Function at 0x14001cce0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check os version
Create process on windows
Encrypt data using speck
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb78
movaps xmmword [rsp + 0xb60], xmm6
mov qword [rsp + 0x68], rdx
mov r13d, ecx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0xb58], rax
lea rcx, str.PATH
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14001cdba
mov ebp, eax
mov ecx, eax
add rcx, rcx
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
mov esi, ebp
dec esi
lea rcx, str.PATH
mov rdx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp esi, eax
jne 0x14001cdb1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
lea eax, [r15 - 1]
cmp eax, 0x7ffe
ja 0x14001cdb1
mov ecx, r15d
add rcx, rcx
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
mov rcx, rbx
mov rdx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001cda8
lea rcx, str.PATH
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
lea rcx, [0x14005a5fc]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, r13d
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
call fcn.140020550
test al, al
je 0x14001f5b1
lea rcx, str.Mozilla
mov rax, rcx
mov qword [rsp + 0x98], rcx
mov qword [0x140062cb0], rcx
lea r12, [rsi + 8]
mov rax, qword [rsi + 8]
test rax, rax
je 0x14001cf94
lea rcx, [rsi + 0x10]
mov edx, 0xff
mov r10, rax
mov r8, r12
movzx r9d, word [r10]
cmp r9d, 0x2d
je 0x14001ce42
cmp r9d, 0x2f
je 0x14001f59a
mov r10, qword [r8 + 8]
add r8, 8
add rcx, 8
test r10, r10
jne 0x14001ce18
jmp 0x14001cedc
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x6c
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x14001ce2c
cmp r11b, 0x2d
je 0x14001ce7e
lea edi, [r11 - 0x30]
cmp dil, 0xa
jb 0x14001ce7e
lea edi, [r11 - 0x61]
cmp dil, 0x19
ja 0x14001ce2c
movzx edi, si
cmp edi, edx
cmovae esi, edx
lea edi, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp dil, 0x1a
movzx edi, bl
cmovae edi, esi
cmp dil, r11b
jne 0x14001ce2c
lea r11, str.log_launcher_error
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x12
jne 0x14001ce5a
cmp word [r9 + 0x24], 0
jne 0x14001ce2c
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14001cebe
dec r13d
mov byte [0x140062cb8], 1
mov rax, qword [r12]
test rax, rax
je 0x14001cf94
mov ecx, 0xff
lea rdx, str.contentproc
mov r8, r12
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x14001cf79
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x63
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x14001cf83
cmp r10b, 0x2d
je 0x14001cf39
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001cf39
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001cf83
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14001cf83
mov r10b, byte [rax + rdx + 1]
inc rax
cmp rax, 0xb
jne 0x14001cf14
cmp word [r9 + 0x16], 0
je 0x14001ebaa
jmp 0x14001cf83
cmp r9d, 0x2f
je 0x14001f694
mov rax, qword [r8 + 8]
add r8, 8
test rax, rax
jne 0x14001cef4
lea rcx, [rsp + 0x1d0]
call fcn.140020b90
pxor xmm0, xmm0
lea rbx, [rsp + 0x700]
movdqa xmmword [rbx + 0x20], xmm0
movdqa xmmword [rbx + 0x10], xmm0
movdqa xmmword [rbx], xmm0
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rbx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
mov ebp, eax
mov eax, dword [rbx + 0x28]
lea r15, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
test ebp, ebp
cmovns r15, rax
js 0x14001f7be
mov ecx, 0x1000
xor edx, edx
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14001f7ee
lea r15, [rsp + 0x720]
mov dword [r15 - 0x20], 0
mov byte [r15 - 8], 0
lea r9, [rsp + 0x2c0]
mov dword [r9], 0x209
mov rcx, r14
mov edx, 1
mov r8, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rdi, r12
test eax, eax
je 0x14001f827
cmp byte [rsp + 0x718], 0
jne 0x14001f860
mov r8d, dword [rsp + 0x700]
lea r12, [rsp + 0x130]
mov rcx, r12
mov rdx, r15
call fcn.1400211c0
cmp byte [r12 + 0x18], 0
jne 0x14001f87f
lea r15, [rsp + 0x2e0]
mov dword [r15 - 0x20], 1
mov byte [r15 - 8], 0
xor ecx, ecx
mov rdx, r15
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x14001d0bd
test eax, eax
jne 0x14001f1eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r12d, 0x29
mov sil, 1
lea r15, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, r14
inc rax
cmp rax, 2
jb 0x14001d0f6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x14001f7cd
test r15b, r15b
sete r14b
lea rcx, [0x1400582e4]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
mov r15, rdi
jne 0x14001f8ff
mov rax, qword [r15]
test rax, rax
je 0x14001d38c
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
mov edx, 0xff
mov r9, rax
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x14001d161
cmp r8d, 0x2f
je 0x14001f6a0
mov r9, qword [rcx]
add rcx, 8
test r9, r9
jne 0x14001d13c
jmp 0x14001d38c
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
movzx r9d, word [r8]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
cmp r10d, edx
cmovae r9d, edx
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6c
jne 0x14001d150
movzx r9d, word [r8 + 2]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x61
jne 0x14001d150
movzx r9d, word [r8 + 4]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x75
jne 0x14001d150
movzx r9d, word [r8 + 6]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6e
jne 0x14001d150
movzx r9d, word [r8 + 8]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x63
jne 0x14001d150
movzx r9d, word [r8 + 0xa]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x68
jne 0x14001d150
movzx r9d, word [r8 + 0xc]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x65
jne 0x14001d150
movzx r9d, word [r8 + 0xe]
test r9w, r9w
je 0x14001d150
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x72
jne 0x14001d150
cmp word [r8 + 0x10], 0
jne 0x14001d150
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14001d374
dec r13d
mov rax, qword [r15]
jmp 0x14001d39b
mov bpl, 1
mov sil, 1
test r14b, r14b
je 0x14001d449
mov sil, 1
test rax, rax
je 0x14001d447
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
mov edx, 0xff
mov r8, r15
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x14001d428
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x66
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x14001d432
cmp r10b, 0x2d
je 0x14001d3fd
lea edi, [r10 - 0x30]
cmp dil, 0xa
jb 0x14001d3fd
lea edi, [r10 - 0x61]
cmp dil, 0x19
ja 0x14001d432
movzx edi, r11w
cmp edi, edx
cmovae r11d, edx
lea edi, [r11 - 0x41]
mov ebp, r11d
or bpl, 0x20
cmp dil, 0x1a
movzx edi, bpl
cmovae edi, r11d
cmp dil, r10b
jne 0x14001d432
jmp 0x14001f91c
cmp r9d, 0x2f
je 0x14001f95d
mov rax, qword [r8 + 8]
add r8, 8
add rcx, 8
test rax, rax
jne 0x14001d3b8
xor ebp, ebp
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r13
mov r12d, 1
cmp qword [rsp + 0x1f0], 0
je 0x14001f271
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14001f5d3
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14001f5d3
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14001f5d3
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14001f5d3
cmp dword [rax + rcx + 0x50], 0x148
jb 0x14001f5d3
mov r13d, dword [rax + rcx + 8]
lea r14, [rsp + 0x218]
cmp qword [r14 + 0x10], 0
jne 0x14001d548
mov r15, qword [rsp + 0x208]
cmp qword [rsp + 0x210], 8
jb 0x14001d4ea
mov r8, qword [rsp + 0x1f8]
jmp 0x14001d4f2
lea r8, [rsp + 0x1f8]
mov rax, qword [rsp + 0x230]
cmp rax, r15
jae 0x14001fa02
mov rcx, r14
mov rdx, r15
call fcn.14000cbf0
mov rax, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x230]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jae 0x14001fa39
lea r8, str.Image
mov edx, 6
mov r9d, 6
mov rcx, r14
call fcn.14000d0a0
mov dword [rsp + 0x2c0], 4
mov rcx, qword [rsp + 0x1f0]
cmp qword [rsp + 0x230], 8
jb 0x14001d56e
mov r14, qword [rsp + 0x218]
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x130]
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001f463
cmp dword [rsp + 0x130], 4
jne 0x14001fb4b
cmp dword [rsp + 0x700], r13d
jne 0x14001f46c
test bpl, bpl
je 0x14001d61a
lea r14, [rsp + 0x700]
mov qword [r14], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r14]
mov qword [rsp + 0x1e0], rax
mov byte [rsp + 0x1e8], 1
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x130], 1
mov r13, qword [rsp + 0x60]
mov edi, dword [rsp + 0x130]
mov sil, 1
test edi, edi
jne 0x14001d713
mov bpl, 1
jmp 0x14001d741
cmp r12d, 1
mov r13, qword [rsp + 0x60]
jne 0x14001f51a
lea r14, [rsp + 0x1d0]
mov rcx, r14
call fcn.1400210c0
mov rdx, qword [r14 + 0x20]
lea r14, [rsp + 0x700]
mov rcx, r14
mov r8, rax
call fcn.140020390
cmp byte [r14 + 0x10], 0
jne 0x14001fdac
lea r14, [rsp + 0x1d0]
mov rcx, r14
call fcn.140020fe0
mov rdx, qword [r14 + 0x20]
lea r14, [rsp + 0x2c0]
mov rcx, r14
mov r8, rax
call fcn.140020390
cmp byte [r14 + 0x10], 0
jne 0x1400200e8
mov dl, byte [rsp + 0x708]
test dl, dl
setne r8b
mov cl, byte [rsp + 0x2c8]
test cl, cl
setne al
xor al, r8b
test dl, dl
je 0x14001d6c4
test cl, cl
je 0x14001d6c4
mov rax, qword [rsp + 0x700]
cmp rax, qword [rsp + 0x2c0]
setae al
and sil, al
movzx edi, sil
cmp dil, 1
je 0x1400200f6
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [r14]
lea rax, [rsp + 0x1d8]
mov qword [rax - 8], rcx
mov byte [rax], 1
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x130], edi
jmp 0x14001d607
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001fde3
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
jne 0x14001fdf7
xor ebp, ebp
cmp qword [rsp + 0x1f0], 0
je 0x14001f2fa
lea r14, [rsp + 0x298]
cmp qword [r14 + 0x10], 0
jne 0x14001d7da
mov r15, qword [rsp + 0x208]
cmp qword [rsp + 0x210], 8
jb 0x14001d77c
mov r8, qword [rsp + 0x1f8]
jmp 0x14001d784
lea r8, [rsp + 0x1f8]
mov rax, qword [rsp + 0x2b0]
cmp rax, r15
jae 0x14001fa78
mov rcx, r14
mov rdx, r15
call fcn.14000cbf0
mov rax, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b0]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xa
jae 0x14001fab4
lea r8, str.Blocklist
mov edx, 0xa
mov r9d, 0xa
mov rcx, r14
call fcn.14000d0a0
mov rcx, qword [rsp + 0x1f0]
cmp qword [rsp + 0x2b0], 8
mov r8, r14
jb 0x14001d7f8
mov r8, qword [rsp + 0x298]
mov qword [rsp + 0x30], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14001f389
mov r12d, dword [rsp + 0x700]
and r12d, 0xfffffffe
mov rcx, r12
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x1f0]
cmp qword [rsp + 0x2b0], 8
jb 0x14001d85d
mov r14, qword [rsp + 0x298]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, r14
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
mov r12, qword [rsp + 0x58]
jne 0x14001fba0
xor eax, eax
mov qword [rsp + 0x700], rax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x718], 7
mov word [rsp + 0x700], 0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rbx, rax
lea rcx, [rsp + 0x700]
cmp rax, 7
jbe 0x14001fbfd
mov rdx, rbx
mov r8, r15
call fcn.14000cbf0
mov rdi, qword [rsp + 0x700]
movups xmm0, xmmword [rsp + 0x708]
movaps xmmword [rsp + 0x80], xmm0
mov rbx, qword [rsp + 0x718]
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
mov qword [rsp + 0x1a0], rdi
movdqa xmm0, xmmword [rsp + 0x80]
mov qword [rsp + 0x88], 0
movdqu xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rbx
mov al, 1
mov byte [rsp + 0x1c0], al
test sil, bpl
je 0x14001e1f7
mov eax, dword [0x140062d4c]
cmp eax, 0x3838
ja 0x14001da07
mov eax, dword [0x14006204c]
cmp eax, 0x383a
jb 0x14001da79
lea rbx, [rsp + 0x708]
mov r8d, 0x114
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rbx - 8], rax
mov dword [rbx + 4], 0x3839
mov rsi, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 4
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rsi
lea rcx, [rsp + 0x700]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14001fc1e
mov eax, 0x3839
xchg dword [0x140062d4c], eax
mov eax, dword [0x140062cd0]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14001da4e
lea rcx, [0x140062cd0]
call fcn.14002e938
cmp dword [0x140062cd0], 0xffffffff
jne 0x14001da4e
call fcn.140031a70
lea rcx, [0x140062cd0]
call fcn.14002e8d8
mov rax, qword [0x140062cc8]
test rax, rax
je 0x14001da79
lea rdx, [rsp + 0x700]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [0x140068010]
mov ecx, 0x403
call fcn.140022ca0
call fcn.140020a80
cmp qword [rsp + 0x68], 0
je 0x14001f969
lea rbx, [rsp + 0x700]
mov rcx, rbx
call fcn.140020ce0
mov rax, qword [rbx]
test rax, rax
je 0x14001f969
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x14001e0af
lea rax, [rcx + 0x10]
mov ecx, 0xff
lea rdx, str.wait_for_browser
mov r10, rbx
mov r8, r12
movzx r9d, word [r10]
cmp r9d, 0x2d
jne 0x14001db5e
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x77
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x14001db68
cmp r11b, 0x2d
je 0x14001db21
lea edi, [r11 - 0x30]
cmp dil, 0xa
jb 0x14001db21
lea edi, [r11 - 0x61]
cmp dil, 0x19
ja 0x14001db68
movzx edi, si
cmp edi, ecx
cmovae esi, ecx
lea edi, [rsi - 0x41]
mov ebp, esi
or bpl, 0x20
cmp dil, 0x1a
movzx edi, bpl
cmovae edi, esi
cmp dil, r11b
jne 0x14001db68
mov r11b, byte [r10 + rdx + 1]
inc r10
cmp r10, 0x10
jne 0x14001dafd
cmp word [r9 + 0x20], 0
je 0x14001e0ef
jmp 0x14001db68
cmp r9d, 0x2f
je 0x14001fc2e
mov r10, qword [r8 + 8]
add r8, 8
add rax, 8
test r10, r10
jne 0x14001dadb
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov ecx, 0xff
mov r8, rbx
movzx edx, word [r8]
cmp edx, 0x2f
je 0x14001dbb4
cmp edx, 0x2d
jne 0x14001dd47
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x14001dbbb
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x14001dd47
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001dd47
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x72
jne 0x14001dd47
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x69
jne 0x14001dd47
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x14001dd47
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6e
jne 0x14001dd47
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
je 0x1400201aa
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001db8e
mov eax, 0xff
lea rcx, str.backgroundtask
mov r9, rbx
mov rdx, qword [rsp + 0x58]
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x14001dd93
cmp r8d, 0x2d
jne 0x14001de05
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x14001dd9a
add r9, 2
mov r8, r9
mov r10b, 0x62
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001de05
cmp r10b, 0x2d
je 0x14001ddc5
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001ddc5
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001de05
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov edi, r11d
or dil, 0x20
cmp sil, 0x1a
movzx esi, dil
cmovae esi, r11d
cmp sil, r10b
jne 0x14001de05
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0xe
jne 0x14001dda0
cmp word [r8 + 0x1c], 0
je 0x1400202b4
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
jne 0x14001dd6b
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov ecx, 0xff
mov r8, rbx
movzx edx, word [r8]
cmp edx, 0x2f
je 0x14001de4d
cmp edx, 0x2d
jne 0x14001dfe0
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x14001de54
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x68
jne 0x14001dfe0
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001dfe0
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001dfe0
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x14001dfe0
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6c
jne 0x14001dfe0
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001dfe0
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
je 0x14002026e
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001de27
mov eax, 0xff
lea rcx, str.remote_debugging_port
mov r9, rbx
mov rdx, qword [rsp + 0x58]
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x14001e02c
cmp r8d, 0x2d
jne 0x14001e09e
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x14001e033
add r9, 2
mov r8, r9
mov r10b, 0x72
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001e09e
cmp r10b, 0x2d
je 0x14001e05e
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001e05e
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001e09e
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov edi, r11d
or dil, 0x20
cmp sil, 0x1a
movzx esi, dil
cmovae esi, r11d
cmp sil, r10b
jne 0x14001e09e
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0x15
jne 0x14001e039
cmp word [r8 + 0x2a], 0
je 0x1400202b4
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
jne 0x14001e004
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001e0ca
cmp byte [rax], 0
jne 0x1400202b4
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor r14d, r14d
test rax, rax
jne 0x140020065
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14001e10c
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001e0ef
dec r13d
mov rbx, qword [r12]
mov r14d, 1
test rbx, rbx
je 0x14001e311
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov ecx, 0xff
mov r9, rbx
mov rdx, r12
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x14001e153
cmp r8d, 0x2f
je 0x14001f99b
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
jne 0x14001e129
jmp 0x14001e223
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
mov r10b, 0x6e
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001e13d
cmp r10b, 0x2d
je 0x14001e190
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001e190
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001e13d
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov edi, r11d
or dil, 0x20
cmp sil, 0x1a
movzx esi, dil
cmovae esi, r11d
cmp sil, r10b
jne 0x14001e13d
lea r10, str.no_deelevate
mov r10b, byte [r9 + r10 + 1]
inc r9
cmp r9, 0xc
jne 0x14001e16b
cmp word [r8 + 0x18], 0
jne 0x14001e13d
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001e1d7
dec r13d
mov r12, qword [rsp + 0x58]
mov rbx, qword [r12]
xor eax, eax
jmp 0x14001e225
lea rcx, [rsp + 0x1d0]
lea rbx, [rsp + 0x700]
mov rdx, rbx
call fcn.140020dd0
cmp byte [rbx + 0x10], 0
jne 0x14001fc3a
xor esi, esi
xor r12d, r12d
jmp 0x14001eb58
mov al, 1
test rbx, rbx
je 0x14001e309
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
mov edx, 0xff
mov r8, r12
movzx r9d, word [rbx]
cmp r9d, 0x2d
je 0x14001e269
cmp r9d, 0x2f
je 0x14001f9a7
mov rbx, qword [r8 + 8]
add r8, 8
add rcx, 8
test rbx, rbx
jne 0x14001e23f
jmp 0x14001e309
lea r9, [rbx + 2]
lea r10, [rbx + 4]
cmp word [rbx + 2], 0x2d
cmove r9, r10
mov r11b, 0x61
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x14001e253
cmp r11b, 0x2d
je 0x14001e2a4
lea edi, [r11 - 0x30]
cmp dil, 0xa
jb 0x14001e2a4
lea edi, [r11 - 0x61]
cmp dil, 0x19
ja 0x14001e253
movzx edi, si
cmp edi, edx
cmovae esi, edx
lea edi, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp dil, 0x1a
movzx edi, bl
cmovae edi, esi
cmp dil, r11b
jne 0x14001e253
lea r11, str.attempting_deelevation
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x16
jne 0x14001e280
cmp word [r9 + 0x2c], 0
jne 0x14001e253
mov rdx, qword [rcx]
mov qword [rcx - 8], rdx
add rcx, 8
test rdx, rdx
jne 0x14001e2e4
dec r13d
lea ecx, [r14 + 2]
test al, al
cmovne ecx, r14d
or ecx, 4
mov r14d, ecx
jmp 0x14001e311
test al, al
jne 0x14001e311
or r14d, 2
lea r9, [rsp + 0xc8]
mov qword [r9], 0
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
lea rbx, [rsp + 0x188]
mov rcx, rbx
mov r8d, r14d
call fcn.140032bd0
cmp byte [rbx + 0x10], 0
jne 0x14001fc4e
mov r15, qword [rsp + 0xc8]
test r15, r15
jne 0x14001fc69
mov eax, dword [rsp + 0x188]
test eax, eax
jne 0x14001fc73
xor eax, eax
cmp r14d, 4
setae al
lea edi, [rax + rax]
inc edi
lea rcx, [rsp + 0x1d0]
lea rbx, [rsp + 0x170]
mov rdx, rbx
call fcn.140020dd0
cmp byte [rbx + 0x10], 0
jne 0x14001fcd2
mov qword [rsp + 0x20], 0
lea rbx, [rsp + 0xc0]
xor r12d, r12d
mov rcx, rbx
mov edx, r13d
mov r8, qword [rsp + 0x68]
xor r9d, r9d
call fcn.140023400
mov rsi, qword [rbx]
test rsi, rsi
je 0x14001fceb
mov rax, qword [rsp + 0x58]
mov r8, qword [rax]
test r8, r8
je 0x14001e670
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov ecx, 0xff
movzx edx, word [r8]
cmp edx, 0x2d
je 0x14001e40a
cmp edx, 0x2f
je 0x14001f9d0
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001e3e7
jmp 0x14001e670
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x14001e3f9
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001e3f9
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x66
jne 0x14001e3f9
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001e3f9
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x2d
jne 0x14001e3f9
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x14001e3f9
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x14001e3f9
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x14001e3f9
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x14001e3f9
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001e3f9
cmp word [rdx + 0x12], 0
jne 0x14001e3f9
lea rcx, str.DisableSafeMode
call fcn.1400229b0
mov ebx, eax
xor bl, 1
jmp 0x14001e672
xor ebx, ebx
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x90], edi
jne 0x14001fe36
mov dword [rsp + 0x7c], ebx
mov rdi, r15
xor eax, eax
lea r12, [rsp + 0x138]
mov qword [r12 - 8], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 3
lea rcx, [rsp + 0x150]
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
lea rcx, [rsp + 0x130]
call fcn.140031cd0
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov rbx, rax
mov ecx, 0xfffffff5
call rsi
mov r13, rax
mov ecx, 0xfffffff4
call rsi
mov rbp, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001e752
mov rcx, rbx
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001e752
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x14001ffc8
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], rbx
inc qword [rsp + 0x140]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001e7a5
mov rcx, r13
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001e7a5
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x14001ffe5
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], r13
inc qword [rsp + 0x140]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001e7f8
mov rcx, rbp
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001e7f8
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x140020002
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], rbp
inc qword [rsp + 0x140]
lea rcx, [rsp + 0x130]
lea r15, [rsp + 0x118]
lea r12, [rsp + 0x700]
mov rdx, r15
mov r8, r12
call fcn.140032980
cmp byte [r15 + 0x10], 0
jne 0x14001fe50
xor esi, esi
cmp byte [rsp + 0x118], 0
je 0x14001fd1d
mov r15d, 0x80404
cmp qword [rsp + 0x140], 0
je 0x14001e86c
or byte [rsp + 0x73d], 1
mov qword [rsp + 0x750], rbx
mov qword [rsp + 0x758], r13
mov qword [rsp + 0x760], rbp
mov esi, 1
xorps xmm6, xmm6
lea rbx, [rsp + 0x2c0]
movaps xmmword [rbx], xmm6
movaps xmmword [rbx + 0x50], xmm6
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
mov qword [rbx + 0x60], 0
mov dword [rbx], 0x68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rbx + 0x3d], 8
je 0x14001e8bc
mov rax, qword [rsp + 0x2d8]
test rax, rax
jne 0x14002010b
lea rax, [rsp + 0xa0]
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
test rdi, rdi
jne 0x14001fe76
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
mov rcx, rdx
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov rsi, qword [rsp + 0x58]
je 0x14001fd28
mov r13, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
test r14b, 1
je 0x14001fd75
lea rbx, [rsp + 0xb40]
mov rcx, rbx
mov rdx, r13
call fcn.140031b90
mov rbx, qword [rbx]
mov rdx, qword [rsi]
test rdx, rdx
je 0x14001ea08
mov eax, 0xff
movzx ecx, word [rdx]
cmp ecx, 0x2d
je 0x14001e982
cmp ecx, 0x2f
je 0x14001f9dc
mov rdx, qword [rsi + 8]
add rsi, 8
test rdx, rdx
jne 0x14001e95f
jmp 0x14001ea08
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
mov r8b, 0x64
xor edx, edx
movzx r9d, word [rcx + rdx*2]
test r9w, r9w
je 0x14001e970
cmp r8b, 0x2d
je 0x14001e9bd
lea r10d, [r8 - 0x30]
cmp r10b, 0xa
jb 0x14001e9bd
lea r10d, [r8 - 0x61]
cmp r10b, 0x19
ja 0x14001e970
movzx r10d, r9w
cmp r10d, eax
cmovae r9d, eax
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, r8b
jne 0x14001e970
lea r8, str.disabledynamicblocklist
mov r8b, byte [rdx + r8 + 1]
inc rdx
cmp rdx, 0x17
jne 0x14001e998
cmp word [rcx + 0x2e], 0
jne 0x14001e970
mov al, 1
jmp 0x14001ea0a
xor eax, eax
cmp byte [rsp + 0x7c], 0
setne sil
or sil, al
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
mov byte [rsp + 0xf0], 0
cmp byte [rsp + 0x1c0], 0
je 0x14001ea53
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x1a0]
call fcn.140020470
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], sil
lea r15, [rsp + 0x100]
mov rcx, r15
mov r8, r13
mov r9d, dword [rsp + 0x90]
call fcn.140031f90
cmp byte [r15 + 0x10], 0
jne 0x14001feb2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14001febe
test r14b, 1
je 0x14001ff11
mov rcx, r13
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001f9e8
lea rdx, [rsp + 0xb40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001f9e8
mov r12d, dword [rsp + 0xb40]
mov sil, 1
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14001eafc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14001eb0f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
mov rbx, qword [rsp + 0x70]
jb 0x14001eb27
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, rdi
mov r13, qword [rsp + 0x60]
lea rcx, [rsp + 0x130]
call fcn.140031a20
test rbx, rbx
je 0x14001eb4a
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
lea rax, [r15 + 1]
cmp rax, 2
jae 0x14001fd7c
cmp byte [rsp + 0x1c0], 0
je 0x14001eb94
mov rax, qword [rsp + 0x1b8]
cmp rax, 8
jb 0x14001eb94
mov rcx, qword [rsp + 0x1a0]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
jne 0x14001f9b3
call qword [sym.imp.mozglue.dll_free]
lea rcx, [rsp + 0x1d0]
call fcn.140022180
test sil, sil
jne 0x14001efb3
lea eax, [r13 + 1]
shl rax, 3
cmp r13d, 0xffffffff
mov rsi, 0xffffffffffffffff
cmovge rsi, rax
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rsp + 0x58], rax
movsxd rax, r13d
mov qword [rsp + 0x70], rax
test r13d, r13d
jle 0x14001f566
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x60], r13
xor ebp, ebp
xorps xmm6, xmm6
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
mov r15, qword [rbx + rbp*8]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r12, rax
lea rdi, [rax + rax*2]
lea rcx, [rax + rax*2]
add rcx, 2
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
inc edi
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, r12d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cdqe
mov byte [r13 + rax], 0
mov qword [rsi + rbp*8], r13
inc rbp
cmp r14, rbp
jne 0x14001ec01
mov qword [rsi + r14*8], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
test r14d, r14d
jle 0x14001f619
mov r13, qword [rsp + 0x60]
mov r8d, r13d
shl r8, 3
mov rcx, rdi
mov rdx, rsi
call sub.ntdll.dll_memcpy
lea rcx, [0x140058344]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
mov r14, qword [rax]
lea rcx, [rsp + 0x2c0]
mov dl, 1
call qword [sym.imp.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_init_void____ptr64_]
call qword [sym.imp.mozglue.dll_public:_static_class_mozilla::baseprofiler::ProfilingStack____ptr64___cdecl_mozilla::baseprofiler::AutoProfilerLabel::GetProfilingStack_void_]
mov qword [rsp + 0x130], rax
test rax, rax
je 0x14001ed2b
mov r15, rax
mov ebx, dword [rax + 0x10]
cmp ebx, dword [rax]
jb 0x14001ecf0
mov rcx, r15
call qword [sym.imp.mozglue.dll_private:_void___cdecl_mozilla::baseprofiler::ProfilingStack::ensureCapacitySlow_void____ptr64]
mov rax, qword [r15 + 8]
lea rcx, [rbx + rbx*4]
lea rdx, str.nsBrowserApp_main
mov qword [rax + rcx*8], rdx
mov qword [rax + rcx*8 + 8], 0
lea rdx, [rsp + 0x130]
mov qword [rax + rcx*8 + 0x10], rdx
mov dword [rax + rcx*8 + 0x24], 0x10001
mov eax, dword [r15 + 0x10]
inc eax
mov dword [r15 + 0x10], eax
cmp r13d, 2
jl 0x14001f5bc
mov rax, qword [rsp + 0x58]
lea r15, [rax + 8]
mov rax, qword [rax + 8]
movzx ecx, byte [rax]
cmp ecx, 0x2d
jne 0x14001efe2
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001efeb
lea r12d, [r13 - 1]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsi + r12*8]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::SetGeckoProcessType_char_const____ptr64_]
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov rdx, qword [rsi + 8]
mov r14d, r13d
test rdx, rdx
je 0x14001ee5e
mov rax, qword [rsp + 0x58]
add rax, 0x10
movzx ecx, byte [rdx]
cmp ecx, 0x2d
je 0x14001edcc
cmp ecx, 0x2f
je 0x14001f5a6
mov rdx, qword [r15 + 8]
add r15, 8
add rax, 8
test rdx, rdx
jne 0x14001eda5
jmp 0x14001ee5b
lea rcx, [rdx + 1]
lea r8, [rdx + 2]
cmp byte [rdx + 1], 0x2d
cmove rcx, r8
mov r8b, 0x77
xor edx, edx
mov r9b, byte [rcx + rdx]
test r9b, r9b
je 0x14001edb6
cmp r8b, 0x2d
je 0x14001ee04
lea r10d, [r8 - 0x30]
cmp r10b, 0xa
jb 0x14001ee04
lea r10d, [r8 - 0x61]
cmp r10b, 0x19
ja 0x14001edb6
lea r10d, [r9 - 0x41]
movzx r11d, r9b
or r9b, 0x20
cmp r10b, 0x1a
movzx r9d, r9b
cmovae r9d, r11d
cmp r9b, r8b
jne 0x14001edb6
lea r8, str.win32klockeddown
mov r8b, byte [rdx + r8 + 1]
inc rdx
cmp rdx, 0x10
jne 0x14001ede1
cmp byte [rcx + 0x10], 0
jne 0x14001edb6
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001ee40
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::SetWin32kLockedDownInPolicy_void_]
mov r14d, r12d
jmp 0x14001ee5e
mov r14d, r13d
mov eax, dword [0x140062da0]
mov ecx, eax
or ecx, 1
mov rdx, qword [sym.imp.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov edx, dword [rdx]
add edx, 0xfffffffc
cmp edx, 7
ja case.0x14001ee88.6
lea r8, [0x140020300]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x14001f623
call qword [sym.imp.mozglue.dll_enum_mozilla::WindowsDpiInitializationResult___cdecl_mozilla::WindowsDpiInitialization_void_]
xor ecx, ecx
call fcn.140021480
test eax, eax
js 0x14001f63d
mov r15, qword [0x140062a80]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x700], xmm0
mov qword [rsp + 0x710], 0
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x14001f648
dec r14d
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsi + r14*8]
mov rax, qword [r15]
mov rax, qword [rax + 0x50]
mov rcx, r15
call qword [0x140068010]
mov rax, qword [r15]
mov rax, qword [rax + 0x48]
mov rcx, r15
call qword [0x140068010]
cmp eax, 9
je 0x14001f672
mov rax, qword [r15]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x700]
mov rcx, r15
mov edx, r14d
mov r8, rsi
call qword [0x140068010]
mov r12d, eax
shr r12d, 0x1f
mov rcx, qword [0x140062a80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140068010]
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::UnregisterRuntimeExceptionModule_void_]
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x14001ef6a
mov ecx, dword [rax + 0x10]
dec ecx
mov dword [rax + 0x10], ecx
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_shutdown_void_]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.mozglue.dll_free]
test r13d, r13d
mov rax, qword [rsp + 0x70]
je 0x14001efaa
dec rax
mov rbx, qword [sym.imp.mozglue.dll_free]
mov rsi, rax
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je 0x14001ef9d
call rbx
mov rcx, rsi
mov rax, rsi
dec rax
test ecx, ecx
jne 0x14001ef8f
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
mov rcx, qword [rsp + 0xb58]
xor rcx, rsp
call fcn.14002fa70
mov eax, r12d
movaps xmm6, xmmword [rsp + 0xb60]
add rsp, 0xb78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp ecx, 0x2f
je 0x14001f722
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov ecx, dword [0x140062da0]
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
mov rax, qword [r15]
movzx ecx, byte [rax]
cmp ecx, 0x2d
jne 0x14001f1c8
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
lea rdx, str.silentmode
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14001f7a0
call qword [sym.imp.mozglue.dll_enum_mozilla::WindowsDpiInitializationResult___cdecl_mozilla::WindowsDpiInitialization_void_]
call fcn.140020320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, r13d
mov r8, qword [rsp + 0x58]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::CreateAndStorePreXULSkeletonUI_struct_HINSTANCE______ptr64__int__char____ptr64____ptr64_]
mov ecx, 1
call fcn.140021480
test eax, eax
js 0x14001f63d
mov rcx, qword [0x140062a80]
movdqu xmm0, xmmword [rsp + 0x2c0]
lea r8, [rsp + 0x1d0]
movdqa xmmword [r8], xmm0
mov rax, qword [rsp + 0x2d0]
mov qword [r8 + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov edx, 1
call qword [0x140068010]
mov rcx, qword [0x140062a80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [0x140068010]
lea rcx, str.XUL_APP_FILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r15, rax
test rax, rax
jne 0x14001f6ac
cmp r13d, 1
jle 0x14001f6d7
mov r12, qword [rsp + 0x58]
mov rcx, qword [r12 + 8]
lea rdx, [0x1400573cd]
call fcn.140031980
test al, al
jne 0x14001f6e4
mov rcx, qword [r12 + 8]
lea rdx, str.xpcshell
call fcn.140031980
mov ebp, r13d
test al, al
jne 0x14001f72d
test r15, r15
jne 0x14001f77f
lea r15, [0x140057157]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x708], rax
mov qword [rsp + 0x710], r15
call fcn.1400319c0
test rax, rax
je 0x14001f70b
mov qword [rsp + 0x700], rax
mov ecx, ebp
mov rdx, r12
call fcn.140022400
test al, al
je 0x14001f5b1
mov rcx, qword [0x140062a80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
lea r9, [rsp + 0x700]
mov edx, ebp
mov r8, r12
call qword [0x140068010]
mov r12d, eax
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::CleanupProcessRuntime_void_]
mov rcx, qword [0x140062a80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140068010]
mov rcx, qword [0x140062a80]
mov qword [0x140062a80], 0
test rcx, rcx
je 0x14001ef4f
mov rax, qword [rcx]
mov rax, qword [rax + 8]
jmp 0x14001ef49
cmp ecx, 0x2f
jne 0x14001f031
inc rax
mov rcx, rax
jmp 0x14001f01c
or eax, 9
jmp 0x14001f1e4
or eax, 0x11
mov ecx, eax
jmp case.0x14001ee88.6
cmp byte [rsp + 0x2d8], 0
jne 0x14002001f
mov r8d, dword [rsp + 0x2c0]
lea r12, [rsp + 0x1a0]
mov rcx, r12
mov rdx, r15
call fcn.1400211c0
cmp byte [r12 + 0x18], 0
jne 0x14002003e
cmp byte [rsp + 0x148], 0
jne 0x14002005d
movdqu xmm0, xmmword [rsp + 0x1a0]
movq xmm1, qword [rsp + 0x140]
movq xmm2, qword [rsp + 0x1b0]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x130]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor r15d, r15d
cmp eax, 0xffff
sete r15b
xor esi, esi
jmp 0x14001d0e1
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002007d
mov rdi, qword [rsp + 0x700]
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
jne 0x1400200ac
mov qword [rsp + 0x1f0], rdi
mov eax, dword [rsp + 0x2c0]
cmp eax, 2
jne 0x14001f589
mov r12d, 1
jmp 0x14001d468
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400200b7
mov rdi, qword [rsp + 0x700]
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
jne 0x1400200dd
mov qword [rsp + 0x1f0], rdi
mov eax, dword [rsp + 0x2c0]
dec eax
cmp eax, 1
jbe 0x14001d750
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x1400200ca
cmp eax, 2
jne 0x140020120
lea rcx, [rsp + 0x1d0]
lea rbx, [rsp + 0x700]
mov rdx, rbx
call fcn.140023f80
cmp byte [rbx + 0x20], 0
mov r12, qword [rsp + 0x58]
jne 0x14001fd8a
lea rcx, [rsp + 0x1d0]
call fcn.140032570
mov ecx, dword [rsp + 0x710]
cmp qword [rsp + 0x718], 8
jb 0x14001f3e0
mov rbx, qword [rsp + 0x700]
lea edx, [rcx + rcx]
add edx, 2
cmp qword [rax + 0x18], 8
jb 0x14001f3f0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1f0]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov rdx, rax
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140020138
cmp byte [rsp + 0x720], 0
jne 0x14001fd8a
lea rcx, [rsp + 0x700]
mov rdi, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x80], xmm0
mov rbx, qword [rcx + 0x18]
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
call fcn.140031c60
jmp 0x14001d908
cmp eax, 2
jne 0x14002015d
lea rcx, [rsp + 0x1d0]
lea r14, [rsp + 0x700]
mov rdx, r14
call fcn.140032380
cmp byte [r14 + 0x10], 0
jne 0x14001fdac
lea rcx, [rsp + 0x1d0]
call fcn.1400322a0
mov dword [rsp + 0x2c0], r13d
cmp qword [rax + 0x18], 8
jb 0x14001f4ae
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1f0]
lea rdx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 4
mov rdx, rax
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001d5b8
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x140], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rax
mov dword [rsp + 0x138], 0x79
jmp 0x14001fb94
test r12d, r12d
jne 0x140020175
lea r14, [rsp + 0x700]
mov qword [r14], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r14]
mov qword [rsp + 0x1d0], rax
mov byte [rsp + 0x1d8], 1
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x130], 0
jmp 0x14001d600
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rax + rcx*8], 0
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
jmp 0x14001ec96
cmp eax, 1
jne 0x14002019b
xor r12d, r12d
jmp 0x14001d468
add r10, 2
mov r9, r10
jmp 0x14001ce54
inc rdx
mov rcx, rdx
jmp 0x14001eddc
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov ecx, dword [0x140062da0]
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
jmp 0x14001f031
mov byte [rsp + 0x140], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rax
movabs rax, 0x800700c100000025
mov qword [rsp + 0x138], rax
xor esi, esi
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.140034fc0
xor ebp, ebp
mov r13, qword [rsp + 0x60]
jmp 0x14001d741
mov r13, qword [rsp + 0x60]
jmp 0x14001ec96
call fcn.1400517c0
test rax, rax
jne 0x14001ee9e
lea rcx, str.Failed_to_initialize_the_sandbox_target_services.
call fcn.140033cf0
mov r12d, 0xff
jmp 0x14001ef4f
call fcn.1400517c0
mov qword [rsp + 0x700], rax
test rax, rax
je 0x14001f795
lea rax, [0x14003aad0]
mov qword [rsp + 0x708], rax
jmp 0x14001eee1
call fcn.1400319c0
mov qword [rsp + 0x710], rax
jmp 0x14001ef16
or eax, 0x21
jmp 0x14001f1e4
or eax, 5
jmp 0x14001f1e4
add rax, 2
mov r9, rax
jmp 0x14001cf0f
add r9, 2
mov r8, r9
jmp 0x14001d173
mov al, byte [r15]
cmp r13d, 2
jl 0x14001f6bd
test al, al
je 0x14001f0d9
cmp r13d, 1
mov r12, qword [rsp + 0x58]
jg 0x14001f0f7
mov rcx, r13
mov ebp, r13d
jmp 0x14001f785
mov ebp, r13d
mov r12, qword [rsp + 0x58]
jmp 0x14001f11c
mov rbx, r13
cmp r13d, 2
jne 0x14001faf7
lea rcx, str.Incorrect_number_of_arguments_passed_to__app
call fcn.140033cf0
mov r12d, 0xff
mov r13, rbx
jmp 0x14001f187
lea rcx, str.Couldnt_initialize_the_broker_services._n
call fcn.140033cf0
mov r12d, 0xff
jmp 0x14001f187
inc rax
mov rcx, rax
jmp 0x14001ed5e
mov rsi, qword [rsp + 0x58]
lea rcx, [rsi + 8]
mov rdx, rsi
add rdx, 0x10
lea r15d, [r13 - 1]
lea r8, [r15*8]
call sub.ntdll.dll_memmove
call fcn.1400319c0
lea rdx, [rsp + 0x700]
mov qword [rdx], rax
mov rcx, qword [0x140062a80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x20], rdx
mov edx, r15d
mov r8, rsi
mov r9, r14
jmp 0x14001f17e
mov rcx, r13
mov al, byte [r15]
test al, al
jne 0x14001f9f0
mov r13, rcx
jmp 0x14001f11c
mov r12d, 1
jmp 0x14001ef3b
lea rcx, str.MOZ_APP_SILENT_START1
mov rbx, qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
call rbx
lea rcx, str.MOZ_APP_ALLOW_WINDOWLESS1
call rbx
jmp 0x14001f031
mov rdi, r12
or ebp, 0x10000000
mov r12d, 0x526
lea rcx, [rsp + 0x700]
mov qword [rcx], r15
mov dword [rcx + 8], r12d
mov dword [rcx + 0xc], ebp
xor r14d, r14d
xor edx, edx
call fcn.140034fc0
jmp 0x14001d106
mov rdi, r12
xor r15d, r15d
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14001d0e1
cmp eax, 0x57
je 0x14001d0e1
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r12d, 0x5c
jmp 0x14001d0d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov byte [rsp + 0x718], 1
lea r15, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov qword [rsp + 0x708], r15
mov r12d, 0x1e
mov sil, 1
jmp 0x14001d0e1
mov r15, qword [rsp + 0x708]
mov r12d, dword [rsp + 0x710]
mov sil, 1
mov ebp, dword [rsp + 0x714]
jmp 0x14001d0e1
mov ebp, dword [rsp + 0x13c]
cmp ebp, 0xd000003a
jne 0x14001fdcb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x70], rax
mov qword [rdx], rax
lea r15, [rsp + 0x2c0]
mov rcx, r15
call fcn.140039580
cmp byte [r15 + 0x18], 0
je 0x1400202c3
mov r15, qword [rsp + 0x2c8]
mov r12d, dword [rsp + 0x2d0]
mov sil, 1
mov ebp, dword [rsp + 0x2d4]
mov rax, qword [rsp + 0x70]
inc rax
cmp rax, 2
jb 0x14001d0e1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001d0e1
cmp byte [rax], 0
je 0x14001d11f
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov r14b, 1
jmp 0x14001d11f
lea r10, str.force_launcher
mov r10b, byte [rax + r10 + 1]
inc rax
cmp rax, 0xe
jne 0x14001d3d8
cmp word [r9 + 0x1c], 0
jne 0x14001d432
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14001f941
dec r13d
xor ebp, ebp
xor esi, esi
jmp 0x14001d449
add rax, 2
mov r9, rax
jmp 0x14001d3d3
lea rcx, [rsp + 0x700]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000150
mov qword [rcx + 8], rax
xor esi, esi
xor edx, edx
call fcn.140034fc0
jmp 0x14001e21b
add r9, 2
mov r8, r9
jmp 0x14001e165
add rbx, 2
mov r9, rbx
jmp 0x14001e27a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400202f9
mov rcx, rax
jmp 0x14001eb8e
add r8, 2
mov rdx, r8
jmp 0x14001e41c
add rdx, 2
mov rcx, rdx
jmp 0x14001e993
xor r12d, r12d
jmp 0x14001eae6
xor eax, eax
mov qword [rsp + 0x98], rax
mov r13, rcx
jmp 0x14001f123
mov rdi, r14
cmp rax, 8
jb 0x14001fa13
mov rdi, qword [rsp + 0x218]
mov qword [rsp + 0x228], r15
lea rax, [r15 + r15]
mov rcx, rdi
mov rdx, r8
mov r8, rax
call sub.ntdll.dll_memmove
mov word [rdi + r15*2], 0
jmp 0x14001d50e
lea rdx, [rax + 6]
mov qword [rsp + 0x228], rdx
mov rdx, r14
cmp rcx, 8
jb 0x14001fa56
mov rdx, qword [rsp + 0x218]
movabs rcx, 0x61006d0049007c
mov qword [rdx + rax*2], rcx
mov dword [rdx + rax*2 + 8], 0x650067
mov word [rdx + rax*2 + 0xc], 0
jmp 0x14001d548
mov r12, r14
cmp rax, 8
jb 0x14001fa89
mov r12, qword [rsp + 0x298]
mov qword [rsp + 0x2a8], r15
lea rax, [r15 + r15]
mov rcx, r12
mov rdx, r8
mov r8, rax
call sub.ntdll.dll_memmove
mov word [r12 + r15*2], 0
mov r13, qword [rsp + 0x60]
jmp 0x14001d7a0
lea rdx, [rax + 0xa]
mov qword [rsp + 0x2a8], rdx
mov rdx, r14
cmp rcx, 8
jb 0x14001fad1
mov rdx, qword [rsp + 0x298]
movdqa xmm0, xmmword [str.Blocklist]
movdqu xmmword [rdx + rax*2], xmm0
mov dword [rdx + rax*2 + 0x10], 0x740073
mov word [rdx + rax*2 + 0x14], 0
mov r13, qword [rsp + 0x60]
jmp 0x14001d7da
mov rax, qword [rsp + 0x58]
mov r15, qword [rax + 0x10]
lea r14, [rsp + 0x700]
mov rcx, r14
mov r8, r15
call fcn.140033e00
mov rcx, r14
call qword [sym.imp.mozglue.dll_strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
test eax, eax
jne 0x14001ffaf
mov rcx, qword [rsp + 0x58]
mov r12, rcx
add r12, 0x10
mov rax, qword [rcx]
mov qword [rcx + 0x10], rax
mov r13, rbx
lea ebp, [rbx - 2]
jmp 0x14001f113
mov eax, 0x43
mov ecx, 0x8007065d
mov byte [rsp + 0x140], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs r8, 0xffffff0000000000
and r8, rdx
mov r9d, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, r8
or r9, rdx
mov qword [rsp + 0x130], r9
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], ecx
jmp 0x14001f5fc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
mov eax, 0x5c
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], edi
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1c0], 0
xor eax, eax
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14001d938
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rdx, r15
call sub.ntdll.dll_memcpy
mov word [rsp + rbx*2 + 0x700], 0
jmp 0x14001d8df
mov eax, 0x3839
xchg dword [0x14006204c], eax
jmp 0x14001da79
add r10, 2
mov r9, r10
jmp 0x14001daf7
lea rcx, [rsp + 0x700]
xor edx, edx
call fcn.140034fc0
jmp 0x14001e219
xor esi, esi
lea rcx, [rsp + 0x188]
xor edx, edx
call fcn.140034fc0
mov r15, qword [rsp + 0xc8]
jmp 0x14001fce3
mov edi, 4
jmp 0x14001e373
xor edi, edi
cmp eax, 1
jne 0x14001e373
mov edi, 2
test r14b, 3
jne 0x14001e373
mov edi, 5
cmp r14d, 3
ja 0x14001e373
lea rbx, [rsp + 0x700]
mov rcx, rbx
mov rdi, r13
mov edx, r13d
mov r8, qword [rsp + 0x68]
call fcn.140038660
mov sil, 1
cmp byte [rbx + 0x10], 0
jne 0x1400202e3
xor r12d, r12d
xor r15d, r15d
mov r13, rdi
jmp 0x14001eb4a
xor esi, esi
lea rcx, [rsp + 0x170]
xor edx, edx
call fcn.140034fc0
xor r12d, r12d
jmp 0x14001eb4a
lea rcx, [rsp + 0x700]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000198
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140034fc0
xor esi, esi
jmp 0x14001eb4a
mov r15d, 0x404
jmp 0x14001e86c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb40]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1de
mov dword [rcx + 0xc], edx
xor esi, esi
xor edx, edx
call fcn.140034fc0
xor r12d, r12d
mov r15, rdi
mov rbx, qword [rsp + 0x70]
jmp 0x14001eb2a
xor ebx, ebx
jmp 0x14001e94e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001eb58
mov rax, qword [rsp + 0x708]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x700]
call fcn.140031c60
jmp 0x14001fbca
movdqu xmm0, xmmword [rsp + 0x700]
movdqa xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x140], 1
jmp 0x14001f5fc
mov r15, qword [rsp + 0x130]
mov sil, 1
mov r12d, dword [rsp + 0x138]
jmp 0x14001d0e1
cmp byte [rax], 0
je 0x14001d729
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14001d73f
cmp word [rax], 0
je 0x14001f60d
xor ebp, ebp
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul r14d, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.1400396a0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001f60f
mov rdi, r15
cmp byte [rax], 0
movzx eax, bl
mov ecx, 1
cmove ecx, eax
mov dword [rsp + 0x7c], ecx
jmp 0x14001e6a0
xor esi, esi
lea rcx, [rsp + 0x118]
xor edx, edx
call fcn.140034fc0
xor r12d, r12d
mov r13, qword [rsp + 0x60]
mov r15, rdi
mov rbx, qword [rsp + 0x70]
jmp 0x14001eb2f
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8, qword [rsp + 0x70]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14001e911
xor esi, esi
lea rcx, [rsp + 0x100]
jmp 0x14001fef4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb40]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1f9
mov dword [rcx + 0xc], edx
xor esi, esi
xor edx, edx
call fcn.140034fc0
mov rcx, r13
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r12d, r12d
jmp 0x14001eae9
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
test eax, eax
setne cl
neg ecx
mov dword [rsp + 0x58], ecx
xor r15d, r15d
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x90], eax
test eax, eax
jne 0x14001ff44
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x7c], eax
or dword [rsp + 0x58], 0x2710
cmp dword [rsp + 0x90], 0
jne 0x14001ff64
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
sub r15d, dword [rsp + 0x7c]
mov sil, 1
mov r14d, dword [rsp + 0x58]
sub r14d, r15d
jbe 0x14001ff09
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r13
mov edx, r14d
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x14001eae9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x14001eae9
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001ff4c
lea rcx, str.Couldnt_set__s._n
lea rdx, [rsp + 0x700]
call fcn.140033cf0
jmp 0x14001f6fd
mov rcx, r12
call fcn.1400397d0
test al, al
je 0x14001e752
mov rax, qword [rsp + 0x140]
jmp 0x14001e73e
mov rcx, r12
call fcn.1400397d0
test al, al
je 0x14001e7a5
mov rax, qword [rsp + 0x140]
jmp 0x14001e791
mov rcx, r12
call fcn.1400397d0
test al, al
je 0x14001e7f8
mov rax, qword [rsp + 0x140]
jmp 0x14001e7e4
mov r15, qword [rsp + 0x2c8]
mov r12d, dword [rsp + 0x2d0]
mov sil, 1
mov ebp, dword [rsp + 0x2d4]
jmp 0x14001d0e1
mov r15, qword [rsp + 0x1a0]
mov r12d, dword [rsp + 0x1a8]
mov sil, 1
mov ebp, dword [rsp + 0x1ac]
jmp 0x14001d0e1
xor r15d, r15d
jmp 0x14001f26a
cmp byte [rax], 0
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jne 0x14001e106
jmp 0x14001e10c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov byte [rsp + 0x140], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rdx
jmp 0x14001fb8d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001f2d7
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], ecx
jmp 0x14001fbca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001f360
movdqu xmm0, xmmword [rsp + 0x2c0]
jmp 0x14001fdb5
lea rax, [rsp + 0x1e8]
mov qword [rax - 8], 0
jmp 0x14001d6fc
or byte [rsp + 0x73d], 8
mov qword [rsp + 0x718], rax
jmp 0x14001e8bc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x54
jmp 0x14001fbbc
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x80], 0x6a
mov dword [rsp + 0x84], ecx
jmp 0x14001fd9a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3f
jmp 0x14001fb55
mov byte [rsp + 0x140], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rax
movabs rax, 0x8007050700000119
jmp 0x14001f5f4
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x140020090
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x14001dd47
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x14001dd47
movzx r8d, word [rdx + 0x12]
test r8w, r8w
je 0x14001dd47
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001dd47
cmp word [rdx + 0x14], 0
jne 0x14001dd47
jmp 0x1400202b4
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001dfe0
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x14001dfe0
cmp word [rdx + 0x10], 0
jne 0x14001dfe0
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14001e106
lea rcx, [rsp + 0x700]
lea rdx, [rsp + 0x2c0]
call fcn.140039610
movzx r15d, al
xor esi, esi
jmp 0x14001f8dd
xor esi, esi
lea rcx, [rsp + 0x700]
xor edx, edx
call fcn.140034fc0
jmp 0x14001fcc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3