Function at 0x140005f90
Capabilities:
Check os version
Create process on windows
Query environment variable
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xab8
mov rsi, r9
mov r13, r8
mov rdi, rcx
mov rax, qword [0x1400f7448]
mov rax, qword [rax]
xor rax, rsp
mov qword [rsp + 0xab0], rax
mov rax, qword [0x1400f7740]
mov qword [rsp + 0x210], rax
movdqa xmm0, xmmword [0x1400f7730]
movdqa xmmword [rsp + 0x200], xmm0
lea r8, [rsp + 0x200]
mov qword [rsp + 0x60], rdx
mov rcx, rdx
mov rdx, r13
call fcn.140007b90
mov qword [0x140150420], rsi
lea r12, [r13 + 8]
mov rax, qword [r13 + 8]
test rax, rax
je 0x140006229
mov r15, rdi
lea r14, [r13 + 0x10]
lea rbx, str.log_launcher_error
mov rbp, r12
jmp 0x140006041
mov rax, qword [rbp + 8]
add rbp, 8
add r14, 8
test rax, rax
je 0x1400060a8
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006030
lea rdi, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rdi, rax
xor esi, esi
movzx ecx, word [rdi + rsi]
test cx, cx
je 0x140006030
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, word [rsi + rbx]
jne 0x140006030
lea rax, [rsi + 2]
cmp word [rsi + rbx + 2], 0
mov rsi, rax
jne 0x140006060
cmp word [rdi + rax], 0
jne 0x140006030
nop word [rax + rax]
mov rax, qword [r14]
mov qword [r14 - 8], rax
add r14, 8
test rax, rax
jne 0x140006090
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
mov rax, qword [r12]
test rax, rax
mov rdi, r15
je 0x140006229
lea rsi, [r13 + 0x10]
jmp 0x1400060d0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006229
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400060c0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x1400060c0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400060c0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400060c0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400060c0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400060c0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400060c0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400060c0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x70
jne 0x1400060c0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400060c0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400060c0
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x1400060c0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x1400060c0
cmp word [rbx + 0x16], 0
jne 0x1400060c0
mov qword [rdi], 0
mov rbx, qword [0x1400f7448]
jmp 0x1400067a1
lea rcx, [rsp + 0xa0]
call fcn.140004440
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x690], xmm0
movdqa xmmword [rsp + 0x680], xmm0
movdqa xmmword [rsp + 0x670], xmm0
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x670]
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x140006314
mov r8d, dword [rsp + 0x698]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14000632b
mov dword [rsp + 0x670], 0
mov byte [rsp + 0x688], 0
mov dword [rsp + 0x238], 0x209
lea rsi, [rsp + 0x690]
lea r9, [rsp + 0x238]
mov rcx, rbp
mov edx, 1
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140006356
cmp byte [rsp + 0x688], 0
je 0x140006baf
mov rsi, qword [rsp + 0x678]
mov r15d, dword [rsp + 0x680]
mov r14b, 1
mov ebx, dword [rsp + 0x684]
jmp 0x14000637a
mov ebx, eax
or ebx, 0x10000000
lea rsi, [0x1400f79fe]
mov r15d, 0x502
jmp 0x14000638c
xor esi, esi
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000637a
cmp eax, 0x57
je 0x14000637a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r15d, 0x5c
jmp 0x140006370
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r15d, 0x1e
mov r14b, 1
lea rsi, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_SameBinary.h
mov rax, rbp
add rax, 1
cmp rax, 2
jae 0x1400063b4
test r14b, r14b
je 0x1400063c2
mov qword [rsp + 0x670], rsi
mov dword [rsp + 0x678], r15d
mov dword [rsp + 0x67c], ebx
lea rcx, [rsp + 0x670]
call fcn.140004320
xor esi, esi
jmp 0x1400063c9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x14000638c
test sil, sil
sete sil
lea rcx, [0x1400f7cc6]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400063ee
cmp byte [rax], 0
je 0x1400063ee
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov sil, 1
mov rax, qword [r12]
test rax, rax
je 0x14000652c
lea rbx, [r13 + 0x10]
jmp 0x140006420
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x14000652c
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006410
lea rbp, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbp, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x140006410
movzx ecx, word [rbp + 2]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006410
movzx ecx, word [rbp + 4]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x140006410
movzx ecx, word [rbp + 6]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006410
movzx ecx, word [rbp + 8]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140006410
movzx ecx, word [rbp + 0xa]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x140006410
movzx ecx, word [rbp + 0xc]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006410
movzx ecx, word [rbp + 0xe]
test cx, cx
je 0x140006410
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006410
cmp word [rbp + 0x10], 0
jne 0x140006410
mov rax, qword [rbx]
mov qword [rbx - 8], rax
add rbx, 8
test rax, rax
jne 0x140006512
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
jmp 0x140006535
test sil, sil
je 0x14000671f
mov rax, qword [r12]
xor ebp, ebp
test rax, rax
je 0x14000671a
lea rsi, [r13 + 0x10]
jmp 0x140006560
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x14000671a
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006550
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x140006550
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006550
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006550
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140006550
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006550
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x140006550
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x140006550
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006550
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x140006550
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006550
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140006550
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x140006550
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006550
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x140006550
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006550
cmp word [rbx + 0x1c], 0
jne 0x140006550
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x1400066fa
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
mov r9d, 1
jmp 0x140006727
xor r9d, r9d
jmp 0x140006727
xor r9d, r9d
mov ebp, 1
lea rcx, [rsp + 0x670]
lea rdx, [rsp + 0xa0]
mov r8d, ebp
call fcn.14000a590
cmp byte [rsp + 0x680], 0
je 0x1400067cf
lea rcx, [rsp + 0x670]
call fcn.140004320
mov rbx, qword [0x1400f7448]
lea rcx, [rsp + 0x670]
lea rdx, [rsp + 0xa0]
call fcn.140007de0
cmp byte [rsp + 0x680], 0
je 0x14000678d
lea rcx, [rsp + 0x670]
call fcn.140004320
mov qword [rdi], 0
lea rcx, [rsp + 0xa0]
call fcn.140004730
mov rax, qword [rsp + 0xab0]
xor rax, rsp
mov rcx, qword [rbx]
cmp rcx, rax
jne 0x140007b3a
mov rax, rdi
add rsp, 0xab8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rsp + 0x670], 0
je 0x140006858
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400067fa
cmp byte [rax], 0
je 0x1400067fa
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14000675a
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
mov rbx, qword [0x1400f7448]
je 0x140006761
cmp word [rax], 0
je 0x140006761
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstoul
imul esi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov edx, eax
call fcn.140013bf0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006761
mov eax, dword [0x140152670]
cmp eax, 0x3838
ja 0x140006926
mov eax, dword [0x14014f014]
cmp eax, 0x383a
jb 0x140006960
lea rcx, [rsp + 0x678]
mov r8d, 0x114
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x670], rax
mov dword [rsp + 0x67c], 0x3839
mov rsi, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 4
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rsi
lea rcx, [rsp + 0x670]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, [0x14014f014]
lea rdx, [0x140152670]
test eax, eax
cmove rdx, rcx
mov eax, 0x3839
xchg dword [rdx], eax
je 0x140006960
mov al, byte [0x140150270]
test al, al
je 0x140007b4f
mov rax, qword [0x140152668]
test rax, rax
je 0x140006960
mov dword [rsp + 0x670], 4
lea rdx, [rsp + 0x670]
mov r8d, 4
mov ecx, 0xa
call rax
call fcn.1400080f0
test r13, r13
je 0x140006c6c
lea rcx, [rsp + 0x670]
xor edx, edx
call fcn.140013650
mov rax, qword [rsp + 0x670]
test rax, rax
je 0x140006c6c
mov r15, rdi
mov qword [r13], rax
mov rax, qword [r13 + 8]
test rax, rax
je 0x14000724d
lea rsi, [r13 + 0x10]
jmp 0x1400069c0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006d0f
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400069b0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x77
jne 0x1400069b0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400069b0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x69
jne 0x1400069b0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400069b0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x1400069b0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x1400069b0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400069b0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400069b0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x1400069b0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x62
jne 0x1400069b0
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400069b0
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400069b0
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x77
jne 0x1400069b0
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x1400069b0
movzx ecx, word [rbx + 0x1c]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400069b0
movzx ecx, word [rbx + 0x1e]
test cx, cx
je 0x1400069b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400069b0
cmp word [rbx + 0x20], 0
jne 0x1400069b0
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x140006b92
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
jmp 0x14000727c
mov r8d, dword [rsp + 0x670]
lea rcx, [rsp + 0x190]
mov rdx, rsi
call fcn.140013820
cmp byte [rsp + 0x1a8], 0
je 0x140006cb5
mov ebx, dword [rsp + 0x19c]
cmp ebx, 0xd000003a
jne 0x140006e6f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x238], 0
mov byte [rsp + 0x250], 0
mov dword [rsp + 0x190], 0x209
lea rbx, [rsp + 0x258]
lea r9, [rsp + 0x190]
mov qword [rsp + 0x68], rax
mov rcx, rax
mov edx, 1
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400071a4
cmp byte [rsp + 0x250], 0
je 0x140007528
mov rsi, qword [rsp + 0x240]
mov r15d, dword [rsp + 0x248]
mov r14b, 1
mov ebx, dword [rsp + 0x24c]
mov rcx, qword [rsp + 0x68]
jmp 0x140007592
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x800705070000012e
mov qword [rsp + 0x678], rax
lea rcx, [rsp + 0x670]
call fcn.140004320
mov qword [rdi], 0
mov rbx, qword [0x1400f7448]
jmp 0x140006794
mov dword [rsp + 0x238], 1
mov byte [rsp + 0x250], 0
lea rsi, [rsp + 0x258]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x140006cf0
test eax, eax
jne 0x140007177
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r15d, 0x29
jmp 0x140006370
mov rax, qword [r12]
test rax, rax
je 0x14000724d
lea rsi, [r13 + 0x10]
jmp 0x140006d40
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006e87
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006d30
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6d
jne 0x140006d30
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006d30
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006d30
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x69
jne 0x140006d30
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006d30
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006d30
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006d30
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006d30
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006d30
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006d30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006d30
cmp word [rbx + 0x14], 0
jne 0x140006d30
jmp 0x14000727c
mov rsi, qword [rsp + 0x190]
mov r15d, dword [rsp + 0x198]
mov r14b, 1
jmp 0x14000637a
mov rax, qword [r12]
test rax, rax
je 0x14000724d
lea rsi, [r13 + 0x10]
jmp 0x140006eb0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x14000704f
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006ea0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x62
jne 0x140006ea0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006ea0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140006ea0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6b
jne 0x140006ea0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x67
jne 0x140006ea0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006ea0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006ea0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x140006ea0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006ea0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140006ea0
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006ea0
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006ea0
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140006ea0
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x140006ea0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6b
jne 0x140006ea0
cmp word [rbx + 0x1c], 0
jne 0x140006ea0
jmp 0x14000727c
mov rax, qword [r12]
test rax, rax
je 0x14000724d
lea rsi, [r13 + 0x10]
jmp 0x140007080
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x1400071d2
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140007070
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x140007070
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140007070
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140007070
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140007070
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x140007070
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140007070
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140007070
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140007070
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140007070
cmp word [rbx + 0x10], 0
jne 0x140007070
jmp 0x14000727c
cmp byte [rsp + 0x250], 0
je 0x1400075ab
mov rsi, qword [rsp + 0x240]
mov r15d, dword [rsp + 0x248]
mov r14b, 1
mov ebx, dword [rsp + 0x24c]
jmp 0x14000637a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r14b, 1
mov r15d, 0x1e
lea rsi, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_SameBinary.h
mov rcx, qword [rsp + 0x68]
jmp 0x140007592
mov rax, qword [r12]
test rax, rax
je 0x14000724d
lea rsi, [0x1400f7db8]
mov rbx, r12
jmp 0x1400071f4
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
je 0x14000724d
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400071e7
lea rdi, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rdi, rax
xor ebp, ebp
nop word cs:[rax + rax]
nop dword [rax]
movzx ecx, word [rdi + rbp]
test cx, cx
je 0x1400071e7
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, word [rbp + rsi]
jne 0x1400071e7
lea rax, [rbp + 2]
cmp word [rbp + rsi + 2], 0
mov rbp, rax
jne 0x140007220
cmp word [rdi + rax], 0
jne 0x1400071e7
jmp 0x14000727c
lea rcx, str.MOZ_AUTOMATION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140007263
cmp byte [rax], 0
jne 0x14000727c
lea rcx, str.MOZ_HEADLESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor r14d, r14d
test rax, rax
je 0x140007282
cmp byte [rax], 0
je 0x140007282
mov r14d, 1
mov rax, qword [r12]
test rax, rax
je 0x14000742e
lea rsi, [r13 + 0x10]
mov rdi, r15
jmp 0x1400072b0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140007431
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400072a0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400072a0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400072a0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x1400072a0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x1400072a0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400072a0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400072a0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x1400072a0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400072a0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x76
jne 0x1400072a0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400072a0
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400072a0
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x1400072a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400072a0
cmp word [rbx + 0x18], 0
jne 0x1400072a0
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x140007412
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
or r14d, 2
mov rdi, r15
mov qword [rsp + 0x98], 0
mov rdx, qword [r13]
lea rcx, [rsp + 0x1e8]
lea r9, [rsp + 0x98]
mov r8d, r14d
call fcn.140005880
cmp byte [rsp + 0x1f8], 0
mov rsi, qword [rsp + 0x60]
je 0x140007490
lea rcx, [rsp + 0x1e8]
call fcn.140004320
mov qword [rdi], 0
mov rbp, qword [rsp + 0x98]
mov rbx, qword [0x1400f7448]
jmp 0x140007603
mov rbp, qword [rsp + 0x98]
test r14d, r14d
jne 0x1400074e5
cmp dword [rsp + 0x1e8], 1
jne 0x1400074e5
test rbp, rbp
jne 0x1400074e5
mov edx, dword [rsi]
lea rcx, [rsp + 0x670]
mov r8, r13
call fcn.140004810
cmp byte [rsp + 0x680], 0
je 0x1400075f0
lea rcx, [rsp + 0x670]
call fcn.140004320
mov qword [rdi], 0
jmp 0x1400075fa
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0xa0]
call fcn.140007de0
cmp byte [rsp + 0x1e0], 0
je 0x14000761f
lea rcx, [rsp + 0x1d0]
call fcn.140004320
mov qword [rdi], 0
mov rbx, qword [0x1400f7448]
jmp 0x140007603
cmp byte [rsp + 0x688], 0
mov rcx, qword [rsp + 0x68]
jne 0x14000758d
mov eax, dword [rsp + 0x670]
or eax, dword [rsp + 0x238]
jne 0x14000758d
lea r14, [rsp + 0x190]
mov rcx, r14
mov rdx, rsi
call sub.ntdll.dll_RtlInitUnicodeString
lea rsi, [rsp + 0x218]
mov rcx, rsi
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, r14
mov rdx, rsi
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
mov rcx, qword [rsp + 0x68]
xor esi, esi
test al, al
setne sil
xor r14d, r14d
jmp 0x140007592
xor esi, esi
xor r14d, r14d
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000637a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000637a
mov r8d, dword [rsp + 0x238]
lea rcx, [rsp + 0x218]
mov rdx, rsi
call fcn.140013820
cmp byte [rsp + 0x230], 0
je 0x140007756
mov rsi, qword [rsp + 0x218]
mov r15d, dword [rsp + 0x220]
mov r14b, 1
mov ebx, dword [rsp + 0x224]
jmp 0x14000637a
mov dword [rdi], 0
mov byte [rdi + 4], 1
mov rbx, qword [0x1400f7448]
xor ebp, ebp
lea rax, [rbp + 1]
cmp rax, 2
jb 0x140006794
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006794
mov edx, dword [rsi]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
mov r8, r13
xor r9d, r9d
call fcn.140004c70
cmp qword [rsp + 0x90], 0
je 0x14000776b
lea rcx, [rsp + 0x88]
mov rdx, rsi
mov r8, r13
mov r9d, 2
call fcn.140008250
cmp byte [rsp + 0x89], 0
je 0x14000778e
mov qword [rsp + 0x190], 0
movdqa xmm0, xmmword [0x1400f7500]
movdqu xmmword [rsp + 0x1a0], xmm0
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1c8], 0
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.140008560
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov qword [rsp + 0x170], rax
mov ecx, 0xfffffff5
call rdi
mov qword [rsp + 0x178], rax
mov ecx, 0xfffffff4
call rdi
mov qword [rsp + 0x180], rax
lea rdx, [rsp + 0x170]
mov rcx, rsi
call fcn.140008670
lea rcx, [rsp + 0x158]
lea rbx, [rsp + 0x670]
mov rdx, rsi
mov r8, rbx
call fcn.1400087c0
cmp byte [rsp + 0x168], 0
je 0x140007840
lea rcx, [rsp + 0x158]
call fcn.140004320
mov rdi, r15
mov qword [r15], 0
mov rbx, qword [0x1400f7448]
lea rcx, [rsp + 0x190]
call fcn.140008bc0
jmp 0x1400077d2
cmp byte [rsp + 0x1a8], 0
je 0x1400077f9
xor esi, esi
jmp 0x140007838
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x8007050700000159
jmp 0x1400077af
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x8007005700000160
mov qword [rsp + 0x678], rax
lea rcx, [rsp + 0x670]
call fcn.140004320
mov qword [rdi], 0
mov rbx, qword [0x1400f7448]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x140007603
call sub.mozglue.dll_free
jmp 0x140007603
movdqu xmm0, xmmword [rsp + 0x190]
movdqu xmm1, xmmword [rsp + 0x218]
pcmpeqb xmm1, xmm0
movq xmm0, qword [rsp + 0x1a0]
movq xmm2, qword [rsp + 0x228]
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb eax, xmm2
xor esi, esi
cmp eax, 0xffff
sete sil
xor r14d, r14d
jmp 0x14000637a
xor esi, esi
cmp byte [rsp + 0x158], 0
mov rdi, r15
je 0x140007891
mov r12d, 0x80404
cmp qword [rsp + 0x1a0], 0
je 0x140007897
or byte [rsp + 0x6ad], 1
movdqa xmm0, xmmword [rsp + 0x170]
movdqu xmmword [rsp + 0x6c0], xmm0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x6d0], rax
mov esi, 1
jmp 0x140007897
mov r12d, 0x404
lea rcx, [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x275], 8
je 0x1400078cc
mov rax, qword [rsp + 0x250]
test rax, rax
je 0x1400078cc
or byte [rsp + 0x6ad], 8
mov qword [rsp + 0x688], rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rdx, qword [r13]
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x70]
test rbp, rbp
je 0x140007928
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], 0
mov rcx, rbp
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140007953
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000796b
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
test r14b, 1
jne 0x1400079c1
xor eax, eax
jmp 0x1400079d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x228], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x218], rax
mov dword [rsp + 0x220], 0x19f
mov dword [rsp + 0x224], ecx
lea rcx, [rsp + 0x218]
call fcn.140004320
mov qword [rdi], 0
jmp 0x140007740
lea rcx, [rsp + 0x218]
mov rdx, r12
call fcn.140008a20
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x89], 0
je 0x140007b3f
mov rdx, qword [r13]
lea rcx, [rsp + 0x140]
mov r8, r12
call fcn.1400041b0
cmp byte [rsp + 0x150], 0
je 0x140007a31
lea rcx, [rsp + 0x140]
call fcn.140004320
mov rcx, r12
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rdi], 0
jmp 0x140007aca
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140007a5f
test r14b, 1
jne 0x140007aa9
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edx, edx
or edx, 0x2710
mov rcx, r12
call fcn.140008b10
jmp 0x140007abb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x228], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x218], rax
mov dword [rsp + 0x220], 0x1b4
mov dword [rsp + 0x224], ecx
lea rcx, [rsp + 0x218]
jmp 0x140007a12
mov rcx, r12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140007b16
mov rdi, r15
mov dword [r15], 0
mov byte [r15 + 4], 1
mov rbx, qword [0x1400f7448]
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140007ae6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140007af9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 1]
cmp rax, 2
jb 0x140007747
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007747
lea rdx, [rsp + 0x218]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140007abb
mov eax, dword [rsp + 0x218]
mov rdi, r15
mov dword [r15], eax
jmp 0x140007ac5
call fcn.1400763e0
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea rcx, [0x140150270]
call fcn.1400c0fd4
test eax, eax
je 0x140006934
lea rcx, [0x140152660]
lea rdx, [0x1400f776e]
lea r8, [0x1400f7788]
call fcn.140008090
lea rcx, [0x140150270]
call fcn.1400c10ab
jmp 0x140006934