Function at 0x14000cde0
Capabilities:
Check for time delay via queryperformancecounter
Parse pe header
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1400f74a8]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12d, 1
cmp qword [rdx + 0x20], 0
je 0x14000ce80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14000ce62
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000ce62
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000ce62
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14000ce62
cmp dword [rax + rcx + 0x50], 0x147
ja 0x14000cf6e
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800700c100000025
mov qword [rsi + 8], rax
jmp 0x14000cef5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWARETor_ProjectFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000cf23
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov byte [rsi + 0x10], 1
lea rdx, str._var_tmp_build_firefox_d8b47d80163d_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rax, qword [rsp + 0xa0]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000d1fe
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsp + 0x88]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000cf3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], r14
mov eax, dword [rsp + 0x70]
cmp eax, 1
je 0x14000cf57
cmp eax, 2
jne 0x14000cf5f
mov r12d, 1
jmp 0x14000ce21
xor r12d, r12d
jmp 0x14000ce21
mov ecx, 0x80070507
mov eax, 0xb4
jmp 0x14000cee1
mov r13d, dword [rax + rcx + 8]
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.14000d220
cmp byte [rsp + 0x98], 0
je 0x14000cfa1
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 1
jmp 0x14000cef5
cmp byte [rsp + 0x8c], 0
je 0x14000cfea
cmp dword [rsp + 0x88], r13d
jne 0x14000cfea
cmp ebx, 1
jne 0x14000d008
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 1
jmp 0x14000cef5
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000d360
cmp byte [rsp + 0x80], 0
je 0x14000d042
movups xmm0, xmmword [rsp + 0x70]
jmp 0x14000cf95
cmp r12d, 1
je 0x14000d052
test r12d, r12d
jne 0x14000d08b
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov byte [rdi + 8], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 0
jmp 0x14000cef5
movzx ecx, byte [rdi + 0x40]
mov eax, ecx
and al, 1
je 0x14000d0ac
mov rcx, qword [rdi + 0x48]
jmp 0x14000d0af
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000d5f0
cmp byte [rsp + 0x80], 0
jne 0x14000d001
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.14000d740
cmp byte [rsp + 0x68], 0
je 0x14000d147
movups xmm0, xmmword [rsp + 0x58]
jmp 0x14000cf95
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007050700000119
mov qword [rsi + 8], rax
jmp 0x14000cef5
shr rcx, 1
test rcx, rcx
jne 0x14000d0df
lea r14, [rdi + 0x40]
lea rdx, [rdi + 0x28]
mov rcx, r14
call fcn.14007ef80
lea rdx, str.Image
mov r8d, 6
mov rcx, r14
call fcn.14007dda0
movzx eax, byte [rdi + 0x40]
and al, 1
mov dword [rsp + 0x58], r13d
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000d0f2
mov rdx, qword [rdi + 0x50]
jmp 0x14000d0f6
lea rdx, [rdi + 0x42]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cfb5
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x79
jmp 0x14000cef2
movzx ecx, byte [rsp + 0x78]
test cl, cl
setne dl
movzx eax, byte [rsp + 0x60]
test al, al
setne r8b
xor r8b, dl
mov r14d, 1
jne 0x14000d18e
mov r14d, ebx
test ebx, ebx
jne 0x14000d18e
mov r14d, ebx
test cl, cl
je 0x14000d18e
test al, al
je 0x14000d203
mov rax, qword [rsp + 0x70]
xor r14d, r14d
cmp rax, qword [rsp + 0x58]
setae r14b
cmp ebp, 1
cmove r14d, ebx
test r14d, r14d
je 0x14000d1ae
cmp r14d, 1
jne 0x14000d1dd
mov qword [rdi + 0x10], 0
add rdi, 0x18
jmp 0x14000d1ce
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
add rdi, 8
mov byte [rdi], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], r14d
jmp 0x14000cef5
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800705070000015d
mov qword [rsi + 8], rax
jmp 0x14000cef5
call fcn.1400c8850
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3