Function at 0x1400cd760
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x658
movaps xmmword [rsp + 0x640], xmm7
movaps xmmword [rsp + 0x630], xmm6
mov qword [rsp + 0x58], r9
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x628], rax
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x1400d031d
mov r12, qword [rcx]
test r12, r12
je 0x1400d0320
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x1400d0323
mov r15d, r8d
mov ebp, edx
mov rcx, r12
call fcn.1400eee40
mov rcx, rsi
mov edx, eax
call fcn.140308f10
mov rdi, rax
test rax, rax
je 0x1400cf96b
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cd89d
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rcx, [rsp + 0x360]
mov r8d, 0x380
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.version_on_the_system:
mov r8d, reloc.WS2_32.dll_socket
call fcn.1401f8290
mov rsi, rax
mov rcx, rdi
call fcn.1402caa70
lea rbx, [rsp + 0x230]
mov rcx, rax
mov rdx, rbx
call fcn.140107c20
movsx r8, byte [rbx + 0x17]
test r8, r8
jns 0x1400cd86e
mov r8, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x230]
mov rcx, rsi
mov rdx, rbx
call fcn.1401f8290
cmp byte [rsp + 0x247], 0
jns 0x1400cd890
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
lea rcx, [rsp + 0x360]
call fcn.14010e2d0
mov qword [rsp + 0x70], r14
lea r13, [r12 + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x1b0]
mov qword [rbx + 0x10], rax
movaps xmm6, xmmword [0x1403d4b30]
movaps xmmword [rbx], xmm6
lea rcx, str.onestart.exe
lea r14, [rsp + 0x1a0]
mov qword [r14], rcx
call fcn.14029c474
mov rsi, rax
mov qword [r14 + 8], rax
mov qword [rsp + 0x48], r13
mov rcx, r13
mov rdx, rbx
mov r8, r14
call fcn.14021d0c0
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cd952
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rbx, [rsp + 0x360]
mov rcx, rbx
mov r8d, 0x38b
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.UninstallProduct:_Chrome
mov r8d, Ordinal_27
call fcn.1401f8290
mov rcx, rbx
call fcn.14010e2d0
movabs r13, 0x7ffffffffffffff7
test r15b, r15b
mov qword [rsp + 0x60], r12
je 0x1400cfb09
movsx rax, byte [r12 + 0x1f]
mov rcx, qword [rsp + 0x48]
test rax, rax
jns 0x1400cd984
mov rax, qword [r12 + 0x10]
mov rcx, qword [r12 + 8]
lea rdx, [0x1403d4b40]
mov qword [rsp + 0x360], rdx
mov qword [rsp + 0x368], rcx
mov qword [rsp + 0x370], rax
cmp rsi, r13
ja 0x1400d0333
cmp rsi, 0xa
jbe 0x1400cfa1d
mov rax, rsi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov ebx, reloc.WS2_32.dll_listen
cmovne rbx, rcx
test rbx, rbx
js 0x1400d030b
lea rcx, [rbx + rbx]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x230], rax
lea rax, [rbx + r13]
add rax, 9
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x238], rsi
lea rbx, [rcx + rsi*2]
lea rdx, str.onestart.exe
cmp rcx, rdx
seta al
cmp rbx, rdx
setbe dl
or dl, al
je 0x1400cf9d2
test rsi, rsi
je 0x1400cda39
add rsi, rsi
lea rdx, str.onestart.exe
mov r8, rsi
call fcn.1402b6370
mov word [rbx], 0
lea rsi, [rsp + 0x230]
lea r9, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
mov r8d, 2
call fcn.1402f1490
cmp byte [rsi + 0x17], 0
jns 0x1400cda71
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
mov dword [rsp + 0x54], reloc.WS2_32.dll_recvfrom
lea rdx, [0x1403db410]
mov ecx, 5
call fcn.1402b9c80
xorps xmm0, xmm0
lea rbx, [rsp + 0x360]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rbx
call fcn.140120920
test al, al
je 0x1400cdb57
lea rsi, [rsp + 0x230]
movsx rax, byte [rsp + 0x377]
test rax, rax
cmovs rax, qword [rsp + 0x368]
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], r14
cmovs rbx, qword [rsp + 0x360]
movaps xmmword [rsi], xmm6
lea rdx, [rsp + 0x210]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1402126d0
mov qword [rsp + 0x1f0], r14
cmp byte [rsi + 0x17], 0
jns 0x1400cdb14
mov rsi, qword [rsp + 0x230]
lea rbx, [rsp + 0x1f0]
mov rcx, rbx
mov rdx, rsi
call fcn.1402b9d50
lea rdx, [0x1403db410]
mov ecx, 5
call fcn.1402b9c80
mov rcx, rbx
call fcn.1402b9e50
cmp byte [rsp + 0x247], 0
jns 0x1400cdb57
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
mov byte [rsp + 0x47], r15b
mov qword [rsp + 0x68], rdi
cmp byte [rsp + 0x377], 0
jns 0x1400cdb78
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
call fcn.14030cd80
lea r14, [rsp + 0x140]
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rdi
movaps xmmword [r14], xmm6
lea rsi, str.chrome_proxy.exe
lea r15, [rsp + 0x130]
mov qword [r15], rsi
mov rcx, rsi
call fcn.14029c474
mov rbx, rax
mov qword [r15 + 8], rax
mov rcx, qword [rsp + 0x48]
mov rdx, r14
mov r8, r15
call fcn.14021d0c0
lea rdx, str.self_destruct
mov rcx, qword [rsp + 0x58]
call fcn.14021ea20
test al, al
je 0x1400cde61
mov rcx, r12
call fcn.1400eee40
test al, al
jne 0x1400cde61
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cdc4b
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea r14, [rsp + 0x360]
mov rcx, r14
mov r8d, 0x3e1
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Retargeting_user_generated_Chrome_shortcuts.
mov r8d, Ordinal_46
call fcn.1401f8290
mov rcx, r14
call fcn.14010e2d0
lea r14, [rsp + 0x230]
mov qword [r14 + 0x10], rdi
movaps xmmword [r14], xmm6
mov rcx, r14
mov dl, 1
call fcn.14030b410
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x1400cdc77
mov rax, qword [rsp + 0x238]
test rax, rax
je 0x1400d01b3
lea r14, [rsp + 0x210]
mov qword [r14 + 0x10], rdi
movaps xmmword [r14], xmm6
lea r15, [rsp + 0x120]
lea rcx, str.onestart.exe
mov qword [r15], rcx
call fcn.14029c474
mov qword [r15 + 8], rax
lea rcx, [rsp + 0x230]
mov rdx, r14
mov r8, r15
call fcn.14021d0c0
mov rcx, r14
call fcn.140103240
test al, al
jne 0x1400cdd1f
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cdd37
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea r14, [rsp + 0x360]
mov rcx, r14
mov r8d, 0x3ee
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Retarget_failed:_system_level_Chrome_not_found.
mov r8d, 0x2f
call fcn.1401f8290
mov rcx, r14
call fcn.14010e2d0
jmp 0x1400cdd37
lea rdx, [rsp + 0x1b0]
lea r8, [rsp + 0x210]
mov rcx, r12
call fcn.1400d0680
lea rcx, [rsp + 0x210]
call fcn.14021c6c0
lea rdx, [rsp + 0x210]
mov qword [rdx + 0x10], rdi
movaps xmmword [rdx], xmm6
lea r8, [rsp + 0x110]
mov qword [r8], rsi
mov qword [r8 + 8], rbx
lea rcx, [rsp + 0x230]
call fcn.14021d0c0
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cddc9
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x3f5
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Retargeting_user_generated_Chrome_Proxy_shortcuts.
mov r8d, 0x32
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x210]
call fcn.140103240
test al, al
jne 0x1400cde2f
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cde47
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x3fa
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Retarget_failed:_system_level_Chrome_Proxy_not_found.
mov r8d, gethostname
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
jmp 0x1400cde47
lea rdx, [rsp + 0x140]
lea r8, [rsp + 0x210]
mov rcx, r12
call fcn.1400d0680
lea rcx, [rsp + 0x210]
call fcn.14021c6c0
lea rcx, [rsp + 0x230]
call fcn.14021c6c0
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x1b0]
call fcn.14021c540
lea rsi, [rsp + 0x248]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.14010ff30
mov ecx, 0x30
call fcn.14027768c
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], rax
lea r14, [rax + 0x30]
mov qword [rsp + 0x220], r14
test rax, rax
je 0x1400cf9d2
mov rbx, rax
lea rdx, [rsp + 0x230]
mov rcx, rax
call fcn.14021c540
add rbx, 0x18
je 0x1400cf9d2
mov rcx, rbx
mov rdx, rsi
call fcn.14021c540
mov qword [rsp + 0x218], r14
mov rcx, r12
call fcn.1400eee40
mov ebx, eax
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cdf51
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0xe6
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Deleting_shortcuts.
mov r8d, reloc.WS2_32.dll_send
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
movzx ecx, bl
inc ecx
lea rsi, [rsp + 0x210]
mov rdx, rsi
call fcn.140301150
mov rbx, qword [rsi]
test rbx, rbx
jne 0x1400cf9e0
lea rcx, [rsp + 0x248]
call fcn.14021c6c0
lea rcx, [rsp + 0x230]
call fcn.14021c6c0
mov rbx, qword [r12 + 0x58]
lea rcx, [rsp + 0xf0]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
call fcn.1400fbe80
lea rsi, [rsp + 0x360]
mov rcx, rsi
call fcn.1402f9350
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x200
call fcn.1402d3660
cmp byte [rsi + 0x17], 0
jns 0x1400cdfd9
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
lea rsi, [rsp + 0x360]
mov rcx, rsi
call fcn.1401160c0
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x200
call fcn.1402d3660
cmp byte [rsi + 0x17], 0
jns 0x1400ce00d
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
lea r14, [0x1403dda1e]
mov rcx, r14
call fcn.14029c474
cmp rax, r13
ja 0x1400d0326
mov rbx, rax
cmp rax, 0xa
jbe 0x1400cf9d4
mov rax, rbx
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r15d, reloc.WS2_32.dll_listen
cmovne r15, rcx
test r15, r15
js 0x1400d030b
lea rcx, [r15 + r15]
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
lea rax, [r15 + r13]
add rax, 9
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x368], rbx
lea r15, [rsi + rbx*2]
cmp rsi, r14
seta al
cmp r15, r14
setbe cl
or cl, al
je 0x1400cf9d2
test rbx, rbx
je 0x1400ce0b2
add rbx, rbx
lea rdx, [0x1403dda1e]
mov rcx, rsi
mov r8, rbx
call fcn.1402b6370
mov word [r15], 0
lea rsi, [rsp + 0x230]
mov rcx, rsi
call fcn.140116110
mov rcx, qword [r12 + 0x58]
lea r9, [rsp + 0x360]
mov rdx, rsi
mov r8d, 0x200
call fcn.1402d3810
cmp byte [rsi + 0x17], 0
jns 0x1400ce0f6
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
cmp byte [rsp + 0x377], 0
jns 0x1400ce10d
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
lea rbx, [rsp + 0xec]
mov dword [rbx], Ordinal_27
lea rsi, [rsp + 0xd0]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
lea rdx, [rsp + 0x1b0]
mov rcx, rsi
call fcn.14011c760
mov rcx, r12
mov rdx, 0xffffffff80000001
mov r8, rsi
mov r9, rbx
call fcn.1400ca2b0
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1400ce161
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x1400ce270
xorps xmm7, xmm7
lea rbx, [rsp + 0x360]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
lea r9, [rsp + 0xec]
mov rcx, r12
mov rdx, 0xffffffff80000001
mov r8, rbx
call fcn.1400ca2b0
cmp byte [rbx + 0x17], 0
jns 0x1400ce1ad
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
lea rbx, [rsp + 0x360]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
mov rcx, rbx
call fcn.14011cd60
test al, al
je 0x1400ce259
movsx rcx, byte [rsp + 0x377]
mov rax, rcx
test rcx, rcx
jns 0x1400ce1e9
mov rax, qword [rsp + 0x368]
movsx rdx, byte [rsp + 0xe7]
mov r8, rdx
test rdx, rdx
jns 0x1400ce202
mov r8, qword [rsp + 0xd8]
cmp r8, rax
jne 0x1400ce23a
test rax, rax
je 0x1400ce259
test cl, cl
jns 0x1400ce218
mov rbx, qword [rsp + 0x360]
test dl, dl
jns 0x1400ce224
mov rsi, qword [rsp + 0xd0]
xor ecx, ecx
movzx edx, word [rsi + rcx*2]
cmp dx, word [rbx + rcx*2]
jne 0x1400ce23a
inc rcx
cmp rax, rcx
jne 0x1400ce226
jmp 0x1400ce259
lea r8, [rsp + 0x360]
lea r9, [rsp + 0xec]
mov rcx, r12
mov rdx, 0xffffffff80000001
call fcn.1400ca2b0
cmp byte [rsp + 0x377], 0
jns 0x1400ce270
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov rcx, r12
call fcn.1400eee40
test al, al
jne 0x1400ce29e
test bpl, bpl
je 0x1400ce62b
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0xd0]
call fcn.1402fda70
test al, al
je 0x1400ce2bd
lea r8, [rsp + 0xd0]
lea r9, [rsp + 0xec]
mov rcx, r12
mov rdx, 0xffffffff80000002
call fcn.1400ca2b0
call fcn.1402d5600
mov rsi, rax
mov rcx, qword [r12 + 0x58]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call fcn.1400f6250
mov rcx, rsi
call fcn.1402d5650
test rsi, rsi
je 0x1400ce2f8
mov rax, qword [rsi]
mov rax, qword [rax]
mov rcx, rsi
mov edx, 1
call qword [str._a_]
mov rcx, r12
call fcn.1400d07c0
mov rcx, r12
call fcn.1400d0930
lea rsi, [rsp + 0x360]
mov qword [rsi], rdi
lea rdx, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140120a20
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400ce353
call fcn.14030ca50
mov rcx, qword [rsp + 0x360]
mov qword [rsp + 0x360], 0
test rcx, rcx
je 0x1400ce353
mov edx, 1
call fcn.140120ae0
lea rsi, [rsp + 0x360]
mov rcx, rsi
call fcn.140116050
lea r15, str.BLBeacon
mov rcx, r15
call fcn.14029c474
mov r14, rax
movsx rax, byte [rsi + 0x17]
mov r12, r13
add r13, 8
mov edx, 0xa
mov rbx, rax
test rax, rax
jns 0x1400ce3a4
mov rdx, qword [rsp + 0x370]
and rdx, r13
dec rdx
mov rbx, qword [rsp + 0x368]
mov rcx, rdx
sub rcx, rbx
cmp rcx, r14
jb 0x1400d0137
test r14, r14
je 0x1400ce418
test al, al
jns 0x1400ce3c4
mov rsi, qword [rsp + 0x360]
test r14, r14
js 0x1400cf9d2
lea rcx, [rsi + rbx*2]
lea rax, [rcx + r14*2]
cmp rcx, r15
seta dl
cmp rax, r15
setbe al
or al, dl
je 0x1400cf9d2
lea r8, [r14 + r14]
lea rdx, str.BLBeacon
call fcn.1402b6370
add rbx, r14
cmp byte [rsp + 0x377], 0
jns 0x1400d016d
mov qword [rsp + 0x368], rbx
mov word [rsi + rbx*2], 0
lea rsi, [rsp + 0x360]
mov rcx, 0xffffffff80000001
mov rdx, rsi
xor r8d, r8d
call fcn.1402d3660
cmp byte [rsi + 0x17], 0
jns 0x1400ce445
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 0x8000000
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.1400eccb0
test bpl, bpl
je 0x1400ce7c8
mov rcx, qword [rsp + 0x60]
call fcn.1400eee40
test al, al
je 0x1400ce7c8
mov qword [rsp + 0x370], rdi
movaps xmmword [rsp + 0x360], xmm6
lea r14, str.SoftwareMicrosoftMediaPlayerShimInclusionList
mov rcx, r14
call fcn.14029c474
cmp rax, r12
ja 0x1400d0326
mov rbx, rax
cmp rax, 0xa
jbe 0x1400cfa3b
mov rax, rbx
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r15d, reloc.WS2_32.dll_listen
cmovne r15, rcx
test r15, r15
js 0x1400d030b
lea rcx, [r15 + r15]
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
lea rax, [r12 + r15]
add rax, 9
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x368], rbx
lea r15, [rsi + rbx*2]
cmp rsi, r14
seta al
cmp r15, r14
setbe cl
or cl, al
je 0x1400cf9d2
test rbx, rbx
je 0x1400ce52d
add rbx, rbx
lea rdx, str.SoftwareMicrosoftMediaPlayerShimInclusionList
mov rcx, rsi
mov r8, rbx
call fcn.1402b6370
mov word [r15], 0
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov dx, 0x5c
call fcn.14020ac80
lea r15, str.onestart.exe
mov rcx, r15
call fcn.14029c474
mov r14, rax
movsx rax, byte [rsi + 0x17]
mov edx, 0xa
mov rbx, rax
test rax, rax
jns 0x1400ce581
and r13, qword [rsp + 0x370]
dec r13
mov rbx, qword [rsp + 0x368]
mov rdx, r13
mov rcx, rdx
sub rcx, rbx
cmp rcx, r14
jb 0x1400d020f
test r14, r14
je 0x1400ce5f5
test al, al
jns 0x1400ce5a1
mov rsi, qword [rsp + 0x360]
test r14, r14
js 0x1400cf9d2
lea rcx, [rsi + rbx*2]
lea rax, [rcx + r14*2]
cmp rcx, r15
seta dl
cmp rax, r15
setbe al
or al, dl
je 0x1400cf9d2
lea r8, [r14 + r14]
lea rdx, str.onestart.exe
call fcn.1402b6370
add rbx, r14
cmp byte [rsp + 0x377], 0
jns 0x1400d02fb
mov qword [rsp + 0x368], rbx
mov word [rsi + rbx*2], 0
lea rsi, [rsp + 0x360]
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
call fcn.1402d3660
cmp byte [rsi + 0x17], 0
jns 0x1400ce7c8
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
jmp 0x1400ce7c8
call fcn.1402d5600
mov rsi, rax
mov rcx, qword [r12 + 0x58]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call fcn.1400f6250
mov rcx, rsi
call fcn.1402d5650
test rsi, rsi
je 0x1400ce666
mov rax, qword [rsi]
mov rax, qword [rax]
mov rcx, rsi
mov edx, 1
call qword [str._a_]
mov rcx, r12
call fcn.1400d07c0
mov rcx, r12
call fcn.1400d0930
lea rsi, [rsp + 0x360]
mov qword [rsi], rdi
lea rdx, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140120a20
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400ce6c1
call fcn.14030ca50
mov rcx, qword [rsp + 0x360]
mov qword [rsp + 0x360], 0
test rcx, rcx
je 0x1400ce6c1
mov edx, 1
call fcn.140120ae0
lea rsi, [rsp + 0x360]
mov rcx, rsi
call fcn.140116050
lea r15, str.BLBeacon
mov rcx, r15
call fcn.14029c474
mov r14, rax
movsx rax, byte [rsi + 0x17]
mov edx, 0xa
mov rbx, rax
test rax, rax
jns 0x1400ce70c
lea rdx, [r13 + 8]
and rdx, qword [rsp + 0x370]
dec rdx
mov rbx, qword [rsp + 0x368]
mov rcx, rdx
sub rcx, rbx
cmp rcx, r14
jb 0x1400d017d
test r14, r14
je 0x1400ce780
test al, al
jns 0x1400ce72c
mov rsi, qword [rsp + 0x360]
test r14, r14
js 0x1400cf9d2
lea rcx, [rsi + rbx*2]
lea rax, [rcx + r14*2]
cmp rcx, r15
seta dl
cmp rax, r15
setbe al
or al, dl
je 0x1400cf9d2
lea r8, [r14 + r14]
lea rdx, str.BLBeacon
call fcn.1402b6370
add rbx, r14
cmp byte [rsp + 0x377], 0
jns 0x1400d02eb
mov qword [rsp + 0x368], rbx
mov word [rsi + rbx*2], 0
mov r12, r13
lea rsi, [rsp + 0x360]
mov rcx, 0xffffffff80000001
mov rdx, rsi
xor r8d, r8d
call fcn.1402d3660
cmp byte [rsi + 0x17], 0
jns 0x1400ce7b0
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 0x8000000
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.1400eccb0
mov bpl, 1
cmp dword [rsp + 0x54], 0x12
je 0x1400ce7e5
lea rdx, str.delete_profile
mov rcx, qword [rsp + 0x58]
call fcn.14021ea20
mov ebp, eax
mov dword [rsp + 0xec], reloc.WS2_32.dll_send
mov qword [rsp + 0xc0], rdi
movaps xmmword [rsp + 0xb0], xmm6
lea rsi, [rsp + 0x360]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.14021c520
mov ecx, 0x3e9
mov rdx, rsi
call fcn.140105ef0
test al, al
mov r13, r12
lea rcx, [rsp + 0xb0]
jne 0x1400ce83a
call fcn.14021c520
jmp 0x1400ce847
lea rdx, [rsp + 0x360]
call fcn.14010ff30
mov r15, qword [rsp + 0x60]
lea rcx, [rsp + 0x360]
call fcn.14021c6c0
lea rcx, [rsp + 0x90]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
call fcn.14021c520
movsx rax, byte [rsp + 0xc7]
test rax, rax
jns 0x1400ce883
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x1400ce949
lea rsi, [rsp + 0x210]
movaps xmmword [rsi], xmm6
mov qword [rsi + 0x10], rdi
mov rcx, rsi
call fcn.14021c520
lea rbx, [rsp + 0x230]
mov qword [rbx + 0x10], rdi
movaps xmmword [rbx], xmm6
lea rcx, str.Local_State
lea r14, [rsp + 0x1f0]
mov qword [r14], rcx
call fcn.14029c474
mov qword [r14 + 8], rax
lea rcx, [rsp + 0xb0]
mov rdx, rbx
mov r8, r14
call fcn.14021d0c0
mov rcx, rsi
call fcn.1401075b0
test al, al
jne 0x1400ce9b0
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400ce9c5
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x116
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Failed_to_create_temporary_file_for_Local_State.
mov r8d, 0x30
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
jmp 0x1400ce9c5
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400ce99c
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x479
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Could_not_retrieve_the_users_profile_directory.
mov r8d, 0x30
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
mov dword [rsp + 0xec], reloc.WS2_32.dll_sendto
mov esi, reloc.WS2_32.dll_sendto
xor ebp, ebp
jmp 0x1400ce9f7
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x210]
call fcn.1402f1f20
lea rcx, [rsp + 0x230]
call fcn.14021c6c0
lea rcx, [rsp + 0x90]
lea rsi, [rsp + 0x210]
mov rdx, rsi
call fcn.14010ff50
mov rcx, rsi
call fcn.14021c6c0
mov esi, reloc.WS2_32.dll_send
lea rcx, [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
call fcn.140102d10
movsx rax, byte [r15 + 0x1f]
test rax, rax
jns 0x1400cea14
mov rax, qword [r15 + 0x10]
test rax, rax
mov dword [rsp + 0x54], ebp
je 0x1400cefc4
mov dword [rsp + 0x58], esi
lea r15, [rsp + 0x210]
mov qword [r15 + 0x10], rdi
movaps xmmword [r15], xmm6
lea rbx, [rsp + 0x360]
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.14021c730
lea r14, str.Temp
lea r12, [rsp + 0x1d0]
mov qword [r12], r14
mov rcx, r14
call fcn.14029c474
mov rsi, rax
mov qword [r12 + 8], rax
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.14021d0c0
mov rcx, rbx
call fcn.14021c6c0
mov rcx, r15
call fcn.140103450
test al, al
je 0x1400cec45
lea rcx, [rsp + 0x230]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.1402c8e40
cmp rsi, r13
ja 0x1400d0326
cmp rsi, 0xa
jbe 0x1400cfa2e
mov rax, rsi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r15d, reloc.WS2_32.dll_listen
cmovne r15, rcx
test r15, r15
js 0x1400d030b
lea rcx, [r15 + r15]
call fcn.14027768c
mov rbx, rax
mov qword [rsp + 0x360], rax
lea rax, [r15 + r13]
add rax, 9
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x368], rsi
lea r15, [rbx + rsi*2]
cmp rbx, r14
seta al
cmp r15, r14
setbe cl
or cl, al
je 0x1400cf9d2
test rsi, rsi
je 0x1400ceb3e
add rsi, rsi
lea rdx, str.Temp
mov rcx, rbx
mov r8, rsi
call fcn.1402b6370
mov word [r15], 0
lea rsi, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.14021c730
lea rcx, [rsp + 0x230]
lea r8, [rsp + 0x360]
mov rdx, rsi
call fcn.1402c9240
test al, al
je 0x1400cebb1
lea rcx, [rsp + 0x230]
call fcn.1402c8f40
mov ebx, eax
lea rcx, [rsp + 0x1f0]
call fcn.14021c6c0
cmp byte [rsp + 0x377], 0
jns 0x1400ceba8
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
test bl, bl
je 0x1400cebd5
jmp 0x1400cec38
lea rcx, [rsp + 0x1f0]
call fcn.14021c6c0
cmp byte [rsp + 0x377], 0
jns 0x1400cebd5
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cec38
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x5f
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Failed_to_delete_temp_dir
mov r8d, reloc.WLDAP32.dll_Ordinal_26
call fcn.1401f8290
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.14010a6f0
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x230]
call fcn.1402c8e60
lea rcx, [rsp + 0x210]
call fcn.14021c6c0
lea rcx, [rsp + 0x1f0]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
call fcn.14021c520
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.140110900
test al, al
je 0x1400ceca6
lea rcx, [rsp + 0x78]
lea rsi, [rsp + 0x360]
mov rdx, rsi
call fcn.14021c730
lea rcx, [rsp + 0x1f0]
mov rdx, rsi
call fcn.14010ff50
mov rcx, rsi
call fcn.14021c6c0
mov rdi, r13
lea rsi, [rsp + 0x360]
mov r8d, 0x2c8
mov rcx, rsi
mov dl, 0xaa
call fcn.1402b6a10
mov rcx, rsi
mov rdx, qword [rsp + 0x48]
mov r8b, 1
mov r9d, 3
call fcn.140104f10
lea rbx, [rsp + 0x1d0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm6
mov rcx, rsi
mov rdx, rbx
call fcn.1401051c0
movsx rax, byte [rbx + 0x17]
test rax, rax
mov rbx, qword [rsp + 0x60]
jns 0x1400ced12
mov rax, qword [rsp + 0x1d8]
test rax, rax
je 0x1400cf055
lea r13, str.....chromeinstaller_setupuninstall.cc
lea r15, [rsp + 0x230]
lea rbp, [rsp + 0x1d0]
lea r14, [rsp + 0x360]
lea rsi, [rsp + 0x1f0]
jmp 0x1400ceda3
mov rcx, qword [rsp + 0x210]
call fcn.1402776c8
mov rcx, rbp
call fcn.1401030f0
test al, al
mov rbx, qword [rsp + 0x60]
je 0x1400d0245
mov rcx, r14
mov rdx, r15
call fcn.1401051c0
mov rcx, rbp
mov rdx, r15
call fcn.14010ff50
mov rcx, r15
call fcn.14021c6c0
movsx rax, byte [rsp + 0x1e7]
test rax, rax
jns 0x1400ced9a
mov rax, qword [rsp + 0x1d8]
test rax, rax
je 0x1400cf055
movsx rax, byte [rsp + 0x207]
test rax, rax
jns 0x1400cedb9
mov rax, qword [rsp + 0x1f8]
test rax, rax
je 0x1400cedef
mov rcx, rbp
mov rdx, rsi
call fcn.14010ff90
test al, al
jne 0x1400ced66
mov rcx, rsi
mov rdx, rbp
call fcn.140110900
test al, al
jne 0x1400ced66
mov rcx, rbp
mov rdx, rsi
call fcn.140110900
test al, al
jne 0x1400ced66
mov edx, Ordinal_46
mov rcx, r13
call fcn.14021c080
test eax, eax
jle 0x1400cee44
mov rcx, r15
mov rdx, r13
mov r8d, 0x157
mov r9d, 0xffffffff
call fcn.14010dcd0
mov r8d, Ordinal_27
lea rcx, [rsp + 0x240]
lea rdx, str.Deleting_install_path
call fcn.1401f8290
mov rcx, rax
mov rdx, rbp
call fcn.14010a6f0
mov rcx, r15
call fcn.14010e2d0
mov rcx, rbp
call fcn.1401030f0
test al, al
jne 0x1400ced66
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400ceea6
mov rcx, r15
mov rdx, r13
mov r8d, 0x159
mov r9d, 2
call fcn.14010dcd0
mov r8d, 0x21
lea rcx, [rsp + 0x240]
lea rdx, str.Failed_to_delete_path__1st_try_:
call fcn.1401f8290
mov rcx, rax
mov rdx, rbp
call fcn.14010a6f0
mov rcx, r15
call fcn.14010e2d0
movsx rax, byte [rbx + 0x1f]
mov rcx, qword [rsp + 0x48]
test rax, rax
jns 0x1400ceebd
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
lea rdx, [0x1403d4b40]
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x238], rcx
mov qword [rsp + 0x240], rax
lea rcx, str.onestart.exe
call fcn.14029c474
cmp rax, rdi
ja 0x1400d0310
mov rbx, rax
cmp rax, 0xa
jbe 0x1400cefb3
mov rax, rbx
or rax, 3
lea r12, [rax + 1]
cmp rax, 0xb
mov eax, reloc.WS2_32.dll_listen
cmove r12, rax
test r12, r12
js 0x1400d030b
lea rcx, [r12 + r12]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x210], rax
lea rax, [rdi + r12]
add rax, 9
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x218], rbx
lea r12, [rcx + rbx*2]
lea rdx, str.onestart.exe
cmp rcx, rdx
seta al
cmp r12, rdx
setbe dl
or dl, al
je 0x1400cf9d2
test rbx, rbx
je 0x1400cef81
add rbx, rbx
lea rdx, str.onestart.exe
mov r8, rbx
call fcn.1402b6370
mov word [r12], 0
lea rcx, [rsp + 0x210]
xor edx, edx
mov r8d, 2
mov r9, r15
call fcn.1402f1490
cmp byte [rsp + 0x227], 0
jns 0x1400ced51
jmp 0x1400ced44
mov byte [rsp + 0x227], bl
lea rcx, [rsp + 0x210]
jmp 0x1400cef4b
mov ecx, 2
call fcn.14021c050
test al, al
mov rbx, qword [rsp + 0x68]
mov bpl, byte [rsp + 0x47]
je 0x1400cf036
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x139
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.DeleteChromeFilesAndFolders:_no_installation_destination
mov r8d, reloc.WS2_32.dll_gethostname
call fcn.1401f8290
lea rdx, str.path.
mov r8d, 5
mov rcx, rax
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x78]
call fcn.14021c6c0
mov dword [rsp + 0xec], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x58], reloc.WS2_32.dll_sendto
jmp 0x1400cf09d
lea rcx, [rsp + 0x1d0]
call fcn.14021c6c0
lea rcx, [rsp + 0x360]
call fcn.140105120
lea rcx, [rsp + 0x1f0]
call fcn.14021c6c0
lea rcx, [rsp + 0x78]
call fcn.14021c6c0
mov r13, rdi
mov rbx, qword [rsp + 0x68]
mov bpl, byte [rsp + 0x47]
movabs rdi, 0xaaaaaaaaaaaaaaaa
cmp byte [rsp + 0x54], 0
je 0x1400cf43e
movsx rax, byte [rsp + 0xc7]
test rax, rax
jns 0x1400cf0be
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x1400cf249
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cf131
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x123
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Deleting_user_profile
mov r8d, Ordinal_27
call fcn.1401f8290
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14010a6f0
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0xb0]
call fcn.1401030f0
test al, al
jne 0x1400cf1a5
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cf1a5
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x125
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Failed_to_delete_user_profile_dir:
mov r8d, 0x23
call fcn.1401f8290
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14010a6f0
mov rcx, rsi
call fcn.14010e2d0
lea rsi, [rsp + 0x360]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0xb0]
mov rdx, rsi
call fcn.14021c730
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1400cf1d6
mov rax, qword [rsp + 0x368]
test rax, rax
je 0x1400cf23c
lea rcx, [rsp + 0x360]
call fcn.1400ca1e0
test eax, eax
jne 0x1400cf23c
lea rsi, [rsp + 0x230]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x360]
mov rdx, rsi
call fcn.14021c730
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1400cf21d
mov rax, qword [rsp + 0x238]
test rax, rax
je 0x1400cf22f
lea rcx, [rsp + 0x230]
call fcn.1400ca1e0
lea rcx, [rsp + 0x230]
call fcn.14021c6c0
lea rcx, [rsp + 0x360]
call fcn.14021c6c0
lea rax, [rsp + 0x374]
mov byte [rax + 3], 0xa
lea rcx, str.Extensions
lea rdx, [rsp + 0x360]
cmp rdx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
movups xmm0, xmmword [str.Extensions]
movaps xmmword [rsp + 0x360], xmm0
mov dword [rsp + 0x370], 0x73006e
mov word [rsp + 0x374], 0
mov ecx, 0x30
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x378], rax
lea rax, [r13 + 0x21]
mov qword [rsp + 0x388], rax
mov qword [rsp + 0x380], reloc.WS2_32.dll_sendto
lea rax, [rsi + 0x28]
lea rcx, str.NativeMessagingHosts
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
movups xmm0, xmmword [0x1403db6cc]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [str.NativeMessagingHosts]
movups xmmword [rsi], xmm0
movabs rax, 0x7300740073006f
mov qword [rsi + 0x20], rax
mov word [rsi + 0x28], 0
mov ecx, 0x30
call fcn.14027768c
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rax
lea rdi, [rax + 0x30]
mov qword [rsp + 0x240], rdi
test rax, rax
je 0x1400cf9d2
mov rcx, qword [rsp + 0x370]
mov qword [rax + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x360]
movups xmmword [rax], xmm0
add rax, 0x18
je 0x1400cf9d2
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rax
mov rdx, rsi
call fcn.14020a9f0
lea rsi, [rsp + 0x230]
mov qword [rsi + 8], rdi
lea rdi, [rsp + 0x210]
mov rcx, rdi
call fcn.140116050
mov rcx, 0xffffffff80000001
mov rdx, rdi
mov r8, rsi
call fcn.1400eb2b0
cmp byte [rdi + 0x17], 0
jns 0x1400cf3b3
mov rcx, qword [rsp + 0x210]
call fcn.1402776c8
mov rsi, qword [rsp + 0x230]
test rsi, rsi
je 0x1400cf410
mov rdi, qword [rsp + 0x238]
mov rcx, rsi
cmp rsi, rdi
je 0x1400cf403
add rdi, 0xffffffffffffffe8
jmp 0x1400cf3ea
mov rcx, qword [rdi]
call fcn.1402776c8
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x1400cf3fb
test rdi, rdi
je 0x1400cf9d2
cmp byte [rdi + 0x17], 0
js 0x1400cf3d6
jmp 0x1400cf3de
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0x238], rsi
call fcn.1402776c8
cmp byte [rsp + 0x38f], 0
jns 0x1400cf427
mov rcx, qword [rsp + 0x378]
call fcn.1402776c8
cmp byte [rsp + 0x377], 0
jns 0x1400cf43e
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
test rbx, rbx
sete al
or bpl, al
jne 0x1400cf4c3
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cf4a3
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x48b
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Uninstallation_complete._Launching_post_uninstall_operations.
mov r8d, 0x3d
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
mov rcx, rbx
call fcn.1402caa70
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0xf0]
mov rcx, rax
call fcn.1400c2530
movsx rax, byte [rsp + 0xa7]
test rax, rax
jns 0x1400cf4d9
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x1400cf4eb
lea rcx, [rsp + 0x90]
call fcn.140102e10
call fcn.1400dcd80
cmp eax, 1
je 0x1400cf5b2
call fcn.1400dcd80
cmp eax, 2
jne 0x1400cf767
mov ecx, 0xb0
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
add r13, 0x61
mov qword [rsp + 0x370], r13
mov qword [rsp + 0x368], 0x57
add rax, 0xae
lea rcx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartStartup___f
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartStartup___f
mov r8d, 0xae
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xae], 0
lea rsi, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
call fcn.1400d0350
cmp byte [rsi + 0x17], 0
jns 0x1400cf598
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 0xb0
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
jmp 0x1400cf6ef
mov ecx, 0xb8
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
lea rax, [r13 + 0x65]
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x368], 0x58
lea rax, [rsi + 0xb0]
lea rcx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartChromium___f
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartChromium___f
mov r8d, 0xb0
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xb0], 0
lea rsi, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
call fcn.1400d0350
cmp byte [rsi + 0x17], 0
jns 0x1400cf644
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 0xa8
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
lea rax, [r13 + 0x5d]
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x368], 0x53
lea rax, [rsi + 0xa6]
lea rcx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartBar___f
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartBar___f
mov r8d, Ordinal_167
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xa6], 0
lea rsi, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
call fcn.1400d0350
cmp byte [rsi + 0x17], 0
jns 0x1400cf6d6
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
mov ecx, 0xb0
call fcn.14027768c
mov rsi, rax
mov qword [rsp + 0x360], rax
add r13, 0x61
mov qword [rsp + 0x370], r13
mov qword [rsp + 0x368], 0x56
add rax, 0xac
lea rcx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartUpdate___f
cmp rsi, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.reg_delete__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__OneStartUpdate___f
mov r8d, 0xac
mov rcx, rsi
call fcn.1402b6370
mov word [rsi + 0xac], 0
lea rsi, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
call fcn.1400d0350
cmp byte [rsi + 0x17], 0
jns 0x1400cf767
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
call fcn.1402d6cd0
mov ecx, 0x58
call fcn.14027768c
mov rbx, rax
add rax, 0x52
lea rcx, str.reg_delete__HKCUSoftwareOneStart.ai___f
cmp rbx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.reg_delete__HKCUSoftwareOneStart.ai___f
mov r8d, 0x52
mov rcx, rbx
call fcn.1402b6370
mov word [rbx + 0x52], 0
mov ecx, 0x58
call fcn.14027768c
mov r15, rax
add rax, 0x50
lea rcx, str.rmdir___LOCALAPPDATA_OneStart.ai___s__q
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1400cf9d2
lea rdx, str.rmdir___LOCALAPPDATA_OneStart.ai___s__q
mov r8d, 0x50
mov rcx, r15
call fcn.1402b6370
mov word [r15 + 0x50], 0
mov ecx, 0x40
call fcn.14027768c
test rax, rax
je 0x1400cf9d2
mov rdi, rax
mov rsi, rax
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov rcx, rdi
mov rdx, rbx
call fcn.14020a9f0
mov qword [rdi + 0x18], 1
mov r14, rdi
add r14, 0x20
je 0x1400cf9d2
mov r8d, Ordinal_41
mov rcx, r14
mov rdx, r15
call fcn.14020a9f0
mov qword [rsi + 0x38], 1
mov rcx, r15
call fcn.1402776c8
mov rcx, rbx
call fcn.1402776c8
mov ebx, dword [rsi + 0x1c]
cmp ebx, 0xffffffff
je 0x1400cf87c
inc ebx
mov edx, dword [rsi + 0x18]
mov rcx, rsi
call fcn.1400d0350
dec ebx
jne 0x1400cf86d
mov ebx, dword [rsi + 0x3c]
cmp ebx, 0xffffffff
je 0x1400cf895
inc ebx
mov edx, dword [rsi + 0x38]
mov rcx, r14
call fcn.1400d0350
dec ebx
jne 0x1400cf886
add rdi, 0x20
je 0x1400cf9d2
cmp byte [rsi + 0x37], 0
jns 0x1400cf8ad
mov rcx, qword [rdi]
call fcn.1402776c8
cmp byte [rsi + 0x17], 0
mov r14d, dword [rsp + 0x58]
jns 0x1400cf8c0
mov rcx, qword [rsi]
call fcn.1402776c8
mov rcx, rsi
call fcn.1402776c8
lea rcx, [rsp + 0x90]
call fcn.14021c6c0
lea rcx, [rsp + 0xb0]
call fcn.14021c6c0
cmp byte [rsp + 0xe7], 0
jns 0x1400cf8f9
mov rcx, qword [rsp + 0xd0]
call fcn.1402776c8
cmp byte [rsp + 0x107], 0
jns 0x1400cf910
mov rcx, qword [rsp + 0xf0]
call fcn.1402776c8
lea rcx, [rsp + 0x140]
call fcn.14021c6c0
lea rcx, [rsp + 0x1b0]
call fcn.14021c6c0
mov rcx, qword [rsp + 0x628]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1400cf944
call fcn.140278ca0
int3
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x630]
movaps xmm7, xmmword [rsp + 0x640]
add rsp, 0x658
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15b, r15b
jne 0x1400cd89d
mov ecx, 2
call fcn.14021c050
mov r14d, reloc.WS2_32.dll_ntohs
test al, al
je 0x1400cf92a
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x383
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Chrome_not_found_for_uninstall.
mov r8d, 0x1f
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
jmp 0x1400cf92a
ud2
mov byte [rsp + 0x377], bl
jmp 0x1400ce080
mov rsi, qword [rsp + 0x218]
mov rcx, rbx
cmp rbx, rsi
je 0x1400cfa0b
add rsi, 0xffffffffffffffe8
je 0x1400cf9d2
mov rcx, rsi
call fcn.14021c6c0
cmp rsi, rbx
jne 0x1400cf9f0
mov rcx, qword [rsp + 0x210]
mov qword [rsp + 0x218], rbx
call fcn.1402776c8
jmp 0x1400cdf72
lea rcx, [rsp + 0x230]
mov byte [rcx + 0x17], sil
jmp 0x1400cda03
mov byte [rsp + 0x377], sil
jmp 0x1400ceb0c
mov byte [rsp + 0x377], bl
jmp 0x1400ce4fb
cmp r9b, 0xb
jb 0x1400cfab4
lea rax, [rsp + r9*2]
add rax, 0x360
lea rcx, [rsp + r9*2]
add rcx, 0x38c
lea rdx, str.____close_all_browsers
cmp rax, rdx
setbe r8b
cmp rcx, rdx
seta cl
test r8b, cl
jne 0x1400cf9d2
movups xmm0, xmmword [0x1403dac94]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x1403dac88]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.____close_all_browsers]
movups xmmword [rax], xmm0
add r9, 0x16
mov eax, r9d
and al, 0x7f
mov byte [rsp + 0x377], al
jmp 0x1400cfbd4
mov edx, 0xa
mov r8, r9
sub r8, rdx
add r8, 0x16
lea rax, str.____close_all_browsers
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x30], Ordinal_27
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x360]
call fcn.14020a830
jmp 0x1400cfbdb
lea rcx, [rsp + 0x230]
mov byte [rcx + 0x17], sil
jmp 0x1400cfce7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x220], rax
movaps xmmword [rsp + 0x210], xmm6
lea rdx, [0x1403d9cb4]
lea rsi, [rsp + 0x360]
lea r8, [rsp + 0x1b0]
mov rcx, rsi
call fcn.1400c9e20
movsx r9, byte [rsi + 0x17]
test r9, r9
jns 0x1400cfa47
lea rdx, [r13 + 8]
and rdx, qword [rsp + 0x370]
dec rdx
mov r9, qword [rsp + 0x368]
mov rax, rdx
sub rax, r9
cmp rax, 0x16
jb 0x1400cfab9
mov rsi, qword [rsp + 0x360]
lea rax, [rsi + r9*2]
lea rcx, [rsi + r9*2]
add rcx, 0x2c
lea rdx, str.____close_all_browsers
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x1400cf9d2
movups xmm0, xmmword [0x1403dac94]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x1403dac88]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.____close_all_browsers]
movups xmmword [rax], xmm0
add r9, 0x16
mov qword [rsp + 0x368], r9
mov word [rsi + r9*2], 0
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x220], rax
movaps xmm0, xmmword [rsp + 0x360]
movaps xmmword [rsp + 0x210], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x360], xmm0
mov qword [rsp + 0x370], 0
cmp byte [rsp + 0x377], 0
jns 0x1400cfc29
mov rcx, qword [rsp + 0x360]
call fcn.1402776c8
lea rcx, [rsp + 0x210]
mov edx, Ordinal_301
call fcn.1400d0350
movsx rax, byte [r12 + 0x1f]
mov rcx, qword [rsp + 0x48]
test rax, rax
jns 0x1400cfc55
mov rax, qword [r12 + 0x10]
mov rcx, qword [r12 + 8]
lea rdx, [0x1403d4b40]
mov qword [rsp + 0x360], rdx
mov qword [rsp + 0x368], rcx
mov qword [rsp + 0x370], rax
lea rbx, str.onestart.exe
mov rcx, rbx
call fcn.14029c474
cmp rax, r13
ja 0x1400d0333
mov rsi, rax
cmp rax, 0xa
jbe 0x1400cfaf8
mov rax, rsi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r14d, reloc.WS2_32.dll_listen
cmovne r14, rcx
test r14, r14
js 0x1400d030b
lea rcx, [r14 + r14]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x230], rax
lea rax, [r14 + r13]
add rax, 9
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x238], rsi
lea r14, [rcx + rsi*2]
cmp rcx, rbx
seta al
cmp r14, rbx
setbe dl
or dl, al
je 0x1400cf9d2
test rsi, rsi
je 0x1400cfd16
add rsi, rsi
lea rdx, str.onestart.exe
mov r8, rsi
call fcn.1402b6370
mov word [r14], 0
lea rsi, [rsp + 0x230]
lea r9, [rsp + 0x360]
mov rcx, rsi
xor edx, edx
mov r8d, 2
call fcn.1402f1490
cmp byte [rsi + 0x17], 0
jns 0x1400cfd4f
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
mov dword [rsp + 0x1d0], 0
lea rsi, [rsp + 0x230]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
xor edx, edx
call fcn.140111f60
lea rcx, [0x1403dde75]
lea rbx, [rsp + 0x1f0]
mov qword [rbx], rcx
call fcn.14029c0d0
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140112bf0
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cfdff
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x178
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Launching_Chrome_to_do_uninstall_tasks.
mov r8d, Ordinal_41
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rdx, [rsp + 0x230]
lea r8, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x48]
call fcn.1400ee520
test al, al
je 0x1400cfed1
lea rcx, str.....chromeinstaller_setupuninstall.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1400cfe8a
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x17a
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.chrome.exe_launched_for_uninstall_confirmation_returned:
mov r8d, reloc.WS2_32.dll_gethostname
call fcn.1401f8290
mov edx, dword [rsp + 0x1d0]
mov rcx, rax
call fcn.1400c2b00
mov rcx, rsi
call fcn.14010e2d0
mov eax, dword [rsp + 0x1d0]
lea ecx, [rax - 0xa]
cmp ecx, 2
jb 0x1400cfeaf
cmp eax, 2
je 0x1400cfeaf
mov r14d, reloc.WS2_32.dll_select
cmp eax, 0xc
je 0x1400cff33
jmp 0x1400cff2d
lea rcx, [rsp + 0x230]
call fcn.1401124e0
mov r14d, reloc.WS2_32.dll_setsockopt
xor esi, esi
mov dword [rsp + 0x54], reloc.WS2_32.dll_setsockopt
jmp 0x1400cffd9
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cff2d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8d, 0x184
mov r9d, 2
call fcn.1402f6330
lea rcx, [rsp + 0x370]
lea rdx, str.Failed_to_launch_chrome.exe_for_uninstall_confirmation.
mov r8d, gethostname
call fcn.1401f8290
mov rcx, rsi
call fcn.1402f63a0
mov r14d, reloc.WS2_32.dll_recvfrom
lea rsi, [rsp + 0x230]
mov rcx, rsi
call fcn.1401124e0
lea rdx, str.bbUninstalled
lea rbx, [0x1403daca6]
xor ecx, ecx
mov r8, rbx
xor r9d, r9d
call fcn.1400dacc0
mov rcx, rbx
call fcn.1400dca90
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x1b0]
call fcn.14011c760
test bpl, bpl
je 0x1400cffb7
lea rcx, [rsp + 0x1b0]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.1402fda70
test al, al
je 0x1400cffb7
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1400cfffe
cmp byte [rsp + 0x247], 0
jns 0x1400cffce
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
mov dword [rsp + 0x54], reloc.WS2_32.dll_select
mov sil, 1
cmp byte [rsp + 0x227], 0
jns 0x1400cfff0
mov rcx, qword [rsp + 0x210]
call fcn.1402776c8
test sil, sil
je 0x1400cf91d
jmp 0x1400cda79
lea rbx, str.run_as_admin
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call fcn.14021ea20
test al, al
jne 0x1400cffb7
mov byte [rsp + 0x47], r15b
mov r12, rbx
lea rbx, [rsp + 0x360]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov rcx, rbx
xor edx, edx
call fcn.140111f60
mov rcx, rbx
mov rdx, qword [rsp + 0x58]
mov r8b, 1
call fcn.1402f82d0
lea r15, [rsp + 0x190]
mov qword [r15], r12
mov rcx, r12
call fcn.14029c0d0
mov qword [r15 + 8], rax
mov rcx, rbx
mov rdx, r15
call fcn.140112bf0
lea rcx, str.remove_chrome_registration
lea r15, [rsp + 0x180]
mov qword [r15], rcx
call fcn.14029c0d0
mov qword [r15 + 8], rax
mov rcx, rbx
mov rdx, r15
call fcn.140112bf0
movsx rcx, byte [rsp + 0x247]
mov rax, rcx
test rcx, rcx
jns 0x1400d00b4
mov rax, qword [rsp + 0x238]
test rax, rax
mov r15b, byte [rsp + 0x47]
mov r12, qword [rsp + 0x60]
je 0x1400d010c
test cl, cl
jns 0x1400d00cf
mov rsi, qword [rsp + 0x230]
lea rbx, [rsp + 0x170]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
lea rcx, str.register_chrome_browser_suffix
lea rsi, [rsp + 0x160]
mov qword [rsi], rcx
call fcn.14029c0d0
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x360]
mov rdx, rsi
mov r8, rbx
call fcn.140112c60
lea rdx, [rsp + 0x1f0]
mov dword [rdx], Ordinal_27
lea rsi, [rsp + 0x360]
mov rcx, rsi
call fcn.140309240
mov rcx, rsi
call fcn.1401124e0
jmp 0x1400cffb7
mov r8, r14
add r8, rbx
sub r8, rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x360]
mov r9, rbx
call fcn.14020a830
jmp 0x1400ce418
mov eax, ebx
and al, 0x7f
mov byte [rsp + 0x377], al
jmp 0x1400ce412
mov r8, r14
add r8, rbx
sub r8, rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x360]
mov r9, rbx
call fcn.14020a830
jmp 0x1400ce780
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400cdd44
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea r14, [rsp + 0x360]
mov rcx, r14
mov r8d, 0x3e5
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x370]
lea rdx, str.Retarget_failed:_system_level_Chrome_install_directory_not_found.
mov r8d, 0x41
call fcn.1401f8290
mov rcx, r14
call fcn.14010e2d0
jmp 0x1400cdd44
mov r8, r14
add r8, rbx
sub r8, rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x360]
mov r9, rbx
call fcn.14020a830
jmp 0x1400ce5f5
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1400d02a8
lea rdx, str.....chromeinstaller_setupuninstall.cc
lea rsi, [rsp + 0x230]
mov rcx, rsi
mov r8d, 0x15d
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x240]
lea rdx, str.Failed_to_delete_path__2nd_try_:
mov r8d, 0x21
call fcn.1401f8290
lea rdx, [rsp + 0x1d0]
mov rcx, rax
call fcn.14010a6f0
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x1d0]
call fcn.14021c6c0
lea rcx, [rsp + 0x360]
call fcn.140105120
lea rcx, [rsp + 0x1f0]
call fcn.14021c6c0
mov r13, rdi
mov rbx, qword [rsp + 0x68]
mov bpl, byte [rsp + 0x47]
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x1400cf036
mov eax, ebx
and al, 0x7f
mov byte [rsp + 0x377], al
jmp 0x1400ce77a
mov eax, ebx
and al, 0x7f
mov byte [rsp + 0x377], al
jmp 0x1400ce5ef
call fcn.1402b9a10
lea rcx, [rsp + 0x210]
call fcn.1402b99d0
int3
int3
int3
lea rcx, [rsp + 0x360]
call fcn.1402b99d0
lea rcx, [rsp + 0x230]
call fcn.1402b99d0
int3