Function at 0x140036670
Capabilities:
Access the windows event log
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x818
movaps xmmword [rsp + 0x800], xmm6
mov rsi, r8
mov rbx, rdx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x50], rcx
mov eax, dword [rcx]
cmp rax, 0xc
ja 0x140036753
lea rcx, str.3_n_
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x358], 0xf
mov byte [rsp + 0x340], 0
mov r15, qword [rax]
mov r14, qword [rax + 8]
cmp r14, 0xf
jbe 0x14003677b
test r14, r14
js 0x14003affd
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b061
lea rcx, [rdi + 1]
call fcn.1400559d0
mov r12, rax
mov qword [rsp + 0x350], r14
mov qword [rsp + 0x358], rdi
mov rcx, r12
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + r14], 0
mov qword [rsp + 0x340], r12
jmp 0x14003679b
xor eax, eax
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x358], 0xf
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x340], 0
jmp 0x14003679b
lea rcx, [rsp + 0x340]
mov qword [rcx + 0x10], r14
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + r14 + 0x340], 0
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
cmp qword [rbx + 0x18], 0x10
jb 0x1400367ae
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x68]
cmp rdi, 0xf
ja 0x1400367cc
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x320], xmm0
mov r14d, 0xf
jmp 0x140036829
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
mov r14, rdi
cmp rdi, 0xfff
jb 0x140036804
lea rcx, [rdi + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140036810
lea rcx, [rdi + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x320], rcx
mov rdi, qword [rsp + 0x68]
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x338], r14
cmp dword [rsi], 0
mov qword [rsp + 0x318], 0xf
jne 0x140036877
mov dword [rsp + 0x303], 0x6c616974
mov dword [rsp + 0x300], 0x74696e69
mov byte [rsp + 0x307], 0
mov eax, 7
jmp 0x140036896
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x300], rax
mov byte [rsp + 0x308], 0
mov eax, 8
mov qword [rsp + 0x310], rax
mov eax, dword [rsi + 4]
cmp eax, 2
je 0x1400368e4
cmp eax, 1
jne 0x140036922
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x776f6873
mov byte [rsp + 0x2e4], 0x6e
jmp 0x14003691b
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x6f727265
mov byte [rsp + 0x2e4], 0x72
mov eax, 5
jmp 0x140036959
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x2e8], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x2e0], 0
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x70], rcx
call fcn.140032860
lea r14, [rsp + 0x4d4]
mov r8d, 0x118
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [r14 - 4], 0x11c
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140036ab1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbp, str.GetOSVersion
mov rcx, r13
mov edx, r12d
mov r8, rbp
mov r9d, 0x5e
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x5e
mov rcx, r14
mov rdx, rbx
mov r9, r13
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036a8c
mov r15, rax
lea rax, [rsp + 0x360]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
test r12d, r12d
jne 0x140037061
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
jmp 0x140036e23
lea rax, [0x14006c640]
lea r15, [rsp + 0x3e8]
mov qword [r15 - 0x88], rax
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [r15], rax
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
lea rdi, [0x14006c638]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff78
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x35c], ecx
lea r12, [rsp + 0x368]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x360], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x35c], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x360
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x35c], ebx
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, [0x14006c5c0]
mov qword [r12], rbx
mov qword [r12 + 0x68], 0
mov dword [r12 + 0x70], 4
mov edx, dword [rsp + 0x4d4]
mov rbp, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x360]
call rbp
mov r14, rax
lea r13, [0x1400a290b]
mov rcx, rax
mov rdx, r13
call fcn.14005a9f0
mov edx, dword [rsp + 0x4d8]
mov rcx, r14
call rbp
mov r14, rax
mov rcx, rax
mov rdx, r13
call fcn.14005a9f0
mov edx, dword [rsp + 0x4dc]
mov rcx, r14
call rbp
cmp dword [rsp + 0x4d4], 0xa
jne 0x140036c63
cmp dword [rsp + 0x4d8], 0
jne 0x140036c63
lea rax, [rsp + 0x228]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x748]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a4dac]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140037793
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov eax, dword [rsp + 0x3d8]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x1400378e5
mov rcx, qword [rsp + 0x3a8]
mov r14, qword [rcx]
test r14, r14
je 0x1400378e5
lea rax, [rsp + 0x388]
mov rcx, qword [rax + 0x48]
cmp r14, rcx
cmovb r14, rcx
mov rax, qword [rax]
mov r13, qword [rax]
test r13, r13
je 0x14003b002
sub r14, r13
cmp r14, 0xf
jbe 0x1400377bf
test r14, r14
js 0x14003affd
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0x60], rcx
jae 0x14003b011
inc rcx
call fcn.1400559d0
mov rbp, rax
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14], 0
mov qword [rsp + 0x748], rbp
mov rbp, qword [rsp + 0x748]
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x35c], ecx
mov qword [rsp + 0x368], rbx
test byte [rsp + 0x3d8], 1
je 0x140036dbf
mov rax, qword [rsp + 0x3a8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b02b
mov rcx, qword [rsp + rcx + 0x360]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b040
call fcn.140055a14
mov rax, qword [rsp + 0x380]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c0]
mov dword [rax], ecx
mov qword [rsp + 0x3d0], rcx
and byte [rsp + 0x3d8], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2b0], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2b8], rax
lea rdi, [rsp + 0x4d0]
mov r8d, 0xaa
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
mov qword [rsp + 0xa8], rbp
je 0x1400371f3
lea rdi, [rsp + 0x360]
lea rdx, [rsp + 0x4d0]
mov rcx, rdi
call fcn.14002df90
cmp dword [rdi + 0x20], 0
jne 0x140037abc
mov rbp, qword [rsp + 0x360]
mov rax, qword [rsp + 0x368]
mov rbx, qword [rsp + 0x370]
mov r15, qword [rsp + 0x378]
mov byte [rsp + 0x360], 0
mov qword [rsp + 0x370], 0
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], r15
xor eax, eax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
lea r8, str.PrevNotificationAction
lea r13, [rsp + 0x4d0]
mov rcx, r13
mov edx, 1
xor r9d, r9d
call fcn.14002da30
lea rdx, [rsp + 0x4f8]
mov r12d, dword [rdx]
test r12d, r12d
je 0x1400372f2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x177
call fcn.14002c330
cmp dword [rsp + 0x4f8], 0
je 0x140037354
test r12d, r12d
jns 0x140037366
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140036fd0
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036fcb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
jb 0x140037017
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037012
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x140037061
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003705c
mov r8, rax
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
mov rdx, r8
add rdx, 0x28
mov rcx, rax
call fcn.140055a14
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x1400370a8
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400370a3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x1400370ef
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400370ea
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x140037136
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037131
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jb 0x14003717d
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037178
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x358]
cmp rax, 0x10
jb 0x1400371c4
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400371bf
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rcx, qword [rsp + 0x7f8]
xor rcx, rsp
call fcn.140056980
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x800]
add rsp, 0x818
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rbx, str.0x_X_in__S:_d
lea r8, str.GetOSLocale
mov rcx, rbx
mov edx, r12d
mov r9d, 0x66
call fcn.140058910
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetOSLocale
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x66
mov rcx, r15
mov rdx, rdi
mov r9, rbx
call fcn.140058990
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400372d7
mov r13, rax
lea rax, [rsp + 0x360]
mov qword [rax], r15
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055a14
test r12d, r12d
je 0x140037785
mov rax, qword [rsp + 0x60]
jmp 0x14003701f
lea rdi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rdi - 0x18], xmm0
movaps xmmword [rdi - 0x28], xmm0
mov byte [rdi - 8], 0
mov rcx, rdi
call fcn.14005a360
cmp byte [rdi - 8], 0
jne 0x1400374fd
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
jmp 0x140038b9e
lea rcx, [rsp + 0x4d0]
call fcn.14005a480
jmp 0x140036f80
cmp dword [rsi + 4], 1
jne 0x14003741c
mov edx, dword [rsi + 8]
mov rcx, r13
call fcn.140032860
cmp qword [rsp + 0x4e8], 0x10
jb 0x14003738e
mov r13, qword [rsp + 0x4d0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8, r13
xor r9d, r9d
call fcn.14002d130
mov eax, dword [rsi]
test eax, eax
je 0x1400373d5
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x196
call fcn.14002c330
mov rax, qword [rsp + 0x4e8]
cmp rax, 0x10
jb 0x14003741c
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037417
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
xor eax, eax
lea rsi, [rsp + 0x228]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r8, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.140059cf0
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x14003790f
lea rdx, [rax + 8]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x140037480
mov rsi, qword [rsp + 0x228]
movups xmm0, xmmword [str._version]
movups xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4d0], 0
mov qword [rsp + 0x4e8], 7
mov qword [rsp + 0x4e0], 1
mov dword [rsp + 0x4d0], 0x32
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
cmp rcx, rax
je 0x140037933
lea rdx, [rax + 1]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x14003765a
mov rcx, qword [rsp + 0x228]
jmp 0x140037662
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.14005a3d0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
lea rcx, [rsp + 0x260]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
lea rdx, str.dismissed_by_timeout
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.dismissed_to_action_center
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.dismissed_by_button
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.dismissed_by_application_hidden
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.remind_me_later
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.make_firefox_default_button
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.toast_clicked
lea rcx, [rsp + 0x260]
call fcn.14005a9a0
test al, al
je 0x140038b9e
lea rdx, str.no_action
lea rdi, [rsp + 0x260]
mov rcx, rdi
call fcn.14005a9a0
test al, al
je 0x140038b9e
mov rax, qword [rsp + 0x278]
cmp rax, 9
jae 0x140038b71
mov ecx, 0x10
call fcn.1400559d0
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
movabs rcx, 0x6f697463612d6f6e
mov qword [rax], rcx
mov word [rax + 8], 0x6e
mov qword [rsp + 0x260], rax
jmp 0x140038b9e
lea rcx, [rsp + 0x228]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 2
mov dword [rsp + 0x258], 0
lea rcx, [0x1400a17fd]
lea rdx, str.DisableTelemetry
call fcn.14003b110
test al, al
je 0x1400376e0
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.140036050
mov r12d, eax
jmp 0x14003772e
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x748]
mov rcx, rsi
mov edx, 1
call fcn.1400308a0
mov r12d, dword [rsi + 0x10]
test r12d, r12d
je 0x1400377f8
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0xf9
call fcn.14002c330
mov rax, qword [rsp + 0x240]
cmp rax, 8
jb 0x140036f89
mov rcx, qword [rsp + 0x228]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003777b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
jmp 0x140036f89
xor r15d, r15d
xor ebx, ebx
xor eax, eax
xor ebp, ebp
jmp 0x140036ed4
lea rdx, [0x1400a290b]
lea r14, [rsp + 0x360]
mov rcx, r14
call fcn.14005a9f0
mov edx, dword [rsp + 0x748]
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036c63
lea rbp, [rsp + 0x748]
mov qword [rbp + 0x10], r14
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x748], 0
mov r13, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140036d31
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x748]
mov r12b, byte [rsp + 0x750]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdi, qword [rsi]
test r12b, r12b
je 0x14003785e
mov rax, rdi
test rdi, rdi
jne 0x140037845
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
sub rax, rbx
jbe 0x1400376a9
shr rax, 9
cmp rax, 0x6388fc53
jb 0x1400376a9
mov qword [rsp + 0x6e0], rdi
xor edi, edi
lea rsi, [rsp + 0x4d0]
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.LastPingSentAt
mov edx, 0xe
mov rcx, rsi
call fcn.140059cf0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x370], xmm1
movaps xmmword [rsp + 0x360], xmm0
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rsi
call fcn.140059cf0
cmp qword [rsp + 0x378], 8
jb 0x140037958
mov r8, qword [rsp + 0x360]
jmp 0x140037960
mov ecx, 0xf
mov qword [rsp + 0x60], rcx
test al, 4
jne 0x140037907
mov rax, qword [rsp + 0x3a0]
mov r14, qword [rax]
test r14, r14
jne 0x14003b07c
xor r14d, r14d
jmp 0x140036d31
lea r8, str._version
lea rcx, [rsp + 0x228]
mov edx, 8
mov r9d, 8
call fcn.14005a1d0
jmp 0x140037492
lea rcx, [rsp + 0x228]
lea r8, [rsp + 0x4d0]
mov edx, 1
mov r9d, 1
call fcn.14005a1d0
jmp 0x14003766f
lea r8, [rsp + 0x360]
cmp qword [rsp + 0x4e8], 8
jb 0x140037973
mov rsi, qword [rsp + 0x4d0]
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, rsi
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
test eax, eax
jne 0x140038465
mov rax, qword [rsp + 0x4e8]
cmp rax, 8
jb 0x1400379fe
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400379f9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x378]
cmp rax, 8
jb 0x140037a4c
mov rcx, qword [rsp + 0x360]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037a47
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
test esi, esi
je 0x140037a78
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x109
call fcn.14002c330
lea rcx, [rsp + 0x228]
lea rsi, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14002b520
mov r12d, dword [rsi]
test r12d, r12d
je 0x140037acb
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r12d
jmp 0x14003861f
mov r15d, 0xf
xor ebp, ebp
xor ebx, ebx
jmp 0x140036ed4
lea rcx, [rsp + 0x228]
mov r8d, dword [rcx + 0x2c]
lea r13, [rsp + 0x7d8]
mov rdx, r13
call fcn.14002cec0
mov eax, 0x90
lea rcx, [rsp + 0x360]
add rcx, rax
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x4d0]
add rax, rcx
mov qword [rsp + 0x58], rax
xor r12d, r12d
xorps xmm6, xmm6
mov esi, 0xf
xor edi, edi
cmp dword [rsp + 0x258], 0
je 0x1400383db
mov qword [rsp + 0x750], r12
mov qword [rsp + 0x760], r12
mov qword [rsp + 0x768], rsi
mov byte [rsp + 0x750], r12b
mov qword [rsp + 0x770], r12
mov qword [rsp + 0x780], r12
mov qword [rsp + 0x788], rsi
mov byte [rsp + 0x770], r12b
mov qword [rsp + 0x790], r12
mov qword [rsp + 0x7a0], r12
mov qword [rsp + 0x7a8], rsi
mov byte [rsp + 0x790], r12b
mov byte [rsp + 0x7d0], r12b
cmp qword [rsp + 0x7f0], 8
mov r8, r13
jb 0x140037ba8
mov r8, qword [rsp + 0x7d8]
lea rcx, [rsp + 0x360]
lea rdx, str.CacheEntryVersion
call fcn.14002e330
mov ebx, dword [rsp + 0x368]
test ebx, ebx
jne 0x140038402
mov rax, qword [rsp + 0x360]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x140038256
mov dword [rsp + 0x748], eax
test eax, eax
je 0x1400382d3
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
mov r8, r13
lea r9, str.NotificationType
call fcn.14002e740
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038333
movaps xmmword [rsp + 0x6f0], xmm6
movaps xmmword [rsp + 0x6e0], xmm6
mov byte [rsp + 0x700], 0
lea rcx, [rsp + 0x708]
lea rdx, [rsp + 0x738]
call fcn.14005a360
mov r13d, 4
cmp byte [rsp + 0x700], 0
je 0x1400383b2
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a3d0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jb 0x140037cc1
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037cbc
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a3930]
call fcn.14002e740
cmp dword [rsp + 0x738], 0
jne 0x140037d20
lea rcx, [rsp + 0x710]
call fcn.14005a480
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a360
cmp dword [rsp + 0x388], 0
jne 0x140037d7a
lea rcx, [rsp + 0x360]
call fcn.14005a480
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a360
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a780
mov rcx, rbx
call fcn.14005a480
cmp byte [rsp + 0x700], 0
je 0x1400383b2
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a3d0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jb 0x140037e40
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037e3b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x20], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a39aa]
call fcn.14002e740
cmp dword [rsp + 0x738], 0
jne 0x140037ea0
lea rcx, [rsp + 0x710]
call fcn.14005a480
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a360
cmp dword [rsp + 0x388], 0
jne 0x140037efa
lea rcx, [rsp + 0x360]
call fcn.14005a480
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a360
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a780
mov rcx, rbx
call fcn.14005a480
cmp byte [rsp + 0x700], 0
je 0x1400383b2
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a3d0
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jb 0x140037fc0
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037fbb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x748]
mov dword [rsp + 0x78], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, str.PrevNotificationAction
call fcn.14002e740
cmp dword [rsp + 0x738], 0
jne 0x14003802e
lea rcx, [rsp + 0x710]
call fcn.14005a480
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a360
cmp dword [rsp + 0x388], 0
jne 0x140038088
lea rcx, [rsp + 0x360]
call fcn.14005a480
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038390
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a360
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a780
mov rcx, rbx
call fcn.14005a480
cmp dword [rsp + 0x78], 2
jb 0x1400380f9
cmp byte [rsp + 0x700], 0
je 0x1400383b2
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x6e0]
call fcn.14005a850
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x490]
call fcn.14002e620
mov ebx, dword [rsp + 0x490]
test ebx, ebx
jne 0x140038390
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x748]
call fcn.14002e910
mov r13b, 1
mov byte [rsp + 0x3f0], r13b
mov r8d, 0x91
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0x4d0], eax
lea rcx, [rsp + 0x388]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmmword [rbx + 8], xmm0
mov qword [rsp + 0x378], r12
mov qword [rsp + 0x380], rsi
mov byte [rsp + 0x368], r12b
lea rax, [rsp + 0x388]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x4f8]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x3a0], rsi
mov byte [rsp + 0x388], r12b
movups xmm0, xmmword [rcx + 0x20]
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm1
mov qword [rsp + 0x3b8], r12
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x3a8], r12b
movups xmmword [rbx + 0x68], xmm6
movups xmmword [rbx + 0x78], xmm6
mov byte [rbx + 0x88], r12b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
call fcn.14005a360
mov byte [rsp + 0x560], r13b
cmp byte [rsp + 0x3f0], r12b
je 0x140038246
lea rcx, [rsp + 0x360]
call fcn.14002c4d0
mov dword [rsp + 0x570], 0
jmp 0x1400383ac
cmp qword [rsp + 0x7f0], 8
mov rax, r13
jb 0x14003826c
mov rax, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1bb
call fcn.14002c330
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
call fcn.14002e620
mov ebx, dword [rsp + 0x710]
test ebx, ebx
jne 0x140038595
lea rcx, [rsp + 0x748]
call fcn.14002c4d0
jmp 0x140038374
cmp qword [rsp + 0x7f0], 8
jb 0x1400382e6
mov r13, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x208
call fcn.14002c330
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
call fcn.14002e620
mov ebx, dword [rsp + 0x360]
test ebx, ebx
je 0x140038388
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x748]
call fcn.14002c4d0
cmp r13d, 4
lea r13, [rsp + 0x7d8]
jne 0x1400385c0
inc edi
cmp edi, dword [rsp + 0x250]
jbe 0x140037b1c
jmp 0x14003841e
mov r13d, 4
jmp 0x140038355
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x6e0]
call fcn.14005a480
cmp dword [rsp + 0x738], 0
jne 0x140038355
lea rcx, [rsp + 0x710]
call fcn.14005a480
jmp 0x140038355
lea rsi, [rsp + 0x4d0]
mov r8d, 0x91
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0
jmp 0x1400385c0
cmp qword [rsp + 0x7f0], 8
jb 0x140038558
mov rax, qword [rsp + 0x7d8]
jmp 0x140038560
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24c
call fcn.14002c330
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
jmp 0x1400385c0
movzx r12d, si
or r12d, 0x80070000
test esi, esi
cmovle r12d, esi
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x58], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegistrySetValueQword
mov edx, r12d
mov r9d, 0xee
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegistrySetValueQword
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xee
mov rcx, rbx
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003854b
mov r13, rax
lea rax, [rsp + 0x710]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
jmp 0x1400379b0
lea rax, [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b5
call fcn.14002c330
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], ebx
lea rcx, [rsp + 0x748]
call fcn.14002c4d0
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x14003860e
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140038609
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov r12d, dword [rsp + 0x570]
test r12d, r12d
je 0x140038742
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x15c
call fcn.14002c330
cmp dword [rsp + 0x570], 0
jne 0x140038665
cmp byte [rsp + 0x560], 0
je 0x140038665
lea rcx, [rsp + 0x4d0]
call fcn.14002c4d0
test r12d, r12d
js 0x14003772e
mov rax, qword [rsp + 0x50]
mov edi, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rcx, [rsp + 0x4d0]
mov edx, 1
xor r9d, r9d
call fcn.14002da30
lea r13, [rsp + 0x4f8]
mov r12d, dword [r13]
test r12d, r12d
je 0x140038bb0
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x11f
call fcn.14002c330
xor edi, edi
xor ebx, ebx
xor edx, edx
xor eax, eax
cmp dword [rsp + 0x4f8], 0
je 0x140038c87
test r12d, r12d
jne 0x14003772e
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x210], rbx
mov rsi, rdx
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x220], rax
mov rdi, qword [rsp + 0x270]
cmp qword [rsp + 0x278], 0x10
jb 0x140038ce5
mov r12, qword [rsp + 0x260]
jmp 0x140038ced
lea rcx, [rsp + 0x360]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x560], 0
je 0x140038644
lea rsi, [rsp + 0x560]
lea rdi, [rsp + 0x3f0]
mov eax, dword [rsi - 0x90]
mov dword [rdi - 0x90], eax
movups xmm0, xmmword [rsi - 0x88]
movups xmmword [rdi - 0x88], xmm0
movups xmm0, xmmword [rsi - 0x78]
movups xmmword [rdi - 0x78], xmm0
xor ebx, ebx
mov qword [rsi - 0x78], rbx
mov eax, 0xf
mov qword [rsi - 0x70], rax
mov byte [rsi - 0x88], bl
movups xmm0, xmmword [rsi - 0x68]
movups xmmword [rdi - 0x68], xmm0
movups xmm0, xmmword [rsi - 0x58]
movups xmmword [rdi - 0x58], xmm0
mov qword [rsi - 0x58], rbx
mov qword [rsi - 0x50], rax
mov byte [rsi - 0x68], bl
movups xmm0, xmmword [rsi - 0x48]
movups xmmword [rdi - 0x48], xmm0
movups xmm0, xmmword [rsi - 0x38]
movups xmmword [rdi - 0x38], xmm0
mov qword [rsi - 0x38], rbx
mov qword [rsi - 0x30], rax
mov byte [rsi - 0x48], bl
mov byte [rdi - 8], bl
xorps xmm0, xmm0
movups xmmword [rdi - 0x18], xmm0
movups xmmword [rdi - 0x28], xmm0
mov rcx, rdi
mov rdx, rsi
call fcn.14005a360
mov byte [rdi], 1
cmp byte [rsi], bl
je 0x140038827
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.14002c4d0
mov byte [rsi + 0x90], 0
cmp byte [rsp + 0x3f0], 0
je 0x140038644
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.140036050
cmp byte [rsp + 0x3f0], 0
je 0x14003afe7
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e910
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x1400388c3
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400388be
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x310], xmm1
movaps xmmword [rsp + 0x300], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0xf
mov byte [rcx + 8], 0
call fcn.14002c4d0
cmp byte [rsp + 0x3f0], 0
je 0x14003afe7
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e910
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x14003896d
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038968
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x2f0], xmm1
movaps xmmword [rsp + 0x2e0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], 0
call fcn.14002c4d0
cmp byte [rsp + 0x3f0], 0
je 0x14003afe7
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e910
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140038a18
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038a13
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x2d0], xmm1
movaps xmmword [rsp + 0x2c0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
call fcn.14002c4d0
cmp byte [rsp + 0x3f0], 0
je 0x14003afe7
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002e910
mov bl, byte [rsi + 0x88]
mov rcx, rsi
call fcn.14002c4d0
test bl, bl
je 0x14003a465
cmp byte [rsp + 0x3f0], 0
je 0x14003afe7
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002e910
cmp byte [rsi + 0x88], 0
je 0x14003aff2
mov rsi, qword [rsp + 0x7b0]
movups xmm6, xmmword [rsp + 0x7b8]
mov rdi, qword [rsp + 0x7c8]
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0xf
mov byte [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140038b47
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038b42
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov qword [rsp + 0x260], rsi
movups xmmword [rsp + 0x268], xmm6
mov qword [rsp + 0x278], rdi
lea rcx, [rsp + 0x748]
call fcn.14002c4d0
jmp 0x14003a4e0
cmp rax, 0x10
jb 0x140038b7f
mov rdi, qword [rsp + 0x260]
mov qword [rsp + 0x270], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rdi], rax
mov word [rdi + 8], 0x6e
lea rcx, [rsp + 0x360]
call fcn.14005a480
jmp 0x140036f72
lea rsi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, r13
call fcn.14005a360
cmp byte [rsi - 8], 0
jne 0x140038caf
cmp edi, 0xc
ja 0x140038d3f
lea rax, str.3_n_
mov rax, qword [rax + rdi*8]
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov rdi, qword [rax]
mov rax, qword [rax + 8]
mov rsi, rax
cmp rax, 0xf
jbe 0x14003a26c
test rsi, rsi
js 0x14003affd
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x14003b0e5
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400559d0
mov r12, rax
mov rcx, r12
mov rdx, rdi
mov rdi, rsi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rsi], 0
mov qword [rsp + 0x748], r12
jmp 0x140038d5f
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x50], rdx
mov rsi, r13
mov r13, rax
call fcn.14005a480
mov rax, r13
mov r13, rsi
mov rdx, qword [rsp + 0x50]
jmp 0x1400386e2
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.14005a3d0
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov rbx, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14003a2b0
lea r12, [rsp + 0x260]
cmp rdi, 0xf
ja 0x140038d07
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1e0], xmm0
mov ebx, 0xf
jmp 0x140038d84
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038d64
lea rcx, [rbx + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038d70
mov qword [rsp + 0x748], 0
mov byte [rsp + 0x748], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
xor esi, esi
jmp 0x14003a2a3
lea rcx, [rbx + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x1e0], rcx
lea r8, [rdi + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], rbx
mov rbx, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x140038db4
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x70], rax
cmp rbx, 0xf
ja 0x140038dd6
mov rax, qword [rsp + 0x70]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1c0], xmm0
mov eax, 0xf
mov qword [rsp + 0x78], rax
jmp 0x140038e3f
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x78], rcx
cmp rcx, 0xfff
jb 0x140038e18
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038e29
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rbx + 1]
mov rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1d0], rbx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1d8], rax
mov rbx, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x140038e71
mov r12, qword [rsp + 0x2e0]
jmp 0x140038e79
lea r12, [rsp + 0x2e0]
cmp rbx, 0xf
ja 0x140038e9b
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1a0], xmm0
mov eax, 0xf
mov qword [rsp + 0x88], rax
jmp 0x140038f0b
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x88], rcx
cmp rcx, 0xfff
jb 0x140038ee3
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038ef7
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1b0], rbx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1b8], rax
mov rbx, qword [rsp + 0x310]
cmp qword [rsp + 0x318], 0x10
jb 0x140038f40
mov r12, qword [rsp + 0x300]
jmp 0x140038f48
lea r12, [rsp + 0x300]
cmp rbx, 0xf
ja 0x140038f6a
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x180], xmm0
mov eax, 0xf
mov qword [rsp + 0x80], rax
jmp 0x140038fda
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jb 0x140038fb2
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038fc6
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x180], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x198], rax
cmp r15, 0x10
lea r15, [rsp + 0x280]
cmovae r15, rbp
mov qword [rsp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
cmp qword [rsp + 0xa0], 0xf
ja 0x14003903c
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x160], xmm0
mov eax, 0xf
mov qword [rsp + 0x58], rax
jmp 0x1400390b0
mov rcx, qword [rsp + 0xa0]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x58], rcx
cmp rcx, 0xfff
jb 0x140039083
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039094
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x160], rcx
mov rax, qword [rsp + 0xa0]
lea r8, [rax + 1]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x60], 0x10
lea rbx, [rsp + 0x2a0]
cmovae rbx, qword [rsp + 0xa8]
cmp r14, 0xf
ja 0x140039101
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x140], xmm0
mov eax, 0xf
mov qword [rsp + 0x70], rax
jmp 0x140039168
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x70], rcx
cmp rcx, 0xfff
jb 0x140039143
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039154
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x140], rcx
lea r8, [r14 + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0xb0], 0x10
jb 0x14003917d
mov rbx, qword [rsp + 0x320]
jmp 0x140039185
lea rbx, [rsp + 0x320]
mov qword [rsp + 0x150], r14
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x68], 0xf
ja 0x1400391b9
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x120], xmm0
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x140039227
mov rcx, qword [rsp + 0x68]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x60], rcx
cmp rcx, 0xfff
jb 0x1400391fd
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003920e
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x98], 0x10
lea rbx, [rsp + 0x208]
cmovae rbx, qword [rsp + 0x90]
mov qword [rsp + 0x100], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
cmp rsi, 0xf
ja 0x14003928f
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x100], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
jmp 0x1400392f6
mov rcx, rsi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jb 0x1400392d1
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400392e2
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0x100], rcx
lea r8, [rsi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x110], rsi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x118], rax
mov r14, qword [rsp + 0x350]
cmp qword [rsp + 0x358], 0x10
jb 0x140039328
mov rsi, qword [rsp + 0x340]
jmp 0x140039330
lea rsi, [rsp + 0x340]
cmp r14, 0xf
ja 0x14003934d
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov eax, 0xf
mov qword [rsp + 0x68], rax
jmp 0x1400393b4
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x68], rcx
cmp rcx, 0xfff
jb 0x14003938f
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400393a0
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 1]
call fcn.1400559d0
mov rcx, rax
mov qword [rsp + 0xe0], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rsp + 0xe0]
mov qword [rbx + 0x10], r14
lea rsi, [rsp + 0x748]
and dword [rsi + 8], 0xfffffe00
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
lea rdx, str.release
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044a0
lea rdx, str.build_channel
lea r8, [0x1400a1ed7]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea rdx, [0x1400a26ae]
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044a0
lea rdx, str.build_version
lea r8, [0x1400a1e26]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, rbx
call fcn.14005f310
lea rdx, [0x1400a1b4f]
lea r8, [0x1400a1b5e]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.previous_default_browser
lea r8, [0x1400a1b5e]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a18b1]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x140]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.os_version
lea r8, [0x1400a1e18]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.os_locale
lea r8, [0x1400a2400]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.notification_type
lea r8, [0x1400a232f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.notification_shown
lea r8, [0x1400a1c9a]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.14005f310
lea rdx, [0x1400a1d1c]
lea r8, [0x1400a1d2f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.14005f310
lea rdx, str.previous_notification_action
lea r8, [0x1400a1d2f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rcx, [rsp + 0x360]
call fcn.140056b60
lea rdx, [0x1400a2a33]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.1400044a0
lea r8, [rsp + 0x71b]
mov qword [r8 + 0xd], 0xf
mov qword [r8 + 5], 0xb
movabs rax, 0x7461746e65646e69
mov qword [r8 - 0xb], rax
mov dword [r8 - 4], 0x6e6f6974
mov byte [r8], 0
lea rcx, [rsp + 0x368]
lea rbx, [rsp + 0x710]
mov rdx, rbx
call fcn.1400045b0
mov rcx, rsi
mov rdx, rax
call fcn.140004400
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x140039767
mov rcx, qword [rsp + 0x710]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039762
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
call fcn.1400011b0
lea rax, [0x14006c640]
mov qword [rbx], rax
lea rsi, [rsp + 0x558]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [rsi], rax
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
lea r15, [0x14006c638]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x4cc], ecx
lea r12, [rsp + 0x4d8]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
xor edi, edi
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x4cc], esi
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, [0x14006c5c0]
mov qword [r12], rsi
mov qword [r12 + 0x68], rdi
mov dword [r12 + 0x70], 4
lea rcx, [rsp + 0x360]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400b0010]
mov r14, rax
mov rax, qword [rax]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x748]
lea rbx, [rsp + 0x4d0]
mov rcx, r14
mov r8, rbx
call qword [0x1400b0010]
mov qword [rsp + 0x6e0], rdi
mov qword [rsp + 0x6f0], rdi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
mov eax, dword [rbx + 0x78]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x14003af6d
mov rcx, qword [rsp + 0x518]
mov rbx, qword [rcx]
test rbx, rbx
je 0x14003af6d
mov rax, qword [rsp + 0x540]
cmp rbx, rax
cmovb rbx, rax
mov rax, qword [r13]
mov rbp, qword [rax]
test rbp, rbp
je 0x140039970
sub rbx, rbp
cmp rbx, 0xf
jbe 0x14003a608
test rbx, rbx
js 0x14003affd
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jae 0x14003b093
call fcn.1400559d0
mov r13, rax
mov qword [rsp + 0x6f0], rbx
mov qword [rsp + 0x6f8], rdi
mov rcx, r13
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [r13 + rbx], 0
mov qword [rsp + 0x6e0], r13
mov rax, qword [r14]
mov rax, qword [rax]
mov rcx, r14
mov edx, 1
call qword [0x1400b0010]
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x4cc], ecx
mov qword [rsp + 0x4d8], rsi
test byte [rsp + 0x548], 1
je 0x140039a0a
mov rax, qword [rsp + 0x518]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b0ad
mov rcx, qword [rsp + rcx + 0x4d0]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x4f0]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b0c2
call fcn.140055a14
mov rax, qword [rsp + 0x4f0]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
mov rax, qword [rsp + 0x528]
mov dword [rax], ecx
mov rax, qword [rsp + 0x4f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x518]
mov qword [rax], rcx
mov rax, qword [rsp + 0x530]
mov dword [rax], ecx
mov qword [rsp + 0x540], rcx
and byte [rsp + 0x548], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rcx, [rsp + 0x710]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x140039c1e
xorps xmm0, xmm0
lea rsi, [rsp + 0x4d0]
movups xmmword [rsi + 0x3e], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rcx, [rsp + 0x710]
mov rdx, rsi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
jne 0x140039cf0
lea rbx, [rsp + 0x4d2]
mov ecx, 0x50
call fcn.1400559d0
mov r14, rax
mov r8d, 0x48
mov rcx, rax
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + 0x48], 0
mov qword [rsp + 0x7d8], r14
mov qword [rsp + 0x7e0], 0
mov qword [rsp + 0x7e8], 0x24
mov qword [rsp + 0x7f0], 0x27
lea rcx, section..rdata
lea r9, [rsp + 0x4b0]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0xa8], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x14003a3aa
mov r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov rcx, rdi
mov edx, eax
mov r8, r13
mov r9d, 0x75
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x75
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058990
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039c11
mov r14, rax
mov qword [rsp + 0x4d0], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
jmp 0x14003af16
mov r12d, eax
or r12d, 0x80010000
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r13, str.GenerateUUIDStr
mov rcx, r14
mov edx, r12d
mov r8, r13
mov r9d, 0x2e
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055a0c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x2e
mov rcx, rsi
mov rdx, rbp
mov r9, r14
call fcn.140058990
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039dc7
mov rbx, rax
mov qword [rsp + 0x4d0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, r12d
jmp 0x140039db8
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.GenerateUUIDStr
mov r12d, 0x8007007a
mov rcx, r14
mov edx, 0x8007007a
mov r8, r15
mov r9d, 0x35
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0x35
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rsi
mov rdx, r13
mov r9, r14
call fcn.140058990
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039dc7
mov rbx, rax
lea rax, [rsp + 0x7d8]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140055a14
mov rax, qword [rsp + 0x6f8]
cmp rax, 0x10
jb 0x140039e16
mov rcx, qword [rsp + 0x6e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039e11
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rcx, [rsp + 0x360]
call fcn.140062c30
lea rcx, [rsp + 0x748]
call fcn.1400011b0
cmp qword [rsp + 0x68], 0x10
jb 0x140039e7a
mov rcx, qword [rsp + 0xe0]
cmp qword [rsp + 0x68], 0xfff
jb 0x140039e6b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x68], 0x28
mov rcx, rax
jmp 0x140039e70
inc qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140055a14
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0x50], 0x10
jb 0x140039ee4
mov rcx, qword [rsp + 0x100]
cmp qword [rsp + 0x50], 0xfff
jb 0x140039ed5
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x50], 0x28
mov rcx, rax
jmp 0x140039eda
inc qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140055a14
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
cmp qword [rsp + 0x60], 0x10
jb 0x140039f4e
mov rcx, qword [rsp + 0x120]
cmp qword [rsp + 0x60], 0xfff
jb 0x140039f3f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x60], 0x28
mov rcx, rax
jmp 0x140039f44
inc qword [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
call fcn.140055a14
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
cmp qword [rsp + 0x70], 0x10
jb 0x140039fb8
mov rcx, qword [rsp + 0x140]
cmp qword [rsp + 0x70], 0xfff
jb 0x140039fa9
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x70], 0x28
mov rcx, rax
jmp 0x140039fae
inc qword [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140055a14
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
cmp qword [rsp + 0x58], 0x10
jb 0x14003a022
mov rcx, qword [rsp + 0x160]
cmp qword [rsp + 0x58], 0xfff
jb 0x14003a013
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x58], 0x28
mov rcx, rax
jmp 0x14003a018
inc qword [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
call fcn.140055a14
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
cmp qword [rsp + 0x80], 0x10
jb 0x14003a09b
mov rcx, qword [rsp + 0x180]
cmp qword [rsp + 0x80], 0xfff
jb 0x14003a086
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x80], 0x28
mov rcx, rax
jmp 0x14003a08e
inc qword [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140055a14
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
cmp qword [rsp + 0x88], 0x10
jb 0x14003a114
mov rcx, qword [rsp + 0x1a0]
cmp qword [rsp + 0x88], 0xfff
jb 0x14003a0ff
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x88], 0x28
mov rcx, rax
jmp 0x14003a107
inc qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
call fcn.140055a14
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
cmp qword [rsp + 0x78], 0x10
jb 0x14003a17e
mov rcx, qword [rsp + 0x1c0]
cmp qword [rsp + 0x78], 0xfff
jb 0x14003a16f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add qword [rsp + 0x78], 0x28
mov rcx, rax
jmp 0x14003a174
inc qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
call fcn.140055a14
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
mov rax, qword [rsp + 0x1f8]
cmp rax, 0x10
jb 0x14003a1e5
mov rcx, qword [rsp + 0x1e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a1e0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0xf
mov byte [rsp + 0x1e0], 0
cmp qword [rsp + 0x98], 0x10
jb 0x14003772e
mov rax, qword [rsp + 0x98]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a25a
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
mov rdx, qword [rsp + 0x98]
add rdx, 0x28
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140055a14
jmp 0x14003772e
lea r12, [rsp + 0x748]
mov qword [r12 + 0x10], rsi
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x748], 0
mov rbx, qword [r12 + 8]
mov rsi, qword [r12 + 0x10]
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x748]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x358], 0x10
jb 0x14003a2c5
mov r8, qword [rsp + 0x340]
jmp 0x14003a2cd
lea r8, [rsp + 0x340]
lea rdx, str.PingCurrentDefault
lea rdi, [rsp + 0x748]
mov rcx, rdi
xor r9d, r9d
call fcn.14002d130
mov r12d, dword [rdi]
test r12d, r12d
jne 0x14003a2fe
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
jmp 0x14003a38a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002c330
xor edi, edi
mov ebx, 0
mov esi, 0
mov r13d, 0
cmp qword [rsp + 0x50], 0x10
jb 0x14003a38a
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a377
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140055a14
xor edi, edi
xor ebx, ebx
xor esi, esi
xor r13d, r13d
lea rcx, [rsp + 0x360]
call fcn.14005a480
mov rax, r13
lea r13, [rsp + 0x4f8]
mov rdx, rsi
jmp 0x1400386d4
mov rsi, qword [rsp + 0x4b0]
lea rbx, [rsp + 0x4d0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a450e]
mov rcx, rbx
mov qword [rsp + 0xb0], rsi
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x14003a500
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, r13
mov r9d, 0x81
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea rsi, [rax + rax]
add rsi, 2
mov rcx, rsi
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0x81
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, rbp
jmp 0x14003a6d1
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x14003a4ac
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a4a7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
cmp byte [rsp + 0x3f0], 0
je 0x140038644
lea rcx, [rsp + 0x360]
call fcn.14002c4d0
jmp 0x140038644
lea rdx, [0x1400a2c4c]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003a582
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x86
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x86
jmp 0x14003a6c3
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003a62c
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x8b
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x8b
jmp 0x14003a6c3
lea rcx, [rsp + 0x6e0]
mov qword [rcx + 0x10], rbx
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x6e0], 0
jmp 0x140039970
cmp qword [rsp + 0x7f0], 8
jb 0x14003a641
mov rdx, qword [rsp + 0x7d8]
jmp 0x14003a649
lea rdx, [rsp + 0x7d8]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003ab1f
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x90
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x90
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, r13
mov r9, r15
call fcn.140058990
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a73b
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
xorps xmm6, xmm6
xor r14d, r14d
xor edi, edi
xor esi, esi
cmp qword [rsp + 0xb0], 0
je 0x14003a766
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test dil, dil
je 0x14003af16
mov qword [rsp + 0x4b0], r14
movups xmmword [rsp + 0x4b8], xmm6
cmp rsi, 8
lea rax, [rsp + 0x4b0]
cmovb r14, rax
mov qword [rsp + 0x4c8], rsi
lea rax, [0x14006c4e8]
lea rsi, [rsp + 0x578]
mov qword [rsi - 0xa8], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [rsi], rax
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
lea rbx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
mov edi, 0xffffff58
lea ecx, [rax + rdi]
mov dword [rsp + rax + 0x4cc], ecx
lea r15, [rsp + 0x4d8]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
add edi, eax
mov dword [rsp + rax + 0x4cc], edi
mov rcx, r15
call fcn.14005bd20
mov rcx, r15
mov rdx, r14
call fcn.14005bda0
test rax, rax
jne 0x14003a8a3
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6f0]
cmp qword [rsp + 0x6f8], 0x10
jb 0x14003a8c6
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, qword [rsp + 0xb8]
call fcn.140002f00
mov rax, qword [r14]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003aa30
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r8, str.SendPing
mov r12d, 0x8007045d
mov rcx, rdi
mov edx, 0x8007045d
mov r9d, 0xc6
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SendPing
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0xc6
mov dword [rsp + 0x20], 0x8007045d
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058990
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a9de
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007045d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.14005ad60
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003aec8
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.14005ad60
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdx, str.pingsender.exe
lea rsi, [rsp + 0x710]
mov rcx, rsi
call fcn.140031be0
mov r12d, dword [rsi + 0x20]
test r12d, r12d
jne 0x14003aec8
movups xmm0, xmmword [rsp + 0x710]
movups xmm1, xmmword [rsp + 0x720]
movaps xmmword [rsp + 0x4a0], xmm1
movaps xmmword [rsp + 0x490], xmm0
xor eax, eax
mov qword [rsp + 0x720], rax
mov ecx, 7
mov qword [rsp + 0x728], rcx
mov word [rsp + 0x710], ax
lea rsi, [rsp + 0x470]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov word [rsi], ax
lea r8, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rsi
call fcn.140059cf0
mov r9, qword [rsp + 0x7e8]
cmp qword [rsp + 0x7f0], 8
jb 0x14003ab7f
mov r8, qword [rsp + 0x7d8]
jmp 0x14003ab87
xor eax, eax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], 7
mov word [rsp + 0x710], 0
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rbx, rax
lea rcx, [rsp + 0x710]
cmp rax, 7
jbe 0x14003afa3
lea r8, [rsp + 0x4d0]
mov rdx, rbx
call fcn.140059cf0
jmp 0x14003afc4
lea r8, [rsp + 0x7d8]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r9
jae 0x14003abb4
lea rcx, [rsp + 0x470]
mov rdx, r9
call fcn.14005a1d0
jmp 0x14003abe6
lea rdi, [rax + r9]
mov qword [rsp + 0x480], rdi
cmp rcx, 8
jb 0x14003abce
mov rsi, qword [rsp + 0x470]
lea rcx, [rsi + rax*2]
add r9, r9
mov rdx, r8
mov r8, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rdi*2], 0
lea rbx, [rsp + 0x490]
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14003ac00
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x450], rax
cmp qword [rsp + 0x488], 8
jb 0x14003ac1d
mov rax, qword [rsp + 0x470]
jmp 0x14003ac25
lea rax, [rsp + 0x470]
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x4c8], 8
jb 0x14003ac48
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0x450]
mov rax, qword [rsp + 0xa8]
mov qword [r8 + 0x10], rax
lea rsi, [rsp + 0xd8]
mov rcx, rsi
mov edx, 3
call fcn.140005800
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4d0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x520], xmm0
movaps xmmword [rsp + 0x510], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x4e0], xmm0
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x4d0], 0x68
mov dword [rsp + 0x50c], 1
mov rsi, qword [rsi]
cmp qword [rsp + 0x4a8], 8
jb 0x14003acdc
mov rbx, qword [rsp + 0x490]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003ae04
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.SendPing
mov rcx, rdi
mov edx, r12d
mov r8, r13
mov r9d, 0xe4
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xe4
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058990
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003adfa
mov r14, rax
lea rax, [rsp + 0x6d8]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
jmp 0x14003ae1f
mov rcx, qword [rsp + 0xc8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xc0]
call rdi
test rsi, rsi
je 0x14003ae2c
mov rcx, rsi
call fcn.140055a14
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003ae7a
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003ae75
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x14003aec8
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003aec3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x14003af16
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003af11
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x140039dcf
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003af63
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b0df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
jmp 0x140039dcf
test al, 4
jne 0x140039970
mov rax, qword [rsp + 0x510]
mov rbx, qword [rax]
test rbx, rbx
je 0x140039970
lea rax, [rsp + 0x4f0]
mov r13, rax
mov rax, qword [rax + 0x38]
movsxd rax, dword [rax]
add rbx, rax
jmp 0x1400398f5
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x4d0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx*2 + 0x710], 0
mov r14, qword [rsp + 0x710]
movups xmm6, xmmword [rsp + 0x718]
mov rsi, qword [rsp + 0x728]
xor r12d, r12d
mov dil, 1
jmp 0x14003a74d
int3
int3
call fcn.140059b90
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x140037907
add rcx, 0x28
call fcn.1400559d0
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x140036d15
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036d91
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add rdx, 0x27
mov rcx, rax
jmp 0x140036dba
lea rcx, [rdi + 0x28]
call fcn.1400559d0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140036726
lea rax, [rsp + 0x380]
mov rcx, qword [rax + 0x38]
movsxd rcx, dword [rcx]
add r14, rcx
jmp 0x140036cbf
lea rcx, [rdi + 0x28]
call fcn.1400559d0
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x140039944
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x1400399dc
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b0df
add rdx, 0x27
mov rcx, rax
jmp 0x140039a05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400559d0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140038c64