Function at 0x140002ef0
Capabilities:
Copy file
Create service
Delete file
Enumerate processes
Get installed programs
Modify service
Move file
Query service status
Set registry value
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x518
mov ebp, ecx
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x510], rax
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140002fbb
mov rsi, rax
lea rdi, [rsp + 0xc0]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140002ffc
lea rdx, str.MozillaMaintenance
mov rcx, rsi
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x14000303d
cmp eax, 0x424
je 0x14000303d
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000402c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service.____lu_
jmp 0x14000302e
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003faa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service_manager.____lu_
mov r8d, eax
call fcn.140008f00
xor ebp, ebp
jmp 0x140003722
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003feb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_module_filename_when_attempting_to_install_service.____lu_
mov r8d, eax
call fcn.140008f00
xor ebp, ebp
jmp 0x140003719
test rbx, rbx
je 0x1400033c1
lea r14, [rsp + 0x2d0]
mov qword [r14], 0
mov rcx, rbx
mov rdx, r14
call fcn.140004850
mov edi, eax
mov rcx, qword [r14]
test rcx, rcx
je 0x140003070
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x1400030ae
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000406d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_reset_security_ACE_on_service_handle._It_might_not_be_possible_to_start_the_service._This_error_should_never_happen.____lu_
mov r8d, eax
call fcn.140008f00
lea r9, [rsp + 0x9c]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400030d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003660
lea r14, [rsp + 0x9c]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a700
mov rdi, rax
mov rcx, rbx
mov rdx, rax
mov r8d, r15d
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x1400034a8
cmp byte [0x14003e154], 0
je 0x1400034ef
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x94]
lea r9, [rsp + 0x90]
call fcn.1400050d0
mov r14d, eax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x88]
lea r8, [rsp + 0x84]
lea r9, [rsp + 0x80]
call fcn.1400050d0
test eax, eax
je 0x1400036d5
cmp ebp, 2
je 0x1400031a4
test r14d, r14d
je 0x1400031a4
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x98], eax
jae 0x140003787
mov rcx, rbx
call fcn.140002700
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140003748
mov r14, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test r15, r15
je 0x1400037e1
cmp eax, ecx
jg 0x1400042bd
lea rdx, str.Sending_stop_request...
call fcn.140008de0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0xa0]
mov rcx, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000328f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x14000328f
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400044c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_sending_stop_request.____lu_
mov r8d, eax
call fcn.140008f00
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call rbx
mov rcx, r15
call rbx
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400042fe
lea rdx, str.Waiting_for_service_stop...
call fcn.140008de0
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov qword [rsp + 0x70], rdi
je 0x14000380e
mov r15, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000391d
mov r12, rax
lea r14, [rsp + 0x2d0]
mov dword [r14 + 4], 0xcf
mov edi, 0xffffffce
lea r13, [rsp + 0xbc]
mov rbp, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r13
mov rcx, r12
xor edx, edx
mov r8, r14
mov r9d, 0x24
call rbp
test eax, eax
je 0x140003367
cmp dword [rsp + 0x2d4], 1
jne 0x140003398
jmp 0x1400039cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x140003384
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x140003398
jmp 0x140003a36
cmp eax, 0x79
jle 0x1400039a5
cmp eax, 0x41c
jne 0x140003a10
mov ecx, 0x32
call rbx
add edi, 0x32
cmp edi, 0x74fe
jb 0x14000333f
mov eax, dword [rsp + 0x2d4]
mov dword [rsp + 0x6c], eax
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003a69
test ebp, ebp
je 0x140003656
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
lea rdx, str.MozillaMaintenance
lea r8, str.Mozilla_Maintenance_Service
mov rcx, rsi
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x14000369e
mov rbx, rax
lea r14, [rsp + 0x2d0]
mov qword [r14], 0
mov rcx, rax
mov rdx, r14
call fcn.140004850
mov edi, eax
mov rcx, qword [r14]
test rcx, rcx
je 0x140003458
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x140003496
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400041fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_set_security_ACE_on_service_handle__the_service_will_not_be_able_to_be_started_from_unelevated_processes._This_error_should_never_happen.____lu_
mov r8d, eax
call fcn.140008f00
mov rcx, rbx
call fcn.140002700
mov ebp, 1
jmp 0x140003710
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_open_service_but_could_not_query_service_config.____lu_
mov r8d, eax
call fcn.140008f00
mov rcx, rdi
call fcn.14000a718
jmp 0x14000369a
mov r14, qword [rdi + 0x10]
mov rcx, r14
call fcn.140016e68
cmp rax, 3
jb 0x14000355e
mov r15, rax
lea rdx, str.maintenanceservice_tmp.exe
mov rcx, r14
call fcn.14000bac8
test rax, rax
jne 0x14000355e
cmp word [r14], 0x22
jne 0x14000355e
cmp word [r14 + r15*2 - 2], 0x22
jne 0x14000355e
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004443
lea rdx, str.The_MozillaMaintenance_service_path_is_correct.
call fcn.140008de0
jmp 0x140003114
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040ef
lea rdx, str.The_MozillaMaintenance_path_is_NOT_correct._It_was:__ls
mov r8, r14
call fcn.140008de0
lea r15, [rsp + 0x2d0]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.14002b6c0
mov r8d, 0x104
mov rcx, r15
mov rdx, r14
call fcn.140017330
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140003838
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004171
lea r14, str.Couldnt_remove_file_spec.____lu_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
mov r8d, eax
call fcn.140008f00
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004130
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_fix_service_path._This_should_never_happen.____lu_
mov r8d, eax
call fcn.140008f00
mov ebp, 1
jmp 0x140003708
mov ebp, 1
jmp 0x140003719
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400041b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_determine_buffer_size_for_query_service_config.____lu_
mov r8d, eax
call fcn.140008f00
xor ebp, ebp
jmp 0x140003710
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000423b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_create_Windows_service._This_error_should_never_happen_since_a_service_install_should_only_be_called_when_elevated.____lu_
jmp 0x14000302e
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000427c
lea rdx, str.Could_not_obtain_version_number_from_new_path
call fcn.140008f00
xor ebp, ebp
mov rcx, rdi
call fcn.14000a718
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14001af60
mov eax, ebp
add rsp, 0x518
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004380
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service_manager.____lu_
mov r8d, eax
call fcn.140008f00
jmp 0x140003807
jne 0x1400037c6
mov eax, dword [rsp + 0x84]
cmp dword [rsp + 0x94], eax
jb 0x1400031a4
jne 0x1400037c6
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x90], eax
jb 0x1400031a4
jne 0x1400037c6
mov eax, dword [rsp + 0x8c]
cmp eax, dword [rsp + 0x7c]
jb 0x1400031a4
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14000364c
cmp eax, ecx
jg 0x1400043c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service.____lu_
mov r8d, eax
call fcn.140008f00
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebp, ebp
jmp 0x140003e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov eax, 0xfd
cmovne eax, ecx
mov dword [rsp + 0x6c], eax
jmp 0x140003a73
lea rdx, [0x140035922]
lea r14, [rsp + 0x2d0]
mov rcx, r14
call fcn.14002c160
test eax, eax
je 0x140003974
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov edx, 0xffffffff
mov r8d, 0xffffffff
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ecx, dword [0x14003e370]
mov edx, dword [0x14003cda0]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400039de
cmp ecx, edx
jg 0x1400045c9
lea rdx, str.Fixed_service_path_to:__ls.
lea r8, [rsp + 0x2d0]
call fcn.140008de0
mov byte [0x14003e154], 1
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000460a
lea rdx, str.Restarting_install_action:__d
mov r8d, ebp
call fcn.140008de0
mov ecx, ebp
call fcn.140002ef0
mov ebp, eax
jmp 0x140003708
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, 0x7a
jg 0x140003952
cmp ebx, 5
je 0x1400039fc
cmp ebx, 6
jne 0x1400039f2
mov dword [rsp + 0x6c], 0xec
jmp 0x140003a73
cmp ebx, 0x7b
je 0x140003a06
cmp ebx, 0x424
jne 0x1400039f2
mov dword [rsp + 0x6c], 0xee
jmp 0x140003a73
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000464b
lea r14, str.Couldnt_append_file_spec.____lu_
jmp 0x140003601
cmp eax, 5
je 0x140003a2f
cmp eax, 6
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x140003a28
cmp eax, 0x57
jne 0x140003a4b
mov eax, 0xdc
jmp 0x140003a5e
mov eax, 1
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003a65
cmp ecx, edx
jg 0x140004663
lea r14, str.Could_not_fix_service_path.____lu_
jmp 0x140003601
mov dword [rsp + 0x6c], 0xef
jmp 0x140003a73
mov dword [rsp + 0x6c], 0xeb
jmp 0x140003a73
mov dword [rsp + 0x6c], 0xed
jmp 0x140003a73
cmp eax, 0x7a
je 0x140003a52
cmp eax, 0x7c
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x140003a4b
mov eax, 0xdd
jmp 0x140003a5e
mov eax, 0xd9
jmp 0x140003a5e
mov eax, 0xda
jmp 0x140003a57
cmp eax, 0x45b
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x140003a4b
mov eax, 0xde
jmp 0x140003a5e
mov eax, 0xdf
jmp 0x140003a5e
mov eax, 0xdb
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x2d4], eax
mov dword [rsp + 0x6c], eax
mov rcx, r12
call rdi
mov rcx, r15
call rdi
xor r14d, r14d
lea r15, [rsp + 0x2fc]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
lea r12, [rsp + 0x2d0]
lea r13, [0x140035922]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140003ae8
mov rbp, rax
mov dword [rsp + 0x2d0], 0x238
mov rcx, rax
mov rdx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140003af2
mov rcx, r13
mov rdx, r15
call fcn.14001473c
test eax, eax
je 0x140003afc
mov rcx, rbp
mov rdx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140003ac3
mov ebx, 0x490
jmp 0x140003afe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003b07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003afe
xor ebx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x490
je 0x140003b23
mov ecx, 0x3e8
call rdi
inc r14d
cmp r14d, 0x1e
jne 0x140003a94
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000433f
lea rdx, str.Done_waiting_for_service_stop__last_service_state:__lu
mov edi, dword [rsp + 0x6c]
mov r8d, edi
call fcn.140008de0
xor ebp, ebp
cmp edi, 1
mov rdi, qword [rsp + 0x70]
jne 0x140003e67
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
call fcn.140016e14
test eax, eax
je 0x140003cbc
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140003e74
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004402
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_overwrite_old_service_binary_file._This_should_never_happen__but_if_it_does_the_next_upgrade_will_fix_it__the_service_is_not_a_critical_component_that_needs_to_be_installed_for_upgrades_to_work.____lu_
mov r8d, eax
call fcn.140008f00
mov r14, qword [rdi + 0x10]
mov rcx, r14
call fcn.140016e68
cmp rax, 4
jb 0x140003cff
mov rcx, rax
inc rcx
lea r15, [rax + rax + 2]
mov rcx, 0xffffffffffffffff
cmovns rcx, r15
mov r12, rax
call fcn.14000a700
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14002b6c0
mov rcx, rbx
mov rdx, r14
mov r8, r12
call fcn.140017330
lea rcx, [rbx + r12*2]
add rcx, 0xfffffffffffffffa
lea rdx, [0x140035ac4]
mov r8d, 3
call fcn.140017330
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140003d37
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [0x14003e370]
mov edx, dword [0x14003cda0]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003d7d
cmp ecx, edx
jg 0x14000467b
lea rdx, str.The_new_service_binary_was_copied_in_by_first_moving_the_old_one_out_of_the_way.
call fcn.140008de0
mov ebp, 1
jmp 0x140003d93
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004506
lea rdx, str.File_is_already_in_the_correct_location__no_action_needed_for_upgrade.__The_path_is:___ls_
lea r8, [rsp + 0xc0]
call fcn.140008de0
mov ebp, 1
jmp 0x140003e67
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004547
lea rdx, str.Service_binary_path_was_less_than_3__service_will_not_be_updated.__This_should_never_happen.
call fcn.140008f00
xor ebp, ebp
jmp 0x140003df4
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400046fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x10]
mov dword [rsp + 0x20], eax
lea rdx, str.Could_not_move_old_service_file_out_of_the_way_from:___ls__to___ls_._Service_will_not_be_upgraded.____lu_
mov r9, rbx
call fcn.140008f00
xor ebp, ebp
jmp 0x140003dec
cmp ecx, edx
jg 0x14000473e
lea rdx, str.The_new_service_binary_could_not_be_copied_in._The_service_will_not_be_upgraded.
call fcn.140008f00
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x14003e370]
mov edx, dword [0x14003cda0]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003dd8
cmp ecx, edx
jg 0x1400046bc
lea rdx, str.The_old_temp_service_path_was_deleted:__ls.
mov r8, rbx
call fcn.140008de0
jmp 0x140003dec
cmp ecx, edx
jg 0x14000477f
lea rdx, str.The_old_temp_service_path_was_not_deleted.
call fcn.140008f00
mov rcx, rbx
call fcn.14000a718
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [0x14003e370]
mov edx, dword [0x14003cda0]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003e4b
cmp ecx, edx
jg 0x140004484
lea rdx, str.Deleting_the_old_file_path_on_the_next_reboot:__ls.
lea r8, [rsp + 0xc0]
call fcn.140008de0
jmp 0x140003e67
cmp ecx, edx
jg 0x140004588
lea rdx, str.Call_to_delete_the_old_file_path_failed:__ls.
lea r8, [rsp + 0xc0]
call fcn.140008f00
mov rcx, rdi
call fcn.14000a718
jmp 0x140003719
lea r14, [rsp + 0x2d0]
mov r8d, 0x100
mov rcx, r14
xor edx, edx
call fcn.14002b6c0
mov eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x84]
mov r9d, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._d._d._d._d
mov edx, 0x80
mov rcx, r14
call fcn.14002c0f0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallMozillaMaintenanceService
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20206
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003f3e
mov rcx, r14
call fcn.140016e68
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea rdx, str.DisplayVersion
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140003f6f
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004801
lea rdx, str.The_uninstaller_version_string_could_not_be_updated.
call fcn.140008de0
mov eax, dword [0x14003e370]
mov ecx, dword [0x14003cda0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400047c0
lea rdx, str.The_new_service_binary_was_copied_in.
call fcn.140008de0
mov ebp, 1
jmp 0x140003df4
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140002fe0
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140002fe0
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003021
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003021
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140002fac
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140002fac
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003099
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003099
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400034cd
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400034cd
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003583
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003583
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003637
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003637
lea rcx, [0x14003e370]
call fcn.14000a75c
lea r14, str.Couldnt_remove_file_spec.____lu_
cmp dword [0x14003e370], 0xffffffff
jne 0x140003601
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003601
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003685
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003685
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003481
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003481
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400036c3
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400036c3
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400036fa
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400036fa
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x14000321a
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x14000321a
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400032c5
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400032c5
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003b48
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003b48
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x14000376d
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x14000376d
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400037e9
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400037e9
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003bc6
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003bc6
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x14000354d
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x14000354d
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003e35
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003e35
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x14000327a
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x14000327a
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003ce1
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003ce1
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003d24
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003d24
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003e53
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003e53
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x1400038c0
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x1400038c0
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003900
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003900
lea rcx, [0x14003e370]
call fcn.14000a75c
lea r14, str.Couldnt_append_file_spec.____lu_
jmp 0x140004184
lea rcx, [0x14003e370]
call fcn.14000a75c
lea r14, str.Could_not_fix_service_path.____lu_
jmp 0x140004184
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003ca6
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003ca6
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003dc7
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003dc7
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003d5c
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003d5c
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003d85
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003d85
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003de0
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003de0
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003f94
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003f94
lea rcx, [0x14003e370]
call fcn.14000a75c
cmp dword [0x14003e370], 0xffffffff
jne 0x140003f63
mov qword [0x14003e160], 0
lea rcx, [fcn.140001d10]
call fcn.14000a840
lea rcx, [0x14003e370]
call fcn.14000a7d4
jmp 0x140003f63