Function at 0x140007420
Capabilities:
Delete registry value
Enumerate process modules
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1590]
mov eax, 0x1690
call fcn.14000aa30
sub rsp, rax
mov rax, qword [0x140013010]
xor rax, rsp
mov qword [rbp + 0x1580], rax
lea rdi, vtable.RegUtil.0
mov qword [rsp + 0x30], rdi
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov r14d, r12d
mov ebx, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r12
lea r8, str.HKEY_LOCAL_MACHINESoftwareAdobeAdobe_AcrobatDCWebResource
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r9d, [r12 + 1]
lea r8, str.irandom
lea rdx, [rsp + 0x50]
call fcn.1400092d0
test eax, eax
je 0x1400074d9
lea r8, str.irandom
lea rdx, [rsp + 0x50]
call fcn.140008fa0
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 0x270f
ja 0x1400080a5
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1370]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1160]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf50]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x50]
call fcn.140001b00
mov edx, 0x104
lea rcx, [rbp + 0xf50]
test eax, eax
je 0x140007563
lea r8, str.HKEY_USERS_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rbp + 0xf50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140007570
lea r8, [0x14000b8d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.SoftwareAdobeAdobe_AcrobatDCAVGeneral
mov edx, 0x104
lea rcx, [rbp + 0xf50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.HKEY_LOCAL_MACHINESOFTWAREGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
mov edx, 0x104
lea rcx, [rbp + 0x1370]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [rbp + 0xf50]
call fcn.140008c60
mov r15, rax
mov ecx, 0x208
call fcn.140009e10
mov rbx, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rdi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rsi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xf50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140007638
lea rdx, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.140009914
mov rcx, rsi
call fcn.140009914
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000774a
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bChromeExtnRepromptDone
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000774a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007740
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140007726
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007740
lea r9, str.Already_re_created_the_registry_for_re_prompt.
lea r8, str.CustomActionInfo:_ERROR:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov eax, 0x67
jmp 0x1400080aa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
call fcn.140002d20
test eax, eax
je 0x1400077fc
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400077f2
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x1400077d8
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x1400077f2
lea r9, str.pluginstatus_is_not_0__not_continuing
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov eax, 0x66
jmp 0x1400080aa
lea r8, [rsp + 0x40]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140007845
mov esi, dword [rsp + 0x40]
shr esi, 2
mov edi, r12d
test esi, esi
je 0x140007845
lea rbx, [rsp + 0x50]
mov ecx, dword [rbx]
test ecx, ecx
je 0x14000783b
call fcn.140003790
test eax, eax
jne 0x140007a45
inc edi
add rbx, 4
cmp edi, esi
jb 0x140007828
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400078cd
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x1400078b3
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x1400078cd
lea r9, str.chrome_is_not_running__not_continuing
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
lea r8, str.iChromeExtnRepromptCount
lea rdx, [rbp + 0xf50]
call fcn.140008fa0
lea ebx, [rax + 1]
mov dword [rsp + 0x20], 1
mov r9d, ebx
lea r8, str.iChromeExtnRepromptCount
lea rdx, [rbp + 0xf50]
call fcn.140009120
cmp ebx, 0x14
jb 0x140007a3d
xor edx, edx
lea r14d, [rdx + 0x64]
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007996
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x14000797c
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007996
lea r9, str.chrome_is_not_running__retries_exceeded.
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov dword [rsp + 0x20], r12d
mov r9d, 1
lea r8, str.bChromeExtnRepromptPending
lea rdx, [rbp + 0xf50]
call fcn.140009120
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007a3d
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140007a22
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007a3d
lea r9, str.chrome_is_not_running__retries_exceeded__setting_ChromeExtnRepromptPending
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
nop
mov eax, r14d
jmp 0x1400080aa
lea rdx, [rbp + 0x1370]
call fcn.140008c60
mov r15, rax
mov ecx, 0x208
call fcn.140009e10
mov rbx, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rdi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rsi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1370]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140007adb
lea rdx, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.140009914
mov rcx, rsi
call fcn.140009914
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007d9d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.update_url
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007d9d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
lea rdx, [rbp + 0x1370]
call fcn.140008c60
mov r14, rax
mov ecx, 0x208
call fcn.140009e10
mov rbx, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rdi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rsi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1370]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140007bf1
lea rdx, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.140009914
mov rcx, rsi
call fcn.140009914
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf023f
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007cf7
lea rdx, str.update_url
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x140007cf7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007ce9
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140007ccf
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007ce9
lea r9, str.Found_and_deleted_chrome_extension_reg_in_HKLM
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov r14d, 1
mov r9d, r14d
jmp 0x14000804a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007d92
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140007d78
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007d92
lea r9, str.Failed_to_delete_chrome_ext_reg_from_32bit_HKLM
lea r8, str.CustomActionInfo:_ERROR:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov r14d, 0x68
jmp 0x140007a3d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
lea rcx, [rsp + 0x50]
call fcn.140001b00
mov edx, 0x104
lea rcx, [rbp + 0x1160]
test eax, eax
je 0x140007df0
lea r8, str.HKEY_USERS_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x1160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140007dfd
lea r8, [0x14000b8d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.SOFTWAREGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
mov edx, 0x104
lea rcx, [rbp + 0x1160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rbp + 0x1160]
call fcn.140008c60
mov r15, rax
mov ecx, 0x208
call fcn.140009e10
mov rbx, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rdi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x208
call fcn.140009e10
mov rsi, rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x1160]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140007eac
lea rdx, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.140009914
mov rcx, rsi
call fcn.140009914
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000808d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.update_url
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000808d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
lea r8, str.update_url
lea rdx, [rbp + 0x1160]
call fcn.1400095f0
xor edx, edx
mov r8d, 0x106
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x140007fc5
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007d92
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140007fb9
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140007d92
lea r9, str.Failed_to_delete_chrome_ext_reg_from_HKCU
jmp 0x140007d7f
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140008040
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140008026
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x50]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140008040
lea r9, str.Found_and_deleted_chrome_extension_reg_in_HKCU
lea r8, str.CustomActionInfo:_INFO:__DeleteChromeExtRegForReprompt__:_:
lea rdx, str._s_____s_n
call fcn.140001040
mov r14d, 2
lea r9d, [r14 - 1]
mov dword [rsp + 0x20], r12d
lea r8, str.bChromeExtnRepromptDone
lea rdx, [rbp + 0xf50]
call fcn.140009120
lea r8, str.bChromeExtnRepromptPending
lea rdx, [rbp + 0xf50]
call fcn.1400095f0
lea r8, str.iChromeExtnRepromptCount
lea rdx, [rbp + 0xf50]
call fcn.1400095f0
jmp 0x140007a3d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140009914
jmp 0x140007a3d
mov eax, 0x65
mov rcx, qword [rbp + 0x1580]
xor rcx, rsp
call fcn.1400098f0
lea r11, [rsp + 0x1690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret