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r15]
lea rcx, [rsp + 0x1d0]
mov qword [rcx - 8], rax
mov eax, 1
mov byte [rcx], 1
mov byte [rsp + 0x130], 0
mov dword [rsp + 0x120], eax
mov bpl, 1
test eax, eax
jne 0x140021b1c
mov bl, 1
jmp 0x140021b4a
cmp ebx, 1
jne 0x140023267
lea r15, [rsp + 0x1d8]
lea rcx, [rsp + 0x1b8]
call fcn.140024af0
lea r12, [rsp + 0x6e0]
mov rcx, r12
mov rdx, r15
mov r8, rax
call fcn.140023db0
cmp byte [r12 + 0x10], 0
jne 0x140023a5c
lea rcx, [rsp + 0x1b8]
call fcn.140024a10
lea r12, [rsp + 0x2a0]
mov rcx, r12
mov rdx, r15
mov r8, rax
call fcn.140023db0
cmp byte [r12 + 0x10], 0
jne 0x140023b8a
mov dl, byte [rsp + 0x6e8]
test dl, dl
setne r8b
mov cl, byte [rsp + 0x2a8]
test cl, cl
setne al
xor al, r8b
test dl, dl
je 0x140021ad4
test cl, cl
je 0x140021ad4
mov rax, qword [rsp + 0x6e0]
cmp rax, qword [rsp + 0x2a0]
setae al
and bpl, al
cmp bpl, 1
je 0x140023b98
lea r15, [rsp + 0x120]
mov qword [r15], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r15]
lea rcx, [rsp + 0x1c0]
mov qword [rcx - 8], rax
movzx eax, bpl
mov byte [rcx], 1
mov byte [rsp + 0x130], 0
jmp 0x140021a1c
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400236d9
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
jne 0x1400236ed
xor ebx, ebx
cmp qword [rsp + 0x1d8], 0
je 0x14002304c
lea r15, [rsp + 0x280]
cmp qword [r15 + 0x10], 0
jne 0x140021be6
mov r12, qword [rsp + 0x1f0]
cmp qword [rsp + 0x1f8], 8
jb 0x140021b85
mov r9, qword [rsp + 0x1e0]
jmp 0x140021b8d
lea r9, [rsp + 0x1e0]
mov rax, qword [rsp + 0x298]
cmp rax, r12
jae 0x14002359d
mov rcx, r15
mov rdx, r12
call fcn.140008b40
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xa
jae 0x1400235d2
mov qword [rsp + 0x20], 0xa
lea r9, str.Blocklist
mov edx, 0xa
mov rcx, r15
call fcn.140008c60
mov rcx, qword [rsp + 0x1d8]
cmp qword [rsp + 0x298], 8
mov r8, r15
jb 0x140021c04
mov r8, qword [rsp + 0x280]
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x30], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400230d9
mov r13d, dword [rsp + 0x6e0]
and r13d, 0xfffffffe
mov rcx, r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x1d8]
cmp qword [rsp + 0x298], 8
jb 0x140021c71
mov r15, qword [rsp + 0x280]
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, r15
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140023665
xor eax, eax
mov qword [rsp + 0x6e0], rax
mov qword [rsp + 0x6f0], rax
mov qword [rsp + 0x6f8], 7
mov word [rsp + 0x6e0], 0
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r14, rax
lea rcx, [rsp + 0x6e0]
cmp rax, 7
jbe 0x140023670
mov rdx, r14
mov r9, r12
call fcn.140008b40
mov rsi, qword [rsp + 0x6e0]
mov r14, qword [rsp + 0x6e8]
mov r15, qword [rsp + 0x6f0]
mov r13, qword [rsp + 0x6f8]
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], r13
mov al, 1
mov byte [rsp + 0x1b0], al
test bpl, bl
je 0x14002257a
mov eax, dword [0x140064da4]
cmp eax, 0x3838
ja 0x140023737
mov eax, dword [0x140064050]
cmp eax, 0x383a
jb 0x140021e15
lea r14, [rsp + 0x6e8]
mov r8d, 0x114
mov rcx, r14
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [r14 - 8], rax
mov dword [r14 + 4], 0x3839
mov rsi, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 4
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rsi
lea rcx, [rsp + 0x6e0]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x14002372c
mov eax, 0x3839
xchg dword [0x140064050], eax
call fcn.140032260
call fcn.140024490
test rdi, rdi
je 0x1400234a8
lea r14, [rsp + 0x6e0]
mov rcx, r14
call fcn.1400246f0
mov rax, qword [r14]
test rax, rax
je 0x1400234a8
mov qword [rdi], rax
mov r15, qword [rdi + 8]
test r15, r15
mov r14, qword [rsp + 0x70]
je 0x140022434
lea rax, [rdi + 0x10]
mov ecx, 0xff
lea rdx, str.wait_for_browser
mov r10, r15
mov r8, r14
movzx r9d, word [r10]
cmp r9d, 0x2d
jne 0x140021eef
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x77
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x140021ef9
cmp r11b, 0x2d
je 0x140021eb3
lea ebx, [r11 - 0x30]
cmp bl, 0xa
jb 0x140021eb3
lea ebx, [r11 - 0x61]
cmp bl, 0x19
ja 0x140021ef9
movzx ebx, si
cmp ebx, ecx
cmovae esi, ecx
lea ebx, [rsi - 0x41]
mov ebp, esi
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
cmovae ebx, esi
cmp bl, r11b
jne 0x140021ef9
mov r11b, byte [r10 + rdx + 1]
inc r10
cmp r10, 0x10
jne 0x140021e91
cmp word [r9 + 0x20], 0
je 0x14002246e
jmp 0x140021ef9
cmp r9d, 0x2f
je 0x1400236cd
mov r10, qword [r8 + 8]
add r8, 8
add rax, 8
test r10, r10
jne 0x140021e6f
mov r13, r14
lea rax, [rdi + 0x10]
mov ecx, 0xff
mov r8, r15
movzx edx, word [r8]
cmp edx, 0x2f
je 0x140021f43
cmp edx, 0x2d
jne 0x1400220d6
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x140021f4a
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x1400220d6
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x1400220d6
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x72
jne 0x1400220d6
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x69
jne 0x1400220d6
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x1400220d6
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6e
jne 0x1400220d6
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
je 0x140023c19
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x140021f1d
mov eax, 0xff
lea rcx, str.backgroundtask
mov r9, r15
mov rdx, r13
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x140022120
cmp r8d, 0x2d
jne 0x140022190
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x140022127
add r9, 2
mov r8, r9
mov r10b, 0x62
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x140022190
cmp r10b, 0x2d
je 0x140022152
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x140022152
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x140022190
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x140022190
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0xe
jne 0x14002212d
cmp word [r8 + 0x1c], 0
je 0x140023d23
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
jne 0x1400220f8
lea rax, [rdi + 0x10]
mov ecx, 0xff
mov r8, r15
movzx edx, word [r8]
cmp edx, 0x2f
je 0x1400221d3
cmp edx, 0x2d
jne 0x140022366
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x1400221da
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x68
jne 0x140022366
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x140022366
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x140022366
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x140022366
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6c
jne 0x140022366
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x140022366
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
je 0x140023cdd
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x1400221ad
mov eax, 0xff
lea rcx, str.remote_debugging_port
mov r9, r15
mov rdx, r13
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x1400223b0
cmp r8d, 0x2d
jne 0x140022420
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x1400223b7
add r9, 2
mov r8, r9
mov r10b, 0x72
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x140022420
cmp r10b, 0x2d
je 0x1400223e2
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x1400223e2
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x140022420
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x140022420
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0x15
jne 0x1400223bd
cmp word [r8 + 0x2a], 0
je 0x140023d23
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
mov r14, r13
jne 0x140022388
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002244f
cmp byte [rax], 0
jne 0x140023c00
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140023b2d
mov r12, qword [rsp + 0x60]
xor ebp, ebp
jmp 0x14002248d
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14002246e
mov rax, qword [rsp + 0x68]
dec dword [rax]
mov r15, qword [r14]
mov ebp, 1
test r15, r15
je 0x14002269d
lea rax, [rdi + 0x10]
mov ecx, 0xff
mov r9, r15
mov rdx, r14
mov r13, rbp
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x1400224d2
cmp r8d, 0x2f
je 0x1400234d8
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
jne 0x1400224a8
jmp 0x1400225a9
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
mov r10b, 0x6e
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x1400224bc
cmp r10b, 0x2d
je 0x14002250f
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14002250f
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x1400224bc
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x1400224bc
lea r10, str.no_deelevate
mov r10b, byte [r9 + r10 + 1]
inc r9
cmp r9, 0xc
jne 0x1400224ea
cmp word [r8 + 0x18], 0
jne 0x1400224bc
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140022559
dec dword [rdx]
mov r15, qword [r14]
xor eax, eax
mov r12, qword [rsp + 0x60]
mov rbp, r13
jmp 0x1400225ab
lea rcx, [rsp + 0x1b8]
lea rdi, [rsp + 0x6e0]
mov rdx, rdi
call fcn.1400247f0
cmp byte [rdi + 0x10], 0
jne 0x140023795
mov qword [r12], 0
jmp 0x140022ee9
mov al, 1
test r15, r15
je 0x140022696
lea rcx, [rdi + 0x10]
mov edx, 0xff
mov r8, r14
movzx r9d, word [r15]
cmp r9d, 0x2d
je 0x1400225ea
cmp r9d, 0x2f
je 0x1400234e4
mov r15, qword [r8 + 8]
add r8, 8
add rcx, 8
test r15, r15
jne 0x1400225c0
jmp 0x140022696
lea r9, [r15 + 2]
lea r10, [r15 + 4]
cmp word [r15 + 2], 0x2d
cmove r9, r10
mov r11b, 0x61
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x1400225d4
cmp r11b, 0x2d
je 0x140022624
lea ebx, [r11 - 0x30]
cmp bl, 0xa
jb 0x140022624
lea ebx, [r11 - 0x61]
cmp bl, 0x19
ja 0x1400225d4
movzx ebx, si
cmp ebx, edx
cmovae esi, edx
lea ebx, [rsi - 0x41]
mov ebp, esi
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
mov rbp, r13
cmovae ebx, esi
cmp bl, r11b
jne 0x1400225d4
lea r11, str.attempting_deelevation
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x16
jne 0x140022602
cmp word [r9 + 0x2c], 0
jne 0x1400225d4
mov r8, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov qword [rcx - 8], rdx
add rcx, 8
test rdx, rdx
jne 0x14002266d
dec dword [r8]
lea ecx, [r13 + 2]
test al, al
cmovne ecx, r13d
or ecx, 4
mov ebp, ecx
mov r12, qword [rsp + 0x60]
jmp 0x14002269d
test al, al
jne 0x14002269d
or ebp, 2
lea r9, [rsp + 0xb8]
mov qword [r9], 0
mov rdx, qword [rdi]
lea r15, [rsp + 0x178]
mov rcx, r15
mov r8d, ebp
call fcn.140033180
cmp byte [r15 + 0x10], 0
jne 0x1400237a2
mov rsi, qword [rsp + 0xb8]
test rsi, rsi
jne 0x1400237c6
mov eax, dword [rsp + 0x178]
test eax, eax
jne 0x1400237d1
xor eax, eax
cmp ebp, 4
setae al
lea r13d, [rax + rax]
inc r13d
lea rcx, [rsp + 0x1b8]
lea r15, [rsp + 0x160]
mov rdx, r15
call fcn.1400247f0
cmp byte [r15 + 0x10], 0
jne 0x14002383f
mov rax, qword [rsp + 0x68]
mov edx, dword [rax]
mov qword [rsp + 0x20], 0
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.140025640
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140023849
mov r8, qword [r14]
test r8, r8
je 0x1400229f4
lea rax, [rdi + 0x10]
mov ecx, 0xff
movzx edx, word [r8]
cmp edx, 0x2d
je 0x14002278e
cmp edx, 0x2f
je 0x140023512
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14002276b
jmp 0x1400229f4
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
movzx r8d, word [rdx]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x14002277d
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14002277d
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x66
jne 0x14002277d
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14002277d
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x2d
jne 0x14002277d
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x14002277d
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x14002277d
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x14002277d
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x14002277d
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14002277d
cmp word [rdx + 0x12], 0
jne 0x14002277d
lea rcx, str.DisableSafeMode
call fcn.140025350
mov ebx, eax
xor bl, 1
jmp 0x1400229f6
xor ebx, ebx
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x84], r13d
jne 0x140023881
xor eax, eax
lea r12, [rsp + 0x128]
mov qword [r12 - 8], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 3
lea rcx, [rsp + 0x140]
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
lea rcx, [rsp + 0x120]
call fcn.140032400
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov r15, rax
mov ecx, 0xfffffff5
call rsi
mov r13, rax
mov ecx, 0xfffffff4
call rsi
mov rbp, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140022ad3
mov rcx, r15
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140022ad3
mov rax, qword [rsp + 0x130]
cmp rax, qword [rsp + 0x138]
je 0x140023a92
mov rcx, qword [rsp + 0x128]
mov qword [rcx + rax*8], r15
inc qword [rsp + 0x130]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140022b26
mov rcx, r13
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140022b26
mov rax, qword [rsp + 0x130]
cmp rax, qword [rsp + 0x138]
je 0x140023aaf
mov rcx, qword [rsp + 0x128]
mov qword [rcx + rax*8], r13
inc qword [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140022b79
mov rcx, rbp
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140022b79
mov rax, qword [rsp + 0x130]
cmp rax, qword [rsp + 0x138]
je 0x140023acc
mov rcx, qword [rsp + 0x128]
mov qword [rcx + rax*8], rbp
inc qword [rsp + 0x130]
mov dword [rsp + 0x80], ebx
lea rcx, [rsp + 0x120]
lea rbx, [rsp + 0x108]
lea r12, [rsp + 0x6e0]
mov rdx, rbx
mov r8, r12
call fcn.140032f30
cmp byte [rbx + 0x10], 0
jne 0x140023894
xor r14d, r14d
cmp byte [rsp + 0x108], 0
je 0x1400238ba
mov esi, 0x80404
cmp qword [rsp + 0x130], 0
je 0x140022bf4
or byte [rsp + 0x71d], 1
mov qword [rsp + 0x730], r15
mov qword [rsp + 0x738], r13
mov qword [rsp + 0x740], rbp
mov r14d, 1
xorps xmm6, xmm6
lea rbx, [rsp + 0x2a0]
movaps xmmword [rbx], xmm6
movaps xmmword [rbx + 0x50], xmm6
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
mov qword [rbx + 0x60], 0
mov dword [rbx], 0x68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rbx + 0x3d], 8
mov rcx, qword [rsp + 0x68]
je 0x140022c49
mov rax, qword [rsp + 0x2b8]
test rax, rax
jne 0x140023bad
lea rax, [rsp + 0x90]
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rdx, qword [rdi]
test rcx, rcx
jne 0x1400238c4
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rcx, rdx
mov r14, qword [rsp + 0x78]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
je 0x140023900
mov r13, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
test byte [rsp + 0x88], 1
je 0x140023948
lea rbx, [rsp + 0xb20]
mov rcx, rbx
mov rdx, r13
call fcn.1400322c0
mov r15, qword [rbx]
mov rdx, qword [rsi]
test rdx, rdx
mov ebx, dword [rsp + 0x80]
je 0x140022da3
mov eax, 0xff
movzx ecx, word [rdx]
cmp ecx, 0x2d
je 0x140022d1d
cmp ecx, 0x2f
je 0x14002351e
mov rdx, qword [rsi + 8]
add rsi, 8
test rdx, rdx
jne 0x140022cfa
jmp 0x140022da3
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
mov r8b, 0x64
xor edx, edx
movzx r9d, word [rcx + rdx*2]
test r9w, r9w
je 0x140022d0b
cmp r8b, 0x2d
je 0x140022d58
lea r10d, [r8 - 0x30]
cmp r10b, 0xa
jb 0x140022d58
lea r10d, [r8 - 0x61]
cmp r10b, 0x19
ja 0x140022d0b
movzx r10d, r9w
cmp r10d, eax
cmovae r9d, eax
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, r8b
jne 0x140022d0b
lea r8, str.disabledynamicblocklist
mov r8b, byte [rdx + r8 + 1]
inc rdx
cmp rdx, 0x17
jne 0x140022d33
cmp word [rcx + 0x2e], 0
jne 0x140022d0b
mov al, 1
jmp 0x140022da5
xor eax, eax
test bl, bl
setne bl
or bl, al
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe0], 0
cmp byte [rsp + 0x1b0], 0
je 0x140022de9
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x190]
call fcn.140023e90
mov rdx, qword [rdi]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8, r13
mov r9d, dword [rsp + 0x84]
call fcn.140032510
cmp byte [rdi + 0x10], 0
jne 0x140023950
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14002395a
test byte [rsp + 0x88], 1
je 0x1400239b0
mov rcx, r13
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140023a31
lea rdx, [rsp + 0xb20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140023a31
mov eax, dword [rsp + 0xb20]
mov dword [r12], eax
mov byte [r12 + 4], 1
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140022e95
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 1]
cmp rax, 2
jb 0x140022ea8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
jb 0x140022ebb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.140032270
test r14, r14
mov rsi, qword [rsp + 0x68]
je 0x140022edb
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140023a4e
cmp byte [rsp + 0x1b0], 0
je 0x140022f25
mov rax, qword [rsp + 0x1a8]
cmp rax, 8
jb 0x140022f25
mov rcx, qword [rsp + 0x190]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
jne 0x1400234f0
call qword [sym.imp.mozglue.dll_free]
lea rcx, [rsp + 0x1b8]
call fcn.140024bf0
jmp 0x140021780
cmp byte [rsp + 0x2b8], 0
jne 0x140023ae9
mov r8d, dword [rsp + 0x2a0]
lea r13, [rsp + 0x190]
mov rcx, r13
mov rdx, r12
call fcn.140024e70
cmp byte [r13 + 0x18], 0
jne 0x140023b07
cmp byte [rsp + 0x138], 0
jne 0x140023b25
movdqu xmm0, xmmword [rsp + 0x190]
movq xmm1, qword [rsp + 0x130]
movq xmm2, qword [rsp + 0x1a0]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x120]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor r12d, r12d
cmp eax, 0xffff
sete r12b
xor ebx, ebx
jmp 0x1400214d3
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023b45
mov rsi, qword [rsp + 0x6e0]
mov rcx, qword [rsp + 0x1d8]
test rcx, rcx
jne 0x140023b74
mov qword [rsp + 0x1d8], rsi
mov eax, dword [rsp + 0x2a0]
cmp eax, 2
jne 0x14002329d
mov ebx, 1
jmp 0x14002187e
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002369f
mov rsi, qword [rsp + 0x6e0]
mov rcx, qword [rsp + 0x1d8]
test rcx, rcx
jne 0x140023b7f
mov qword [rsp + 0x1d8], rsi
mov eax, dword [rsp + 0x2a0]
dec eax
cmp eax, 1
jbe 0x140021b59
jmp 0x14002369f
cmp eax, 2
jne 0x14002369f
lea rcx, [rsp + 0x1b8]
lea r14, [rsp + 0x6e0]
mov rdx, r14
call fcn.1400260d0
cmp byte [r14 + 0x20], 0
mov r12, qword [rsp + 0x60]
jne 0x140023692
lea rcx, [rsp + 0x1b8]
call fcn.140032af0
mov ecx, dword [rsp + 0x6f0]
cmp qword [rsp + 0x6f8], 8
jb 0x140023131
mov r14, qword [rsp + 0x6e0]
lea edx, [rcx + rcx]
add edx, 2
cmp qword [rax + 0x18], 8
jb 0x140023141
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1d8]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r14
mov rdx, rax
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023692
cmp byte [rsp + 0x700], 0
jne 0x140023692
lea rcx, [rsp + 0x6e0]
mov rsi, qword [rcx]
mov r14, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov r13, qword [rcx + 0x18]
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
call fcn.140032390
jmp 0x140021d23
cmp eax, 2
jne 0x140023bc2
lea rcx, [rsp + 0x1b8]
lea r15, [rsp + 0x6e0]
mov rdx, r15
call fcn.140032900
cmp byte [r15 + 0x10], 0
jne 0x140023a5c
lea rcx, [rsp + 0x1b8]
call fcn.140032820
mov dword [rsp + 0x2a0], r14d
cmp qword [rax + 0x18], 8
jb 0x1400231fb
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1d8]
lea rdx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 4
mov rdx, rax
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400219d9
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x130], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], 0x79
jmp 0x140023659
test ebx, ebx
jne 0x140023bda
lea r15, [rsp + 0x6e0]
mov qword [r15], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r15]
lea rcx, [rsp + 0x1c0]
mov qword [rcx - 8], rax
xor eax, eax
jmp 0x140021a0a
cmp eax, 1
jne 0x140023c0a
xor ebx, ebx
jmp 0x14002187e
add r10, 2
mov r9, r10
jmp 0x14002123e
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [rsp + 0x130], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x120], rax
movabs rax, 0x800700c100000025
mov qword [rsp + 0x128], rax
xor ebp, ebp
lea rcx, [rsp + 0x120]
xor edx, edx
call fcn.1400348c0
jmp 0x140021b48
add rax, 2
mov r9, rax
jmp 0x1400212f8
add r9, 2
mov r8, r9
jmp 0x14002155b
or ebp, 0x10000000
mov r13d, 0x519
lea rcx, [rsp + 0x6e0]
mov qword [rcx], r12
mov dword [rcx + 8], r13d
mov dword [rcx + 0xc], ebp
xor ebx, ebx
xor edx, edx
call fcn.1400348c0
jmp 0x1400214f6
xor r12d, r12d
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400214d3
cmp eax, 0x57
je 0x1400214d3
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r13d, 0x5c
jmp 0x1400214ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov byte [rsp + 0x6f8], 1
mov r13d, 0x1e
jmp 0x1400214ca
mov r12, qword [rsp + 0x6e8]
mov r13d, dword [rsp + 0x6f0]
mov bl, 1
mov ebp, dword [rsp + 0x6f4]
jmp 0x1400214d3
mov ebp, dword [rsp + 0x12c]
cmp ebp, 0xd000003a
jne 0x140023a7b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
lea rdx, [rsp + 0x120]
mov qword [rdx], rax
lea r12, [rsp + 0x2a0]
mov rcx, r12
call fcn.140039e20
cmp byte [r12 + 0x18], 0
je 0x140023d30
mov r12, qword [rsp + 0x2a8]
mov r13d, dword [rsp + 0x2b0]
mov bl, 1
mov ebp, dword [rsp + 0x2b4]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400214d3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400214d3
cmp byte [rax], 0
je 0x14002150c
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov bl, 1
jmp 0x14002150c
lea r10, str.force_launcher
mov r10b, byte [rax + r10 + 1]
inc rax
cmp rax, 0xe
jne 0x1400217f5
cmp word [r9 + 0x1c], 0
jne 0x14002184d
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14002347b
mov rax, qword [rsp + 0x68]
dec dword [rax]
xor r13d, r13d
xor ebp, ebp
jmp 0x140021865
add rax, 2
mov r9, rax
jmp 0x1400217f0
lea rcx, [rsp + 0x6e0]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000156
mov qword [rcx + 8], rax
xor edx, edx
call fcn.1400348c0
jmp 0x14002259c
add r9, 2
mov r8, r9
jmp 0x1400224e4
add r15, 2
mov r9, r15
jmp 0x1400225fc
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140023d72
mov rcx, rax
mov r12, qword [rsp + 0x60]
jmp 0x140022f1f
add r8, 2
mov rdx, r8
jmp 0x1400227a0
add rdx, 2
mov rcx, rdx
jmp 0x140022d2e
mov rsi, r15
cmp rax, 8
jb 0x14002353b
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x210], r12
lea r8, [r12 + r12]
mov rcx, rsi
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rsi + r12*2], 0
jmp 0x140021924
lea rdx, [rax + 6]
mov qword [rsp + 0x210], rdx
mov rdx, r15
cmp rcx, 8
jb 0x14002357b
mov rdx, qword [rsp + 0x200]
movabs rcx, 0x61006d0049007c
mov qword [rdx + rax*2], rcx
mov dword [rdx + rax*2 + 8], 0x650067
mov word [rdx + rax*2 + 0xc], 0
jmp 0x140021961
mov r13, r15
cmp rax, 8
jb 0x1400235ae
mov r13, qword [rsp + 0x280]
mov qword [rsp + 0x290], r12
lea r8, [r12 + r12]
mov rcx, r13
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [r13 + r12*2], 0
jmp 0x140021ba9
lea rdx, [rax + 0xa]
mov qword [rsp + 0x290], rdx
mov rdx, r15
cmp rcx, 8
jb 0x1400235ef
mov rdx, qword [rsp + 0x280]
movdqa xmm0, xmmword [str.Blocklist]
movdqu xmmword [rdx + rax*2], xmm0
mov dword [rdx + rax*2 + 0x10], 0x740073
mov word [rdx + rax*2 + 0x14], 0
jmp 0x140021be6
mov eax, 0x43
mov ecx, 0x8007065d
mov byte [rsp + 0x130], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs r8, 0xffffff0000000000
and r8, rdx
mov r9d, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, r8
or r9, rdx
mov qword [rsp + 0x120], r9
mov dword [rsp + 0x128], eax
mov dword [rsp + 0x12c], ecx
jmp 0x1400232ed
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
jmp 0x14002369f
mov qword [rcx + 0x10], r14
mov r8, r14
add r8, r14
mov rdx, r12
call sub.ntdll.dll_memcpy
mov word [rsp + r14*2 + 0x6e0], 0
jmp 0x140021cf5
lea rcx, [rsp + 0x6e0]
call fcn.140032390
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1b0], 0
xor eax, eax
mov r12, qword [rsp + 0x60]
jmp 0x140021d45
add r10, 2
mov r9, r10
jmp 0x140021e8b
cmp byte [rax], 0
je 0x140021b32
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140021b48
cmp word [rax], 0
je 0x140021b48
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul r15d, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140039f40
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140021b4a
mov eax, 0x3839
xchg dword [0x140064da4], eax
mov eax, dword [0x140064d08]
mov ecx, dword [0x1400644c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140023d78
mov rax, qword [0x140064d00]
test rax, rax
mov r12, qword [rsp + 0x60]
je 0x140021e15
lea rdx, [rsp + 0x6e0]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [0x14006a010]
jmp 0x140021e15
lea rcx, [rsp + 0x6e0]
jmp 0x1400234cc
lea rcx, [rsp + 0x178]
xor edx, edx
call fcn.1400348c0
mov qword [r12], 0
mov rsi, qword [rsp + 0xb8]
jmp 0x140022edb
mov r13d, 4
jmp 0x1400226fc
xor r13d, r13d
cmp eax, 1
jne 0x1400226fc
mov r13d, 2
test bpl, 3
jne 0x1400226fc
mov r13d, 5
cmp ebp, 3
ja 0x1400226fc
mov rax, qword [rsp + 0x68]
mov edx, dword [rax]
lea rbx, [rsp + 0x6e0]
mov rcx, rbx
mov r8, rdi
call fcn.140034bd0
cmp byte [rbx + 0x10], 0
jne 0x140023d50
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov sil, 1
mov r12, qword [rsp + 0x60]
mov byte [r12 + 4], sil
xor esi, esi
jmp 0x140022edb
lea rcx, [rsp + 0x160]
jmp 0x14002386d
lea rcx, [rsp + 0x6e0]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x800705070000019e
mov qword [rcx + 8], rax
xor edx, edx
call fcn.1400348c0
mov qword [r12], 0
jmp 0x140022edb
cmp byte [rax], 0
movzx eax, bl
mov ebx, 1
cmove ebx, eax
jmp 0x140022a21
lea rcx, [rsp + 0x108]
xor edx, edx
call fcn.1400348c0
mov r12, qword [rsp + 0x60]
mov qword [r12], 0
mov r14, qword [rsp + 0x78]
jmp 0x140022ebb
mov esi, 0x404
jmp 0x140022bf4
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], 0
mov r14, qword [rsp + 0x78]
mov r8, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140022c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb20]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1e4
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.1400348c0
mov qword [r12], 0
jmp 0x140022ebb
xor r15d, r15d
jmp 0x140022ce2
lea rcx, [rsp + 0xf0]
jmp 0x14002398e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb20]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1ff
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.1400348c0
mov rcx, r13
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [r12], 0
jmp 0x140022e82
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov edi, eax
xor esi, esi
test eax, eax
setne sil
neg esi
xor r14d, r14d
mov dword [rsp + 0x70], 0
test eax, eax
jne 0x1400239db
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x70], eax
or esi, 0x2710
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jne 0x1400239fa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
sub r14d, dword [rsp + 0x70]
mov r12d, esi
sub r12d, r14d
jbe 0x140023a31
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r13
mov edx, r12d
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x140023a31
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x140023a31
mov ecx, 0xa
call rbx
jmp 0x1400239e8
mov r12, qword [rsp + 0x60]
mov dword [r12], 0
mov byte [r12 + 4], 1
mov r14, qword [rsp + 0x78]
jmp 0x140022e82
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140022ee9
movdqu xmm0, xmmword [rsp + 0x6e0]
movdqa xmmword [rsp + 0x120], xmm0
mov byte [rsp + 0x130], 1
jmp 0x1400232ed
mov r12, qword [rsp + 0x120]
mov bl, 1
mov r13d, dword [rsp + 0x128]
jmp 0x1400214d3
mov rcx, r12
call fcn.14003a0e0
test al, al
je 0x140022ad3
mov rax, qword [rsp + 0x130]
jmp 0x140022abf
mov rcx, r12
call fcn.14003a0e0
test al, al
je 0x140022b26
mov rax, qword [rsp + 0x130]
jmp 0x140022b12
mov rcx, r12
call fcn.14003a0e0
test al, al
je 0x140022b79
mov rax, qword [rsp + 0x130]
jmp 0x140022b65
mov r12, qword [rsp + 0x2a8]
mov r13d, dword [rsp + 0x2b0]
mov bl, 1
mov ebp, dword [rsp + 0x2b4]
jmp 0x1400214d3
mov r12, qword [rsp + 0x190]
mov r13d, dword [rsp + 0x198]
mov bl, 1
mov ebp, dword [rsp + 0x19c]
jmp 0x1400214d3
xor r12d, r12d
jmp 0x140022fb5
cmp byte [rax], 0
mov r12, qword [rsp + 0x60]
mov ebp, 0
jne 0x140022488
jmp 0x14002248d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov byte [rsp + 0x130], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x120], rdx
jmp 0x140023652
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002302a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400230ba
movdqu xmm0, xmmword [rsp + 0x2a0]
jmp 0x140023a65
lea rcx, [rsp + 0x1d0]
mov qword [rcx - 8], 0
jmp 0x140021b08
or byte [rsp + 0x71d], 8
mov qword [rsp + 0x6f8], rax
jmp 0x140022c49
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3f
jmp 0x14002361a
mov byte [rsp + 0x130], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x120], rax
movabs rax, 0x8007050700000119
jmp 0x1400232e5
mov r12, qword [rsp + 0x60]
jmp 0x140022488
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x140023b58
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x1400220d6
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x1400220d6
movzx r8d, word [rdx + 0x12]
test r8w, r8w
je 0x1400220d6
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x1400220d6
cmp word [rdx + 0x14], 0
jne 0x1400220d6
jmp 0x140023d23
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x140022366
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x140022366
cmp word [rdx + 0x10], 0
jne 0x140022366
mov r12, qword [rsp + 0x60]
mov r14, r13
jmp 0x140022488
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x2a0]
call fcn.140039eb0
movzx r12d, al
xor ebx, ebx
jmp 0x14002341e
xor esi, esi
lea rcx, [rsp + 0x6e0]
xor edx, edx
call fcn.1400348c0
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x14002382e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [0x140064d08]
call fcn.14002ef24
cmp dword [0x140064d08], 0xffffffff
jne 0x14002375c
call fcn.14003a070
lea rcx, [0x140064d08]
call fcn.14002eec4
jmp 0x14002375c