Function at 0x14001ad60
Capabilities:
Check for software breakpoints
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov qword [rcx], 0
cmp qword [r9], 0
je 0x14001add0
cmp qword [rsi + 0x10], 0
je 0x14001d4cc
cmp qword [rsi + 0x18], 0
je 0x14001d4cc
cmp dword [rsi + 8], 0
je 0x14001d4cc
cmp byte [rsi + 0x34], 0
je 0x14001d4cc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [rsi + 0x20]
lea edx, [rcx + 8]
cmp qword [rsi], 0
je 0x14001bf6a
cmp edx, dword [rsi + 0x30]
ja 0x14001bf72
mov rdx, qword [rsi + 0x10]
mov qword [rdx + rcx], rax
add dword [rsi + 0x20], 8
cmp qword [rsi], 0
je 0x14001ae2f
mov al, byte [rsi + 0x34]
cmp qword [rsi + 0x10], 0
je 0x14001d4cc
cmp qword [rsi + 0x18], 0
je 0x14001d4cc
cmp dword [rsi + 8], 0
je 0x14001d4cc
test al, al
je 0x14001d4cc
mov rax, qword [rbx]
mov ecx, dword [rbx + 0x10]
add rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [rsi + 0x20]
lea edx, [rcx + 8]
cmp qword [rsi], 0
mov qword [rsp + 0x40], rdi
je 0x14001bf7d
cmp edx, dword [rsi + 0x30]
ja 0x14001bf85
mov rdx, qword [rsi + 0x10]
mov qword [rdx + rcx], rax
add dword [rsi + 0x20], 8
cmp qword [rsi], 0
je 0x14001ae9a
mov al, byte [rsi + 0x34]
cmp qword [rsi + 0x10], 0
je 0x14001d4be
cmp qword [rsi + 0x18], 0
je 0x14001d4be
cmp dword [rsi + 8], 0
je 0x14001d4be
test al, al
je 0x14001d4be
mov rcx, qword [rbx]
mov edx, dword [rbx + 0x10]
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001aeb5
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x48
jne 0x14001aee3
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001aed5
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0xb8
je 0x14001b905
mov eax, dword [rsi + 0x20]
mov dword [rsi + 0x24], eax
mov dword [rsi + 0x28], eax
cmp byte [r15 + 0x34], 0
je 0x14001bfbb
mov eax, dword [r15 + 0x30]
and eax, 2
mov ecx, eax
shr ecx, 1
mov dword [rsp + 0x3c], ecx
xor ecx, ecx
test eax, eax
sete cl
lea r14d, [rcx + rcx*2]
add r14d, 0xa
mov edx, dword [rbx + 0x10]
xor r12d, r12d
cmp edx, r14d
jae 0x14001b73f
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebp, edx
mov dword [rsp + 0x2c], r14d
mov r13, qword [rbx]
mov rcx, r13
mov edx, ebp
test r12b, 1
jne 0x14001bac8
mov rcx, r13
mov edx, ebp
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001af63
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xf
je 0x14001bb2c
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001af85
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x88
jae 0x14001b53b
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001afa7
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x40
je 0x14001b3fe
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001afc9
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x41
je 0x14001b3fe
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001afeb
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x44
je 0x14001bc5d
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b00d
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x45
je 0x14001bd06
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b02f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xfa
cmp al, 0x48
je 0x14001b102
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b054
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x66
je 0x14001bdec
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b076
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xf0
cmp al, 0x50
jne 0x14001b562
add rdx, qword [rcx + 0x40]
mov r8d, dword [rsi + 0x20]
lea ecx, [r8 + 1]
cmp r8d, dword [rsi + 0x28]
jne 0x14001b09b
mov dword [rsi + 0x28], ecx
mov rax, qword [rsi]
test rax, rax
je 0x14001bde4
cmp ecx, dword [rsi + 0x30]
ja 0x14001bab6
cmp qword [rax], 0
je 0x14001bab6
add r8, qword [rsi + 0x10]
mov qword [rsp + 0x50], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 1
call rdi
test eax, eax
je 0x14001bab6
cmp qword [rsp + 0x50], 1
jne 0x14001bab6
inc dword [rsi + 0x20]
inc dword [rbx + 0x10]
mov ebp, dword [rbx + 0x10]
cmp ebp, r14d
jb 0x14001af37
jmp 0x14001b73d
add rdx, qword [rcx + 0x40]
mov r8d, dword [rsi + 0x20]
lea ecx, [r8 + 1]
cmp r8d, dword [rsi + 0x28]
jne 0x14001b117
mov dword [rsi + 0x28], ecx
mov rax, qword [rsi]
test rax, rax
je 0x14001bef2
cmp ecx, dword [rsi + 0x30]
ja 0x14001babf
cmp qword [rax], 0
je 0x14001babf
add r8, qword [rsi + 0x10]
mov qword [rsp + 0x50], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 1
call rdi
test eax, eax
je 0x14001babf
cmp qword [rsp + 0x50], 1
jne 0x14001babf
inc dword [rsi + 0x20]
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x14001b18a
mov rdx, qword [rcx + 8]
mov eax, dword [rbx + 0x10]
cmp byte [rdx + rax], 0x81
je 0x14001b49b
mov edx, eax
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b1ae
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
je 0x14001bfc6
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b1d0
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
je 0x14001bff0
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b1f2
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
je 0x14001c038
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b214
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x2b
je 0x14001c08f
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b236
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x85
je 0x14001c0d4
call fcn.14001a280
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x14001b258
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], r12
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xfd
cmp al, 0x89
jne 0x14001c0fe
lea edi, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
mov rax, qword [rbp]
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x28], 0x20
lea rax, [r13 + 0x30]
mov qword [r13 + 0x18], rax
mov rcx, qword [rbp + 0x40]
add rcx, rdi
mov qword [r13 + 0x50], rcx
mov r15, qword [rbp + 0x10]
cmp r15, rdi
jbe 0x14001b30c
mov r12, qword [rbp + 8]
lea rbp, [r12 + r15]
add r12, rdi
mov r14, rbp
sub r14, r12
cmp r14, 0x21
jae 0x14001c165
xor ecx, ecx
cmp r15, rdi
jle 0x14001b305
add rax, rcx
mov cl, byte [r12]
mov byte [rax], cl
inc r12
inc rax
cmp r12, rbp
jb 0x14001b2f0
mov rcx, qword [r13 + 0x20]
add rcx, r14
mov qword [r13 + 0x20], rcx
lea rdi, [r13 + 8]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 0
lea r15, [rsp + 0x50]
mov rcx, r15
lea rdx, [rsp + 0x48]
call fcn.14001d960
mov ebp, eax
lock dec dword [rdi]
jne 0x14001b36c
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001b36c
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
test ebp, ebp
mov r14d, dword [rsp + 0x2c]
mov r12, qword [rsp + 0x30]
js 0x14001c186
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
mov r8d, dword [rsi + 0x20]
lea ecx, [r8 + rbp]
inc ecx
cmp r8d, dword [rsi + 0x28]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x14001b3a2
mov dword [rsi + 0x28], ecx
inc ebp
mov rax, qword [rsi]
test rax, rax
je 0x14001c1e7
cmp ecx, dword [rsi + 0x30]
ja 0x14001bc54
cmp qword [rax], 0
je 0x14001bc54
add r8, qword [rsi + 0x10]
mov r13d, ebp
mov qword [rsp + 0x50], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9, r13
call rdi
test eax, eax
je 0x14001bc54
cmp qword [rsp + 0x50], r13
jne 0x14001bc54
add dword [rsi + 0x20], ebp
add dword [rbx + 0x10], ebp
jmp 0x14001b0f1
add rdx, qword [rcx + 0x40]
mov r8d, dword [rsi + 0x20]
lea ecx, [r8 + 1]
cmp r8d, dword [rsi + 0x28]
jne 0x14001b413
mov dword [rsi + 0x28], ecx
mov rax, qword [rsi]
test rax, rax
je 0x14001c33a
cmp ecx, dword [rsi + 0x30]
ja 0x14001bd8c
cmp qword [rax], 0
je 0x14001bd8c
add r8, qword [rsi + 0x10]
mov qword [rsp + 0x50], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 1
call rdi
test eax, eax
je 0x14001bd8c
cmp qword [rsp + 0x50], 1
jne 0x14001bd8c
inc dword [rsi + 0x20]
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b486
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xf0
cmp al, 0x50
je 0x14001b086
jmp 0x14001c342
lea edx, [rax + 1]
call fcn.14001a280
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x14001b4b3
mov rdx, qword [rcx + 8]
mov eax, dword [rbx + 0x10]
mov dl, byte [rdx + rax + 1]
and dl, 0xf8
cmp dl, 0xe8
jne 0x14001b197
mov rdx, qword [rcx + 0x40]
add rdx, rax
mov r8d, dword [rsi + 0x20]
lea ecx, [r8 + 6]
cmp r8d, dword [rsi + 0x28]
jne 0x14001b4de
mov dword [rsi + 0x28], ecx
mov rax, qword [rsi]
test rax, rax
je 0x14001c43a
cmp ecx, dword [rsi + 0x30]
ja 0x14001bd95
cmp qword [rax], 0
je 0x14001bd95
add r8, qword [rsi + 0x10]
mov qword [rsp + 0x50], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 6
call rdi
test eax, eax
je 0x14001bd95
cmp qword [rsp + 0x50], 6
jne 0x14001bd95
add dword [rsi + 0x20], 6
add dword [rbx + 0x10], 6
jmp 0x14001b0f1
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b550
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x8b
ja 0x14001af92
jmp 0x14001c442
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b577
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x65
je 0x14001c461
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b599
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x80
je 0x14001c4fb
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b5bb
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x90
je 0x14001bdc0
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b5dd
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xf8
cmp al, 0xb8
jne 0x14001b612
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001b5fb
add eax, 5
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 5
call fcn.14001d8d0
add dword [rbx + 0x10], 5
jmp 0x14001b0f1
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001b627
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x33
je 0x14001c698
call fcn.14001a280
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x14001b649
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], r12
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xf6
jne 0x14001c6a1
mov byte [rsp + 0x48], 0
lea edi, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
lea r12, [r13 + 0x10]
mov rcx, r12
mov rdx, rbp
mov r8d, edi
call fcn.14001d580
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 0
mov rcx, r15
lea rdx, [rsp + 0x48]
call fcn.14001d960
mov ebp, eax
lock dec dword [r13 + 8]
jne 0x14001b6f1
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001b6f1
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
test ebp, ebp
mov r12, qword [rsp + 0x30]
js 0x14001d4be
cmp byte [rsp + 0x48], 0
jne 0x14001d4be
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
add ebp, 2
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x14001b72a
add eax, ebp
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, ebp
call fcn.14001d8d0
add dword [rbx + 0x10], ebp
jmp 0x14001b0f1
mov edx, ebp
cmp edx, 0x64
ja 0x14001d4be
test r12b, 1
jne 0x14001b76d
mov rax, qword [rbx]
mov edx, edx
add rdx, qword [rax + 0x40]
mov rcx, rsi
mov r8d, 3
call fcn.14001db40
test al, al
je 0x14001d4be
cmp byte [rsi + 0x34], 0
je 0x14001d4be
cmp qword [rsi], 0
je 0x14001d4be
mov eax, dword [rsi + 0x20]
mov r15d, dword [rsi + 0x24]
mov dword [rsi + 0x2c], eax
add r15, qword [rsi + 0x18]
je 0x14001d4be
mov r9d, dword [rbx + 0x10]
test r9, r9
je 0x14001c1ef
mov rax, qword [rbx]
mov rdx, qword [rax]
mov r8, qword [rax + 0x40]
lea r14, [rsp + 0x88]
mov qword [r14 - 0x38], rdx
mov qword [r14 - 0x30], r8
mov qword [r14 - 0x28], r9
xor edi, edi
mov qword [r14 - 0x20], rdi
mov qword [r14 - 0x10], rdi
mov qword [r14 - 8], 0x20
mov qword [r14 - 0x18], r14
mov byte [r14 + 0x20], 1
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call fcn.14001d630
cmp qword [rbx + 0x10], rdi
je 0x14001d49b
cmp byte [rsp + 0xa8], 0
je 0x14001d49b
cmp byte [rsp + 0x3c], 0
jne 0x14001c1fa
lea rdi, [rsp + 0x70]
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14001c224
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0x49
mov rax, qword [rsp + 0x78]
inc rax
mov qword [rsp + 0x78], rax
inc dword [rsp + 0x68]
cmp rax, qword [rsp + 0x80]
je 0x14001c243
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0xbb
mov rax, qword [rsp + 0x78]
inc rax
mov qword [rsp + 0x78], rax
inc dword [rsp + 0x68]
lea rcx, [rax + 8]
cmp rcx, qword [rsp + 0x80]
ja 0x14001c262
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x160]
mov qword [rcx + rax], rdx
mov rax, qword [rsp + 0x78]
add rax, 8
mov qword [rsp + 0x78], rax
add dword [rsp + 0x68], 8
cmp rax, qword [rsp + 0x80]
je 0x14001c281
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0x41
mov rax, qword [rsp + 0x78]
inc rax
mov qword [rsp + 0x78], rax
inc dword [rsp + 0x68]
cmp rax, qword [rsp + 0x80]
je 0x14001c2a0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0xff
mov rax, qword [rsp + 0x78]
inc rax
mov qword [rsp + 0x78], rax
inc dword [rsp + 0x68]
cmp rax, qword [rsp + 0x80]
je 0x14001c2bf
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0xe3
jmp 0x14001d523
add edx, 0xa
call fcn.14001a280
mov r12, qword [rbx]
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x14001b91f
mov rax, qword [r12 + 8]
mov r13d, dword [rbx + 0x10]
cmp byte [rax + r13 + 0xa], 0xff
jne 0x14001c2de
lea edx, [r13 + 0xb]
mov rcx, r12
call fcn.14001a280
mov r12, qword [rbx]
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x14001b94d
mov rax, qword [r12 + 8]
mov r13d, dword [rbx + 0x10]
cmp byte [rax + r13 + 0xb], 0xe0
jne 0x14001c2de
add r13d, 2
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbp, rax
movabs rax, 0x100000001
mov qword [rbp + 8], rax
lea rax, [0x140052420]
mov qword [rbp], rax
lea rdi, [rbp + 0x10]
mov rcx, rdi
mov rdx, r12
mov r8d, r13d
call fcn.14001d580
mov rcx, rdi
mov edx, 8
call fcn.14001a280
mov rax, qword [rbp + 0x18]
mov r14, qword [rax]
lock dec dword [rbp + 8]
jne 0x14001b9e1
mov rdi, rbp
add rdi, 0xc
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, rbp
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001b9e1
mov rax, qword [rbp]
mov rax, qword [rax + 8]
mov rcx, rbp
call qword [0x140067010]
lea rdi, [rsp + 0x50]
mov rcx, rbx
mov rdx, rdi
call fcn.140030fa0
xor ebp, ebp
cmp qword [rdi + 0x70], 0
je 0x14001ba83
cmp byte [rsp + 0xa8], 0
je 0x14001ba83
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, qword [rsp + 0x160]
call fcn.140031100
mov rcx, rdi
call fcn.140031150
test al, al
je 0x14001c673
mov eax, dword [rsi + 0x20]
lea ecx, [rax + 8]
cmp qword [rsi], 0
je 0x14001c67a
cmp ecx, dword [rsi + 0x30]
ja 0x14001c682
mov rcx, qword [rsi + 0x10]
mov qword [rcx + rax], r14
add dword [rsi + 0x20], 8
cmp qword [rsi], 0
je 0x14001ba75
mov al, byte [rsi + 0x34]
xor ebp, ebp
cmp qword [rsi + 0x10], 0
je 0x14001ba83
cmp qword [rsi + 0x18], 0
je 0x14001ba83
cmp dword [rsi + 8], 0
je 0x14001ba83
test al, al
je 0x14001ba83
mov rax, qword [rsp + 0x168]
mov qword [rax], r14
mov bpl, 1
lea rdi, [rsp + 0xb0]
mov rcx, rdi
call fcn.140031200
mov rcx, qword [rdi - 0x40]
lea rax, [rsp + 0x88]
cmp rcx, rax
jne 0x14001c68d
test bpl, bpl
jne 0x14001d4be
jmp 0x14001aee3
mov byte [rsi + 0x34], 0
jmp 0x14001b0ee
mov byte [rsi + 0x34], 0
jmp 0x14001b16a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001badd
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x90
je 0x14001bb08
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bafb
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xcc
jne 0x14001bc17
inc edx
mov dword [rbx + 0x10], edx
mov r14d, dword [rsp + 0x2c]
cmp edx, r14d
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jb 0x14001af3f
jmp 0x14001b73f
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bb3d
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bb6b
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x1f
jne 0x14001bd9e
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bb89
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bbb7
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xc0
cmp al, 0x40
jne 0x14001d4be
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001bbdc
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
mov cl, byte [rcx + rdx]
and cl, 7
cmp cl, 4
jne 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bc00
add eax, 3
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 3
call fcn.14001d8d0
add dword [rbx + 0x10], 3
jmp 0x14001bd76
cmp qword [rsp + 0x40], 0
je 0x14001d4be
cmp edx, 0xa
jb 0x14001d4be
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov ecx, dword [rax + 0x20]
add rcx, qword [rax + 0x18]
mov al, 1
mov dword [rsp + 0x3c], eax
mov eax, 0x80000001
cmp rcx, rax
jb 0x14001b73f
jmp 0x14001d4be
mov byte [rsi + 0x34], 0
jmp 0x14001b3f6
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bc6e
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001bc9c
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx], 0x89
jne 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bcba
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
inc dword [rbx + 0x10]
mov rcx, rbx
xor edx, edx
call fcn.14001d960
test eax, eax
js 0x14001d4be
mov ebp, eax
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bcf6
add eax, ebp
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, ebp
call fcn.14001d8d0
add dword [rbx + 0x10], ebp
jmp 0x14001bd76
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bd17
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001bd45
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx], 0x33
jne 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bd64
add eax, 2
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 2
call fcn.14001d8d0
add dword [rbx + 0x10], 2
mov r14d, dword [rsp + 0x2c]
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001b0f1
mov byte [rsi + 0x34], 0
jmp 0x14001b466
mov byte [rsi + 0x34], 0
jmp 0x14001b532
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bdb3
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 5
jne 0x14001bf90
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bdd1
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
inc dword [rbx + 0x10]
jmp 0x14001bd76
mov dword [rsi + 0x20], ecx
jmp 0x14001b0ee
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bdfd
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
mov edx, dword [rbx + 0x10]
inc edx
mov dword [rbx + 0x10], edx
mov rcx, qword [rbx]
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001be2b
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x88
jb 0x14001befa
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001be4d
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x8b
ja 0x14001befa
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001be71
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
movzx ecx, byte [rcx + rdx + 1]
mov r8d, ecx
and r8d, 0xffffffc0
mov r9d, 0xc0
cmp r8d, r9d
je 0x14001bd52
cmp r8d, 0x40
je 0x14001beb9
test r8d, r8d
jne 0x14001d4be
mov r9d, ecx
and r9d, 6
cmp r9d, 4
jne 0x14001bd52
cmp r8d, 0x40
jne 0x14001d4be
add rdx, qword [rax + 0x40]
and ecx, 7
mov eax, dword [rsi + 0x20]
mov r8d, dword [rsi + 0x28]
cmp ecx, 4
jne 0x14001c9a3
cmp eax, r8d
jne 0x14001bedb
add eax, 4
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 4
call fcn.14001d8d0
add dword [rbx + 0x10], 4
jmp 0x14001bd76
mov dword [rsi + 0x20], ecx
jmp 0x14001b16a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bf0f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x44
jne 0x14001bd76
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001bf33
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx + 1], 0x89
jne 0x14001bd76
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001bf53
add eax, 2
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 2
call fcn.14001d8d0
add dword [rbx + 0x10], 2
jmp 0x14001bccb
mov dword [rsi + 0x20], edx
jmp 0x14001ae2f
mov byte [rsi + 0x34], 0
xor eax, eax
jmp 0x14001ae07
mov dword [rsi + 0x20], edx
jmp 0x14001ae9a
mov byte [rsi + 0x34], 0
xor eax, eax
jmp 0x14001ae72
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bfa5
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x10
jne 0x14001c536
add rdx, qword [rcx + 0x40]
jmp 0x14001bcad
int3
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001bfdd
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0xe8
jne 0x14001b1bb
jmp 0x14001c018
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c007
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0xc0
jne 0x14001b1dd
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001c02d
add ecx, 3
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
jmp 0x14001bc03
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c04f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0x60
jne 0x14001b1ff
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001c075
add ecx, 5
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
mov r8d, 5
call fcn.14001d8d0
add dword [rbx + 0x10], 5
jmp 0x14001bd76
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c0a6
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jb 0x14001b221
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001c0c9
add ecx, 2
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
jmp 0x14001bd67
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c0eb
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx + 1], 0xc0
jae 0x14001bd52
jmp 0x14001d4be
mov rcx, rbp
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c116
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx]
and al, 0xf8
cmp al, 0xb8
jne 0x14001c603
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001c138
add eax, 9
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 9
call fcn.14001d8d0
add dword [rbx + 0x10], 9
mov r14d, dword [rsp + 0x2c]
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r12, qword [rsp + 0x30]
jmp 0x14001b0f1
lea rcx, [r13 + 0x18]
mov rdx, r14
call fcn.14001a460
test al, al
je 0x14001b30c
mov rax, qword [r13 + 0x18]
mov rcx, qword [r13 + 0x20]
jmp 0x14001b2e8
cmp ebp, 0xfffffffe
jne 0x14001d4be
add dword [rbx + 0x10], 2
mov rcx, rbx
call fcn.140032e90
mov r8b, byte [rsp + 0x48]
test r8b, r8b
je 0x14001c8af
cmp qword [rsi], 0
mov ecx, dword [rsi + 0x20]
je 0x14001c8e9
mov edx, dword [rsi + 0x30]
cmp ecx, edx
jae 0x14001c962
add r8b, 0xb8
mov rdx, qword [rsi + 0x10]
mov byte [rdx + rcx], r8b
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001c8eb
mov edx, dword [rsi + 0x30]
jmp 0x14001c966
mov dword [rsi + 0x20], ecx
jmp 0x14001b3f6
int3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
lea r8, [rsp + 0x50]
mov rdx, r15
mov r9, qword [rsp + 0x160]
call fcn.140032fc0
test al, al
jne 0x14001d3fc
jmp 0x14001d49b
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d34f
mov rax, qword [rsp + 0x78]
jmp 0x14001b821
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d361
mov rax, qword [rsp + 0x78]
jmp 0x14001b849
mov edx, 8
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d373
mov rax, qword [rsp + 0x78]
jmp 0x14001b875
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d385
mov rax, qword [rsp + 0x78]
jmp 0x14001b8a7
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d397
mov rax, qword [rsp + 0x78]
jmp 0x14001b8cf
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d571
mov rax, qword [rsp + 0x78]
jmp 0x14001b8f7
add r13d, 0xa
mov rcx, r12
mov edx, r13d
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c2fd
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 0xa], 0x50
jne 0x14001aee3
add edx, 0xb
call fcn.14001a280
mov r12, qword [rbx]
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x14001c325
mov rax, qword [r12 + 8]
mov r13d, dword [rbx + 0x10]
cmp byte [rax + r13 + 0xb], 0xc3
jne 0x14001aee3
jmp 0x14001b95d
mov dword [rsi + 0x20], ecx
jmp 0x14001b466
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c357
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xb8
jb 0x14001c382
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c375
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xbf
jbe 0x14001c060
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c397
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x8b
jne 0x14001c3c5
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c3b7
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jae 0x14001c0b4
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c3da
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xf7
jne 0x14001d4be
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c3fe
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
mov cl, byte [rcx + rdx + 1]
and cl, 0xf8
cmp cl, 0xc0
jne 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001c423
add eax, 6
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 6
call fcn.14001d8d0
add dword [rbx + 0x10], 6
jmp 0x14001bd76
mov dword [rsi + 0x20], ecx
jmp 0x14001b532
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001c456
inc ecx
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
jmp 0x14001bcbd
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c478
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0x48
jne 0x14001d4be
add edx, 2
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c49e
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 2], 0x88
jb 0x14001d4be
add edx, 2
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c4c4
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx + 2], 0x8b
ja 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001c4e4
add eax, 3
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 3
call fcn.14001d8d0
add dword [rbx + 0x10], 3
jmp 0x14001bccb
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c512
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0x3d
je 0x14001cd89
mov r14d, dword [rsp + 0x2c]
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001b5a6
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c54b
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x11
je 0x14001bfb2
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c56d
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
jb 0x14001d4be
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c58f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x85
ja 0x14001d4be
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c5b1
mov rax, qword [rcx + 8]
mov ecx, dword [rbx + 0x10]
movzx eax, byte [rax + rcx]
lea rdx, [0x140054bb8]
mov edi, dword [rdx + rax*4 - 0x20c]
lea eax, [rcx + 1]
mov dword [rbx + 0x10], eax
dec dword [rsi + 0x20]
mov rcx, rbx
call fcn.140032e90
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call fcn.14001db40
test al, al
mov r14d, dword [rsp + 0x2c]
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x14001b0f1
jmp 0x14001d4be
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c618
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xc7
jne 0x14001c786
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c63c
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx + 1], 0x44
jne 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001c65c
add eax, 8
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 8
call fcn.14001d8d0
add dword [rbx + 0x10], 8
jmp 0x14001c14a
xor ebp, ebp
jmp 0x14001ba83
mov dword [rsi + 0x20], ecx
jmp 0x14001ba75
mov byte [rsi + 0x34], 0
xor eax, eax
jmp 0x14001ba5b
call qword [sym.imp.mozglue.dll_free]
jmp 0x14001baa8
add rdx, qword [rcx + 0x40]
jmp 0x14001bd56
mov rcx, rbp
call fcn.14001a280
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x14001c6b9
mov rax, qword [rbp + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x85
jne 0x14001c8fc
lea edi, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
lea r12, [r13 + 0x10]
mov rcx, r12
mov rdx, rbp
mov r8d, edi
call fcn.14001d580
lea rcx, [rsp + 0x50]
mov qword [rcx], r12
mov qword [rcx + 8], r13
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.14001d960
mov ebp, eax
lock dec dword [r13 + 8]
jne 0x14001c752
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001c752
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
test ebp, ebp
js 0x14001d4be
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
inc ebp
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001c773
add eax, ebp
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, ebp
call fcn.14001d8d0
add dword [rbx + 0x10], ebp
jmp 0x14001c14a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c79b
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xff
je 0x14001ca4c
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c7bd
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x8d
jne 0x14001cbbd
inc edx
call fcn.14001a280
mov r14, qword [rbx]
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x14001c7e1
mov rax, qword [r14 + 8]
mov ebp, dword [rbx + 0x10]
cmp byte [rax + rbp + 1], 0x3f
ja 0x14001c817
lea edx, [rbp + 1]
mov rcx, r14
call fcn.14001a280
mov r14, qword [rbx]
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x14001c806
mov rax, qword [r14 + 8]
mov ebp, dword [rbx + 0x10]
mov al, byte [rax + rbp + 1]
and al, 7
cmp al, 5
je 0x14001d290
inc ebp
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
lea rdi, [r13 + 0x10]
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.14001d580
lea rcx, [rsp + 0x50]
mov qword [rcx], rdi
mov qword [rcx + 8], r13
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.14001d960
mov ebp, eax
lock dec dword [r13 + 8]
jne 0x14001c75a
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001c75a
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
jmp 0x14001c75a
cmp qword [rsi], 0
mov ecx, dword [rsi + 0x20]
je 0x14001d2e6
mov edx, dword [rsi + 0x30]
cmp ecx, edx
jae 0x14001d2f0
mov rdx, qword [rsi + 0x10]
mov byte [rdx + rcx], 0xa1
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001d2e8
mov edx, dword [rsi + 0x30]
jmp 0x14001d2f4
inc ecx
add ecx, 8
inc ecx
inc ecx
inc ecx
mov dword [rsi + 0x20], ecx
jmp 0x14001c14a
mov rcx, rbp
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c914
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xd1
jne 0x14001c9b1
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c938
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jb 0x14001c9b1
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001c957
add ecx, 2
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
jmp 0x14001cc19
mov byte [rsi + 0x34], 0
lea r8d, [rcx + 8]
cmp r8d, edx
jbe 0x14001ca27
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001cb37
mov rax, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x48
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001c8f0
mov edx, dword [rsi + 0x30]
jmp 0x14001cb3b
cmp eax, r8d
je 0x14001bbfa
jmp 0x14001bc00
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c9c6
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
jne 0x14001cb74
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001c9ea
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jb 0x14001cb74
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001ca0d
add ecx, 3
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
mov r8d, 3
call fcn.14001d8d0
add dword [rbx + 0x10], 3
jmp 0x14001c14a
mov rdx, qword [rsi + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
mov ecx, dword [rsi + 0x20]
add ecx, 8
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001c8ee
mov edx, dword [rsi + 0x30]
jmp 0x14001c977
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ca63
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx + 1], 0x3f
ja 0x14001d4be
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ca88
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx + 1]
and al, 7
cmp al, 5
jne 0x14001d4be
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x14001cab0
mov rdx, qword [rcx + 8]
mov eax, dword [rbx + 0x10]
mov dl, byte [rdx + rax + 1]
and dl, 0x38
cmp dl, 0x20
je 0x14001caea
lea edx, [rax + 1]
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001cad7
mov rcx, qword [rax + 8]
mov eax, dword [rbx + 0x10]
mov cl, byte [rcx + rax + 1]
and cl, 0x38
cmp cl, 0x10
jne 0x14001d4be
add eax, 2
mov dword [rbx + 0x10], eax
dec dword [rsi + 0x20]
mov rcx, qword [rbx]
mov edx, dword [rbx + 0x10]
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cb10
mov rax, qword [rcx + 8]
mov ecx, dword [rbx + 0x10]
mov al, byte [rax + rcx + 1]
and al, 0x38
xor r12d, r12d
cmp al, 0x20
sete r12b
mov edi, 4
sub edi, r12d
mov rcx, rbx
call fcn.140032ee0
jmp 0x14001c5d7
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001cc2d
mov rax, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x8b
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001c8f2
mov dl, byte [rsp + 0x48]
lea eax, [rdx*8]
or al, dl
mov edx, dword [rsi + 0x30]
jmp 0x14001cc41
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cb89
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xc3
jne 0x14001cc5a
add rdx, qword [rcx + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001cba7
inc eax
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
inc dword [rbx + 0x10]
jmp 0x14001c14a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cbd2
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x63
jne 0x14001d4be
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001cbf6
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rcx + rdx + 1], 0xc0
jb 0x14001d4be
add rdx, qword [rax + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001cc16
add eax, 2
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, 2
call fcn.14001d8d0
add dword [rbx + 0x10], 2
jmp 0x14001c14a
mov byte [rsi + 0x34], 0
mov r8b, byte [rsp + 0x48]
lea eax, [r8*8]
or al, r8b
cmp ecx, edx
jae 0x14001d2fd
mov rdx, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rdx + rcx], al
inc dword [rsi + 0x20]
jmp 0x14001c14a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cc6f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xcc
je 0x14001cb96
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cc91
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xe8
je 0x14001d319
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ccb3
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xe9
je 0x14001d319
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ccd5
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x73
jb 0x14001ce0a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ccf7
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x75
ja 0x14001ce0a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001cd19
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
movzx eax, byte [rax + rdx]
lea r8, [0x140054bb8]
mov ebp, dword [r8 + rax*4 - 0x1cc]
inc edx
call fcn.14001a280
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001cd46
mov rcx, qword [rax + 8]
mov edx, dword [rbx + 0x10]
movzx ecx, byte [rcx + rdx + 1]
add edx, 2
mov dword [rbx + 0x10], edx
add rdx, rcx
add rdx, qword [rax + 0x40]
mov rcx, rsi
mov r8d, ebp
call fcn.14001db40
test al, al
mov r14d, dword [rsp + 0x2c]
lea r15, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r12, qword [rsp + 0x30]
jne 0x14001b0f1
jmp 0x14001d4be
lea eax, [rdx + 2]
mov dword [rbx + 0x10], eax
cmp qword [rsi], 0
mov eax, dword [rsi + 0x20]
jne 0x14001cde1
inc eax
inc eax
mov dword [rsi + 0x20], eax
mov rcx, rbx
call fcn.140032e90
cmp qword [rsi], 0
mov ecx, dword [rsi + 0x20]
je 0x14001cea5
mov edx, dword [rsi + 0x30]
cmp ecx, edx
jae 0x14001cf11
mov rdx, qword [rsi + 0x10]
mov byte [rdx + rcx], 0x49
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001cea7
mov edx, dword [rsi + 0x30]
jmp 0x14001cf15
mov ecx, dword [rsi + 0x30]
cmp eax, ecx
jae 0x14001cf9a
mov rcx, qword [rsi + 0x10]
mov byte [rcx + rax], 0x49
mov eax, dword [rsi + 0x20]
inc eax
mov dword [rsi + 0x20], eax
cmp qword [rsi], 0
je 0x14001cd9a
mov ecx, dword [rsi + 0x30]
jmp 0x14001cf9e
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ce1f
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0xff
je 0x14001d0d6
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ce41
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
cmp byte [rax + rdx], 0x83
jne 0x14001cfdf
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001ce65
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0x60
jne 0x14001cfdf
mov rax, qword [rcx + 0x40]
add rax, rdx
mov ecx, dword [rsi + 0x20]
cmp ecx, dword [rsi + 0x28]
jne 0x14001ce8b
add ecx, 5
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov rdx, rax
mov r8d, 5
call fcn.14001d8d0
add dword [rbx + 0x10], 5
jmp 0x14001c14a
inc ecx
inc ecx
add ecx, 8
inc ecx
inc ecx
inc ecx
mov dword [rsi + 0x20], ecx
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
cmp ecx, dword [rsi + 0x28]
jne 0x14001cec9
inc ecx
mov dword [rsi + 0x28], ecx
mov rcx, rsi
mov r8d, 1
call fcn.14001d8d0
inc dword [rbx + 0x10]
cmp qword [rsi], 0
mov eax, dword [rsi + 0x20]
je 0x14001cf05
mov ecx, dword [rsi + 0x30]
cmp eax, ecx
jae 0x14001cf3a
mov rcx, qword [rsi + 0x10]
mov byte [rcx + rax], 0x49
mov eax, dword [rsi + 0x20]
inc eax
mov dword [rsi + 0x20], eax
cmp qword [rsi], 0
je 0x14001cf07
mov ecx, dword [rsi + 0x30]
jmp 0x14001cf3e
inc eax
inc eax
mov dword [rsi + 0x20], eax
jmp 0x14001bd76
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001cf54
mov rdx, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rdx + rcx], 0xbb
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001cea9
mov edx, dword [rsi + 0x30]
jmp 0x14001cf58
mov byte [rsi + 0x34], 0
cmp eax, ecx
jae 0x14001cf91
mov rcx, qword [rsi + 0x10]
mov eax, eax
mov byte [rcx + rax], 0x5b
inc dword [rsi + 0x20]
jmp 0x14001bd76
mov byte [rsi + 0x34], 0
lea r8d, [rcx + 8]
cmp r8d, edx
jbe 0x14001cfb4
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001d0a6
mov rax, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x41
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001ceae
mov edx, dword [rsi + 0x30]
jmp 0x14001d0aa
mov byte [rsi + 0x34], 0
jmp 0x14001bd76
mov byte [rsi + 0x34], 0
cmp eax, ecx
jae 0x14001cfd6
mov rcx, qword [rsi + 0x10]
mov eax, eax
mov byte [rcx + rax], 0x53
inc dword [rsi + 0x20]
jmp 0x14001cd9f
mov rdx, qword [rsi + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
mov ecx, dword [rsi + 0x20]
add ecx, 8
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001ceac
mov edx, dword [rsi + 0x30]
jmp 0x14001cf65
mov byte [rsi + 0x34], 0
jmp 0x14001cd9f
call fcn.14001a280
mov r14, qword [rbx]
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x14001cff4
mov rax, qword [r14 + 8]
mov ebp, dword [rbx + 0x10]
cmp byte [rax + rbp], 0xc6
jne 0x14001d4be
inc ebp
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
lea rdi, [r13 + 0x10]
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.14001d580
lea rcx, [rsp + 0x50]
mov qword [rcx], rdi
mov qword [rcx + 8], r13
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.14001d960
mov ebp, eax
lock dec dword [r13 + 8]
jne 0x14001d08c
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001d08c
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
test ebp, ebp
js 0x14001d4be
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
add ebp, 2
jmp 0x14001c766
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001d175
mov rax, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x80
mov ecx, dword [rsi + 0x20]
inc ecx
mov dword [rsi + 0x20], ecx
cmp qword [rsi], 0
je 0x14001ceb0
mov edx, dword [rsi + 0x30]
jmp 0x14001d179
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001d0ed
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
mov r12b, byte [rax + rdx + 1]
inc edx
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001d10c
mov rax, qword [rcx + 8]
mov edx, dword [rbx + 0x10]
movzx edi, byte [rax + rdx + 1]
inc edx
call fcn.14001a280
mov r14, qword [rbx]
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x14001d12b
mov rax, qword [r14 + 8]
shr edi, 3
and edi, 7
mov ebp, dword [rbx + 0x10]
mov dl, byte [rax + rbp + 1]
and dl, 7
cmp r12b, 0xc0
jb 0x14001d198
cmp edi, 6
ja 0x14001d3a9
mov eax, 0x47
bt eax, edi
jae 0x14001d3a9
add rbp, qword [r14 + 0x40]
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001d16a
add eax, 2
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov rdx, rbp
jmp 0x14001cc19
mov byte [rsi + 0x34], 0
cmp ecx, edx
jae 0x14001d18f
mov rax, qword [rsi + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x3b
mov ecx, dword [rsi + 0x20]
jmp 0x14001ceb0
mov byte [rsi + 0x34], 0
jmp 0x14001ceb5
cmp r12b, 0x40
setb al
cmp dl, 5
sete cl
cmp r12b, 0x3f
ja 0x14001d1ba
cmp dil, 2
jne 0x14001d1ba
cmp dl, 5
je 0x14001d3b6
cmp dil, 4
jne 0x14001d4be
and al, cl
cmp al, 1
je 0x14001d3d5
inc ebp
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x140052420]
mov qword [r13], rax
lea rdi, [r13 + 0x10]
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.14001d580
lea rcx, [rsp + 0x50]
mov qword [rcx], rdi
mov qword [rcx + 8], r13
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.14001d960
mov ebp, eax
lock dec dword [r13 + 8]
jne 0x14001d259
mov rdi, r13
add rdi, 0xc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [0x140067010]
lock dec dword [rdi]
jne 0x14001d259
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [0x140067010]
test ebp, ebp
js 0x14001d4be
mov rax, qword [rbx]
mov edx, dword [rbx + 0x10]
add rdx, qword [rax + 0x40]
inc ebp
mov eax, dword [rsi + 0x20]
cmp eax, dword [rsi + 0x28]
jne 0x14001d27a
add eax, ebp
mov dword [rsi + 0x28], eax
mov rcx, rsi
mov r8d, ebp
call fcn.14001d8d0
add dword [rbx + 0x10], ebp
mov r12b, 1
jmp 0x14001bd76
lea edx, [rbp + 1]
mov rcx, r14
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001d2ab
mov rax, qword [rcx + 8]
mov ecx, dword [rbx + 0x10]
mov dil, byte [rax + rcx + 1]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], eax
mov rcx, rbx
call fcn.140032e90
cmp qword [rsi], 0
mov ecx, dword [rsi + 0x20]
je 0x14001d2e6
mov edx, dword [rsi + 0x30]
cmp ecx, edx
jae 0x14001d2f0
shr dil, 3
or dil, 0xb8
mov rdx, qword [rsi + 0x10]
mov byte [rdx + rcx], dil
jmp 0x14001c8cf
inc ecx
add ecx, 8
jmp 0x14001c8f4
mov byte [rsi + 0x34], 0
lea r8d, [rcx + 8]
cmp r8d, edx
jbe 0x14001d306
mov byte [rsi + 0x34], 0
jmp 0x14001c14a
mov rdx, qword [rsi + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
add dword [rsi + 0x20], 8
jmp 0x14001c14a
call fcn.14001a280
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14001d32e
mov rax, qword [rcx + 8]
mov ecx, dword [rbx + 0x10]
xor r12d, r12d
cmp byte [rax + rcx], 0xe9
sete r12b
lea eax, [rcx + 1]
mov dword [rbx + 0x10], eax
mov edi, 4
sub edi, r12d
jmp 0x14001c5cf
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0x78]
jmp 0x14001b83b
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0x78]
jmp 0x14001b863
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0x78]
jmp 0x14001b899
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0x78]
jmp 0x14001b8c1
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0x78]
jmp 0x14001b8e9
cmp dl, 5
sete cl
xor eax, eax
jmp 0x14001d1ba
add ebp, 2
mov dword [rbx + 0x10], ebp
mov rcx, rbx
call fcn.140032ee0
mov rcx, rsi
mov rdx, rax
mov r8d, 4
jmp 0x14001cd61
add ebp, 2
mov dword [rbx + 0x10], ebp
mov rcx, rbx
call fcn.140032ee0
mov rcx, rsi
mov rdx, rax
mov r8d, 3
call fcn.14001db40
mov r12b, 1
jmp 0x14001c5e5
mov rax, qword [rsp + 0x168]
mov qword [rax], r15
cmp qword [rsp + 0xc0], 0
je 0x14001d4f1
cmp byte [rsp + 0xa8], 0
je 0x14001d4f1
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14001d49b
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x14001d4f1
mov edx, dword [rsp + 0x6c]
add rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x70]
lea r9, [rsp + 0x48]
mov qword [r9], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r9
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001d4f1
cmp qword [rsp + 0x48], rdi
jne 0x14001d4f1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x78]
add dword [rsp + 0x6c], eax
mov qword [rsp + 0x78], 0
mov rcx, rbx
call fcn.14001d7d0
lea rax, [rsp + 0xd0]
mov rcx, qword [rax - 0x18]
cmp rcx, rax
jne 0x14001d513
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
jne 0x14001d51b
mov rax, qword [rsp + 0x168]
cmp qword [rax], 0
je 0x14001d502
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x168]
mov qword [rax], 0
jmp 0x14001d49b
mov dword [rsi + 0x20], 0
mov rcx, rsi
call fcn.140030f60
jmp 0x14001d4cc
call qword [sym.imp.mozglue.dll_free]
jmp 0x14001d4b4
call qword [sym.imp.mozglue.dll_free]
jmp 0x14001d4be
inc qword [rsp + 0x78]
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
mov eax, eax
cmp qword [rsp + 0x60], rax
jbe 0x14001d3fc
mov rax, qword [rsp + 0x78]
cmp rax, qword [rsp + 0x80]
je 0x14001d559
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0x90
jmp 0x14001d523
mov edx, 1
mov rcx, rdi
call fcn.14001a460
test al, al
je 0x14001d571
mov rax, qword [rsp + 0x78]
jmp 0x14001d54e
mov byte [rsp + 0xa8], 0
mov eax, dword [rsp + 0x68]
jmp 0x14001d532