Function at 0x140036620
Capabilities:
Access the windows event log
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7f8
movaps xmmword [rsp + 0x7e0], xmm6
mov r12, r8
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x7d8], rax
movsxd rax, dword [rcx]
cmp rax, 0xb
ja 0x140036702
lea rcx, [0x14006c260]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x320], 0
mov qword [rsp + 0x338], 0xf
mov byte [rsp + 0x320], 0
mov r14, qword [rax]
mov rdi, qword [rax + 8]
cmp rdi, 0xf
jbe 0x14003672a
test rdi, rdi
js 0x14003accb
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003ad2c
lea rcx, [rbx + 1]
call fcn.140056c48
mov r15, rax
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0x338], rbx
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
mov qword [rsp + 0x320], r15
jmp 0x140036749
xor eax, eax
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x338], 0xf
mov qword [rsp + 0x330], rax
mov byte [rsp + 0x320], 0
jmp 0x140036749
lea rcx, [rsp + 0x320]
mov qword [rcx + 0x10], rdi
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x320], 0
mov r13, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140036757
mov rsi, qword [rsi]
cmp r13, 0xf
ja 0x14003676f
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x300], xmm0
mov edi, 0xf
jmp 0x1400367c7
mov rdi, r13
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x1400367a7
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400367b3
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x300], rcx
lea r8, [r13 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x310], r13
mov qword [rsp + 0x318], rdi
cmp dword [r12], 0
mov qword [rsp + 0x2f8], 0xf
jne 0x14003680f
mov dword [rsp + 0x2e3], 0x6c616974
mov dword [rsp + 0x2e0], 0x74696e69
mov byte [rsp + 0x2e7], 0
mov eax, 7
jmp 0x14003682e
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x2e8], 0
mov eax, 8
mov qword [rsp + 0x2f0], rax
mov eax, dword [r12 + 4]
cmp eax, 2
je 0x14003687e
cmp eax, 1
jne 0x1400368bc
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 5
mov dword [rsp + 0x2c0], 0x776f6873
mov byte [rsp + 0x2c4], 0x6e
jmp 0x1400368b5
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 5
mov dword [rsp + 0x2c0], 0x6f727265
mov byte [rsp + 0x2c4], 0x72
mov eax, 5
jmp 0x1400368f3
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2c0], rax
mov byte [rsp + 0x2c8], 0x6e
mov eax, 9
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x98], rdi
mov byte [rsp + rax + 0x2c0], 0
mov edx, dword [r12 + 8]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x80], rcx
call fcn.140030080
lea rsi, [rsp + 0x4b4]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov qword [rsp + 0x60], r13
jne 0x140036a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbp, str.GetOSVersion
mov rcx, r13
mov edx, r14d
mov r8, rbp
mov r9d, 0x5e
call fcn.140059a40
cdqe
lea rsi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x5e
mov rcx, rdi
mov rdx, rsi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036a51
mov rsi, rax
lea rax, [rsp + 0x340]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
test r14d, r14d
jne 0x140037018
xor edi, edi
xor esi, esi
xor r13d, r13d
xor ebx, ebx
jmp 0x140036ddd
lea rax, [0x14006c240]
lea r14, [rsp + 0x3c8]
mov qword [r14 - 0x88], rax
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c248]
mov qword [r14], rax
mov rax, qword [r14 - 0x88]
movsxd rax, dword [rax + 4]
lea rbp, [0x14006c238]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [r14 - 0x88]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x33c], ecx
lea r15, [rsp + 0x348]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c258]
mov qword [rsp + rax + 0x340], rcx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x33c], ecx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x340
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x33c], esi
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006c1c0]
mov qword [r15], rax
mov qword [r15 + 0x68], 0
mov dword [r15 + 0x70], 4
mov edx, dword [rsp + 0x4b4]
mov rdi, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x340]
call rdi
lea rsi, [0x1400a26f9]
mov rcx, rax
mov rdx, rsi
call fcn.14005b310
mov edx, dword [rsp + 0x4b8]
mov rcx, rax
call rdi
mov rcx, rax
mov rdx, rsi
call fcn.14005b310
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call rdi
cmp dword [rsp + 0x4b4], 0xa
jne 0x140036c14
cmp dword [rsp + 0x4b8], 0
jne 0x140036c14
lea rax, [rsp + 0x208]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x728]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a4a52]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400377c0
mov qword [rsp + 0x728], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov eax, dword [rsp + 0x3b8]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x140037917
mov rcx, qword [rsp + 0x388]
mov rdx, qword [rcx]
test rdx, rdx
je 0x140037917
lea rax, [rsp + 0x368]
mov rcx, qword [rax + 0x48]
cmp rdx, rcx
cmovb rdx, rcx
mov rax, qword [rax]
mov r13, qword [rax]
test r13, r13
je 0x14003acd0
sub rdx, r13
cmp rdx, 0xf
jbe 0x1400377e9
test rdx, rdx
js 0x14003accb
mov rbx, rdx
mov rax, rdx
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov rdi, rcx
cmp rcx, 0xfff
jae 0x14003acda
inc rcx
call fcn.140056c48
mov rsi, rax
mov rcx, rsi
mov rdx, r13
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov qword [rsp + 0x728], rsi
mov rsi, rbx
mov rbx, qword [rsp + 0x728]
mov rax, qword [rsp + 0x340]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [rsp + 0x340]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x33c], ecx
lea rax, [0x14006c1c0]
mov qword [rsp + 0x348], rax
test byte [rsp + 0x3b8], 1
je 0x140036d79
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003acf4
mov rcx, qword [rsp + rcx + 0x340]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x360]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003ad09
call fcn.140056c84
mov rax, qword [rsp + 0x360]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x380]
mov qword [rax], rcx
mov rax, qword [rsp + 0x398]
mov dword [rax], ecx
mov rax, qword [rsp + 0x368]
mov qword [rax], rcx
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a0]
mov dword [rax], ecx
mov qword [rsp + 0x3b0], rcx
and byte [rsp + 0x3b8], 0xfe
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x298], rdi
lea rsi, [rsp + 0x4b0]
mov r8d, 0xaa
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x1400371aa
lea rsi, [rsp + 0x340]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.140030a30
cmp dword [rsi + 0x20], 0
jne 0x140037aea
mov rbp, qword [rsp + 0x340]
mov rax, qword [rsp + 0x348]
mov rdi, qword [rsp + 0x350]
mov r15, qword [rsp + 0x358]
mov byte [rsp + 0x340], 0
mov qword [rsp + 0x350], 0
mov qword [rsp + 0x260], rbp
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], r15
xor eax, eax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], 0xf
mov byte [rsp + 0x240], 0
lea r8, str.PrevNotificationAction
lea r13, [rsp + 0x4b0]
mov rcx, r13
mov edx, 1
xor r9d, r9d
call fcn.14002e710
lea rsi, [rsp + 0x4d8]
mov r14d, dword [rsi]
test r14d, r14d
je 0x1400372c1
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x177
call fcn.14002cc90
cmp dword [rsp + 0x4d8], 0
je 0x140037326
test r14d, r14d
jns 0x140037338
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x140036f8a
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036f85
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140036fd1
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036fcc
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r8, qword [rsp + 0x298]
cmp r8, 0x10
jb 0x140037018
mov rcx, qword [rsp + 0x280]
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140037013
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ad26
add r8, 0x28
mov rdx, r8
mov rcx, rax
call fcn.140056c84
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x14003705f
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003705a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x1400370a6
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400370a1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x1400370ed
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400370e8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x140037134
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003712f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jb 0x14003717b
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037176
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rcx, qword [rsp + 0x7d8]
xor rcx, rsp
call fcn.140057bf0
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r8, str.GetOSLocale
mov rcx, rdi
mov edx, r14d
mov r9d, 0x66
call fcn.140059a40
cdqe
lea rsi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetOSLocale
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x66
mov rcx, r15
mov rdx, rsi
mov r8, 0xffffffffffffffff
mov r9, rdi
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400372a3
mov rsi, rax
lea rax, [rsp + 0x340]
mov qword [rax], r15
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
test r14d, r14d
je 0x1400377b2
mov r8, qword [rsp + 0x88]
jmp 0x140036fd9
mov rdx, rsi
lea rsi, [rsp + 0x368]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
jne 0x1400374dc
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x240], rax
mov word [rsp + 0x248], 0x6e
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
jmp 0x140038bcb
lea rcx, [rsp + 0x4b0]
call fcn.14005b250
jmp 0x140036f3a
cmp dword [r12 + 4], 1
jne 0x1400373f8
mov r14, rsi
mov edx, dword [r12 + 8]
mov rcx, r13
call fcn.140030080
cmp qword [rsp + 0x4c8], 0x10
jb 0x140037367
mov r13, qword [rsp + 0x4b0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x340]
mov rcx, rsi
mov r8, r13
xor r9d, r9d
call fcn.14002db50
mov eax, dword [rsi]
test eax, eax
je 0x1400373ae
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x196
call fcn.14002cc90
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
mov rsi, r14
jb 0x1400373f8
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400373f3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r13, rsi
xor eax, eax
lea rsi, [rsp + 0x208]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.14005ab20
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x14003793f
lea rdx, [rax + 8]
mov qword [rsp + 0x218], rdx
cmp rcx, 8
jb 0x14003745f
mov rsi, qword [rsp + 0x208]
movups xmm0, xmmword [str._version]
movups xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4b0], 0
mov qword [rsp + 0x4c8], 7
mov qword [rsp + 0x4c0], 1
mov dword [rsp + 0x4b0], 0x32
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x220]
cmp rcx, rax
je 0x140037966
lea rdx, [rax + 1]
mov qword [rsp + 0x218], rdx
cmp rcx, 8
jb 0x140037639
mov rcx, qword [rsp + 0x208]
jmp 0x140037641
lea rcx, [rsp + 0x340]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.14005b1a0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rsp + 0x240]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
lea rdx, str.dismissed_by_timeout
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.dismissed_to_action_center
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.dismissed_by_button
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.dismissed_by_application_hidden
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.remind_me_later
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.make_firefox_default_button
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.toast_clicked
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038bcb
lea rdx, str.no_action
lea rsi, [rsp + 0x240]
mov rcx, rsi
call fcn.14005b2c0
test al, al
je 0x140038bcb
mov rax, qword [rsp + 0x258]
cmp rax, 9
jae 0x140038b9e
mov ecx, 0x10
call fcn.140056c48
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
movabs rcx, 0x6f697463612d6f6e
mov qword [rax], rcx
mov word [rax + 8], 0x6e
mov qword [rsp + 0x240], rax
jmp 0x140038bcb
lea rcx, [rsp + 0x208]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x14003769c
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037697
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], 2
mov dword [rsp + 0x238], 0
lea rcx, [0x1400a161d]
lea rdx, str.DisableTelemetry
call fcn.140030250
test al, al
je 0x14003770d
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x2e0]
lea r8, [rsp + 0x2c0]
lea r9, [rsp + 0x2a0]
call fcn.140036000
mov r14d, eax
jmp 0x14003775b
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x728]
mov rcx, rsi
mov edx, 1
call fcn.140031390
mov r14d, dword [rsi + 0x10]
test r14d, r14d
je 0x140037822
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0xf9
call fcn.14002cc90
mov rax, qword [rsp + 0x220]
cmp rax, 8
jb 0x140036f43
mov rcx, qword [rsp + 0x208]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400377a8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x140036f43
xor r15d, r15d
xor edi, edi
xor eax, eax
xor ebp, ebp
jmp 0x140036e8e
lea rdx, [0x1400a26f9]
lea rcx, [rsp + 0x340]
call fcn.14005b310
mov edx, dword [rsp + 0x728]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036c14
mov rdi, rdx
lea rsi, [rsp + 0x728]
mov qword [rsi + 0x10], rdx
mov rcx, rsi
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x728], 0
mov r13, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov rdi, qword [rsi + 0x18]
mov rsi, rax
jmp 0x140036ce4
mov qword [rsp + 0x90], rbx
mov r14, qword [rsp + 0x728]
mov r12b, byte [rsp + 0x730]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [rsi]
test r12b, r12b
je 0x140037888
mov rax, rbx
test rbx, rbx
jne 0x14003786f
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
sub rax, r14
jbe 0x1400376d6
shr rax, 9
cmp rax, 0x6388fc53
jb 0x1400376d6
mov qword [rsp + 0x6c0], rbx
xor esi, esi
lea r14, [rsp + 0x4b0]
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov ebx, 7
mov qword [r14 + 0x18], rbx
mov word [r14], si
lea r9, str.LastPingSentAt
mov edx, 0xe
mov rcx, r14
call fcn.14005ab20
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x350], xmm1
movaps xmmword [rsp + 0x340], xmm0
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rbx
mov word [r14], si
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, r14
call fcn.14005ab20
cmp qword [rsp + 0x358], 8
jb 0x14003798e
mov r8, qword [rsp + 0x340]
jmp 0x140037996
test al, 4
jne 0x14003acd0
mov edi, 0xf
mov rax, qword [rsp + 0x380]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14003ad46
xor esi, esi
jmp 0x140036ce4
mov qword [rsp + 0x20], 8
lea r9, str._version
lea rcx, [rsp + 0x208]
mov edx, 8
call fcn.14005ac50
jmp 0x140037471
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea r9, [rsp + 0x4b0]
mov edx, 1
call fcn.14005ac50
jmp 0x14003764e
lea r8, [rsp + 0x340]
cmp qword [rsp + 0x4c8], 8
jb 0x1400379a9
mov r14, qword [rsp + 0x4b0]
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, r14
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
test eax, eax
jne 0x1400384a6
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x140037a2c
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037a27
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x358]
cmp rax, 8
jb 0x140037a7a
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037a75
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
test ebx, ebx
je 0x140037aa6
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x109
call fcn.14002cc90
lea rcx, [rsp + 0x208]
lea rsi, [rsp + 0x490]
mov rdx, rsi
call fcn.14002c400
mov r14d, dword [rsi]
test r14d, r14d
je 0x140037af9
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r14d
jmp 0x140038682
mov r15d, 0xf
xor ebp, ebp
xor edi, edi
jmp 0x140036e8e
lea rcx, [rsp + 0x208]
mov r8d, dword [rcx + 0x2c]
lea rsi, [rsp + 0x7b8]
mov rdx, rsi
call fcn.14002d8d0
mov eax, 0x90
lea rcx, [rsp + 0x340]
add rcx, rax
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x58], rax
xor r14d, r14d
xorps xmm6, xmm6
xor r12d, r12d
cmp dword [rsp + 0x238], 0
je 0x14003841c
mov qword [rsp + 0x730], r14
mov qword [rsp + 0x740], r14
mov eax, 0xf
mov qword [rsp + 0x748], rax
mov byte [rsp + 0x730], r14b
mov qword [rsp + 0x750], r14
mov qword [rsp + 0x760], r14
mov qword [rsp + 0x768], rax
mov byte [rsp + 0x750], r14b
mov qword [rsp + 0x770], r14
mov qword [rsp + 0x780], r14
mov qword [rsp + 0x788], rax
mov byte [rsp + 0x770], r14b
mov byte [rsp + 0x7b0], r14b
cmp qword [rsp + 0x7d0], 8
mov r8, rsi
jb 0x140037bd4
mov r8, qword [rsp + 0x7b8]
lea rcx, [rsp + 0x340]
lea rdx, str.CacheEntryVersion
call fcn.14002c990
mov ebx, dword [rsp + 0x348]
test ebx, ebx
jne 0x140038443
mov rax, qword [rsp + 0x340]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x14003827b
mov dword [rsp + 0x728], eax
test eax, eax
je 0x1400382f8
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x6f0]
mov r8, rsi
lea r9, str.NotificationType
call fcn.14002e540
mov esi, dword [rsp + 0x718]
test esi, esi
jne 0x140038358
movaps xmmword [rsp + 0x6d0], xmm6
movaps xmmword [rsp + 0x6c0], xmm6
mov byte [rsp + 0x6e0], 0
lea rcx, [rsp + 0x6e8]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
mov esi, 4
cmp byte [rsp + 0x6e0], 0
je 0x1400383d5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jb 0x140037cec
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037ce7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a35b0]
call fcn.14002e540
cmp dword [rsp + 0x718], 0
jne 0x140037d4b
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x140037da5
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp byte [rsp + 0x6e0], 0
je 0x1400383d5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jb 0x140037e6b
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037e66
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x20], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a362a]
call fcn.14002e540
cmp dword [rsp + 0x718], 0
jne 0x140037ecb
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x140037f25
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp byte [rsp + 0x6e0], 0
je 0x1400383d5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jb 0x140037feb
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037fe6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x70], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, str.PrevNotificationAction
call fcn.14002e540
cmp dword [rsp + 0x718], 0
jne 0x140038059
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x1400380b3
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400383b4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp dword [rsp + 0x70], 2
jb 0x140038124
cmp byte [rsp + 0x6e0], 0
je 0x1400383d5
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x6c0]
call fcn.14005b730
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x470]
call fcn.14002e420
mov esi, dword [rsp + 0x470]
test esi, esi
jne 0x1400383fe
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x728]
call fcn.14003d4a0
mov bl, 1
mov byte [rsp + 0x3d0], bl
mov r8d, 0x91
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x368]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsp + 0x358], r14
mov edx, 0xf
mov qword [rsp + 0x360], rdx
mov byte [rsp + 0x348], r14b
lea rax, [rsp + 0x368]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm1
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x380], rdx
mov byte [rsp + 0x368], r14b
movups xmm0, xmmword [rcx + 0x20]
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rsi + 0x48], xmm0
movups xmmword [rsi + 0x58], xmm1
mov qword [rsp + 0x398], r14
mov qword [rsp + 0x3a0], rdx
mov byte [rsp + 0x388], r14b
movups xmmword [rsi + 0x68], xmm6
movups xmmword [rsi + 0x78], xmm6
mov byte [rsi + 0x88], r14b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
call fcn.14005b4d0
mov byte [rsp + 0x540], bl
cmp byte [rsp + 0x3d0], r14b
je 0x14003826b
lea rcx, [rsp + 0x340]
call fcn.14002d7c0
mov dword [rsp + 0x550], 0
jmp 0x1400383d0
cmp qword [rsp + 0x7d0], 8
mov rax, rsi
jb 0x140038291
mov rax, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1bb
call fcn.14002cc90
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x6f0]
call fcn.14002e420
mov ebx, dword [rsp + 0x6f0]
test ebx, ebx
jne 0x1400385f8
lea rcx, [rsp + 0x728]
call fcn.14002d7c0
jmp 0x140038397
cmp qword [rsp + 0x7d0], 8
jb 0x14003830b
mov rsi, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x208
call fcn.14002cc90
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
call fcn.14002e420
mov esi, dword [rsp + 0x340]
test esi, esi
je 0x1400383ad
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], esi
mov esi, 1
lea rcx, [rsp + 0x728]
call fcn.14002d7c0
cmp esi, 4
lea rsi, [rsp + 0x7b8]
jne 0x140038623
inc r12d
cmp r12d, dword [rsp + 0x230]
jbe 0x140037b43
jmp 0x14003845f
mov esi, 4
jmp 0x140038379
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], ebx
mov esi, 1
lea rcx, [rsp + 0x6c0]
call fcn.14005b250
cmp dword [rsp + 0x718], 0
jne 0x140038379
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
jmp 0x140038379
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], esi
jmp 0x1400383d0
lea rsi, [rsp + 0x4b0]
mov r8d, 0x91
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0
jmp 0x140038623
cmp qword [rsp + 0x7d0], 8
jb 0x1400385bb
mov rax, qword [rsp + 0x7b8]
jmp 0x1400385c3
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24c
call fcn.14002cc90
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
jmp 0x140038623
mov qword [rsp + 0x78], rdi
movzx r14d, bx
or r14d, 0x80070000
test ebx, ebx
cmovle r14d, ebx
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x58], rax
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegistrySetValueQword
mov edx, r14d
mov r8, rdi
mov r9d, 0xee
call fcn.140059a40
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x70], rcx
lea rsi, [rax + rax]
add rsi, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rsi, rax
mov rcx, rsi
call fcn.140056c40
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0xee
mov rcx, r12
mov rdx, qword [rsp + 0x70]
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400385a9
mov rsi, rax
lea rax, [rsp + 0x6f0]
mov qword [rax], r12
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140056c84
mov rdi, qword [rsp + 0x78]
jmp 0x1400379de
lea rax, [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b5
call fcn.14002cc90
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], ebx
lea rcx, [rsp + 0x728]
call fcn.14002d7c0
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x140038671
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003866c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r14d, dword [rsp + 0x550]
test r14d, r14d
je 0x1400387b3
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x15c
call fcn.14002cc90
mov r12, rdi
cmp dword [rsp + 0x550], 0
jne 0x1400386cb
cmp byte [rsp + 0x540], 0
je 0x1400386cb
lea rcx, [rsp + 0x4b0]
call fcn.14002d7c0
test r14d, r14d
js 0x14003775b
mov rax, qword [rsp + 0x50]
movsxd rbx, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov edx, 1
xor r9d, r9d
call fcn.14002e710
mov r14d, dword [rsi + 0x28]
test r14d, r14d
je 0x140038be5
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x11f
call fcn.14002cc90
xor esi, esi
xor ebx, ebx
xor r13d, r13d
xor edi, edi
cmp dword [rsp + 0x4d8], 0
je 0x140038cbb
test r14d, r14d
jne 0x14003775b
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], r13
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x1c0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov rsi, qword [rsp + 0x250]
cmp qword [rsp + 0x258], 0x10
jb 0x140038d03
mov r14, qword [rsp + 0x240]
jmp 0x140038d0b
xor r14d, r14d
lea rcx, [rsp + 0x340]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x540], 0
je 0x1400386a7
lea r12, [rsp + 0x3d0]
mov eax, dword [rsp + 0x4b0]
mov dword [r12 - 0x90], eax
lea rcx, [rsp + 0x4b0]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movups xmmword [r12 - 0x88], xmm0
movups xmmword [r12 - 0x78], xmm1
xor esi, esi
mov qword [rsp + 0x4c8], rsi
mov eax, 0xf
mov qword [rsp + 0x4d0], rax
mov byte [rsp + 0x4b8], sil
movups xmm0, xmmword [r13]
movups xmm1, xmmword [r13 + 0x10]
movups xmmword [r12 - 0x68], xmm0
movups xmmword [r12 - 0x58], xmm1
mov qword [rsp + 0x4e8], rsi
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x4d8], sil
movups xmm0, xmmword [rcx + 0x48]
movups xmm1, xmmword [rcx + 0x58]
movups xmmword [r12 - 0x48], xmm0
movups xmmword [r12 - 0x38], xmm1
mov qword [rsp + 0x508], rsi
mov qword [rsp + 0x510], rax
mov byte [rsp + 0x4f8], sil
mov byte [r12 - 8], sil
xorps xmm0, xmm0
movups xmmword [r12 - 0x18], xmm0
movups xmmword [r12 - 0x28], xmm0
mov rcx, r12
mov rdx, qword [rsp + 0x58]
call fcn.14005b4d0
mov byte [r12], 1
cmp byte [rsp + 0x540], sil
je 0x1400388dd
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.14002d7c0
mov byte [rsi + 0x90], 0
cmp byte [rsp + 0x3d0], 0
je 0x1400386a7
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x2e0]
lea r8, [rsp + 0x2c0]
lea r9, [rsp + 0x2a0]
call fcn.140036000
cmp byte [rsp + 0x3d0], 0
je 0x14003ab99
lea rsi, [rsp + 0x728]
lea r12, [rsp + 0x340]
mov rcx, rsi
mov rdx, r12
call fcn.14003d4a0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movaps xmmword [rsp + 0x2e0], xmm0
movaps xmmword [rsp + 0x2f0], xmm1
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], 0xf
mov byte [rsi + 8], 0
mov rcx, rsi
call fcn.14002d7c0
cmp byte [r12 + 0x90], 0
je 0x14003ab99
lea rsi, [rsp + 0x728]
lea r12, [rsp + 0x340]
mov rcx, rsi
mov rdx, r12
call fcn.14003d4a0
movups xmm0, xmmword [rsi + 0x28]
movups xmm1, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmmword [rsp + 0x2d0], xmm1
mov qword [rsi + 0x38], 0
mov qword [rsi + 0x40], 0xf
mov byte [rsi + 0x28], 0
mov rcx, rsi
call fcn.14002d7c0
cmp byte [r12 + 0x90], 0
je 0x14003ab99
lea rcx, [rsp + 0x728]
lea rdx, [rsp + 0x340]
call fcn.14003d4a0
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x140038a35
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038a30
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rax, [rsp + 0x730]
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmmword [rsp + 0x2a0], xmm0
lea rcx, [rsp + 0x728]
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
call fcn.14002d7c0
cmp byte [rsp + 0x3d0], 0
je 0x14003ab99
lea rsi, [rsp + 0x728]
lea rdx, [rsp + 0x340]
mov rcx, rsi
call fcn.14003d4a0
mov bl, byte [rsi + 0x88]
mov rcx, rsi
call fcn.14002d7c0
test bl, bl
je 0x140039a86
cmp byte [rsp + 0x3d0], 0
je 0x14003ab99
lea rsi, [rsp + 0x728]
lea rdx, [rsp + 0x340]
mov rcx, rsi
call fcn.14003d4a0
cmp byte [rsi + 0x88], 0
je 0x14003acc0
mov rsi, qword [rsp + 0x790]
mov rbx, qword [rsp + 0x798]
mov r12, qword [rsp + 0x7a0]
mov r13, qword [rsp + 0x7a8]
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x140038b6c
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038b67
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rbx
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r13
lea rcx, [rsp + 0x728]
call fcn.14002d7c0
jmp 0x140039b01
cmp rax, 0x10
jb 0x140038bac
mov rsi, qword [rsp + 0x240]
mov qword [rsp + 0x250], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rsi], rax
mov word [rsi + 8], 0x6e
lea rcx, [rsp + 0x340]
call fcn.14005b250
lea rsi, [rsp + 0x4d8]
jmp 0x140036f2c
lea rdx, [rsp + 0x4d8]
lea rsi, [rsp + 0x368]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
jne 0x140038ccd
cmp ebx, 0xb
ja 0x140038d5c
lea rax, [0x14006c260]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x728], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov r14, qword [rax]
mov r13, qword [rax + 8]
cmp r13, 0xf
jbe 0x140039959
test r13, r13
js 0x14003accb
mov rax, r13
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x14003ad5d
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140056c48
mov rsi, rax
mov rcx, rsi
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r13], 0
mov qword [rsp + 0x728], rsi
jmp 0x140038d7d
lea rcx, [rsp + 0x4b0]
call fcn.14005b250
jmp 0x140038745
lea rcx, [rsp + 0x340]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.14005b1a0
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14003999a
lea r14, [rsp + 0x240]
cmp rsi, 0xf
ja 0x140038d24
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x1c0], xmm0
mov ebx, 0xf
jmp 0x140038da2
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038d82
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038d8e
mov qword [rsp + 0x728], 0
mov byte [rsp + 0x728], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
xor r13d, r13d
jmp 0x14003998d
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rsi + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1a0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov rsi, qword [rsp + 0x2b0]
cmp qword [rsp + 0x2b8], 0x10
jb 0x140038dec
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x80], rax
cmp rsi, 0xf
ja 0x140038e0c
mov rax, qword [rsp + 0x80]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1a0], xmm0
mov ebx, 0xf
jmp 0x140038e69
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038e44
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038e50
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x180], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov rbx, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x140038ead
mov rsi, qword [rsp + 0x2c0]
jmp 0x140038eb5
lea rsi, [rsp + 0x2c0]
cmp rbx, 0xf
ja 0x140038ece
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x180], xmm0
mov r14d, 0xf
jmp 0x140038f26
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140038f06
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038f12
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x180], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov rbx, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x140038f6a
mov rsi, qword [rsp + 0x2e0]
jmp 0x140038f72
lea rsi, [rsp + 0x2e0]
cmp rbx, 0xf
ja 0x140038f8b
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x160], xmm0
mov r14d, 0xf
jmp 0x140038fe3
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140038fc3
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038fcf
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x160], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], r14
cmp r15, 0x10
lea rsi, [rsp + 0x260]
cmovae rsi, rbp
mov qword [rsp + 0x140], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
cmp r12, 0xf
ja 0x140039032
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x140], xmm0
mov ebx, 0xf
jmp 0x14003908b
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x14003906a
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039076
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x140], rcx
lea r8, [r12 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x158], rbx
cmp qword [rsp + 0x88], 0x10
lea rsi, [rsp + 0x280]
cmovae rsi, qword [rsp + 0x90]
mov qword [rsp + 0x120], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
cmp qword [rsp + 0x68], 0xf
ja 0x1400390e6
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x120], xmm0
mov ebx, 0xf
jmp 0x140039145
mov rbx, qword [rsp + 0x68]
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140039120
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003912c
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0x98], 0x10
jb 0x14003915a
mov rsi, qword [rsp + 0x300]
jmp 0x140039162
lea rsi, [rsp + 0x300]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x100], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
cmp qword [rsp + 0x60], 0xf
ja 0x1400391a8
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x100], xmm0
mov edi, 0xf
jmp 0x140039207
mov rdi, qword [rsp + 0x60]
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x1400391e2
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400391ee
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x100], rcx
mov rax, qword [rsp + 0x60]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rdi
cmp qword [rsp + 0x50], 0x10
lea rsi, [rsp + 0x1e8]
cmovae rsi, qword [rsp + 0x58]
mov qword [rsp + 0xe0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
cmp r13, 0xf
ja 0x14003925f
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov edi, 0xf
jmp 0x1400392b7
mov rdi, r13
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x140039297
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400392a3
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0xe0], rcx
lea r8, [r13 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov rbx, qword [rsp + 0x330]
cmp qword [rsp + 0x338], 0x10
jb 0x1400392fb
mov rsi, qword [rsp + 0x320]
jmp 0x140039303
lea rsi, [rsp + 0x320]
cmp rbx, 0xf
ja 0x14003931c
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xc0], xmm0
mov r14d, 0xf
jmp 0x140039374
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140039354
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039360
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0xc0], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rsp + 0xc0]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r14
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor edx, edx
call fcn.140006220
lea rdx, [0x1400a18c4]
lea r14, [rsp + 0x4b0]
mov rcx, r14
call fcn.140004a00
lea rdx, str.build_channel
lea r8, [0x1400a1cf0]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call section..text
mov rcx, r14
call fcn.140001130
lea rdx, [0x1400a249c]
lea r14, [rsp + 0x4b0]
mov rcx, r14
call fcn.140004a00
lea rdx, str.build_version
lea r8, [0x1400a1c3f]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call section..text
mov rcx, r14
call fcn.140001130
lea r14, [rsp + 0x4b0]
mov rcx, r14
mov rdx, rdi
call fcn.1400607a0
lea rdx, [0x1400a1973]
lea r8, [0x1400a1982]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call section..text
mov rcx, r14
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.previous_default_browser
lea r8, [0x1400a1982]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a16d1]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x120]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.os_version
lea r8, [0x1400a1c31]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x140]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.os_locale
lea r8, [0x1400a21f5]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.notification_type
lea r8, [0x1400a2140]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.notification_shown
lea r8, [0x1400a1ab3]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, [0x1400a1b35]
lea r8, [0x1400a1b48]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.previous_notification_action
lea r8, [0x1400a1b48]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call section..text
mov rcx, rdi
call fcn.140001130
lea rsi, [rsp + 0x340]
mov rcx, rsi
call fcn.140057dd0
lea rdx, [0x1400a2821]
lea rdi, [rsp + 0x4b0]
mov rcx, rdi
call fcn.140004a00
lea r14, [rsp + 0x6f0]
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], 0xb
movabs rax, 0x7461746e65646e69
mov qword [r14], rax
mov dword [r14 + 7], 0x6e6f6974
mov byte [r14 + 0xb], 0
mov rcx, rsi
mov rdx, r14
call fcn.140006380
mov rcx, rdi
mov rdx, rax
call section..text
mov rax, qword [r14 + 0x18]
cmp rax, 0x10
jb 0x14003970c
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039707
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.140001130
lea r15, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x728]
mov rcx, r15
call fcn.140001380
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x140039b21
xorps xmm0, xmm0
lea r12, [rsp + 0x4b0]
movups xmmword [r12 + 0x3e], xmm0
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rcx, [rsp + 0x6f0]
mov rdx, r12
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
jne 0x140039c0e
lea rsi, [rsp + 0x4b2]
mov ecx, 0x50
call fcn.140056c48
mov r14, rax
mov r8d, 0x48
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + 0x48], 0
mov qword [rsp + 0x7b8], r14
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0x24
mov qword [rsp + 0x7d0], 0x27
lea rcx, section..rdata
lea r9, [rsp + 0x490]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x60], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140039d07
mov r12, qword [rsp + 0x490]
lea r14, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a41b4]
mov rcx, r14
mov rdx, r12
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x140039df1
lea rdx, [0x1400a2a3a]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039e6c
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039ee7
cmp qword [rsp + 0x7d0], 8
jb 0x1400398a4
mov rdx, qword [rsp + 0x7b8]
jmp 0x1400398ac
lea rdx, [rsp + 0x7b8]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039f5f
xor eax, eax
mov qword [rsp + 0x6f0], rax
mov qword [rsp + 0x700], rax
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r14, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003a7f1
mov qword [rcx + 0x10], r14
mov r8, r14
add r8, r14
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + r14*2 + 0x6f0], 0
mov rbp, qword [rsp + 0x6f0]
mov rdi, qword [rsp + 0x6f8]
mov rbx, qword [rsp + 0x700]
mov r13, qword [rsp + 0x708]
xor r14d, r14d
mov sil, 1
jmp 0x14003a067
lea rsi, [rsp + 0x728]
mov qword [rsi + 0x10], r13
mov rcx, rsi
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r13 + 0x728], 0
mov rbx, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x338], 0x10
jb 0x1400399af
mov r8, qword [rsp + 0x320]
jmp 0x1400399b7
lea r8, [rsp + 0x320]
lea rdx, str.PingCurrentDefault
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor r9d, r9d
call fcn.14002db50
mov r14d, dword [rsi]
test r14d, r14d
jne 0x1400399e8
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x140039a74
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002cc90
xor esi, esi
mov ebx, 0
mov r13d, 0
mov edi, 0
cmp qword [rsp + 0x50], 0x10
jb 0x140039a74
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039a61
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ad26
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140056c84
xor esi, esi
xor ebx, ebx
xor r13d, r13d
xor edi, edi
lea rcx, [rsp + 0x340]
call fcn.14005b250
jmp 0x140038737
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x140039acd
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039ac8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x240], rax
mov word [rsp + 0x248], 0x6e
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
cmp byte [rsp + 0x3d0], 0
je 0x1400386a7
lea rcx, [rsp + 0x340]
call fcn.14002d7c0
jmp 0x1400386a7
mov r14d, eax
or r14d, 0x80010000
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.GenerateUUIDStr
mov rcx, r13
mov edx, r14d
mov r8, rbx
mov r9d, 0x2e
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r12, [rax + rax]
add r12, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r12, rax
mov rcx, r12
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x2e
mov rcx, rdi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039c06
mov r15, rax
mov qword [rsp + 0x4b0], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
jmp 0x140039cfd
mov rdi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.GenerateUUIDStr
mov r14d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, r12
mov r9d, 0x35
call fcn.140059a40
cdqe
lea rbx, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x30], 0x35
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rsi
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9, r15
call fcn.140059ac0
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039cfa
mov rdi, rax
lea rax, [rsp + 0x7b8]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
jmp 0x14003a0cc
mov r14d, eax
mov rdi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.GetPingFilePath
mov rcx, r13
mov edx, eax
mov r8, rbx
mov r9d, 0x75
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r15, rax
mov rcx, r15
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x75
mov rcx, rsi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039de4
mov rdi, rax
mov qword [rsp + 0x4b0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
jmp 0x14003a07e
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x81
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x81
jmp 0x140039fd5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x86
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x86
jmp 0x140039fd5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x8b
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x8b
jmp 0x140039fd5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x90
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x90
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a054
mov rbp, rax
mov qword [rsp + 0x6f0], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x6f0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbp
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
xor edi, edi
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor r13d, r13d
test r12, r12
je 0x14003a075
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
jne 0x14003a521
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x14003a0cc
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a0c7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
jb 0x14003a113
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a10e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rcx, [rsp + 0x340]
call fcn.140061c50
lea rcx, [rsp + 0x728]
call fcn.140001130
mov rax, qword [rsp + 0xd8]
cmp rax, 0x10
jb 0x14003a174
mov rcx, qword [rsp + 0xc0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a16f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0xf
mov byte [rsp + 0xc0], 0
mov rax, qword [rsp + 0xf8]
cmp rax, 0x10
jb 0x14003a1db
mov rcx, qword [rsp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a1d6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rax, qword [rsp + 0x118]
cmp rax, 0x10
jb 0x14003a242
mov rcx, qword [rsp + 0x100]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a23d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
mov rax, qword [rsp + 0x138]
cmp rax, 0x10
jb 0x14003a2a9
mov rcx, qword [rsp + 0x120]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a2a4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
mov rax, qword [rsp + 0x158]
cmp rax, 0x10
jb 0x14003a310
mov rcx, qword [rsp + 0x140]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a30b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
mov rax, qword [rsp + 0x178]
cmp rax, 0x10
jb 0x14003a377
mov rcx, qword [rsp + 0x160]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a372
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
mov rax, qword [rsp + 0x198]
cmp rax, 0x10
jb 0x14003a3de
mov rcx, qword [rsp + 0x180]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a3d9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rax, qword [rsp + 0x1b8]
cmp rax, 0x10
jb 0x14003a445
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a440
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rax, qword [rsp + 0x1d8]
cmp rax, 0x10
jb 0x14003a4ac
mov rcx, qword [rsp + 0x1c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a4a7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
cmp qword [rsp + 0x50], 0x10
jb 0x14003775b
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a512
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ad26
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140056c84
jmp 0x14003775b
mov qword [rsp + 0x490], rbp
mov qword [rsp + 0x498], rdi
mov qword [rsp + 0x4a0], rbx
cmp r13, 8
lea rax, [rsp + 0x490]
cmovb rbp, rax
mov qword [rsp + 0x4a8], r13
lea rax, [0x14006c1a8]
lea r12, [rsp + 0x558]
mov qword [r12 - 0xa8], rax
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c248]
mov qword [r12], rax
mov rax, qword [r12 - 0xa8]
movsxd rax, dword [rax + 4]
lea rdi, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rdi
mov rax, qword [r12 - 0xa8]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff58
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x4ac], ecx
lea rbx, [rsp + 0x4b8]
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c258]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4ac], ecx
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4b0], rdi
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x4ac], esi
mov rcx, rbx
call fcn.14005ba80
mov rcx, rbx
mov rdx, rbp
call fcn.14005d3c0
test rax, rax
jne 0x14003a661
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6d0]
cmp qword [rsp + 0x6d8], 0x10
jb 0x14003a67c
mov r15, qword [rsp + 0x6c0]
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov rdx, r15
call fcn.140003430
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003a806
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r13, str.SendPing
mov r14d, 0x8007045d
mov edx, 0x8007045d
mov r8, r13
mov r9d, 0xc6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xc6
mov dword [rsp + 0x20], 0x8007045d
mov rcx, rsi
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a7a2
mov r15, rax
mov qword [rsp + 0x6f0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x6f0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007045d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c960
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003a86b
lea r9, [rsp + 0x4b0]
mov rdx, r14
call fcn.14005ab20
jmp 0x14003992e
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c960
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdx, str.pingsender.exe
lea rdi, [rsp + 0x6f0]
mov rcx, rdi
call fcn.14003ad80
mov r14d, dword [rdi + 0x20]
test r14d, r14d
je 0x14003a8c2
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x14003a07e
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a8b8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x14003a07e
movups xmm0, xmmword [rsp + 0x6f0]
movups xmm1, xmmword [rsp + 0x700]
movaps xmmword [rsp + 0x480], xmm1
movaps xmmword [rsp + 0x470], xmm0
xor eax, eax
mov qword [rsp + 0x700], rax
mov ecx, 7
mov qword [rsp + 0x708], rcx
mov word [rsp + 0x6f0], ax
lea rdi, [rsp + 0x450]
mov qword [rdi], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rcx
mov word [rdi], ax
lea r9, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rdi
call fcn.14005ab20
mov r8, qword [rsp + 0x7c8]
cmp qword [rsp + 0x7d0], 8
jb 0x14003a948
mov r9, qword [rsp + 0x7b8]
jmp 0x14003a950
lea r9, [rsp + 0x7b8]
mov rax, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x468]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x14003aba4
lea rsi, [rax + r8]
mov qword [rsp + 0x460], rsi
cmp rcx, 8
jb 0x14003a989
mov rdi, qword [rsp + 0x450]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], 0
lea rdi, [rsp + 0x470]
cmp qword [rdi + 0x18], 8
mov rax, rdi
jb 0x14003a9b8
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x468], 8
jb 0x14003a9d5
mov rax, qword [rsp + 0x450]
jmp 0x14003a9dd
lea rax, [rsp + 0x450]
mov qword [rsp + 0x438], rax
cmp qword [rsp + 0x4a8], 8
jb 0x14003a9fd
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x430]
mov rax, qword [rsp + 0x60]
mov qword [r8 + 0x10], rax
lea rsi, [rsp + 0xb8]
mov rcx, rsi
mov edx, 3
call fcn.140005d30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4b0], xmm0
movaps xmmword [rsp + 0x4e0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x4d0], xmm0
movaps xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x510], 0
mov dword [rsp + 0x4b0], 0x68
mov dword [rsp + 0x4ec], 1
mov rsi, qword [rsi]
cmp qword [rsp + 0x488], 8
jb 0x14003aa8e
mov rdi, qword [rsp + 0x470]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
movups xmmword [rsp + 0x30], xmm0
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003abbe
mov rcx, qword [rsp + 0xa8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xa0]
call rdi
test rsi, rsi
je 0x14003aaf4
mov rcx, rsi
call fcn.140056c84
mov rax, qword [rsp + 0x468]
cmp rax, 8
jb 0x14003ab42
mov rcx, qword [rsp + 0x450]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003ab3d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003a86b
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003ab8f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ad26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x14003a86b
int3
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x450]
mov rdx, r8
call fcn.14005ac50
jmp 0x14003a99e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.SendPing
mov rcx, r13
mov edx, r14d
mov r8, rbx
mov r9d, 0xe4
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r12, [rax + rax]
add r12, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r12, rax
mov rcx, r12
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0xe4
mov rcx, rdi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003acb3
mov r15, rax
lea rax, [rsp + 0x6b8]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
jmp 0x14003aae7
int3
call fcn.14005aa20
mov edi, 0xf
jmp 0x140037938
add rcx, 0x28
call fcn.140056c48
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140036cc7
mov rax, qword [rsp + 0x380]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036d4b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ad26
add rdx, 0x27
mov rcx, rax
jmp 0x140036d74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400366d5
lea rax, [rsp + 0x360]
mov rcx, qword [rax + 0x38]
movsxd rcx, dword [rcx]
add rdx, rcx
jmp 0x140036c70
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140056c48
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140038c9b