Function at 0x14000598c
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Move file
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe90]
sub rsp, 0xf90
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rbp + 0xe80], rax
mov dword [rsp + 0x54], ecx
mov rsi, rdx
mov r13d, ecx
cmp ecx, 4
jge 0x1400059ee
mov ecx, 2
call fcn.140012920
mov rcx, rax
lea rdx, str.Usage:_updater_patch_dir_install_dir_apply_to_dir__wait_pid__callback_working_dir_callback_path_args...___n
call fcn.140002508
mov eax, 1
jmp 0x140006d18
mov rcx, qword [rdx + 8]
call fcn.14000a1a8
mov rbx, qword [rsi + 8]
xor r12d, r12d
test al, al
jne 0x140005a20
lea ecx, [r12 + 2]
call fcn.140012920
mov r8, rbx
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
call fcn.140002508
jmp 0x1400059e4
mov edi, 0x104
lea rcx, [0x14003d2b0]
mov r8d, edi
mov rdx, rbx
call fcn.1400121c8
mov rcx, qword [rsi + 0x10]
call fcn.14000a1a8
test al, al
jne 0x140005a65
mov ecx, 0x4b
call fcn.140005048
mov ecx, 2
call fcn.140012920
mov r8, qword [rsi + 0x10]
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application___S__n
jmp 0x140005a16
mov rdx, qword [rsi + 0x10]
lea rbx, [0x14003d6d0]
mov rcx, rbx
mov r8, rdi
call fcn.1400121c8
mov edx, 0x5c
mov word [0x14003d8d6], r12w
mov rcx, rbx
call fcn.14000e61c
test rax, rax
je 0x140005aa0
cmp word [rax + 2], r12w
jne 0x140005aa0
mov word [rax], r12w
call fcn.1400050b0
mov qword [rsp + 0x40], r12
lea rdx, str.SoftwareClassesApplications
mov r15b, al
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov r14d, 2
mov qword [rsp + 0x38], rax
mov rbx, 0xffffffff80000001
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea edi, [r14 - 1]
mov qword [rsp + 0x30], r12
lea rdx, str.SoftwareClassesApplicationsupdater.exe
mov dword [rsp + 0x28], r14d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140005ba5
mov rcx, qword [rsp + 0x58]
lea rdx, str.IsHostApp
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rdx, str.NoOpenWith
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rdx, str.NoStartPage
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
cmp r13d, 4
jle 0x140005bf0
mov rcx, qword [rsi + 0x20]
call fcn.1400170dc
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x140005bcd
mov byte [0x14003c170], dil
jmp 0x140005bf0
mov rcx, qword [rsi + 0x20]
lea rdx, str._replace
call fcn.14000e6d0
movzx ecx, byte [0x14003c171]
test rax, rax
cmovne ecx, edi
mov byte [0x14003c171], cl
mov rcx, qword [rsi + 0x18]
call fcn.14000a1a8
test al, al
jne 0x140005c29
mov ecx, 0x4c
call fcn.140005048
mov ecx, r14d
call fcn.140012920
mov r8, qword [rsi + 0x18]
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
call fcn.140002508
mov eax, edi
jmp 0x140006d18
mov rdx, qword [rsi + 0x18]
lea rbx, [0x14003ce90]
mov rcx, rbx
mov r8d, 0x104
call fcn.1400121c8
mov edx, 0x5c
mov word [0x14003d096], r12w
mov rcx, rbx
call fcn.14000e61c
test rax, rax
je 0x140005c67
cmp word [rax + 2], r12w
jne 0x140005c67
mov word [rax], r12w
cmp r13d, 6
jle 0x140005d1f
mov rcx, qword [rsi + 0x30]
call fcn.14000a1a8
test al, al
jne 0x140005ca0
mov ecx, 0x4d
call fcn.140005048
mov ecx, r14d
call fcn.140012920
mov r8, qword [rsi + 0x30]
lea rdx, str.The_callback_file_path_is_not_valid_for_this_application___S__n
jmp 0x140005c1a
xor edx, edx
lea rcx, [rbp + 0x230]
mov r8d, 0x208
call fcn.14000f4f0
or r8, 0xffffffffffffffff
lea rbx, [0x14003d6d0]
inc r8
cmp word [rbx + r8*2], r12w
jne 0x140005cbf
mov rdx, qword [rsi + 0x30]
lea rcx, [rbp + 0x230]
call fcn.1400121c8
lea r8, [rbp + 0x230]
mov rax, rbx
sub r8, rbx
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x140005cf9
add rax, r14
test edx, edx
jne 0x140005ce6
test ecx, ecx
je 0x140005d1f
mov ecx, 0x4e
call fcn.140005048
mov ecx, r14d
call fcn.140012920
mov r8, qword [rsi + 0x30]
lea rdx, str.The_callback_file_must_be_located_in_the_installation_directory___S__n
jmp 0x140005c1a
call fcn.140002608
mov rbx, rax
cmp qword [rax], r12
jne 0x140005d9f
lea rcx, str.update.log
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, [0x14003d2b0]
lea rcx, [rax + 0x210]
lea r8, str._s__s
call fcn.1400025a4
dec eax
cmp eax, 0x102
ja 0x140005d9f
lea r9, [rbx + 8]
xor r8d, r8d
lea rdx, [0x140035748]
lea rcx, [0x14003d2b0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140005d9f
lea rdx, [0x140035750]
lea rcx, [rbx + 8]
call fcn.1400114d4
lea rcx, [rbx + 0x210]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.applying
call fcn.140004f1c
xor ebx, ebx
test al, al
jne 0x140005dca
call fcn.140002608
lea rdx, str.failed_setting_status_to_applying
mov rcx, rax
call fcn.14000a0ec
jmp 0x140005c22
cmp byte [0x14003c170], bl
je 0x140005de0
call fcn.140002608
lea rdx, str.Performing_a_staged_update
jmp 0x140005df4
cmp byte [0x14003c171], bl
je 0x140005dfc
call fcn.140002608
lea rdx, str.Performing_a_replace_request
mov rcx, rax
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
lea r8, [0x14003d2b0]
lea rdx, str.PATCH_DIRECTORY__S
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
lea r8, [0x14003d6d0]
lea rdx, str.INSTALLATION_DIRECTORY__S
call fcn.14000a0ec
call fcn.140002608
lea r12, [0x14003ce90]
mov rcx, rax
mov r8, r12
lea rdx, str.WORKING_DIRECTORY__S
call fcn.14000a0ec
mov r8d, 0x104
lea rdx, [0x14003d6d0]
mov rcx, r12
call fcn.140017374
test eax, eax
je 0x140005f3b
cmp byte [0x14003c170], bl
jne 0x140005ead
cmp byte [0x14003c171], bl
jne 0x140005ead
mov ecx, 0x4a
call fcn.140005048
call fcn.140002608
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
mov rcx, rax
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
jmp 0x140005c22
mov r9, r12
lea r8, [0x140033bf0]
mov r12d, 0x104
lea rcx, [rbp + 0x230]
mov edx, r12d
call fcn.1400025a4
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140005f06
lea ecx, [rax + 0x47]
call fcn.140005048
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140002608
mov rcx, rax
lea rdx, str.Error_calling_PathRemoveFileSpecW:__d
mov r8d, ebx
call fcn.14000a0ec
jmp 0x140005e9b
mov r8, r12
lea rdx, [0x14003d6d0]
lea rcx, [rbp + 0x230]
call fcn.140017374
test eax, eax
je 0x140005f3b
mov ecx, 0x48
call fcn.140005048
call fcn.140002608
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
jmp 0x140005e93
mov rax, qword [rsp + 0x60]
test rax, rax
jle 0x140005f90
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x140005f90
mov edx, 0x7530
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140005f8e
call fcn.140002608
mov rcx, rax
lea rdx, str.The_parent_process_didnt_exit__Continuing_with_update.
call fcn.14000a0ec
xor ebx, ebx
cmp byte [0x14003c171], bl
jne 0x140005fa0
cmp byte [0x14003c170], bl
je 0x140005fd6
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x20a
call fcn.14000f4f0
mov edx, 0x105
lea rcx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140005fd6
lea rcx, [rbp + 0x440]
call fcn.140017524
lea rcx, [0x140033cb8]
call fcn.14001786c
test rax, rax
je 0x140005fee
cmp byte [rax], bl
mov al, dil
jne 0x140005ff0
mov al, bl
lea rcx, str.MOZ_USING_SERVICE
mov byte [0x14003c181], al
call fcn.140012d48
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x208
or r12, 0xffffffffffffffff
call fcn.14000f4f0
cmp byte [0x14003c181], bl
jne 0x1400065eb
mov al, byte [0x14003c170]
mov cl, byte [0x14003c171]
cmp r13d, 6
jg 0x140006041
test al, al
jne 0x140006045
test cl, cl
je 0x140006612
test al, al
je 0x140006055
lea r9, [0x14003d6d0]
lea r8, str._s_updated.update_in_progress.lock
jmp 0x1400060bd
test cl, cl
je 0x1400060b2
mov rcx, rbx
lea r13, [0x14003d6d0]
movzx eax, word [rcx + r13]
mov word [rbp + rcx + 0x230], ax
add rcx, r14
test ax, ax
jne 0x140006063
mov edx, 0x5c
lea rcx, [rbp + 0x230]
call fcn.14000e61c
lea r9, [rbp + 0x230]
mov edx, 0x104
lea r8, str._smoz_update_in_progress.lock
lea rcx, [rbp + 0x650]
mov word [rax], bx
call fcn.1400025a4
mov r13d, dword [rsp + 0x54]
jmp 0x1400060ce
mov r9, qword [rsi + 0x30]
lea r8, str._s.update_in_progress.lock
mov edx, 0x104
lea rcx, [rbp + 0x650]
call fcn.1400025a4
xor edx, edx
lea rcx, [rbp + 0x650]
call fcn.140012210
test eax, eax
jne 0x14000611d
lea rcx, [rbp + 0x650]
call fcn.1400129a8
test eax, eax
je 0x14000611d
cmp byte [0x14003c170], bl
jne 0x140006100
cmp byte [0x14003c171], bl
je 0x14000610c
lea rcx, str.pending
call fcn.140004f1c
call fcn.140002608
lea rdx, str.Update_already_in_progress__Exiting
jmp 0x140005dbd
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x650]
mov dword [rsp + 0x28], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [0x14003d2b0]
mov edx, 0x104
lea r8, str._s_update_elevated.lock
mov r12, rax
lea rcx, [rbp + 0x20]
call fcn.1400025a4
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400062b1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0xf00ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400061c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140002608
mov rcx, rax
lea rdx, str.Could_not_obtain_token_for_current_process__no_privileges_changed.___d_
mov r8d, ebx
call fcn.14000a144
xor ebx, ebx
jmp 0x1400062b1
mov rbx, qword [rsp + 0x58]
xor r14d, r14d
mov qword [rsp + 0x68], rbx
mov r13d, r14d
lea rax, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
mov rdx, qword [rax + r13]
lea r8, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140006256
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rbp + 4], rax
mov dword [rbp], edi
mov dword [rbp + 0xc], r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9d, 0x10
mov qword [rsp + 0x28], r14
lea r8, [rbp]
mov qword [rsp + 0x20], r14
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140006256
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140006256
call fcn.140002608
lea r8, str.SeAssignPrimaryTokenPrivilege
mov rcx, rax
mov r8, qword [r8 + r13]
lea rdx, str.Disabled_unneeded_token_privilege:__s.
call fcn.14000a0ec
jmp 0x140006285
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140002608
lea r8, str.SeAssignPrimaryTokenPrivilege
mov rcx, rax
mov r8, qword [r8 + r13]
lea rdx, str.Could_not_disable_token_privilege_value:__s.___d_
mov r9d, ebx
call fcn.14000a0ec
mov rbx, qword [rsp + 0x68]
add r13, 8
cmp r13, 0x110
jb 0x1400061d4
mov rcx, qword [rsp + 0x58]
xor ebx, ebx
lea r14d, [rbx + 2]
test rcx, rcx
je 0x1400062ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rsp + 0x54]
cmp r12, 0xffffffffffffffff
jne 0x1400065eb
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x1400062f3
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
je 0x1400062f3
mov ecx, r14d
call fcn.140012920
mov rcx, rax
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting_n
call fcn.140002508
jmp 0x140005c22
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x28], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140006337
call fcn.140002608
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting
jmp 0x140005dbd
lea ecx, [r13 - 1]
lea rdx, [rsi + 8]
call fcn.140004674
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov rbx, rax
test rax, rax
jne 0x140006361
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c22
test r15b, r15b
je 0x1400064dd
mov dword [rsp + 0x54], ecx
lea rdx, [rsp + 0x54]
mov rcx, qword [rsi]
call fcn.14000a944
xor ecx, ecx
test eax, eax
je 0x1400064da
cmp dword [rsp + 0x54], ecx
je 0x1400064da
lea rcx, [rsp + 0x54]
mov r15b, dil
call fcn.14000a9f4
xor ecx, ecx
test eax, eax
je 0x1400063b4
mov eax, dword [rsp + 0x54]
test eax, eax
sete r15b
test eax, eax
jne 0x1400064dd
lea rdx, [rbp + 0x440]
call fcn.1400098cc
xor ecx, ecx
test eax, eax
je 0x140006407
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea rdx, [rbp + 0x440]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x14000640a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x14000640a
mov r15b, cl
test r15b, r15b
je 0x1400064dd
mov rdx, rsi
mov ecx, r13d
call fcn.14000a5b8
xor ecx, ecx
test eax, eax
sete r15b
test eax, eax
jne 0x1400064cd
cmp byte [0x14003c170], cl
mov bl, cl
jne 0x140006442
call fcn.140002198
test eax, eax
sete bl
mov edx, 5
call fcn.14000a734
cmp eax, edi
je 0x1400064b2
xor ecx, ecx
lea rax, [0x140005634]
mov qword [rbp + 8], rax
lea r9, [rbp]
lea rax, [rsp + 0x54]
mov qword [rbp + 0x10], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14000266c]
xor edx, edx
mov dword [rsp + 0x20], ecx
call fcn.140012e8c
mov qword [rbp], rax
test rax, rax
je 0x14000649c
test bl, bl
je 0x14000649c
xor edx, edx
mov cl, dil
call fcn.1400022ac
mov rax, qword [rbp]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
call fcn.14000a734
mov rbx, qword [rsp + 0x58]
cmp eax, edi
movzx r15d, r15b
mov ecx, 0
cmovne r15d, ecx
test r15b, r15b
je 0x1400064dd
mov al, byte [0x14003c170]
jmp 0x1400064ff
mov r15b, cl
mov al, byte [0x14003c170]
test al, al
je 0x1400064fa
lea rcx, str.pending
call fcn.140004f1c
xor eax, eax
jmp 0x140006d18
test r15b, r15b
je 0x140006542
test al, al
jne 0x14000653d
mov byte [rsp + 0x50], cl
lea rcx, [rsp + 0x50]
call fcn.1400051b0
xor ecx, ecx
test al, al
je 0x14000653d
cmp byte [rsp + 0x50], cl
je 0x14000653d
call fcn.140004a08
test al, al
jne 0x14000653d
mov ecx, r14d
call fcn.140012920
mov rcx, rax
lea rdx, str.The_post_update_process_which_runs_as_the_user_for_service_update_could_not_be_launched.
call fcn.140002508
test r15b, r15b
jne 0x1400065c0
mov r14d, 0x70
lea rcx, [rbp - 0x70]
mov r8d, r14d
xor edx, edx
call fcn.14000f4f0
mov rax, qword [rsi]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x58], rax
lea rax, str.runas
mov dword [rbp - 0x70], r14d
xor r14d, r14d
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x6c], 0x540
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x40], edi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call fcn.140011538
test ebx, ebx
je 0x1400065b4
mov rcx, qword [rbp - 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400065c3
mov ecx, 9
call fcn.140005048
jmp 0x1400065c3
xor r14d, r14d
cmp r13d, 6
jle 0x1400065da
mov rcx, qword [rsi + 0x28]
lea r8, [rsi + 0x30]
lea edx, [r13 - 6]
call fcn.140004e98
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x140006d18
cmp byte [0x14003c170], bl
lea r15, [0x14003ce90]
je 0x140006604
xor edx, edx
mov rcx, r15
call fcn.1400029fc
cmp byte [0x14003c171], bl
jne 0x1400066c6
jmp 0x140006619
lea r15, [0x14003ce90]
mov rcx, r15
call fcn.1400122d0
test eax, eax
je 0x140006633
call fcn.140017324
cmp dword [rax], 0x11
jne 0x140005c22
cmp byte [0x14003c171], bl
jne 0x1400066c6
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], bx
jne 0x140006643
lea rcx, [rcx*2 + 4]
call fcn.140011578
mov r8, rax
test rax, rax
je 0x140005c22
mov rdx, rax
mov rcx, r15
sub rdx, r15
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, r14
test ax, ax
jne 0x14000666f
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], bx
jne 0x140006682
mov ecx, 0x2f
lea rdx, [r8 + rax*2]
cmp word [r15 + rax*2 - 2], cx
je 0x1400066c3
mov ecx, 0x5c
cmp word [r15 + rax*2 - 2], cx
je 0x1400066c3
mov rcx, rdx
sub rcx, r14
add rcx, r14
cmp word [rcx], bx
jne 0x1400066b0
mov eax, dword [0x1400326e8]
add rdx, r14
mov dword [rcx], eax
mov word [rdx], bx
mov r8d, 0x104
lea rdx, [rbp + 0xc70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x14000675d
call fcn.140002608
mov rcx, rax
lea rdx, str.NS_main:_unable_to_find_apply_to_dir:__S
mov r8, r15
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
mov ecx, 0x41
call fcn.140005048
cmp r12, 0xffffffffffffffff
je 0x14000671d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x14000673d
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
jne 0x140005e9b
cmp r13d, 6
jle 0x140005c22
lea r8, [rsi + 0x30]
mov rcx, qword [rsi + 0x28]
lea edx, [r13 - 6]
call fcn.140004e98
jmp 0x140005c22
or qword [rsp + 0x58], 0xffffffffffffffff
cmp r13d, 6
jle 0x140006da5
xor edx, edx
lea rcx, [rbp + 0x230]
mov r8d, 0x208
call fcn.14000f4f0
lea r15, [rsi + 0x30]
xor edx, edx
mov rbx, qword [r15]
lea rcx, [rbp + 0x860]
mov r8d, 0x410
mov qword [rsp + 0x60], rbx
call fcn.14000f4f0
xor eax, eax
cmp byte [0x14003c171], al
je 0x1400068a8
xor r8d, r8d
lea rdx, [0x14003d6d0]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
mov rdx, qword [r15]
lea rcx, [rbp + 0x860]
movsxd rbx, eax
mov r8, rbx
mov qword [rsp + 0x68], rbx
call fcn.1400121c8
mov ecx, 0x208
lea rax, [rbp + 0x860]
sub rcx, rbx
lea rax, [rax + rbx*2]
mov qword [rsp + 0x60], rcx
lea rdx, [0x14003d6d0]
mov r8, rcx
lea rdx, [rdx + rbx*2]
mov rcx, rax
call fcn.1400121c8
or r8, 0xffffffffffffffff
lea r9, [0x14003d6d0]
lea rax, [r9 + rbx*2]
mov rcx, r8
xor edx, edx
inc rcx
cmp word [rax + rcx*2], dx
jne 0x14000681e
lea rax, [rbp + 0x860]
lea rax, [rax + rbx*2]
lea rbx, [rax + rcx*2]
mov eax, 0x5c
mov word [rbx], ax
add rbx, r14
mov rax, r8
sub rax, rcx
mov rcx, rdx
add qword [rsp + 0x60], rax
mov word [rbx], dx
movzx eax, word [rcx + r9]
mov word [rbp + rcx + 0x440], ax
add rcx, r14
test ax, ax
jne 0x140006852
mov rcx, qword [r15]
lea rdx, [rbp + 0x440]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
mov r8, qword [rsp + 0x60]
movsxd rcx, eax
cmp rcx, qword [rsp + 0x68]
mov rax, qword [r15]
cmovb rcx, qword [rsp + 0x68]
lea rdx, [rax + rcx*2]
mov rcx, rbx
call fcn.1400121c8
lea rbx, [rbp + 0x860]
mov qword [rsp + 0x60], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x140006927
call fcn.140002608
mov rcx, rax
lea rdx, str.NS_main:_unable_to_find_callback_file:__S
mov r8, rbx
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
mov ecx, 0x42
call fcn.140005048
cmp r12, 0xffffffffffffffff
je 0x1400068ff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x14000691f
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
jne 0x140005e9b
mov r8, r15
jmp 0x14000674b
xor ebx, ebx
cmp byte [0x14003c171], bl
jne 0x140006da5
lea rcx, [0x14003d4c0]
or rax, 0xffffffffffffffff
lea rdx, [rbp + 0xc70]
inc rax
cmp word [rdx + rax*2], bx
jne 0x140006947
movsxd r8, eax
lea rdx, [rbp + 0x230]
mov r9d, 0x5c
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
cmp ax, r9w
jne 0x14000697b
lea rdx, [rbp + 0x232]
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
sub rdx, rcx
mov r13d, 0x2f
cmp ax, r9w
jne 0x14000698e
movzx eax, r13w
mov word [rcx], ax
add rcx, r14
movzx eax, word [rcx + rdx]
test ax, ax
jne 0x140006984
mov word [rcx], bx
lea r14, [0x14003cc80]
mov r9, qword [r15]
lea r8, str._s.moz_callback
mov rcx, r14
mov edx, 0x104
call fcn.1400025a4
mov r13d, dword [rsp + 0x54]
cmp eax, 0x103
ja 0x140006d42
mov rcx, r14
call fcn.1400129a8
mov rcx, qword [r15]
mov r8d, edi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140006a67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140002608
mov r8, qword [r15]
lea rdx, str.NS_main:_failed_to_copy_callback_file__S_into_place_at__S
mov rcx, rax
mov r9, r14
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
mov eax, 0x25
cmp ebx, 5
lea ecx, [rax - 2]
cmove eax, ecx
mov ecx, eax
call fcn.140005048
cmp r12, 0xffffffffffffffff
je 0x140006a3c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x140006a5c
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
jne 0x140005e9b
mov rcx, qword [r15]
mov r8, r15
jmp 0x14000674f
mov r15, qword [rsp + 0x60]
mov ebx, edi
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0x40010000
mov dword [rsp + 0x28], eax
mov rcx, r15
mov dword [rsp + 0x20], 3
lea r8d, [rax + 6]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140006b79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call fcn.140002608
mov rcx, rax
mov dword [rsp + 0x20], r14d
mov r9, r15
lea rdx, str.NS_main:_callback_app_file_open_attempt__d_failed._File:__S._Last_error:__d
mov r8d, ebx
call fcn.14000a0ec
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, edi
cmp ebx, 0xa
jle 0x140006a6e
mov r15, qword [rsi + 0x30]
call fcn.140002608
mov r8, r15
mov rcx, rax
cmp r14d, 0x20
je 0x140006b68
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file:__S
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
mov ecx, 0x23
cmp r14d, 5
lea eax, [rcx + 2]
cmovne ecx, eax
call fcn.140005048
lea rcx, [0x14003cc80]
call fcn.1400129a8
cmp r12, 0xffffffffffffffff
je 0x140006b3f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x140006747
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
jne 0x140005e9b
jmp 0x140006747
lea rdx, str.NS_main:_callback_app_file_in_use__continuing_without_exclusive_access_for_executable_file:__S
call fcn.14000a0ec
mov r14, qword [rsp + 0x58]
xor ebx, ebx
cmp byte [0x14003c170], bl
lea rax, str.tobedeleted
lea r15, [0x14003d0a0]
jne 0x140006bcf
cmp byte [0x14003c171], bl
jne 0x140006bcf
lea r9, [0x14003ce90]
mov qword [rsp + 0x20], rax
lea r8, str._s__s
mov edx, 0x104
mov rcx, r15
call fcn.1400025a4
xor edx, edx
mov rcx, r15
call fcn.140012210
test eax, eax
je 0x140006bcf
mov rcx, r15
call fcn.1400122d0
lea rax, [0x140005654]
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x70]
lea rax, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x14000266c]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.140012e8c
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140006c2b
cmp byte [0x14003c170], bl
jne 0x140006c2b
cmp byte [0x14003c171], bl
jne 0x140006c2b
mov dl, dil
xor ecx, ecx
call fcn.1400022ac
mov rax, qword [rsp + 0x70]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13d, 6
jle 0x140006c6b
cmp byte [0x14003c171], bl
jne 0x140006c6b
cmp r14, 0xffffffffffffffff
je 0x140006c5f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14003cc80]
call fcn.1400129a8
cmp byte [0x14003c170], bl
jne 0x140006ce5
cmp byte [0x14003c171], bl
jne 0x140006ce5
mov rcx, r15
call fcn.1400129d0
test eax, eax
je 0x140006ce5
call fcn.140017324
mov rbx, rax
call fcn.140002608
mov r9d, dword [rbx]
lea rdi, str.tobedeleted
mov r8, rdi
lea rdx, str.NS_main:_unable_to_remove_directory:__S__err:__d
mov rcx, rax
call fcn.14000a0ec
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
call fcn.140002608
lea rdx, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
mov r8, rdi
mov rcx, rax
test ebx, ebx
jne 0x140006cde
lea rdx, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
call fcn.14000a0ec
xor ebx, ebx
call fcn.140002608
mov rcx, rax
call fcn.14000a098
lea r9, [rbp + 0x20]
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov ecx, r13d
call fcn.1400058d4
cmp byte [0x14003c180], bl
mov ecx, eax
mov eax, ebx
sete al
test ecx, ecx
cmovne eax, ecx
mov rcx, qword [rbp + 0xe80]
xor rcx, rsp
call fcn.14000d4c0
mov rbx, qword [rsp + 0xfe0]
add rsp, 0xf90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140002608
mov rcx, rax
lea rdx, str.NS_main:_callback_backup_path_truncated
call fcn.14000a0ec
call fcn.140002608
mov rcx, rax
call fcn.14000a098
mov ecx, 3
call fcn.140005048
cmp r12, 0xffffffffffffffff
je 0x140006d7c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140012210
test eax, eax
jne 0x140005c22
lea rcx, [rbp + 0x20]
call fcn.1400129a8
test eax, eax
je 0x140005c22
jmp 0x140005e9b
mov r14, qword [rsp + 0x58]
jmp 0x140006b7b