Function at 0x140010790
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movaps xmmword [rsp + 0x290], xmm6
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov edi, 0x80070057
cmp ecx, 2
jl 0x140010a24
mov rsi, rdx
cmp qword [rdx + 8], 0
je 0x140010a24
mov ebx, ecx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400109ec
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010979
mov rcx, qword [rsi + 8]
lea rdx, str.unregister_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010979
mov rcx, qword [rsi + 8]
lea rdx, str.debug_remote_disabled
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010c97
lea rcx, [0x1400968e5]
lea rdx, str.DisableDefaultBrowserAgent
call fcn.14000ab80
mov edi, 0x800704ec
test al, al
jne 0x1400109ae
mov rcx, qword [rsi + 8]
lea rdx, [0x140098450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010a52
mov rcx, qword [rsi + 8]
lea rdx, str.update_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010ac9
mov rcx, qword [rsi + 8]
lea rdx, str.do_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov edi, 0x80070057
cmp ebx, 3
jl 0x1400109ae
test eax, eax
jne 0x1400109ae
cmp qword [rsi + 0x10], 0
je 0x1400109ae
lea rcx, [rsp + 0x68]
call fcn.140011f70
mov edi, 0x80070020
test al, al
je 0x1400109ae
xor edi, edi
call fcn.14000b750
test al, al
jne 0x1400109ae
mov qword [rsp + 0x140], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
lea rcx, [0x140067100]
lea r9, [0x140067120]
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140010e29
mov rcx, qword [rsp + 0x140]
mov rax, qword [rcx]
lea rdx, [rsp + 0x120]
mov qword [rsp + 0x20], rdx
lea rdx, str.http
mov r8d, 1
mov r9d, 1
call qword [rax + 0x18]
test eax, eax
jns 0x140011155
mov edi, eax
lea rdx, str.GetDefaultBrowser
mov ecx, eax
mov r8d, 0x56
jmp 0x140010e3a
mov edi, 0x80070057
cmp ebx, 3
jl 0x1400109ae
cmp qword [rsi + 0x10], 0
je 0x1400109ae
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140010ced
mov rcx, qword [rsi + 0x10]
call fcn.14000ce30
mov edi, eax
cmp byte [rsp + 0x70], 0
mov rsi, qword [rsp + 0x68]
je 0x140010a0b
test rsi, rsi
je 0x1400109f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x1400109e5
lea rcx, str.Failed_to_release_registry_mutex
lea rdx, str.Release
mov r8d, 0xc5
call fcn.140009e00
mov byte [rsp + 0x70], 0
jmp 0x140010a0b
mov edi, eax
jmp 0x140010a24
lea rcx, str.Unexpectedly_missing_registry_mutex
lea rdx, str.Release
mov r8d, 0xc0
call fcn.140009e00
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140010a1e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140065710
mov eax, edi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0x80070057
cmp ebx, 3
jl 0x1400109ae
cmp qword [rsi + 0x10], 0
je 0x1400109ae
lea rcx, [rsp + 0x68]
call fcn.140011f70
lea r8, str.Installed
lea rcx, [rsp + 0x168]
xor edx, edx
mov r9b, 1
call fcn.14000b300
cmp byte [rsp + 0x16c], 1
jne 0x140010ab9
mov r9d, dword [rsp + 0x168]
lea rcx, str.Failed_to_write_installation_registry_entry:__X
lea rdx, str.WriteInstallationRegistryEntry
mov r8d, 0x7f
call fcn.140009e00
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.14000bf50
jmp 0x1400109ac
mov edi, 0x80070057
cmp ebx, 3
jl 0x1400109ae
cmp qword [rsi + 0x10], 0
je 0x1400109ae
lea rcx, [rsp + 0x68]
call fcn.140011f70
lea r8, str.Installed
lea rbx, [rsp + 0x168]
mov rcx, rbx
xor edx, edx
mov r9b, 1
call fcn.14000b300
cmp byte [rsp + 0x16c], 1
jne 0x140010b33
mov r9d, dword [rsp + 0x168]
lea rcx, str.Failed_to_write_installation_registry_entry:__X
lea rdx, str.WriteInstallationRegistryEntry
mov r8d, 0x7f
call fcn.140009e00
mov rsi, qword [rsi + 0x10]
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140067030]
lea r9, [0x140067020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140010d79
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 0
movaps xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x120]
lea r8, [rsp + 0x140]
lea r9, [rsp + 0xf0]
call qword [rax + 0x50]
test eax, eax
js 0x140010d8c
mov qword [rsp + 0xa0], 0
lea rcx, [0x140098a34]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
test rcx, rcx
je 0x140010c45
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov rdx, r15
call qword [rax + 0x38]
test eax, eax
jns 0x140011090
mov rcx, rsi
xor edx, edx
call fcn.14000bf50
mov edi, eax
test r15, r15
je 0x140010c7b
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140010da2
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140010da2
call fcn.14000b750
movzx esi, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_IsAgentRemoteDisabled:
call fcn.14000bdd0
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor edi, edi
jmp 0x1400109ae
lea rcx, [rsp + 0x68]
call fcn.140011f70
lea rcx, [rsp + 0x168]
xor edx, edx
call fcn.1400016e0
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140010d52
mov qword [rsp + 0xb0], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20107
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140010dbe
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], 0
test rcx, rcx
je 0x1400109a3
call fcn.140064680
jmp 0x1400109a3
mov edi, eax
lea rdx, str.UpdateTask
mov ecx, eax
mov r8d, 0xd6
jmp 0x140010d9d
mov edi, eax
lea rdx, str.UpdateTask
mov ecx, eax
mov r8d, 0xd8
call fcn.140009ce0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400109ae
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400109ae
mov r15, qword [rsp + 0xb0]
mov dword [rsp + 0xf0], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x58], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140010f66
test r15, r15
je 0x140010d52
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140010d52
mov edi, eax
lea rdx, str.GetDefaultBrowser
mov ecx, eax
mov r8d, 0x4d
call fcn.140009ce0
mov bl, 1
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x140010e54
mov rax, qword [rcx]
call qword [rax + 0x10]
test bl, bl
jne 0x140010f18
lea rbx, [rsp + 0x140]
mov rcx, rbx
mov edx, edi
call fcn.140009600
lea r8, [0x140097cdc]
lea rcx, [rsp + 0x168]
mov edx, 1
call fcn.1400096a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call fcn.140015dc0
mov byte [rsp + 0x110], 1
mov bpl, byte [rsp + 0x190]
mov byte [rsp + 0xd0], 0
test bpl, bpl
jne 0x1400116fc
cmp byte [rsp + 0x188], 0
je 0x140010f26
movups xmm0, xmmword [rsp + 0x168]
movups xmm1, xmmword [rsp + 0x178]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xd0], 1
movaps xmm0, xmmword [0x140067830]
movups xmmword [rsp + 0x178], xmm0
mov byte [rsp + 0x168], 0
mov byte [rsp + 0x188], 0
mov cl, 1
jmp 0x140010f28
jne 0x1400109ae
int3
xor ecx, ecx
mov rax, qword [rsp + 0x108]
cmp rax, 0x10
jae 0x14001112b
movaps xmm0, xmmword [0x140067830]
movups xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0xf0], 0
test cl, cl
jne 0x140011743
lea rdx, [rsp + 0x140]
jmp 0x14001174b
mov edi, dword [rsp + 0xf0]
add edi, 1
mov dword [rsp + 0xf0], edi
lea r14, [rdi + rdi]
mov rcx, r14
call fcn.1400646bc
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x140], edi
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
lea r9, [rsp + 0x140]
mov rcx, r15
xor edx, edx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0
test eax, eax
jne 0x14001105b
xorps xmm6, xmm6
lea r14, [rsp + 0x140]
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
jmp 0x14001102a
add r12d, 1
mov rcx, rbx
mov dx, 0x7c
call sub.VCRUNTIME140.dll_wcschr
test rax, rax
movzx ebp, bpl
mov eax, 1
cmovne ebp, eax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x140], eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov edx, r12d
mov r8, rbx
mov r9, r14
call r13
test eax, eax
jne 0x14001105b
mov rdi, qword [rsp + 0x168]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140010fe0
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140010fff
test r15, r15
je 0x140011069
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, 1
jne 0x140011083
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call fcn.140064680
jmp 0x140010d52
movaps xmm0, xmmword [0x140067290]
movups xmmword [rsp + 0x178], xmm0
mov word [rsp + 0x168], 0
lea rdx, [0x140099136]
mov rcx, rbx
call fcn.140007520
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.140006d60
cmp qword [rsp + 0x180], 7
jbe 0x1400110e1
mov rbx, qword [rsp + 0x168]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x98], 0
mov rax, qword [rcx]
lea r8, [rsp + 0x98]
mov rdx, r14
call qword [rax + 0x68]
test eax, eax
jns 0x1400114b2
mov rcx, rsi
xor edx, edx
call fcn.14000bf50
mov edi, eax
jmp 0x14001166b
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140011ec3
call fcn.140064680
mov cl, byte [rsp + 0xd0]
jmp 0x140010f3a
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x168]
movaps xmm6, xmmword [0x140067290]
movups xmmword [rsp + 0x178], xmm6
mov word [rsp + 0x168], 0
lea rdx, [0x140097920]
mov rcx, rdi
call fcn.140007520
mov dword [rsp + 0x188], 1
lea rcx, [rsp + 0x190]
movups xmmword [rsp + 0x1a0], xmm6
mov word [rsp + 0x190], 0
lea rdx, str.Chrome
call fcn.140007520
mov dword [rsp + 0x1b0], 2
lea rcx, [rsp + 0x1b8]
movups xmmword [rsp + 0x1c8], xmm6
mov word [rsp + 0x1b8], 0
lea rdx, str.AppX
call fcn.140007520
mov dword [rsp + 0x1d8], 3
lea rcx, [rsp + 0x1e0]
movups xmmword [rsp + 0x1f0], xmm6
mov word [rsp + 0x1e0], 0
lea rdx, str.MSEdgeHTM
call fcn.140007520
mov dword [rsp + 0x200], 4
lea rcx, [rsp + 0x208]
movups xmmword [rsp + 0x218], xmm6
mov word [rsp + 0x208], 0
lea rdx, [0x140099080]
call fcn.140007520
mov dword [rsp + 0x228], 5
lea rcx, [rsp + 0x230]
movups xmmword [rsp + 0x240], xmm6
mov word [rsp + 0x230], 0
lea rdx, [0x140098a28]
call fcn.140007520
mov dword [rsp + 0x250], 6
lea rcx, [rsp + 0x258]
movups xmmword [rsp + 0x268], xmm6
mov word [rsp + 0x258], 0
lea rdx, str.Brave
call fcn.140007520
mov dword [rsp + 0x278], 7
mov dword [rsp + 0xb0], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0xb8], xmm6
mov ecx, 0x38
call fcn.14006461c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xb8], rax
lea rbx, [rsp + 0xc8]
movups xmmword [rsp + 0xc8], xmm6
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xb0], 0x3f800000
mov edx, 0x10
mov rcx, rbx
call fcn.1400126f0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xf0], rax
lea r12, [rsp + 0xf0]
mov edx, 0x10
mov rcx, rbx
mov r8, r12
call fcn.140012080
movaps xmm0, xmmword [0x1400672a0]
movups xmmword [rsp + 0xe0], xmm0
movabs r14, 0x492492492492491
lea rbx, [rsp + 0xb0]
mov rax, qword [rsp + 0xb8]
mov r15, qword [rax]
mov r13, qword [r15 + 8]
mov ecx, 0x38
call fcn.14006461c
mov rbp, rax
test r15, r15
mov rax, r13
cmove rax, rbp
mov rcx, r15
cmove rcx, rbp
mov qword [rbp], rcx
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x10]
movups xmmword [rbp + 0x20], xmm6
mov rdx, rdi
call fcn.1400074a0
mov eax, dword [rdi + 0x20]
mov dword [rbp + 0x30], eax
mov rax, qword [rsp + 0xc0]
cmp rax, r14
je 0x140011eb5
add rax, 1
mov qword [rsp + 0xc0], rax
mov qword [r15 + 8], rbp
mov qword [r13], rbp
mov rax, qword [rsp + 0xb8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, rbx
mov rdx, r12
call fcn.1400129e0
add rdi, 0x28
lea rax, [rsp + 0x280]
cmp rdi, rax
jne 0x14001136f
lea rcx, [rsp + 0x258]
call fcn.140007340
lea rcx, [rsp + 0x230]
call fcn.140007340
lea rcx, [rsp + 0x208]
call fcn.140007340
lea rcx, [rsp + 0x1e0]
call fcn.140007340
lea rcx, [rsp + 0x1b8]
call fcn.140007340
lea rcx, [rsp + 0x190]
call fcn.140007340
lea rcx, [rsp + 0x168]
call fcn.140007340
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rbp]
xor edi, edi
cmp rbx, rbp
je 0x14001152a
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
mov r15, qword [rsp + 0x60]
lea rdx, [rbx + 0x10]
mov r8, qword [rbx + 0x20]
cmp qword [rbx + 0x28], 8
jb 0x14001149e
mov rdx, qword [rdx]
mov rcx, r15
call r14
test eax, eax
je 0x140011527
mov rbx, qword [rbx]
cmp rbx, rbp
jne 0x14001148c
jmp 0x14001152a
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x90], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
call qword [rax + 0x98]
test eax, eax
jns 0x1400114ec
mov rcx, rsi
xor edx, edx
call fcn.14000bf50
mov edi, eax
jmp 0x140011658
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x88], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x48]
test eax, eax
jns 0x1400115e0
mov rcx, rsi
xor edx, edx
call fcn.14000bf50
mov edi, eax
jmp 0x140011645
mov edi, dword [rbx + 0x30]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140011582
mov rdx, qword [rsp + 0xd8]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140011567
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140011f67
add rdx, 0x27
mov rcx, rax
call fcn.140064680
xorps xmm0, xmm0
lea rax, [rsp + 0xc8]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0xb8]
mov qword [rax + 8], rax
mov qword [rsp + 0xc0], 0
cmp rbx, qword [rsp + 0xb8]
jne 0x1400116a7
mov rbp, rbx
mov edx, 0x38
mov rcx, rbp
call fcn.140064680
cmp qword [rsp + 0x60], 0
je 0x1400115d9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor ebx, ebx
jmp 0x140010e41
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x80], 0
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 1
call qword [rax + 0x40]
test eax, eax
js 0x140011626
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
jns 0x1400116d3
mov rcx, rsi
xor edx, edx
call fcn.14000bf50
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140011645
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140011658
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14001166b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14001167e
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14, r14
je 0x14001168c
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x168]
call fcn.140007340
test r15, r15
jne 0x140010c72
jmp 0x140010c7b
mov rbp, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.140007340
mov edx, 0x38
mov rcx, rbx
call fcn.140064680
mov rbx, rbp
cmp rbp, qword [rsp + 0xb8]
je 0x1400115b9
jmp 0x1400116a7
mov rbx, qword [rsp + 0x78]
mov rcx, rsi
mov rdx, rbx
call fcn.14000bf50
mov edi, eax
test rbx, rbx
je 0x140011632
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140011632
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xd0], 1
movaps xmm0, xmmword [0x140067830]
movups xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0xf0], 0
mov byte [rsp + 0x110], 0
lea rdx, [rsp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
lea rcx, [rsp + 0x120]
call fcn.140015dc0
cmp byte [rsp + 0xd0], 0
je 0x140011796
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x140011b6d
movaps xmm0, xmmword [0x140067830]
movaps xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0xb0], 0
test bpl, bpl
jne 0x1400117ce
cmp byte [rsp + 0x188], 0
je 0x1400117ce
mov rax, qword [rsp + 0x180]
cmp rax, 0x10
jae 0x140011b4a
movaps xmm0, xmmword [0x140067830]
movups xmmword [rsp + 0x178], xmm0
mov byte [rsp + 0x168], 0
cmp qword [rsp + 0x158], 0xf
jbe 0x1400117e1
mov rbx, qword [rsp + 0x140]
lea rdx, [0x140097cdc]
lea rcx, [rsp + 0x168]
mov r8, rbx
call fcn.140009aa0
lea rdx, str.firefox
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011b90
movabs rbx, 0x100000000
mov rax, qword [rsp + 0x138]
cmp rax, 0x10
jae 0x140011ac2
mov rax, qword [rsp + 0x158]
cmp rax, 0x10
jae 0x140011ae5
mov eax, edi
or rbx, rax
mov qword [rsp + 0xf0], rbx
mov rsi, qword [rsi + 0x10]
mov eax, dword [0x14009e3f0]
cmp eax, 0x9ffffff
ja 0x140011915
mov eax, dword [0x14009e048]
cmp eax, 0xa000001
jb 0x140011b13
lea rcx, [rsp + 0x174]
mov r8d, 0x110
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x170], 0
mov dword [rsp + 0x27c], 0
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rdi
lea rcx, [rsp + 0x168]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140011b08
mov eax, 0xa000000
xchg dword [0x14009e3f0], eax
mov ecx, 0xaa
call fcn.1400646bc
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm0
movups xmmword [rax + 0x90], xmm0
movups xmmword [rax + 0x9a], xmm0
mov rcx, rax
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x140011a6e
mov qword [rsp + 0x168], 0
lea rcx, [rsp + 0x168]
call section..text
test al, al
jne 0x140011cbc
lea rcx, str.Failed_to_get_install_directory_when_getting_strings
lea rdx, str.IsEnglish
mov r8d, 0x1f6
call fcn.140009e00
xor ebx, ebx
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x168], 0
test rcx, rcx
je 0x1400119c9
call fcn.140064680
mov rcx, rdi
call fcn.140064680
test bl, bl
je 0x140011b13
lea r8, str.InitialNotificationShown
lea rcx, [rsp + 0x168]
mov edx, 1
call fcn.14000b1a0
cmp byte [rsp + 0x16c], 0
jne 0x140011a9a
movzx eax, word [rsp + 0x168]
cmp byte [rsp + 0x169], 0
je 0x140011a1a
mov byte [rsp + 0x169], 0
movzx ecx, ax
cmp ecx, 0x100
jb 0x140011a9a
test al, al
je 0x140011a9a
lea rdx, str.FollowupRequestTime
lea rcx, [rsp + 0x168]
call fcn.14000b430
cmp byte [rsp + 0x178], 0
jne 0x140011bbb
cmp byte [rsp + 0x170], 0
je 0x140011bbb
mov rdi, qword [rsp + 0x168]
mov byte [rsp + 0x170], 0
jmp 0x140011bbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_get_locale:__X
lea rdx, str.IsEnglish
mov r8d, 0x1ef
mov r9d, eax
call fcn.140009e00
mov rcx, rdi
call fcn.140064680
jmp 0x140011b13
cmp dword [rsp + 0xf0], 4
jne 0x140011b13
cmp dword [rsp + 0xf4], 1
jne 0x140011b13
lea rcx, [rsp + 0x168]
xor edx, edx
mov r8, rsi
call fcn.14000a0c0
jmp 0x140011b30
mov rcx, qword [rsp + 0x120]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140011ee7
call fcn.140064680
jmp 0x140011830
mov rcx, qword [rsp + 0x140]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140011f07
call fcn.140064680
jmp 0x140011842
mov eax, 0xa000000
xchg dword [0x14009e048], eax
mov dword [rsp + 0x168], 0
movabs rax, 0x700000000
mov qword [rsp + 0x16c], rax
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x168]
call fcn.14000d870
jmp 0x1400109ac
mov rcx, qword [rsp + 0x168]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140011f27
call fcn.140064680
jmp 0x1400117b7
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140011f47
call fcn.140064680
jmp 0x14001177f
lea rdx, [0x14009712c]
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011de5
movabs rbx, 0x200000000
jmp 0x14001181e
xor edi, edi
lea r8, str.FollowupNotificationShown
lea rcx, [rsp + 0x168]
mov edx, 1
call fcn.14000b1a0
cmp byte [rsp + 0x16c], 0
jne 0x140011e33
mov eax, dword [rsp + 0x168]
mov ecx, eax
shr ecx, 8
cmp byte [rsp + 0x169], 0
je 0x140011c02
mov byte [rsp + 0x169], 0
test cl, cl
setne cl
test al, al
setne al
test rdi, rdi
je 0x140011d8a
and al, cl
jne 0x140011d8a
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0x168]
mov edx, 1
call fcn.14000b1a0
cmp byte [rsp + 0x16c], 0
jne 0x140011c6d
movzx eax, word [rsp + 0x168]
cmp byte [rsp + 0x169], 0
je 0x140011c5a
mov byte [rsp + 0x169], 0
movzx ecx, ax
cmp ecx, 0x100
jb 0x140011c6d
test al, al
jne 0x140011d8a
lea rcx, [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x168]
sub rax, rdi
jbe 0x140011d8a
shr rax, 0xe
cmp rax, 0x1600a391
jb 0x140011d8a
cmp dword [rsp + 0xf0], 4
jne 0x140011d6e
lea rcx, [rsp + 0x168]
mov edx, 1
jmp 0x140011ab8
mov rdx, qword [rsp + 0x168]
lea r14, str._slocale.ini
mov rcx, r14
call fcn.1400011b0
add eax, 1
movsxd r12, eax
mov rbp, r12
add rbp, r12
mov rax, 0xffffffffffffffff
cmovb rbp, rax
mov rcx, rbp
call fcn.1400646bc
mov r15, rax
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, r12
mov r8, 0xffffffffffffffff
mov r9, r14
call fcn.140001230
mov qword [rsp + 0xb0], 0
lea rdx, [0x1400971a7]
lea r9, [rsp + 0xb0]
mov rcx, r15
mov r8, rdx
call fcn.140009fc0
test al, al
je 0x140011dba
lea rdx, [0x1400990f6]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140011d9a
xor ebx, ebx
jmp 0x140011dba
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0x168]
mov edx, 1
mov r9b, 1
call fcn.14000b300
mov dword [rsp + 0x168], 1
jmp 0x140011b1e
mov rcx, qword [rsp + 0xb0]
lea rdx, [0x1400990f6]
mov r8d, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
sete bl
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
test rcx, rcx
je 0x140011dd8
call fcn.140064680
mov rcx, r15
call fcn.140064680
jmp 0x1400119ab
lea rdx, str.edge
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011e0c
movabs rbx, 0x300000000
jmp 0x14001181e
lea rdx, str.edge_chrome
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011e3c
movabs rbx, 0x400000000
jmp 0x14001181e
mov cl, 1
xor eax, eax
jmp 0x140011c02
lea rdx, [0x1400971ba]
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011e63
movabs rbx, 0x500000000
jmp 0x14001181e
lea rdx, str.opera
lea rcx, [rsp + 0x120]
call fcn.140009640
test eax, eax
jne 0x140011e8a
movabs rbx, 0x600000000
jmp 0x14001181e
lea rdx, str.brave
lea rcx, [rsp + 0x120]
call fcn.140009640
xor ecx, ecx
test eax, eax
movabs rbx, 0x700000000
cmovne rbx, rcx
jmp 0x14001181e
lea rcx, str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
ud2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140011f67
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140011144
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140011f67
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140011adb
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140011f67
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140011afe
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140011f67
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140011b63
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140011f67
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140011b86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
ud2