Function at 0x140022ea0
Capabilities:
Get system information on windows

Disassembly:
mov ebp, 0x128
mov ecx, edi
mov rdx, r15
call fcn.140003de0
cmp eax, r12d
cmp eax, esp
cmp eax, esp
jne case.0x1400153eb.88
mov qword [rbp + 0x128], r15
mov ecx, r13d
mov ecx, ebp
mov ecx, ebp
mov edx, ebx
mov r8d, r12d
call fcn.140003dc0
test al, al
je case.0x1400153eb.88
test edi, edi
je 0x140003882
mov rax, qword [rbp + 0xc8]
add rax, r15
mov ecx, ebx
add rcx, r15
lea rdx, [r15 + 0x70]
xor r8d, r8d
cmp r8, rsi
jae 0x140003b26
mov r11d, dword [rdx]
mov r9d, dword [rdx - 8]
mov r10d, dword [rdx - 4]
add r10, r15
cmp r10, r15
jb 0x140003d5c
test r10, r10
je 0x140003d5c
test r9d, r9d
jle 0x140003d5c
cmp r9d, 6
jg 0x140003d5c
cmp r10, rcx
jb 0x140003d5c
cmp r10, rax
ja 0x140003d5c
mov r11d, r11d
add r10, r11
jb 0x140003d5c
cmp r10, rax
ja 0x140003d5c
inc r8
add rdx, 0xc
cmp rdi, r8
jne 0x140003813
mov ecx, dword [r15]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
adc dword [rbp + 0xb0], eax
adc dword [rbp + 0xb0], eax
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xc0], 0
add byte [rax], al
add byte [rcx + 0x9c8d], cl
add byte [rbx - 0x78f0f602], al
retf
add al, byte [rax]
invalid
add byte [rax], al
add byte [rcx + 0x9c8d], cl
add byte [rbx - 0x78f0f602], al
retf
test esi, esi
je 0x14000392c
lea r13, [r15 + 0x70]
lea r12, [rbp + 0xd0]
lea rdx, [0x140054d98]
xor edi, edi
cmp esi, edi
jbe 0x140003b31
mov r14d, dword [r13]
mov eax, dword [r13 - 8]
mov ebx, dword [r13 - 4]
add rbx, r15
mov qword [r12], rbx
mov dword [rbp + rdi*4 + 0xa0], eax
dec eax
cmp eax, 5
ja case.0x1400038f7.3
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp r14d, 4
jne 0x140003b67
mov eax, dword [rbx]
mov qword [r12], rax
inc rdi
mov eax, esi
add r13, 0xc
add r12, 8
cmp rdi, rax
jb 0x1400038c7
jmp 0x14000392c
cmp r14d, 8
jne 0x140003b67
mov rax, qword [rbx]
jmp 0x140003905
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x80], xmm0
test dword [rax + 0xf000000], eax
sub dword [rbp + 0x70], eax
test dword [rax + 0xf000000], eax
sub dword [rbp + 0x70], eax
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
push rax
push rax
movaps xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x30], ecx
mov r14, qword [rbp + 0x130]
mov esi, dword [rbp + 0x130]
mov esi, dword [rbp + 0x130]
lea rax, [r14 + 0x38]
mov qword [rbp + 0x38], rax
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [rbp + 0x9c]
lea r8, [rbp + 0x120]
call qword [0x140067010]
xor r13d, r13d
test rax, rax
je 0x140003bd3
mov ecx, dword [r15 + 0x60]
mov esi, 6
cmp ecx, 2
stc
add cl, byte [rdi]
test edi, eax
add byte [rax], al
invalid
stc
add cl, byte [rdi]
test edi, eax
add byte [rax], al
add byte [rbx + rcx*4 - 0x6b], cl
and byte [rcx], al
add byte [rax], al
mov r10, qword [rbp + 0x120]
mov r8, qword [rbp + 0xd0]
add byte [rax], al
mov r9, qword [rbp + 0xd8]
lea rdx, [rbp + 0x30]
mov rcx, rax
mov rax, r10
call qword [0x140067010]
mov ebx, 0
mov r12d, 0
test al, al
je 0x1400039ff
lea rsi, [rbp + 0x50]
mov r13d, dword [rsi - 0x10]
mov ebx, dword [rsi - 8]
mov r12d, dword [rsi - 4]
lea rdi, [rbp - 0x20]
mov ecx, 9
add byte [rax], al
add byte [rax], al
rep movsq qword [rdi], qword [rsi]
xor esi, esi
cmp dword [r15 + 4], 1
je 0x140003be2
lea rcx, [rbp + 0x9c]
lea rdx, [rbp + 0xd0]
call fcn.140003e40
mov rcx, r15
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
invalid
rol dword [rax + rax], 1
invalid
mov rdi, qword [rbp + 0x118]
mov dword [rdi + 8], r13d
mov dword [rdi + 0xc], esi
mov dword [rdi + 0x10], ebx
adc byte [rcx + rcx*4 + 0x67], al
adc al, 0x48
add edi, 0x18
adc byte [rcx + rcx*4 + 0x67], al
adc al, 0x48
add edi, 0x18
lea rsi, [rbp - 0x20]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
mov rax, qword [r14 + 0x28]
mov ecx, 3
xchg dword [rax + 8], ecx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ecx, 9
ja case.0x140003a83.2
mov ecx, ecx
lea rdx, [0x140054db0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov r10, qword [rbp + 0x120]
and byte [rcx], al
add byte [rax], al
mov rcx, qword [rbp + 0x100]
movaps xmm0, xmmword [rbp + 0xf0]
add byte [rax], al
add byte [rax], al
movaps xmm1, xmmword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
add byte [rax], al
invalid
add byte [rax], al
add byte [rax - 0x77], cl
and al, 0x40
add byte [rax], al
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm1
invalid
and cl, ch
cmc
invalid
jmp 0x1400039b8
mov r14, rdx
mov ebx, ecx
mov ecx, 0x20
and byte [rax], al
add byte [rax], al
and byte [rax], al
add byte [rax], al
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
xor eax, eax
mov qword [rsi], rax
invalid
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
mov rcx, r15
mov ecx, edi
add byte [rax - 0x77], cl
invalid
invalid
mov ecx, edi
stc
mov edx, edi
mov r8, rsi
call fcn.14002bf40
test al, al
je 0x140003b93
xchg ebx, eax
add byte [rax], al
invalid
xchg ebx, eax
add byte [rax], al
add byte [rcx - 0x77], cl
xor al, 0x24
mov qword [r12], rsi
mov esi, dword [r15 + 0x60]
mov ecx, ebx
mov rdx, r14
jmp case.0x1400038f7.3
invalid
invalid
invalid
mov qword [rbp + 0x128], r15
mov rcx, r15
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x140003d64
add al, byte ds:[rax]
invalid
add al, byte ds:[rax]
add byte [rbp + 0x31], al
fild dword [rbp + 0x31]
shr cl, cl
stc
cld
invalid
xor r11d, r11d
xor r10d, r10d
jmp 0x14000382a
invalid
dec dword [rcx - 0x39]
add al, 0x24
add byte [rax], al
add byte [rax], al
invalid
mov qword [r12], 0
add byte [rax], al
add cl, ch
retf
jmp case.0x1400038f7.3
mov dword [rbp + 0xc4], ecx
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rdx, [0x140054d98]
add byte [rbx + 0xc48d], cl
add byte [rcx + rcx*4 + 0x30], al
invalid
add byte [rbx + 0xc48d], cl
add byte [rcx + rcx*4 + 0x30], al
mov qword [rax + 8], rbx
jmp 0x140003905
invalid
lea rcx, [rbp + 0x9c]
lea rdx, [rbp + 0xd0]
add byte [rax], al
add al, ch
mov byte [rdx], 0
invalid
add byte [rax], al
add al, ch
mov byte [rdx], 0
add byte [rbp + 0x31], al
in eax, dx
xor r13d, r13d
xor ebx, ebx
xor r12d, r12d
in al, 0x4c
mov esi, dword [rbp + 0x130]
add dword [rax], eax
invalid
in al, 0x4c
mov esi, dword [rbp + 0x130]
add dword [rax], eax
invalid
add dword [rax], eax
add byte [rsi + 5], bh
invalid
add byte [rax], al
invalid
mov esi, 5
add eax, 0xe9000000
jmp 0x140003a12
jg 0x140003b8f
invalid
mov qword [r12], 0
lea rcx, [rbp + 0x9c]
lea rdx, [rbp + 0xd0]
xchg ebp, eax
rol byte [rax], 1
add byte [rax], al
add byte [rax - 0x73], cl
lea ebx, [rax + rax - 0x72b80000]
xchg ebp, eax
rol byte [rax], 1
add byte [rax], al
call fcn.140003e40
mov rcx, rsi
call fcn.140043470
jmp 0x140003b7a
in al, 0x4c
mov esi, dword [rbp + 0x130]
xor byte [rcx], al
add byte [rax], al
xor byte [rcx], al
add byte [rax], al
jmp 0x140003d75
mov esi, 5
xor ebx, ebx
xor r12d, r12d
jmp 0x1400039ff
mov rcx, qword [rbp + 0x118]
mov rdx, r15
add byte [rcx + rcx*4 - 6], cl
mov r8, qword [rbp + 0xc8]
call sub.ntdll.dll_memcpy
jmp 0x1400039ff
mov r8, qword [rbp + 0x120]
lea rdx, [rbp + 0x30]
mov rcx, rax
mov rax, r8
call qword [0x140067010]
jmp 0x1400039c8
mov r9, qword [rbp + 0x120]
mov ecx, dword [rbp + 0x120]
mov r8, qword [rbp + 0xd0]
lea rdx, [rbp + 0x30]
mov rcx, rax
mov rax, r9
call qword [0x140067010]
jmp 0x1400039c8
mov r10, qword [rbp + 0x120]
mov rcx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
mov qword [rsp + 0x20], rcx
jmp 0x1400039b8
add byte [rax - 0x75], cl
invalid
mov r10, qword [rbp + 0x120]
movaps xmm0, xmmword [rbp + 0xe0]
add byte [rax], al
add byte [rax], al
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
jmp 0x140003ca8
mov r10, qword [rbp + 0x120]
mov rcx, qword [rbp + 0xf0]
movaps xmm0, xmmword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
mov qword [rsp + 0x30], rcx
movups xmmword [rsp + 0x20], xmm0
jmp 0x1400039b8
mov r10, qword [rbp + 0x120]
movaps xmm0, xmmword [rbp + 0xf0]
movaps xmm1, xmmword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
jmp 0x140003ab4
mov r10, qword [rbp + 0x120]
movaps xmm0, xmmword [rbp + 0x100]
movaps xmm1, xmmword [rbp + 0xf0]
movaps xmm2, xmmword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
jmp 0x140003d3c
mov r10, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x110]
movaps xmm0, xmmword [rbp + 0x100]
movaps xmm1, xmmword [rbp + 0xf0]
movaps xmm2, xmmword [rbp + 0xe0]
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd8]
mov qword [rsp + 0x50], rcx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x20], xmm2
jmp 0x1400039b8
mov rcx, r15
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
xor ebx, ebx
xor r12d, r12d
mov r14, qword [rbp + 0x130]
mov esi, 5
xor r13d, r13d
jmp 0x140003a1a
ret 0xccc3
int3
int3
sar byte [rcx], 0xd1
sal dword [rdx + 0x13], 1
js 0x140003e3c
invalid
cmp eax, ecx
ror byte [rdi], 1
xchg ebx, eax
shl byte [rax], 0xc8
invalid
enter 0xffffffffffffccc3, 0xffffffffffffffcc
int3
int3
int3
stc
add dh, byte [rbp + 7]
test byte [rax], al
add byte [rax], al
add byte [rax], al
add bl, al
leave
add byte [rax], al
int3
invalid
je case.0x140017e88.99
add cl, ch
and al, byte cs:[rax]
add byte [rcx - 0x75], al
invalid
add eax, dword [rcx - 0x77]
adc cl, byte [rax - 0x7d]
add byte ds:[rdi], cl
test byte [rbx + rcx], bh
or eax, dword [rax]
invalid
or eax, dword [rax]
add byte [rbx], bh
push rsi
xor byte [rdi], cl
xchg dword [rbx], edi
or eax, dword [rax]
add byte [rax - 0x75], cl
push rsi
adc byte [rcx - 0x76], al
add al, 7
sub ecx, dword [rdi]
test cl, al
or eax, 0xc2890000
add dword [rdi], 0
add byte [rdx + 0xf], al
mov dh, 0x4c
cmp byte [rcx], al
mov esi, 1
loop 0x140005851
mov ecx, dword [rsp + 0x28]
invalid
add byte [rax], al
cmp dword [rsi], 0
std
invalid
mov byte [rcx + 1], 0xd6
invalid
movzx edx, byte [rdi + rax + 1]
add byte [rax], al
add byte [rax - 0x39], cl
add al, byte [rax]
add byte [rax], al
add byte [rcx + rcx*4 - 0x17], cl
test ecx, ecx
lea esp, [rsp + 0xb8]
mov dword [rsp - 0x38], edx
and al, 0xc8
and al, 0xd8
pop rsp
and al, 0xe0
invalid
loopne 0x140005d9f
mov dword [rsp - 0x10], ebx
and al, 0xe8
add byte [rax], al
and al, 0xb0
add byte [rax], al
add byte [rdi], cl
test byte [rbx + 0x48000008], dh
or byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + riz*4], fs
add byte [rax], al
invalid
or byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + riz*4], fs
add byte [rax], al
add dh, al
add al, 1
mov ebx, 0x24848b48
and al, 0xa8
add byte [rax], al
invalid
and al, 0xa8
add byte [rax], al
add byte [rax - 1], cl
ror byte [rax - 0x77], 0x84
and al, 0xa8
add byte [rax], al
add bh, bh
test byte [rax + rbx*4], ah
add byte [rax], al
add byte [rax - 0x73], cl
or byte [rax + 0x3b], cl
mov word [rax + rsi*4], fs
add byte [rax], al
add byte [rdi], cl
xchg dword [rbp + 0x48000008], ebx
mov ecx, dword [rsp + 0xa0]
mov word [rax + riz*4], fs
add byte [rax], al
invalid
mov word [rax + riz*4], fs
add byte [rax], al
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0x90
add dword [rax], eax
add byte [rax - 0x77], cl
adc al, 1
add byte [rax], al
mov ecx, ecx
add byte [rax - 0x49], al
add ecx, ebp
test esp, edi
invalid
mov ecx, dword [rsi]
adc cl, ch
pop rax
hlt
add ecx, dword [rsi + 0x10]
adc byte [rbx - 0x3f00efbd], cl
add al, 7
cmp byte [rdi + rax + 1], 0x3d
invalid
and byte [rdi], r9b
test byte [rcx - 0x74fffffa], bl
xor byte [rcx], r15b
enter 0xffffffffffff830f, 0xffffffffffffffe7
invalid
add byte [rax], al
and dil, r15b
ror byte [rcx - 0x7cb7dfba], 0x3e
and byte [rax - 0x7d], r9b
add byte ds:[rdi], cl
and byte [rax - 0x7d], r9b
add byte ds:[rdi], cl
test byte [rsi + 6], dh
add byte [rax], al
invalid
add byte [rbx - 0x3616cfb2], cl
invalid
add byte [rcx - 0x76], al
invalid
inc dword [rax - 0x78f0e006]
int1
add byte [rax], al
add al, al
invalid
add byte [rbp - 0x74b7fab8], cl
push rsp
and al, 0x30
and al, 0x30
cli
invalid
push rax
or byte [rcx + 0x39], al
retf 0x860f
enter 0xffffffffffff830f, 0xfffffffffffffffe
add al, byte [rax]
add byte [rax - 0x75], cl
adc byte [rcx + 0x104c6c0], r9b
mov eax, dword [r14 + 0x20]
add byte [rbx], bh
xor byte [rdi], r9b
xchg byte [rax + 7], dl
add byte [rax], al
add byte [rdi], cl
test byte [rax + 0x7e830000], bh
or byte [rax], al
xor al, byte [0x100846e39]
add byte [rax + rax*8 + 0x695850f], al
add byte [rax], al
add byte [rbx + rcx*4 + 0x74], cl
and al, 0x28
out dx, eax
out 0xff, al
dec dword [rbx + rcx*4 + 0x46]
adc byte [rdx - 0x77befefc], cl
add al, 0x10
add byte [rdi], cl
test byte [rsi + 0x3b000003], al
push rsi
xor byte [rdi], cl
xchg dword [rax], esp
invalid
mov word [rax + riz*4], fs
add byte [rax], al
add dh, al
add al, 1
nop
mov edx, dword [0x58]
dec eax
div edi
test dword [rax - 0x7d], 0x834801fb
rol dword [rax], cl
invalid
add byte [rax], al
mov eax, dword [rcx + 0x10]
and byte [r8 - 0x7d], cl
cmp dword [rax], eax
adc dword [rcx], 2
add byte [rax], al
add dword [rax], eax
add byte [rbx + rcx*4 + 0x41], al
mov eax, dword [rcx + 0x30]
lea r9d, [rax + 4]
cmp r9d, r8d
invalid
ror dword [rdi], 0x87
movabs al, byte [0x8910418b4c000001]
rol byte [rcx - 0x39], 4
add byte [rax], al
add byte [rax], al
add byte [rbx - 0x3f7cdfbf], cl
and byte [rbx + 0x418904c0], al
and byte [rax - 0x7d], cl
and byte [rbx + 0x418904c0], al
and byte [rax - 0x7d], cl
cmp dword [rax], eax
jns 0x140007c92
add byte [rdi], cl
xchg ebp, eax
rol bl, 0x48
cmp qword [rcx], 0
test eax, eax
je 0x14000d8f0
lea rbx, [rsp + 0xe0]
mov rdx, qword [rsp + 0x100]
mov rcx, rbx
and al, 0xe0
add byte [rax], al
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0
add dword [rax], eax
add byte [rax - 0x77], cl
fld1
invalid
int3
call fcn.140001d40
mov byte [rbx + 0xc], 1
mov rbx, qword [rsp + 0x1c8]
test r15b, r15b
pushfq
and al, 0xc8
add dword [rax], eax
add byte [rbp - 0x7c], al
push qword [rax + rcx - 0x3a]
je 0x14000d28d
mov byte [rsp + 0xed], 1
je 0x14000d28d
mov byte [rsp + 0xed], 1
add byte [rax], al
add dword [rax - 0x7b], ecx
fisttp dword [rdi]
test byte [rbp + 0xf000000], al
push rdi
ror byte [rbp + rcx*4 - 0x4c], 0x24
add byte [rcx], al
add dword [rax], eax
invalid
test rbx, rbx
je 0x14000d31b
xorps xmm0, xmm0
lea r14, [rsp + 0x100]
add dword [rax], eax
invalid
add dword [rax], eax
add byte [rcx + 0xf], al
sub dword [rsi + 0x30], eax
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea r15, [rsp + 0x80]
mov rcx, r15
mov rdx, r14
mov r8d, 0x10000000
call fcn.14000e5b0
lea r9, [rsp + 0x60]
mov dword [r9], 0x44
lea r14, [rsp + 0x100]
mov ecx, 0x47
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rcx, r15
mov rdx, r14
mov r8d, 0x20000
call fcn.14000e5b0
xchg ebp, eax
adc al, byte [rax]
invalid
xchg ebp, eax
adc al, byte [rax]
add byte [rdi], cl
push rdi
ror byte [rdi], 0x29
and al, 0x60
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rax
movaps xmmword [rsp + 0x40], xmm0
and al, 0x40
and al, 0x40
cmp ebp, 7
ja case.default.0x14000d355
invalid
add byte [rdx + rcx*4 - 0x44], al
and al, 0xd0
add dword [rax], eax
add byte [rcx + 0xd8d48e8], cl
or bh, byte [rdx + 4]
add al, 0
movsxd rax, dword [rcx + rax*4]
mov r15b, byte [rsp + 0x1d0]
mov eax, ebp
lea rcx, [0x140054d58]
add al, 0
add al, 0
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test r15b, r15b
je case.0x14000d355.7
lea rcx, [rsp + 0x80]
call fcn.14000e840
jmp 0x14000d430
lea rcx, [rsp + 0x80]
call fcn.14002e700
test r15b, r15b
je 0x14000d408
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r14, [rsp + 0x100]
xor ecx, ecx
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.14000e560
test rbx, rbx
je 0x14000d408
xorps xmm0, xmm0
lea r14, [rsp + 0x100]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
and byte [rsi], bh
add eax, 0x8c8d4800
and al, 0x80
add byte [rax], al
add byte [rcx + rcx*4 - 0xe], cl
and byte [rsi], bh
add eax, 0x8c8d4800
and al, 0x80
add byte [rax], al
add byte [rcx + rcx*4 - 0xe], cl
call fcn.14000e560
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x40]
call fcn.14000e990
test eax, eax
jne 0x14000d46c
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x60]
call fcn.14000f550
test eax, eax
jne 0x14000d46c
mov rdx, qword [rsp + 0x1d8]
mov dword [rsp + 0xe8], edi
test esi, esi
jne 0x14000d456
lea rcx, [rsp + 0x80]
call fcn.14002e4f0
jmp 0x14000d46c
cmp esi, 1
jne 0x14000e0df
lea rcx, [rsp + 0x80]
call fcn.14000ee20
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000d5e7
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14000d606
mov rsi, qword [rsp + 0xe0]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x14000d5b0
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x14000d4e0
mov rdx, qword [rsp + 0xd8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000e09d
lea rsi, [rsp + 0xc8]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000d520
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000e0e9
lea rsi, [rsp + 0xb0]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14000d560
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000e10a
lea rsi, [rsp + 0x98]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000d58a
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000e0be
invalid
add byte [rdi], cl
cmp dword [rcx], 0xb
add byte [rax], al
invalid
add al, ch
xchg byte [0xcb48d590], dh
mov word [rax + rdx*2], fs
add dword [rax], eax
add byte [rax + 0x31], cl
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
loope 0x14000d57e
invalid
loopne 0x14000d59a
add byte [rcx - 0x3b7eb728], cl
pop rax
add dword [rax], eax
add byte [rbx + 0x5d], bl
pop rdi
pop rsi
pop r12
pop rsp
loope 0x14000d57e
invalid
pop rsp
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0xe0]
call fcn.140001e50
mov r8, qword [rsp + 0x198]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140008c40
mov rcx, qword [rdi]
call fcn.140008b80
mov qword [rdi], 0
jmp 0x14000d4a0
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000e2c5
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000d47c
mov rdi, qword [rsp + 0x68]
cmp rsi, rdi
je 0x14000d65a
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x14000d637
mov rcx, qword [rsi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jae 0x14000e2e6
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
add rsi, 0x20
cmp rsi, rdi
jne 0x14000d610
add byte [rax], al
add byte [rax - 0x39], cl
sbb byte [rdi], r8b
add byte [rax], al
add byte [rsi - 0x39], ah
invalid
mov rsi, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
sub rdx, rsi
cmp rdx, 0x1000
jae 0x14000e30d
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000d48a
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
jne 0x14000e32e
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 1
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
jne 0x14000e352
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
jne 0x14000e376
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
call fcn.14000cef0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x70]
jne 0x14000e39a
lea rcx, [rsp + 0x60]
lea r14, [rsp + 0x100]
mov r8, r14
call fcn.14002e7f0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jae 0x14000e3ca
test r15b, r15b
je 0x14000e40f
mov ebp, 0x44
lea r15, [rsp + 0xfc]
mov dword [r15], ebp
mov r13, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r12, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call r13
lea r14, [rsp + 0x80]
mov rcx, r14
mov rdx, r12
call fcn.14000e560
mov dword [r15], ebp
lea r15, [rsp + 0x100]
add byte [rax], al
add byte [rax], al
lea r12, [rsp + 0xfc]
mov ecx, 1
xor edx, edx
ror byte [rbp - 0x77], cl
clc
ror byte [rbp - 0x77], cl
clc
mov r9, r12
call r13
mov rcx, r14
mov rdx, r15
call fcn.14000e560
add byte [rcx - 0x77], al
sub al, 0x24
add byte [rcx - 0x77], al
sub al, 0x24
lea r15, [rsp + 0x100]
lea r9, [rsp + 0xfc]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call r13
mov rcx, r14
mov rdx, r15
call fcn.14000e560
test rbx, rbx
je 0x14000d8aa
xorps xmm0, xmm0
lea r14, [rsp + 0x100]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.14000e560
lea rcx, [rsp + 0x80]
call fcn.14000f810
jmp 0x14000d408
invalid
mov dword [rsp + 0x28], ecx
and al, 0x28
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x100]
add byte [rcx], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
mov rcx, rax
mov rdx, rbx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x14000d254
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000d278
mov ebx, 0xa0
jmp 0x14000d48a
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
call fcn.14000cef0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x70]
jne 0x14000e12b
lea rcx, [rsp + 0x60]
lea r14, [rsp + 0x100]
mov r8, r14
call fcn.14002e7f0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x14000e156
mov rcx, qword [rsp + 0x100]
lea rdx, [rax*2 + 2]
add dword [rax], eax
add byte [rax - 0x73], cl
adc al, 0x45
add al, byte [rax]
add byte [rax], al
cmp rdx, 0x1000
jb 0x14000d9a2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000e156
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
je 0x14000e18d
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 1
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
je 0x14000e1a7
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
je 0x14000e1c1
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14, qword [rsp + 0x48]
cmp r14, qword [rsp + 0x50]
je 0x14000e1db
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
call fcn.14000cef0
invalid
invalid
dec dword [rax - 0x75]
push rsp
and al, 0x68
cmp rdx, qword [rsp + 0x70]
je 0x14000e421
or byte [rax], al
invalid
invalid
or byte [rax], al
add byte [rax - 0x39], cl
add al, byte [rax]
add byte [rax], al
add byte [rdi], cl
push rdi
ror byte [rdi], 0x11
adc byte [rdi], cl
adc byte [rsp + 0x100], al
and al, 0
add dword [rax], eax
invalid
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x100]
and al, 0
add dword [rax], eax
invalid
and al, 0
add dword [rax], eax
add byte [rdi], cl
adc byte [rsp + 0x110], cl
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add qword [rsp + 0x68], 0x20
test r15b, r15b
je 0x14000d408
mov ebp, 0x44
lea r15, [rsp + 0xfc]
mov dword [r15], ebp
mov r13, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r12, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call r13
lea r14, [rsp + 0x80]
mov rcx, r14
mov rdx, r12
call fcn.14000e560
mov dword [r15], ebp
lea r15, [rsp + 0x100]
lea r12, [rsp + 0xfc]
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9, r12
call r13
mov rcx, r14
mov rdx, r15
call fcn.14000e560
mov dword [r12], ebp
mov dword [rsp], ebp
mov dword [rsp], ebp
lea r15, [rsp + 0x100]
lea r9, [rsp + 0xfc]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call r13
mov rcx, r14
mov rdx, r15
call fcn.14000e560
mov rcx, r14
call fcn.14002e600
mov rcx, r14
call fcn.14000f810
jmp 0x14000d3bc
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e1f5
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 1
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e20f
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e229
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e243
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
call fcn.14000cef0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x70]
je 0x14000e489
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add qword [rsp + 0x68], 0x20
test r15b, r15b
je 0x14000d408
mov ebp, 0x44
lea r14, [rsp + 0xfc]
mov dword [r14], ebp
mov r12, qword cs:[sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r12, qword cs:[sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r15, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
mov r8, r15
mov r9, r14
call r12
lea rbx, [rsp + 0x80]
add byte [rax], 0
add byte [rax - 0x77], cl
invalid
mov rdx, r15
call fcn.14000e560
mov dword [r14], ebp
lea r14, [rsp + 0x100]
lea r15, [rsp + 0xfc]
mov ecx, 1
xor edx, edx
mov r8, r14
mov r9, r15
call r12
mov rcx, rbx
mov rdx, r14
call fcn.14000e560
mov dword [r15], ebp
lea r14, [rsp + 0x100]
lea r15, [rsp + 0xfc]
mov ecx, 0xb
xor edx, edx
mov r8, r14
mov r9, r15
call r12
mov rcx, rbx
mov rdx, r14
call fcn.14000e560
mov dword [r15], ebp
lea r14, [rsp + 0x100]
lea r15, [rsp + 0xfc]
mov ecx, 0x11
xor edx, edx
mov r8, r14
mov r9, r15
call r12
mov rcx, rbx
mov rdx, r14
add byte [rax], 0
add byte [rax - 0x77], cl
invalid
call fcn.14000e560
mov dword [r15], ebp
lea r14, [rsp + 0x100]
lea r9, [rsp + 0xfc]
mov ecx, 0x12
xor edx, edx
mov r8, r14
call r12
mov rcx, rbx
mov rdx, r14
call fcn.14000e560
mov rcx, rbx
call fcn.14002e600
mov rcx, rbx
jmp 0x14000d8b2
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x1b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e25d
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 1
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e277
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e291
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r8, [rsp + 0x100]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rbx, qword [rsp + 0x48]
cmp rbx, qword [rsp + 0x50]
je 0x14000e2ab
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, rbx
call sub.ntdll.dll_memcpy
add rbx, 0x44
mov qword [rsp + 0x48], rbx
xor eax, eax
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
call fcn.14000cef0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x70]
je 0x14000e4ed
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add qword [rsp + 0x68], 0x20
jmp 0x14000d408
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000e551
add rdx, 0x27
mov rcx, rax
jmp 0x14000d4c5
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000e551
add rdx, 0x27
mov rcx, rax
jmp 0x14000d585
mov ebx, 0xa0
jmp 0x14000d46e
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000e551
add rdx, 0x27
mov rcx, rax
jmp 0x14000d505
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000e551
add rdx, 0x27
mov rcx, rax
jmp 0x14000d545
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add qword [rsp + 0x68], 0x20
lea rcx, [rsp + 0x80]
call fcn.14002e700
test r15b, r15b
je 0x14000d408
lea r9, [rsp + 0xfc]
mov dword [r9], 0x44
lea r14, [rsp + 0x100]
mov ecx, 0x12
jmp 0x14000d3a1
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
jmp 0x14000d9ff
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
jmp 0x14000da52
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
jmp 0x14000daa5
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, r14
call fcn.14000eb30
jmp 0x14000daf8
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000dc6f
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000dcc2
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000dd15
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000dd68
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000df35
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000df88
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000dfdb
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x100]
mov rdx, rbx
call fcn.14000eb30
jmp 0x14000e02e
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000e551
add rdx, 0x27
mov rcx, rax
jmp 0x14000d5fc
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14000d632
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp rsi, 0x20
jae 0x14000e551
add rdx, 0x27
mov rsi, rax
jmp 0x14000d66f
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
jmp 0x14000d6c5
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
jmp 0x14000d70e
lea rdx, [rsp + 0x100]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x48], r14
jmp 0x14000d757
mov qword [rdx], 0
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add qword [rsp + 0x68], 0x20
jmp 0x14000d7b9
mov rcx, qword [rsp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e405
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000d7b9
lea rcx, [rsp + 0x80]
call fcn.14002e700
jmp 0x14000d408
lea rcx, [rsp + 0x60]
lea r14, [rsp + 0x100]
mov r8, r14
call fcn.14002e7f0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x14000db62
mov rcx, qword [rsp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e47f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000db62
lea rcx, [rsp + 0x60]
lea rbx, [rsp + 0x100]
mov r8, rbx
call fcn.14002e7f0
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000ddd2
mov rcx, qword [rsp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e4e3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000ddd2
lea rcx, [rsp + 0x60]
lea rbx, [rsp + 0x100]
mov r8, rbx
call fcn.14002e7f0
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000d408
mov rcx, qword [rsp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e547
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e551
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000d408
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
mov edx, dword [rdi + 0x10]
call fcn.140014de0
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400153ce
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
movzx eax, byte [rax + rdx]
shr eax, 6
mov ebx, 2
lea r8, [0x140054c60]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x10]
call fcn.140014de0
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140015408
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 7
xor r8d, r8d
cmp al, 4
sete r8b
add ebx, r8d
test rsi, rsi
je 0x140015443
call fcn.140014de0
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140015436
mov rax, qword [rcx + 8]
mov ecx, dword [rdi + 0x10]
mov al, byte [rax + rcx]
shr al, 3
and al, 7
mov byte [rsi], al
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebx, 1
jmp 0x140015443
call fcn.140014de0
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001546f
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 7
cmp al, 5
je 0x14001554b
call fcn.140014de0
mov rbx, qword [rdi]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140015494
mov rax, qword [rbx + 8]
mov r15d, dword [rdi + 0x10]
mov al, byte [rax + r15]
and al, 7
cmp al, 4
jne 0x14001555f
inc r15d
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
movabs rax, 0x100000001
mov qword [r14 + 8], rax
lea rax, [0x140052420]
mov qword [r14], rax
lea r12, [r14 + 0x10]
mov rcx, r12
mov rdx, rbx
mov r8d, r15d
call fcn.140014fc0
mov rcx, r12
xor edx, edx
call fcn.140014de0
mov rax, qword [r14 + 0x18]
mov al, byte [rax]
and al, 7
xor ecx, ecx
cmp al, 5
sete cl
lea ebx, [rcx*4 + 1]
lock dec dword [r14 + 8]
jne case.0x1400153eb.1
mov r15, r14
add r15, 0xc
mov rax, qword [r14]
mov rax, qword [rax]
mov rcx, r14
call qword [0x140067010]
lock dec dword [r15]
jne case.0x1400153eb.1
mov rax, qword [r14]
mov rax, qword [rax + 8]
mov rcx, r14
call qword [0x140067010]
jmp case.0x1400153eb.1
mov ebx, 5
jmp case.0x1400153eb.1
test rsi, rsi
je 0x140015569
call fcn.140014de0
mov ebx, 0xfffffffe
jmp 0x140015426
mov ebx, 1
jmp case.0x1400153eb.1
mov ebx, 0xfffffffe
jmp 0x140015443
lea r8, [0x140054c70]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
mov eax, dword [rcx + 0x20]
cmp qword [rcx], 0
je 0x1400156f3
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
jae 0x140015704
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 0xff
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400156f5
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
jae 0x14001570d
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 0x25
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400156f7
mov r8d, dword [rcx + 0x30]
lea r9d, [rax + 4]
cmp r9d, r8d
ja 0x140015898
mov r8, qword [rcx + 0x10]
mov eax, eax
mov dword [r8 + rax], 0
mov eax, dword [rcx + 0x20]
add eax, 4
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400156fa
mov r8d, dword [rcx + 0x30]
lea r9d, [rax + 8]
cmp r9d, r8d
ja 0x140015716
mov r8, qword [rcx + 0x10]
mov eax, eax
mov qword [r8 + rax], rdx
add dword [rcx + 0x20], 8
cmp qword [rcx], 0
je 0x140015700
xor eax, eax
cmp qword [rcx + 0x10], 0
je 0x1400156f2
cmp qword [rcx + 0x18], 0
je 0x1400156f2
cmp dword [rcx + 8], 0
je 0x1400156f2
cmp byte [rcx + 0x34], 0
setne al
ret
inc eax
inc eax
add eax, 4
add eax, 8
mov dword [rcx + 0x20], eax
mov al, 1
jmp 0x1400156f2
mov byte [rcx + 0x34], 0
jmp 0x140015664
invalid
inc esi
xor al, 0
mov byte [rcx + 0x34], 0
jmp 0x14001568a
mov byte [rcx + 0x34], 0
jmp 0x1400156d5
cmp qword [rcx], 0
mov eax, dword [rcx + 0x20]
je 0x140015789
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
xor byte [r9 + rdi - 0x40], al
jae 0x1400157c4
adc dword [rdx + 0x4c000000], 0xffffff8b
adc byte [r9 - 0x3a], al
add al, 0
jne 0x140015727
mov r8, qword [rcx + 0x10]
mov byte [r8 + rax], 0x75
jmp 0x140015775
cmp byte [rax - 0x7d], cl
cmp dword [rax], eax
cmp qword [rcx], 0
mov eax, dword [rcx + 0x20]
je 0x140015789
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
jae 0x1400157c4
mov r8, qword [rcx + 0x10]
mov byte [r8 + rax], 0x74
jmp 0x140015775
cmp qword [rcx], 0
mov eax, dword [rcx + 0x20]
je 0x140015789
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
jae 0x1400157c4
mov r8, qword [rcx + 0x10]
mov byte [r8 + rax], 0x72
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x14001578b
mov r8d, dword [rcx + 0x30]
jmp 0x1400157c8
xor r11b, bpl
invalid
inc eax
inc eax
mov dword [rcx + 0x20], eax
jmp 0x14001562c
cmp qword [rcx], 0
mov eax, dword [rcx + 0x20]
je 0x1400157e6
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
jae 0x1400157f6
mov r8, qword [rcx + 0x10]
mov byte [r8 + rax], 0xff
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400157e8
mov r8d, dword [rcx + 0x30]
jmp 0x1400157fa
mov byte [rcx + 0x34], 0
cmp eax, r8d
jae 0x1400157dd
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 0xe
mov eax, dword [rcx + 0x20]
jmp 0x14001578b
mov byte [rcx + 0x34], 0
jmp 0x14001562c
inc eax
inc eax
add eax, 4
inc eax
inc eax
jmp 0x1400156fa
mov byte [rcx + 0x34], 0
cmp eax, r8d
jae 0x14001581e
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 0x15
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400157ea
mov r8d, dword [rcx + 0x30]
jmp 0x140015822
mov byte [rcx + 0x34], 0
lea r9d, [rax + 4]
cmp r9d, r8d
jbe 0x140015853
mov byte [rcx + 0x34], 0
cmp eax, r8d
jae 0x14001587a
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 0xeb
mov eax, dword [rcx + 0x20]
inc eax
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400157ef
mov r8d, dword [rcx + 0x30]
jmp 0x14001587e
mov r8, qword [rcx + 0x10]
mov eax, eax
mov dword [r8 + rax], 2
mov eax, dword [rcx + 0x20]
add eax, 4
mov dword [rcx + 0x20], eax
cmp qword [rcx], 0
je 0x1400157ed
mov r8d, dword [rcx + 0x30]
jmp 0x14001582f
mov byte [rcx + 0x34], 0
cmp eax, r8d
jae 0x140015898
mov r8, qword [rcx + 0x10]
mov eax, eax
mov byte [r8 + rax], 8
mov eax, dword [rcx + 0x20]
inc eax
jmp 0x1400156ab
mov byte [rcx + 0x34], 0
jmp 0x1400156b8
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rdi
movabs rax, 0x5c003f002f
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x1ce], rax
movabs rax, 0x2f003f002f005c
mov qword [rsp + 0x1c8], rax
cmp rsi, 4
mov eax, 4
cmovb rax, rsi
cmp rdi, 8
cmovb r15, rcx
test rax, rax
je 0x140015b32
add rax, rax
xor ecx, ecx
lea rdx, [0x140054062]
movzx r8d, word [r15 + rcx]
cmp r8w, word [rcx + rdx]
jne 0x140015c0a
add rcx, 2
cmp rax, rcx
jne 0x140015b19
cmp rsi, 3
jbe 0x140015c0a
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x1c8]
call fcn.140016ba0
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x140015b81
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jae 0x140016296
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
add eax, dword [rax]
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmm1, xmmword [rsp + 0x1f0]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
cmp qword [rsp + 0xc8], 8
jb 0x140015cb2
mov rsi, qword [rsp + 0xb0]
jmp 0x140015cba
test al, al
jne 0x14001607e
jmp 0x140016118
lea rbx, [rsp + 0x1c8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r12, rax
cmp rsi, 6
mov eax, 6
cmovb rax, rsi
cmp r12, rax
mov rcx, rax
cmovb rcx, r12
test rcx, rcx
je 0x140015c54
xor edx, edx
movzx r8d, word [r15 + rdx*2]
cmp r8w, word [rsp + rdx*2 + 0x1c8]
jne 0x140015c5d
inc rdx
cmp rcx, rdx
jne 0x140015c3c
cmp r12, rax
je 0x140015b51
sub rdi, rsi
cmp rdi, r12
jb 0x1400160ea
lea rax, [r12 + rsi]
mov qword [rsp + 0x1f0], rax
lea rdi, [rsp + r12*2]
add rdi, 0x1c8
lea rax, [r15 + rsi*2]
cmp rax, rbx
setb al
mov r14, r12
cmp rdi, r15
jbe 0x1400160a7
test al, al
jne 0x1400160a7
mov r14, r15
sub r14, rbx
jbe 0x1400160a4
sar r14, 1
jmp 0x1400160a7
lea rsi, [rsp + 0xb0]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x60], r13
mov r15d, 3
mov dword [rsp + 0x1f0], r15d
xor esi, esi
mov byte [rsp + 0x1f4], sil
mov r14d, 0x1038
mov ecx, 0x1038
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r12, rax
mov qword [rsp + 0x1e0], rax
mov qword [rax], rsi
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
lea rax, [r12 + 8]
mov qword [rsp + 0x58], rax
mov qword [r13], rax
lea rax, [r12 + r14]
mov qword [r13 + 8], rax
mov qword [rsp + 0x1e8], r13
mov dword [rsp + 0x1d8], r15d
mov byte [rsp + 0x1dc], sil
mov ecx, 0x1038
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbp, rax
mov qword [rsp + 0x1c8], rax
mov qword [rax], rsi
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rbx], rax
lea rax, [rbp + r14]
mov qword [rbx + 8], rax
mov qword [rsp + 0x1d0], rbx
mov dword [rsp + 0xa8], r15d
mov byte [rsp + 0xac], sil
mov ecx, 0x1038
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rdi, rax
mov qword [rsp + 0x98], rax
mov qword [rax], rsi
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [rdi + 8]
mov qword [rax], rcx
add rdi, r14
mov qword [rax + 8], rdi
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], r15d
mov byte [rsp + 0x94], sil
mov ecx, 0x1038
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rdi, rax
mov qword [rsp + 0x80], rax
mov qword [rax], rsi
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [rdi + 8]
mov qword [rax], rcx
add rdi, r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], r15d
mov byte [rsp + 0x7c], sil
mov ecx, 0x1038
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rdi, rax
mov qword [rsp + 0x68], rax
mov qword [rax], rsi
mov ecx, 0x10
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [rdi + 8]
mov qword [rax], rcx
add rdi, r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x1400162bd
xor edi, edi
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
lea rcx, [rsp + 0x1e0]
xor esi, esi
xor edx, edx
mov r8, r15
mov r9d, 1
call fcn.140016530
test al, al
je 0x140015f90
lea r8, [rsp + 0x1e0]
mov rcx, r14
mov edx, 3
call fcn.140016d20
test al, al
je 0x14001610a
lea rcx, [rsp + 0x1c8]
xor esi, esi
xor edx, edx
mov r8, r15
mov r9d, 1
call fcn.140016530
test al, al
je 0x140015f90
lea r8, [rsp + 0x1c8]
mov rcx, r14
mov edx, 4
call fcn.140016d20
test al, al
je 0x14001610a
lea rcx, [rsp + 0x98]
xor esi, esi
xor edx, edx
mov r8, r15
mov r9d, 1
call fcn.140016530
test al, al
je 0x140015f90
lea r8, [rsp + 0x98]
mov rcx, r14
mov edx, 5
call fcn.140016d20
test al, al
je 0x14001610a
lea rcx, [rsp + 0x80]
xor esi, esi
xor edx, edx
mov r8, r15
mov r9d, 1
call fcn.140016530
test al, al
je 0x140015f90
lea r8, [rsp + 0x80]
mov rcx, r14
mov edx, 6
call fcn.140016d20
test al, al
je 0x14001610a
test dil, dil
jne 0x140015f8d
lea rcx, [rsp + 0x68]
xor esi, esi
xor edx, edx
mov r8, r15
mov r9d, 1
call fcn.140016530
test al, al
je 0x140015f90
lea r8, [rsp + 0x68]
mov rcx, r14
mov edx, 7
call fcn.140016d20
test al, al
je 0x14001610a
mov sil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140015f9f
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x70]
test rcx, rcx
mov r13, qword [rsp + 0x60]
je 0x140015fb3
call fcn.140050b00
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140015fc5
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140015fd7
call fcn.140050b00
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140015fe9
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140015ffb
call fcn.140050b00
mov rcx, qword [rsp + 0x1c8]
test rcx, rcx
je 0x14001600d
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x1d0]
test rcx, rcx
je 0x14001601f
call fcn.140050b00
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
je 0x140016031
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x1e8]
test rcx, rcx
je 0x140016043
call fcn.140050b00
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x140016073
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jae 0x1400163b0
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xor ebp, ebp
test sil, sil
je 0x140016118
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.14002b660
mov eax, ebp
add rsp, 0x208
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
lea rcx, [r15 + r12*2]
lea r8, [rsi*2 + 2]
mov rdx, r15
call sub.ntdll.dll_memmove
lea r8, [r14 + r14]
lea rdx, [rsp + 0x1c8]
mov rcx, r15
call sub.ntdll.dll_memcpy
sub r12, r14
lea rdx, [rdi + r14*2]
lea rcx, [r15 + r14*2]
add r12, r12
mov r8, r12
call sub.ntdll.dll_memcpy
jmp 0x140015b51
lea rcx, [rsp + 0x1e0]
lea r8, [rsp + 0x1c8]
mov rdx, r12
mov r9, r12
call fcn.14003fe30
jmp 0x140015b51
xor esi, esi
jmp 0x140015f90
mov ebp, 2
lea rdi, [rsp + 0xb8]
mov dword [rdi - 8], 2
mov rcx, rdi
call fcn.140022f80
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_sandbox_policy_base.cc
mov qword [rdi + 0xf0], rax
mov dword [rdi + 0xf8], 0x16e
lea rcx, [rsp + 0x1c0]
call fcn.14003b240
lea rdx, str.Failed_to_add_sandbox_rule.
mov rcx, rdi
call fcn.140036230
lea rdx, str._error_
mov rcx, rdi
call fcn.140036230
mov rsi, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rdi
mov edx, ebp
call rsi
mov rdi, rax
lea rdx, str.__subsystem_
mov rcx, rax
call fcn.140036230
mov rcx, rdi
mov edx, r13d
call rsi
mov rdi, rax
lea rdx, str.__semantics_
mov rcx, rax
call fcn.140036230
mov rcx, rdi
mov edx, dword [rsp + 0x34]
call rsi
mov rdi, rax
lea rdx, str.__pattern__
mov rcx, rax
call fcn.140036230
mov rcx, rdi
mov rdx, qword [rsp + 0x48]
call fcn.1400394c0
lea rdx, [0x140056d26]
mov rcx, rdi
call fcn.140036230
lea rcx, [rsp + 0xb0]
call fcn.1400393c0
jmp 0x14001607e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001651b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x140015b7c
mov rcx, qword [rsp + 0x50]
and al, 0x50
mov r9, qword [rsp + 0x58]
cmp eax, 1
jne 0x14001648c
invalid
add byte [rdi], cl
push rdi
ror byte [rdi], 0x11
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
and byte [r15], cl
adc dword [rcx + 0x10], eax
and byte [r15], cl
adc dword [rcx + 0x10], eax
movups xmmword [rcx], xmm0
mov rax, rbp
add rax, 0x38
invalid
invalid
sar byte [rax], 0x48
mov dword [rbx], eax
mov qword [rbx], rax
mov dword [rbp + 8], 4
mov dword [rbp + 0x10], 1
mov word [rbp + 0xc], 2
or al, 2
invalid
or al, 2
add bh, al
mov dword [rbp + 0x18], 0x5fedff56
mov dword [rbp + 0x18], 0x5fedff56
mov qword [rbp], 1
mov dword [rsp + 0x20], 0
and al, 0x20
add byte [rax], al
add byte [rax], al
and al, 0x20
add byte [rax], al
add byte [rax], al
lea rcx, [rsp + 0x1c8]
xor edx, edx
mov r8w, 3
invalid
add eax, dword [rax]
mov eax, 0xb9410003
add dword [rax], eax
add byte [rax], al
add eax, dword [rax]
mov r9d, 1
call fcn.140043f40
cmp byte [rsp + 0x1f4], 0
add byte [rax], al
invalid
add byte [rax], al
add byte [rbp + 0x4f], dh
jne 0x140016386
add byte [rax], al
jne 0x140016386
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
invalid
or byte [rax + 0x29], cl
ret 0x8348
sub rdx, rax
cmp rdx, 0x30
jb 0x140016386
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x10], xmm0
adc byte [rdi], cl
adc dword [rax], eax
adc byte [rdi], cl
adc dword [rax], eax
add qword [rcx], 0x30
add dword [rax], esi
mov dword [rax], 4
mov dword [rax + 8], 1
mov word [rax + 4], 2
mov dword [rax + 4], 0x40c70002
adc byte [rsi - 1], dl
push rsi
invalid
in eax, dx
pop rdi
mov dword [rax + 4], 0x40c70002
adc byte [rsi - 1], dl
push rsi
invalid
in eax, dx
pop rdi
push rsi
invalid
mov rax, qword [rsp + 0x1e0]
inc qword [rax]
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x1e0]
xor edx, edx
mov r8w, 3
mov r9d, 1
add byte [rax - 0x73], cl
mov word [rax + riz*8], fs
add dword [rax], eax
add byte [rcx], dh
shl byte [rsi + 0x41], cl
mov eax, 0xb9410003
add dword [rax], eax
add byte [rax], al
call fcn.140043f40
mov dil, 1
jmp 0x140015e51
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001651b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14001606e
ror byte [rax - 0x7d], 0xc0
sub dword [rax - 0x77], ecx
ret 0x894c
cwde
add byte [rax], al
add byte [rax - 0x77], cl
int1
mov edx, edi
call fcn.140043da0
jmp 0x140016485
cmp edi, 8
jne 0x1400163fd
cmp dword [r14 + 0x44], 3
jl 0x14001611d
mov r8, qword [r14 + 0x98]
mov rcx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x34]
call fcn.1400486a0
jmp 0x140016485
cwde
add byte [rax], al
add byte [rax - 0x77], cl
int1
mov edx, edi
call fcn.14004a050
jmp 0x140016485
xor ebp, ebp
jmp 0x140015bfd
mov dil, 1
mov eax, dword [rsp + 0x34]
cmp eax, 2
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
je 0x140015ed9
cmp eax, 3
jne 0x140015f90
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
mov rax, rbp
add rax, 0x38
mov qword [rbx], rax
mov eax, 4
mov dword [rbp + 8], eax
mov cx, 4
mov word [rbp + 0xc], cx
mov edx, 1
mov dword [rbp + 0x18], edx
mov r8d, 1
mov qword [rbp], r8
movups xmmword [r9 + 0x20], xmm0
movups xmmword [r9 + 0x10], xmm0
movups xmmword [r9], xmm0
mov r9, r12
add r9, 0x38
mov qword [r13], r9
mov dword [r12 + 8], eax
mov word [r12 + 0xc], cx
mov dword [r12 + 0x18], edx
mov qword [r12], r8
jmp 0x140015e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.1400331d0
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsi + 0x38]
mov qword [rsp + 0x60], rax
and al, 0x60
and al, 0x60
lea rax, [rsi + 0x28]
mov qword [rsp + 0x58], rax
xor r15d, r15d
lea r13, [rsp + 0x94]
add byte [rax], al
add byte [rcx], dh
push qword [rcx]
ror byte [rax - 0x77], 0x44
and al, 0x40
add byte [rax], al
add byte [rcx], dh
push qword [rcx]
ror byte [rax - 0x77], 0x44
and al, 0x40
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x94], 0
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x20], 0xffffffff
mov rcx, r14
mov rdx, r13
lea r8, [rsp + 0x88]
lea r9, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
test eax, eax
je 0x140018268
mov r12, qword [rsp + 0x88]
cmp r12, 7
jae case.0x1400153eb.15
add byte [rcx - 0x7d], cl
cld
invalid
dec r12
cmp r12, 4
cld
add al, 0x77
sahf
cld
add al, 0x77
sahf
lea rcx, [0x140054c84]
movsxd rax, dword [rcx + r12*4]
add rax, rcx
jmp rax
mov rsi, qword [rsp + 0x80]
cmp qword [rsp + 0xa0], 0
jne 0x140017eac
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsi + 0x20], r14
mov rdx, qword [rsi + 0x10]
lea r12, [rsi + 0x18]
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0xffffffff
mov rcx, r12
lea r8, [0x140027d60]
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x14001835f
movabs rax, 0xaaaaaaaaaaaaaaa
cmp rdi, rax
je 0x140018353
mov ecx, 0x18
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax + 0x10], rsi
inc rdi
mov rcx, qword [rbx + 8]
or byte [rax - 0x77], cl
sbb byte [rax - 0x77], cl
or byte [rax - 0x77], cl
or byte [r8 - 0x77], cl
add ecx, ebp
cli
invalid
invalid
invalid
add al, ch
invalid
or byte [rax - 0x77], cl
sbb byte [rax - 0x77], cl
or byte [rax - 0x77], cl
or byte [r8 - 0x77], cl
add ecx, ebp
cli
invalid
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [rsi + 8]
mov rcx, qword [rsp + 0x58]
call fcn.140018530
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_UnregisterWait]
mov qword [rsi + 0x18], 0xffffffffffffffff
mov r12d, dword [rsi + 8]
mov rsi, rbx
mov rsi, qword [rsi]
cmp rsi, rbx
je case.0x140018035.5
mov rax, qword [rsi + 0x10]
cmp dword [rax + 8], r12d
jne 0x140017f63
mov r13, qword [rsi]
cmp r13, rbx
je 0x140017fb3
mov rax, qword [r13 + 0x10]
cmp dword [rax + 8], r12d
je 0x140017fad
cmp rsi, r13
je 0x140017faa
mov qword [r13 + 0x10], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rcx, rcx
je 0x140017faa
call fcn.1400184a0
mov rsi, qword [rsi]
mov r13, qword [r13]
jmp 0x140017f7c
cmp rsi, rbx
je 0x140017ff2
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rbx + 8], rax
xor r12d, r12d
mov r13, qword [rsi]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140017fd7
call fcn.1400184a0
mov edx, 0x18
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
inc r12
mov rsi, r13
cmp r13, rbx
jne 0x140017fc6
sub rdi, r12
lea r13, [rsp + 0x94]
jmp case.0x140018035.5
mov rax, rbp
mov rax, qword [rax]
cmp rax, rbp
je 0x14001836c
cmp qword [rax + 0x10], r12
cmp dword [rax + 0x10], esp
jne 0x140018002
mov eax, dword [rsp + 0x94]
add eax, 0xfffffffd
cmp eax, 6
ja case.0x140018035.5
int1
std
invalid
invalid
int1
std
invalid
lea rcx, [0x140054c98]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r12, qword [r12]
mov rsi, rbp
mov rsi, qword [rsi]
cmp rsi, rbp
je case.0x140018035.5
mov rax, qword [rsi + 0x10]
cmp qword [rax], r12
jne 0x14001803e
mov r13, qword [rsi]
cmp r13, rbp
je 0x14001811a
mov rax, qword [r13 + 0x10]
cmp qword [rax], r12
je 0x14001808a
cmp rsi, r13
je 0x140018087
invalid
sbb cl, byte [rcx - 0x39]
adc byte [r8], r8b
add byte [rax], al
add byte [rax - 0x75], cl
adc byte [rax - 0x77], r9b
adc byte [rax - 0x7b], r9b
adc byte [rax - 0x7b], cl
mov qword [r13 + 0x10], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
adc byte [rax - 0x7b], cl
leave
adc byte [rax - 0x7b], cl
leave
je 0x140018087
call fcn.14002f360
mov rsi, qword [rsi]
mov r13, qword [r13]
jmp 0x140018056
mov rsi, qword [rsp + 0x80]
lea r8, [rsi + 0x10]
lea rcx, [rsp + 0x98]
lea rdx, [rsp + 0xa8]
call fcn.140001e60
movabs rax, 0xaaaaaaaaaaaaaaa
mov r12, qword [rsp + 0x40]
and al, 0x40
and al, 0x40
cmp r12, rax
je 0x140018353
mov ecx, 0x18
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax + 0x10], rsi
inc r12
mov qword [rsp + 0x40], r12
mov rcx, qword [rbp + 8]
or byte [rax - 0x77], cl
sub byte [rax - 0x77], cl
or byte [rax - 0x77], cl
or byte [r8 - 0x77], r9b
add ecx, ebp
and bh, ch
invalid
invalid
or byte [rax - 0x77], cl
sub byte [rax - 0x77], cl
or byte [rax - 0x77], cl
or byte [r8 - 0x77], r9b
add ecx, ebp
and bh, ch
invalid
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x1400181b2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x3c], 1
jmp case.0x140018035.5
cmp rsi, rbp
je 0x140017ff2
mov rax, qword [rsi + 8]
mov qword [rax], rbp
mov qword [rbp + 8], rax
xor r12d, r12d
mov r13, qword [rsi]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140018142
call fcn.14002f360
mov edx, 0x18
mov rcx, rsi
add byte [rax], al
add byte [rax - 0x77], cl
int1
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
inc r12
mov rsi, r13
cmp r13, rbp
mov rax, qword [rsp + 0x40]
jne 0x140018131
sub rax, r12
mov qword [rsp + 0x40], rax
jmp 0x140017ff2
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
call fcn.140018530
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rsp + 0x80]
lea rcx, [rsp + 0x98]
call fcn.140018530
mov eax, dword [rsp + 0x3c]
and al, 0x3c
and al, 0x3c
dec eax
je 0x1400181bd
jmp 0x1400181b4
inc eax
mov dword [rsp + 0x3c], eax
jmp case.0x140018035.5
pop rbx
cld
invalid
invalid
pop rbx
cld
invalid
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140017e10
mov rsi, qword [rbx]
xor edi, edi
cmp rsi, rbx
jne 0x140018419
mov rax, qword [rbx + 8]
mov qword [rax], 0
mov rsi, qword [rbx]
test rsi, rsi
jne 0x14001843b
mov edx, 0x18
mov rcx, rbx
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rax, qword [rbp + 8]
mov qword [rax], 0
mov rsi, qword [rbp]
test rsi, rsi
jne 0x14001846e
mov edx, 0x18
mov rcx, rbp
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsi + 8]
call fcn.140018930
mov edx, 0x20
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14002b660
invalid
xor al, 1
add byte [rcx - 0x3b7eb708], cl
enter 1, 0
pop rbx
pop rbp
pop rdi
invalid
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 1
jmp 0x1400181db
mov r13, qword [rsp + 0x80]
mov ecx, 0x20
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
lea rax, [0x140053ef0]
mov qword [rsi], rax
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], 0
mov r12, qword [rbx]
cmp r12, rbx
je 0x1400182df
mov rax, qword [r12 + 0x10]
cmp qword [rax], 0
jne 0x1400182b9
mov r12, qword [r12]
jmp 0x1400182a3
mov ecx, 8
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [0x140053f10]
mov qword [rax], rcx
lea rdx, [rsp + 0x78]
mov qword [rdx], rax
mov rcx, rsi
call fcn.14003dbc0
jmp 0x1400182b3
mov r12, qword [rbp]
cmp r12, rbp
je 0x140018320
mov rax, qword [r12 + 0x10]
cmp qword [rax + 8], 0
jne 0x1400182fa
mov r12, qword [r12]
jmp 0x1400182e3
mov ecx, 8
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [0x140053f10]
mov qword [rax], rcx
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
mov rcx, rsi
call fcn.14003dbc0
jmp 0x1400182f4
lea rdx, [rsp + 0x68]
mov qword [rdx], rsi
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
mov rax, qword [r13]
mov rax, qword [rax + 0x10]
mov rcx, r13
mov edx, 1
call qword [0x140067010]
jmp 0x140017ff2
lea rcx, str.list_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
mov qword [r12], 0xffffffffffffffff
jmp 0x140017ee3
lea rcx, [rsp + 0xb0]
lea rsi, [rsp + 0x1b8]
mov dword [rcx - 8], 3
call fcn.140022f80
stosd dword [rdi], eax
add byte [rax], al
stosd dword [rdi], eax
add byte [rax], al
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_broker_services.cc
mov qword [rsi - 0x18], rax
mov dword [rsi - 0x10], 0x102
lock add al, byte [rcx]
add byte [rax], al
fld qword [rbx]
add byte [rax - 0x77], cl
call 0x142f1ca5e
lock add al, byte [rcx]
add byte [rax], al
mov rcx, rsi
lock add al, byte [rcx]
add byte [rax], al
mov rcx, rsi
call fcn.14003b240
add al, byte [rax]
lea rcx, [rsp + 0xa8]
call fcn.1400393c0
add al, ch
adc dword [rax], edx
add al, byte [rax]
jmp 0x140018014
inc dword [rsp + 0x3c]
jmp case.0x140018035.5
mov rcx, qword [r12]
mov edx, 0x1b64
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
jmp case.0x140018035.5
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_UnregisterWait]
mov rax, qword [rsi + 0x10]
mov qword [rax + 0x18], 0xffffffffffffffff
mov rsi, qword [rsi]
jmp 0x1400181d2
mov r14, qword [rsi]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14001844c
call fcn.1400184a0
mov edx, 0x18
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rsi, r14
test r14, r14
je 0x1400181f2
jmp 0x14001843b
call fcn.14002f360
jmp 0x14001847a
mov rbx, qword [rsi]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x140018467
mov edx, 0x18
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rsi, rbx
test rbx, rbx
je 0x140018217
jmp 0x14001846e
mov r11d, 1
lea r13, [0x140054cfc]
xor eax, eax
xor ecx, ecx
leave
leave
xor ebp, ebp
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], r10
mov r14, qword [rbx + 0x10]
lea rsi, [r15 + r15*2]
shl rsi, 4
lea rdi, [r14 + rsi]
add rdi, 8
test r9b, r9b
jne 0x1400192c8
mov r9d, eax
test rdx, rdx
je 0x1400194ff
invalid
add byte [rcx + 0xf], al
mov bh, 0x44
or al, 0x66
test eax, eax
movzx eax, word [r14 + rsi + 0xc]
test ax, ax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x68], ecx
js 0x1400194a5
cmp rax, r8
jae 0x1400194ff
shl rax, 4
shl eax, 4
add rax, rdx
mov r9d, dword [rdi]
mov ecx, 2
cmp r9, 6
ja 0x140019434
movsxd r9, dword [r13 + r9*4]
add r9, r13
jmp r9
cmp dword [rdi], 6
jne 0x1400192e7
xor r9d, r9d
mov ecx, 0
cmp eax, 4
je 0x14001924b
xor eax, eax
xor ecx, ecx
jmp 0x140019483
mov r9b, 1
jmp 0x140019483
sar dword [rax + 0x6c8b0003], 1
and al, 0x2c
mov rbx, qword [rsp + 0x48]
mov eax, dword [r14 + rsi + 0x10]
test eax, eax
je 0x1400194ac
adc byte ss:[rbp + 0x456f74c0], al
xor ecx, ecx
xor r9d, r9d
cmp ecx, 1
setne r9b
add r9d, r9d
test ecx, ecx
leave
leave
cmove r9d, r11d
test al, 1
cmove r9d, ecx
test al, 2
mov rsi, qword [rsp + 0x68]
cmovne esi, r12d
mov rcx, qword [rsp + 0x50]
cmovne rcx, r12
test al, 4
jne 0x140019577
mov eax, esi
cmp r9d, 1
jne 0x140019494
cmp eax, 4
setne r9b
xor ebp, ebp
inc r15
cmp r15, r10
jne 0x14001922b
invalid
jmp 0x1400196b5
test r9d, r9d
test ecx, ecx
leave
jne 0x1400194bb
cmp eax, 4
sete r9b
rol dword [rax - 0x4b], 1
rol dword [rax - 0x4b], 1
jmp 0x140019483
xor eax, eax
jmp 0x14001927d
std
invalid
invalid
shr cl, 0xd1
std
invalid
mov rax, qword [rsp + 0x68]
mov r9d, ecx
mov ecx, ecx
mov ecx, ecx
leave
mov rcx, qword [rsp + 0x50]
jmp 0x140019474
invalid
mov ecx, 0x2f98341
cmp r9d, 2
jne 0x1400194cd
jmp 0x140019502
invalid
mov qword [rbx], r15
mov dword [rbx + 8], r9d
mov ebp, 1
add byte [rax], al
invalid
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rdx*4], fs
add byte [rax], al
add byte [rax + 0x31], cl
loope 0x1400194cd
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002b660
ja 0x140019508
add dword [rax], eax
mov eax, ebp
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r9d
xor r9d, r9d
jmp 0x140019483
invalid
mov eax, 4
jmp 0x140019474
add bpl, bpl
and bpl, 2
movzx ebp, bpl
jmp 0x1400194d9
lea rcx, [0x140061d00]
call fcn.14002a48c
pmaddwd mm0, qword [rbx]
add al, ch
xchg esi, eax
jl 0x1400227f5
add byte [rax - 0x75], cl
add eax, 0x3f4fb
mov rax, qword [0x140061cf8]
test rax, rax
je 0x14002280d
add rsp, 0x28
jmp qword [0x140067010]
nop
add rsp, 0x28
sub byte [rax - 1], cl
and eax, 0x3e977
sub byte [rax - 1], cl
and eax, 0x3e977
mov rcx, qword [0x140061cf0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add eax, dword [rax]
add eax, dword [rax]
mov qword [0x140061cf0], 0
jmp 0x1400227ea
int3
cmp r8d, 4
ja case.default.0x140022863
mov rcx, rdx
lea rax, [0x140054cd8]
movsxd rdx, dword [rax + r8*4]
add rdx, rax
jmp rdx
lea rax, str.TargetNtCreateFile64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xa
lea rdx, [0x140058a10]
lea r8, str.NtCreateFile
jmp 0x14002291a
lea rax, str.TargetNtSetInformationFile64
add eax, dword [rax]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xe
lea rdx, [0x140058a10]
invalid
add eax, dword [rax]
lea r8, str.NtSetInformationFile
jmp 0x14002291a
invalid
lea rax, str.TargetNtQueryAttributesFile64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xc
lea rdx, [0x140058a10]
lea r8, str.NtQueryAttributesFile
jmp 0x14002291a
lea rax, str.TargetNtQueryFullAttributesFile64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xd
lea rdx, [0x140058a10]
lea r8, str.NtQueryFullAttributesFile
jmp 0x14002291a
lea rax, str.TargetNtOpenFile64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xb
lea rdx, [0x140058a10]
lea r8, [0x140055e91]
mov r9d, 1
call fcn.140009710
mov al, 1
add rsp, 0x38
ret
xor eax, eax
jmp 0x140022927
cmp byte [rax + 0x19], 0
je 0x1400229be
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, dword [rdx + 0x10]
mov r10, qword [rcx + 0x30]
cmp r9, r10
mov r11, r10
cmovb r11, r9
invalid
test r11, r11
je 0x1400229d7
invalid
cmp qword [rcx + 0x38], 8
jb 0x140022985
mov rsi, qword [rcx + 0x20]
jmp 0x140022989
lea rsi, [rcx + 0x20]
lea esi, [rcx + 0x20]
xor edi, edi
movzx ebx, word [r8 + rdi*2]
cmp word [rsi + rdi*2], bx
jne 0x1400229a0
inc rdi
cmp r11, rdi
jne 0x14002298b
jmp 0x1400229d7
setbe r10b
lea r11, [rcx + 0x10]
test r10b, r10b
ror byte [rax + 0xf], cl
ror dword [rdi + rcx + 0x44], 0xd9
ror byte [rax + 0xf], cl
ror dword [rdi + rcx + 0x44], 0xd9
mov rcx, qword [r11]
cmp byte [rcx + 0x19], 0
jne 0x140022944
jmp 0x140022965
add rax, 0x20
mov rcx, rdx
mov rdx, rax
call fcn.14000a370
xor al, 1
add dword [rdi], ecx
mov dh, 0xc0
add dword [rdi], ecx
mov dh, 0xc0
jmp 0x14002294c
cmp r10, r9
setb r10b
ret 0xc4eb
ret 0xc4eb
test byte [rax + 0x81], 8
add byte [rax], al
add byte [rax], cl
je 0x140022a9e
xor edi, edi
add r8d, 0xffffffed
add eax, 0xffffffed
add eax, 0xffffffed
cmp r8d, 0xf
ja case.0x140022a18.3
mov rsi, rdx
lea rax, [0x140054d18]
and eax, dword [rbx]
add byte [rdx + 0x63], cl
or al, 0x80
and eax, dword [rbx]
add byte [rdx + 0x63], cl
or al, 0x80
add rcx, rax
jmp rcx
lea rax, str.TargetGdiDllInitialize64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x18
lea rdx, str.gdi32.dll
lea r8, str.GdiDllInitialize
jmp 0x140022a84
lea rax, str.TargetGetStockObject64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x19
sbb dword [rax], eax
add byte [rax], al
sbb dword [rax], eax
add byte [rax], al
lea rdx, str.gdi32.dll
lea r8, str.GetStockObject
add eax, dword [rax]
add eax, dword [rax]
jmp 0x140022a84
lea rax, str.TargetRegisterClassW64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1a
sbb al, byte [rax]
add byte [rax], al
invalid
sbb al, byte [rax]
add byte [rax], al
invalid
add byte [rax - 0x73], cl
adc eax, 0x35875
lea rdx, str.user32.dll
lea r8, str.RegisterClassW
mov rcx, rsi
mov ecx, esi
mov r9d, 2
call fcn.140009710
mov dil, 1
mov eax, edi
add rsp, 0x38
invalid
invalid
pop rdi
invalid
pop rsi
ret
xor edi, edi
jmp case.0x140022a18.3
lea rax, str.TargetGetCertificateSize64
mov qword [rsp + 0x20], rax
and al, 0x20
and al, 0x20
mov dword [rsp + 0x28], 0x21
lea rdx, str.gdi32.dll
lea r8, str.GetCertificateSize
or dword [rdx], esi
add eax, dword [rax]
invalid
or dword [rdx], esi
add eax, dword [rax]
invalid
add byte [rax - 0x77], cl
int1
mov rcx, rsi
mov r9d, 2
call fcn.140009710
call fcn.14000a6c0
jmp 0x181022953
mov bh, 1
cmp eax, 8
jl case.0x140022a18.3
jmp 0x181022953
lea rax, str.TargetGetCertificateSizeByHandle64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
and bh, al
and al, 0x28
and eax, dword [rax]
add byte [rax], al
mov dword [rsp + 0x28], 0x23
lea rdx, str.gdi32.dll
lea r8, str.GetCertificateSizeByHandle
jmp 0x140022d21
lea rax, str.TargetDestroyOPMProtectedOutput64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
and bh, al
and al, 0x28
and al, 0
add byte [rax], al
mov dword [rsp + 0x28], 0x24
lea rdx, str.gdi32.dll
lea r8, str.DestroyOPMProtectedOutput
jmp 0x140022a84
lea rax, str.TargetConfigureOPMProtectedOutput64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
and bh, al
and al, 0x28
and eax, 0x48000000
lea edx, str.gdi32.dll
mov dword [rsp + 0x28], 0x25
lea rdx, str.gdi32.dll
lea r8, str.ConfigureOPMProtectedOutput
jmp 0x140022a84
lea rax, str.TargetGetOPMInformation64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
and bh, al
and al, 0x28
add byte es:[rax], al
add byte [rax - 0x73], cl
adc eax, 0x35845
mov dword [rsp + 0x28], 0x26
lea rdx, str.gdi32.dll
lea r8, str.GetOPMInformation
jmp 0x140022a84
lea rax, str.TargetGetOPMRandomNumber64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
and bh, al
and al, 0x28
invalid
mov dword [rsp + 0x28], 0x27
lea rdx, str.gdi32.dll
lea r8, str.GetOPMRandomNumber
jmp 0x140022a84
lea rax, str.TargetGetSuggestedOPMProtectedOutputArraySize64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x28
lea rdx, str.gdi32.dll
lea r8, str.GetSuggestedOPMProtectedOutputArraySize
jmp 0x140022a84
lea rax, str.TargetSetOPMSigningKeyAndSequenceNumbers64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x29
lea rdx, str.gdi32.dll
adc eax, 0x357d0
adc eax, 0x357d0
lea r8, str.SetOPMSigningKeyAndSequenceNumbers
jmp 0x140022a84
invalid
dec dword [rax - 0x73]
add eax, 0x33b9e
lea rax, str.TargetEnumDisplayMonitors64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1b
add byte [rax - 0x73], cl
adc eax, 0x356e7
add byte [rax - 0x73], cl
adc eax, 0x356e7
lea r8, str.EnumDisplayMonitors
jmp 0x140022a84
invalid
dec dword [rax - 0x73]
add eax, 0x33e9d
lea rax, str.TargetEnumDisplayDevicesA64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1c
add byte [rax - 0x73], cl
adc eax, 0x356c0
add byte [rax - 0x73], cl
adc eax, 0x356c0
lea r8, str.EnumDisplayDevicesA
jmp 0x140022a84
lea rax, str.TargetGetMonitorInfoA64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1d
lea rdi, str.user32.dll
lea r8, str.GetMonitorInfoA
mov rcx, rsi
mov rdx, rdi
mov r9d, 2
call fcn.140009710
lea rax, str.TargetGetMonitorInfoW64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1e
lea r8, str.GetMonitorInfoW
mov rcx, rsi
mov rdx, rdi
jmp 0x140022a87
lea rax, str.TargetCreateOPMProtectedOutputs64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1f
lea rdx, str.gdi32.dll
lea r8, str.CreateOPMProtectedOutputs
jmp 0x140022a84
lea rax, str.TargetGetCertificate64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x20
lea rdx, str.gdi32.dll
lea r8, str.GetCertificate
mov rcx, rsi
mov r9d, 2
call fcn.140009710
call fcn.14000a6c0
mov dil, 1
cmp eax, 8
jl case.0x140022a18.3
lea rax, str.TargetGetCertificateByHandle64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x22
lea rdx, str.gdi32.dll
lea r8, str.GetCertificateByHandle
mov rcx, rsi
mov r9d, 2
call fcn.140009710
jmp case.0x140022a18.3
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140022ee6
mov r15, qword [r14 + 0x20]
lea rcx, [0x140058a10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140022ee6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140004220
int3
rol byte [rax], 0
add byte [rax - 0x75], cl
add eax, 0x34488
add byte [rax], al
add al, 0
add byte [rax], al
ret 0xffe9
invalid
add byte [rax], al
add byte [rbx + 0x5d], bl
shr ah, 1
add al, byte [rax]
add byte [rcx - 0x422d143b], cl
fild word [rax + rax]
add al, 0
add al, 0
add bl, ch
retf
add byte [rax], al
add byte [rax + 0x31], cl
loope 0x14002ccb7
invalid
add eax, 0x13b27
mov r8, qword [0x140067010]
mov rcx, rdi
mov rdx, rsi
mov edx, esi
invalid
mov edx, esi
add rsp, 0x28
add rsp, 0x28
pop rdi
pop rsi
jmp r8
add esp, 0x28
pop rdi
pop rsi
ret
invalid
int3
or cl, byte [rax - 0x75]
or byte [rbx + r9*4 + 0x42], cl
sbb byte [rax - 0x75], cl
push rdx
adc byte [rdx + rbx - 0x18], dh
sti
sti
mov ecx, dword [rdx + 8]
mov r8, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
je 0x140050097
call fcn.1400040b0
sti
dec dword [rdi]
mov dh, 0xc0
movzx eax, al
shl rax, 2
mov qword [rsi], rax
mov eax, 1
add rsp, 0x20
and byte [rsi - 0x3d], bl
and byte [rsi - 0x3d], bl
call fcn.1400500a0
jmp case.0x140017e88.115
mov rcx, rbx
mov ecx, ebx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140022ea0
int3