Function at 0x140005380
Capabilities:
Enumerate processes
Get graphical window text
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x550], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x450]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r12b
mov rbx, qword [0x14001fcc0]
mov r13, qword [0x14001fcc8]
cmp rbx, r13
je 0x1400055cf
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
lea rax, [rbp + 0x450]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005433
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x70]
call fcn.140004c50
nop
mov rdi, qword [rbx + 0x10]
mov rsi, rbx
mov r14, qword [rbx + 0x18]
cmp r14, 0xf
jbe 0x140005462
mov rsi, qword [rbx]
test rdi, rdi
je 0x140005481
mov r8, rdi
mov edx, 0x2e
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140005481
sub rax, rsi
jmp 0x140005488
mov rax, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
cmp rdi, rax
cmovb rax, rdi
mov rdx, rbx
cmp r14, 0xf
jbe 0x1400054aa
mov rdx, qword [rbx]
mov r8, rax
lea rcx, [rbp + 0x40]
call fcn.140004c50
bts r15d, 0xf
mov dword [rsp + 0x40], r15d
lea r9, [rbp + 0x40]
mov rsi, qword [rbp + 0x40]
mov r15, qword [rbp + 0x58]
cmp r15, 0xf
cmova r9, rsi
lea rcx, [rbp + 0x70]
mov rdi, qword [rbp + 0x70]
mov r14, qword [rbp + 0x88]
cmp r14, 0xf
cmova rcx, rdi
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x80]
call fcn.140007a00
mov r12, rax
cmp r15, 0xf
jbe 0x140005541
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000552e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005590
mov rcx, rsi
call fcn.140013d44
mov r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x70]
cmp r14, 0xf
jbe 0x140005574
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000556c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005597
mov rcx, rdi
call fcn.140013d44
cmp r12, 0xffffffffffffffff
jne 0x14000559e
add rbx, 0x20
cmp rbx, r13
je 0x1400055c1
mov r15d, dword [rsp + 0x40]
xor r12d, r12d
jmp 0x140005410
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x1400055c1
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400055b5
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140006b40
cmp qword [rbp + 0x30], 0
jne 0x1400056df
xor r12d, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400065d0
mov dword [rbp + 0x100], 0x238
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400056cb
nop dword [rax + rax]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x12c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, qword [0x14001fcc0]
mov rdi, qword [0x14001fcc8]
cmp rbx, rdi
je 0x1400056ac
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000566d
mov rdx, qword [rbx]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140005689
add rbx, 0x20
cmp rbx, rdi
jne 0x140005660
jmp 0x1400056ac
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x1400056ac
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400056a0
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140006b40
cmp qword [rbp + 0x30], 0
jne 0x1400056cb
lea rdx, [rbp + 0x100]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005610
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x30], 0
je 0x1400065ac
lea rdx, str.Found___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.This_will_be_killed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400065d0
mov dword [rbp + 0x100], 0x238
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r15d, r15d
test eax, eax
je 0x14000583c
nop dword [rax + rax]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x12c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140005824
mov r8d, dword [rbp + 0x108]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005824
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400057a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
call fcn.140008780
mov rbx, qword [rbp + 0x50]
cmp byte [rbx + 0x19], 0
jne 0x1400058b4
lea rdx, [rbx + 0x20]
mov rdi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000587e
mov rdx, qword [rdx]
mov rsi, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400058ab
jns 0x140005938
jmp 0x1400058b4
cmp rsi, rdi
jae 0x140005938
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [0x14001fce0], rax
je 0x140006652
mov rsi, qword [0x14001fcd8]
lea r14, [0x14001fcd8]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r15
mov ecx, 0x58
call fcn.1400139f0
mov rdi, rax
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x20]
lea rcx, [rax + 0x20]
call fcn.140004de0
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov word [rdi + 0x18], 0
movups xmm0, xmmword [rbp + 0x40]
movaps xmmword [rsp + 0x70], xmm0
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140008310
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r15
mov rdx, qword [rbx + 0x48]
sub rdx, qword [rbx + 0x40]
sar rdx, 5
test rdx, rdx
je 0x1400059bf
lea rcx, [rbp + 0x70]
call fcn.140004d50
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov rdi, qword [rbx + 0x48]
mov rbx, qword [rbx + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov r13, qword [rbp + 0x70]
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
lea rax, [rbp + 0x70]
mov qword [rbp + 0x50], rax
cmp rbx, rdi
je 0x1400059ae
mov rdx, rbx
mov rcx, r13
call fcn.140004de0
add r13, 0x20
mov qword [rbp + 0x48], r13
add rbx, 0x20
cmp rbx, rdi
jne 0x140005992
mov rdx, r13
mov rcx, r13
call fcn.140004f10
mov qword [rbp + 0x78], r13
jmp 0x1400059c3
mov r13, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x70]
mov qword [rsp + 0x40], rdi
cmp rdi, r13
je 0x14000652d
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400059e2
mov rcx, qword [rdi]
mov r8d, 0x104
lea rdx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
cmp r8, 0xb
jne 0x140005a21
lea rdx, str.firefox.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005a21
mov cl, 1
jmp 0x140005a23
xor cl, cl
lea rdx, [rbp + 0x340]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140005a31
test cl, cl
lea rcx, [rbp + 0x340]
je 0x140006109
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rax
call fcn.1400130cc
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x10], xmm0
lea r8, [rbp + 0x10]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140003040
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x60]
call fcn.140006ea0
test eax, eax
jne 0x1400066ab
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140005ad0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005acb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000657b
call fcn.140013d44
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov rbx, qword [rbp + 0x68]
test rbx, rbx
je 0x140005ae8
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x68]
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x10], xmm0
test rbx, rbx
je 0x140005afe
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x68]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
test rbx, rbx
je 0x140005b4b
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140005b47
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005b47
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
jmp 0x140005b4b
mov rbx, qword [rbp + 0x68]
cmp qword [rbp + 0x60], 0
je 0x140006084
mov rbx, qword [rbp + 0x10]
nop word [rax + rax]
mov r8d, 3
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140003f90
mov rax, qword [rbp - 0x80]
mov edx, dword [rbp - 0x78]
test edx, edx
je 0x140005b8c
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140006658
cmp eax, 3
jne 0x14000605d
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x140005ba4
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x30]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
call fcn.1400130cc
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x90], xmm0
lea r8, [rbp + 0x90]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140008c00
nop
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rax, qword [rsp + 0x48]
mov qword [rbp - 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x28], rax
call fcn.1400130cc
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x90], xmm0
lea r8, [rbp + 0x90]
mov edx, eax
lea rcx, [rbp + 0x40]
call fcn.140003040
nop
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.140007040
test eax, eax
jne 0x140006689
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140005c74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006582
call fcn.140013d44
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r15w
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140005cc2
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006589
call fcn.140013d44
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov r12, qword [rbp + 8]
test r12, r12
je 0x140005cdf
lock inc dword [r12 + 8]
mov r12, qword [rbp + 8]
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x90], xmm0
test r12, r12
je 0x140005cfa
lock inc dword [r12 + 8]
mov r12, qword [rbp + 8]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
test r12, r12
je 0x140005d4a
mov eax, 0xffffffff
lock xadd dword [r12 + 8], eax
cmp eax, 1
jne 0x140005d46
mov rbx, qword [rbp + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005d46
mov r12, qword [rbp + 8]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + VariantCopy]
jmp 0x140005d4a
mov r12, qword [rbp + 8]
cmp qword [rbp], 0
je 0x140005fd8
mov rbx, qword [rbp + 0x90]
nop dword [rax]
mov r8d, 3
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140003f90
mov rax, qword [rbp - 0x70]
mov edx, dword [rbp - 0x68]
test edx, edx
je 0x140005d8c
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140006669
cmp eax, 2
jne 0x140005fb1
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x140005da4
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x30]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
call fcn.1400130cc
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x40], xmm0
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, [rbp + 0xb0]
call fcn.140008c00
nop
lea rbx, [rbp + 0xb0]
mov r14, qword [rbp + 0xb0]
mov r15, qword [rbp + 0xc8]
cmp r15, 0xf
cmova rbx, r14
mov rsi, qword [rbp + 0xc0]
cmp rsi, 7
jb 0x140005e59
lea rdi, [rbx + rsi]
lea r8, [rdi - 6]
sub r8, rbx
mov edx, 0x43
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140005e59
cmp dword [rax], 0x6b6f6f43
jne 0x140005e2e
cmp word [rax + 4], 0x6569
jne 0x140005e2e
cmp byte [rax + 6], 0x73
je 0x140005e4c
inc rax
lea r8, [rdi - 6]
sub r8, rax
mov edx, 0x43
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140005e18
jmp 0x140005e59
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140005eee
lea rbx, [rbp + 0xb0]
cmp r15, 0xf
cmova rbx, r14
cmp rsi, 0xe
jb 0x140005f7a
lea rdi, [rbx + rsi]
lea r8, [rdi - 0xd]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140005f7a
nop dword [rax]
nop word [rax + rax]
movabs rcx, 0x2e7365696b6f6f63
cmp qword [rax], rcx
jne 0x140005ec0
cmp dword [rax + 8], 0x696c7173
jne 0x140005ec0
cmp word [rax + 0xc], 0x6574
je 0x140005ee1
inc rax
lea r8, [rdi - 0xd]
sub r8, rax
mov edx, 0x63
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140005ea0
jmp 0x140005f7a
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140005f7a
lea rdx, str.Clearing_cookies__trackers_for
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x140017d80]
mov rcx, rax
call fcn.1400071f0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0xb0]
call fcn.1400050d0
mov r15, qword [rbp + 0xc8]
mov r14, qword [rbp + 0xb0]
cmp r15, 0xf
jbe 0x140005fb1
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140005fa9
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006590
mov rcx, r14
call fcn.140013d44
lea rcx, [rbp + 0x90]
call fcn.1400046e0
test eax, eax
jne 0x14000667a
mov rbx, qword [rbp + 0x90]
test rbx, rbx
jne 0x140005d60
xor r15d, r15d
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140006022
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000601e
mov rbx, qword [rbp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000601e
mov rcx, qword [rbp + 0x98]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12, qword [rbp + 8]
test r12, r12
je 0x14000605d
mov eax, 0xffffffff
lock xadd dword [r12 + 8], eax
cmp eax, 1
jne 0x14000605d
mov rbx, qword [rbp + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000605d
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rcx, [rbp + 0x10]
call fcn.1400040f0
test eax, eax
jne 0x14000669c
mov rbx, qword [rbp + 0x10]
test rbx, rbx
jne 0x140005b60
mov rbx, qword [rbp + 0x68]
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400060c5
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400060c1
mov rbx, qword [rbp + 0x18]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400060c1
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp + 0x68]
test rbx, rbx
je 0x140006513
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140006513
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140006513
mov rcx, qword [rbp + 0x68]
jmp 0x14000650d
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rax
call fcn.1400130cc
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x40], xmm0
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140003040
nop
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.140007040
test eax, eax
jne 0x14000663e
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140006190
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000618b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006597
call fcn.140013d44
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov r12, qword [rbp + 8]
test r12, r12
je 0x1400061aa
lock inc dword [r12 + 8]
mov r12, qword [rbp + 8]
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x10], xmm0
test r12, r12
je 0x1400061c2
lock inc dword [r12 + 8]
mov r12, qword [rbp + 8]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
test r12, r12
je 0x14000620f
mov eax, 0xffffffff
lock xadd dword [r12 + 8], eax
cmp eax, 1
jne 0x14000620b
mov rbx, qword [rbp + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000620b
mov r12, qword [rbp + 8]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + VariantCopy]
jmp 0x14000620f
mov r12, qword [rbp + 8]
cmp qword [rbp], 0
je 0x140006497
mov rbx, qword [rbp + 0x10]
nop
mov r8d, 3
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140003f90
mov rax, qword [rbp - 0x60]
mov edx, dword [rbp - 0x58]
test edx, edx
je 0x14000624c
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x1400066bf
cmp eax, 2
jne 0x140006471
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x140006264
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
call fcn.1400130cc
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0xf0], xmm0
lea r8, [rbp + 0xf0]
mov edx, eax
lea rcx, [rbp + 0xd0]
call fcn.140008c00
nop
lea rbx, [rbp + 0xd0]
mov r14, qword [rbp + 0xd0]
mov r15, qword [rbp + 0xe8]
cmp r15, 0xf
cmova rbx, r14
mov rsi, qword [rbp + 0xe0]
cmp rsi, 7
jb 0x140006322
lea rdi, [rbx + rsi]
lea r8, [rdi - 6]
sub r8, rbx
mov edx, 0x43
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140006322
cmp dword [rax], 0x6b6f6f43
jne 0x1400062f7
cmp word [rax + 4], 0x6569
jne 0x1400062f7
cmp byte [rax + 6], 0x73
je 0x140006315
inc rax
lea r8, [rdi - 6]
sub r8, rax
mov edx, 0x43
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400062e1
jmp 0x140006322
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400063ae
lea rbx, [rbp + 0xd0]
cmp r15, 0xf
cmova rbx, r14
cmp rsi, 0xe
jb 0x14000643a
lea rdi, [rsi + rbx]
lea r8, [rdi - 0xd]
sub r8, rbx
mov edx, 0x63
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000643a
nop dword [rax]
movabs rcx, 0x2e7365696b6f6f63
cmp qword [rax], rcx
jne 0x140006380
cmp dword [rax + 8], 0x696c7173
jne 0x140006380
cmp word [rax + 0xc], 0x6574
je 0x1400063a1
inc rax
lea r8, [rdi - 0xd]
sub r8, rax
mov edx, 0x63
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140006360
jmp 0x14000643a
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14000643a
lea rdx, str.Clearing_cookies__trackers_for
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x140017d80]
mov rcx, rax
call fcn.1400071f0
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0xd0]
call fcn.1400050d0
mov r15, qword [rbp + 0xe8]
mov r14, qword [rbp + 0xd0]
cmp r15, 0xf
jbe 0x140006471
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140006469
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000659e
mov rcx, r14
call fcn.140013d44
lea rcx, [rbp + 0x10]
call fcn.1400046e0
test eax, eax
jne 0x1400066d0
mov rbx, qword [rbp + 0x10]
test rbx, rbx
jne 0x140006220
mov rdi, qword [rsp + 0x40]
xor r15d, r15d
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400064d8
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400064d4
mov rbx, qword [rbp + 0x18]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400064d4
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12, qword [rbp + 8]
test r12, r12
je 0x140006513
mov eax, 0xffffffff
lock xadd dword [r12 + 8], eax
cmp eax, 1
jne 0x140006513
mov rbx, qword [rbp + 8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140006513
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rdi, 0x20
mov qword [rsp + 0x40], rdi
cmp rdi, r13
jne 0x1400059d5
mov r13, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x70]
test rdi, rdi
je 0x1400065d0
mov rdx, r13
mov rcx, rdi
call fcn.140004f10
mov rdx, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x70]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140013d44
jmp 0x1400065d0
lea rdx, str.No_supported_browser_is_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000660e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006609
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140013d44
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400139d0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rsp + 0x48]
mov edx, eax
lea rcx, str.recursive_directory_iterator::recursive_directory_iterator
call fcn.140003f20
nop
call fcn.140002980
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.140003f20
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.140003f20
int3
mov edx, eax
lea rcx, str.recursive_directory_iterator::operator
call fcn.140003e30
nop
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, str.recursive_directory_iterator::recursive_directory_iterator
call fcn.140003f20
nop
mov edx, eax
lea rcx, str.directory_iterator::operator
call fcn.140003e30
nop
lea r8, [rsp + 0x48]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140003f20
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.140003f20
int3
mov edx, eax
lea rcx, str.recursive_directory_iterator::operator
call fcn.140003e30
int3