Function at 0x14000a590
Capabilities:
Check for time delay via queryperformancecounter
Parse pe header
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r12d, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebp, 1
cmp qword [rdx + 0x20], 0
je 0x14000a62f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14000a611
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000a611
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000a611
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14000a611
cmp dword [rax + rcx + 0x50], 0x147
ja 0x14000a71b
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800700c100000021
mov qword [rsi + 8], rax
jmp 0x14000a6a4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000a6d2
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x79
mov byte [rsi + 0x10], 1
lea rdx, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rax, qword [rsp + 0xa0]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000a9a3
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000a6e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], rbp
mov eax, dword [rsp + 0x70]
cmp eax, 1
je 0x14000a705
cmp eax, 2
jne 0x14000a70c
mov ebp, 1
jmp 0x14000a5d0
xor ebp, ebp
jmp 0x14000a5d0
mov ecx, 0x80070507
mov eax, 0x88
jmp 0x14000a690
mov r13d, dword [rax + rcx + 8]
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.14000a9c0
cmp byte [rsp + 0x98], 0
je 0x14000a74e
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 1
jmp 0x14000a6a4
cmp byte [rsp + 0x8c], 0
je 0x14000a797
cmp dword [rsp + 0x88], r13d
jne 0x14000a797
cmp ebx, 1
jne 0x14000a7b5
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 1
jmp 0x14000a6a4
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000ab00
cmp byte [rsp + 0x80], 0
je 0x14000a7ed
movups xmm0, xmmword [rsp + 0x70]
jmp 0x14000a742
cmp ebp, 1
je 0x14000a7fd
test ebp, ebp
jne 0x14000a836
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov byte [rdi + 8], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 0
jmp 0x14000a6a4
movzx ecx, byte [rdi + 0x40]
mov eax, ecx
and al, 1
je 0x14000a857
mov rcx, qword [rdi + 0x48]
jmp 0x14000a85a
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.14000ad80
cmp byte [rsp + 0x80], 0
jne 0x14000a7ae
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.14000aec0
cmp byte [rsp + 0x68], 0
je 0x14000a8f4
movups xmm0, xmmword [rsp + 0x58]
jmp 0x14000a742
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x80070507000000ed
mov qword [rsi + 8], rax
jmp 0x14000a6a4
shr rcx, 1
lea r14, [rdi + 0x40]
test rcx, rcx
jne 0x14000a889
lea rdx, [rdi + 0x28]
mov rcx, r14
call fcn.14007c6e0
lea rdx, str.Image
mov r8d, 6
mov rcx, r14
call fcn.14007b270
mov al, byte [rdi + 0x40]
and al, 1
mov dword [rsp + 0x58], r13d
mov rcx, qword [rdi + 0x20]
test al, al
je 0x14000a89c
mov r14, qword [rdi + 0x50]
jmp 0x14000a8a0
add r14, 2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, r14
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000a762
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
jmp 0x14000a6a1
mov cl, byte [rsp + 0x78]
test cl, cl
setne dl
mov r8b, byte [rsp + 0x60]
test r8b, r8b
setne al
xor al, dl
mov ebp, 1
jne 0x14000a936
mov ebp, ebx
test ebx, ebx
jne 0x14000a936
mov ebp, ebx
test cl, cl
je 0x14000a936
test r8b, r8b
je 0x14000a9a8
mov rax, qword [rsp + 0x70]
xor ebp, ebp
cmp rax, qword [rsp + 0x58]
setae bpl
cmp r12d, 1
cmove ebp, ebx
test ebp, ebp
je 0x14000a954
cmp ebp, 1
jne 0x14000a982
mov qword [rdi + 0x10], 0
add rdi, 0x18
jmp 0x14000a974
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
add rdi, 8
mov byte [rdi], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], ebp
jmp 0x14000a6a4
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007050700000131
mov qword [rsi + 8], rax
jmp 0x14000a6a4
call fcn.1400763e0
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3