Function at 0x14011efc0
Capabilities:
Check if file exists
Check mutex on windows
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
movaps xmmword [rsp + 0x320], xmm7
movaps xmmword [rsp + 0x310], xmm6
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x308], rax
lea r8, str.GlobalMainProcess_612ED4E6_C14D_4464_8AC4_0FD185701786
xor edi, edi
mov ecx, 0x1f0003
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x14011f035
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x14011fdb2
call fcn.14017a3f0
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rdi + 1]
cmp rax, 1
ja 0x14011f16f
cmp dword [0x1402e5a28], 2
jg 0x14011f091
lea rdx, str.audio_capture_fx.cc
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov r8d, 0x45
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_open_main_process_event
mov r8d, 0x1f
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
xor r15d, r15d
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14011f0c7
call fcn.14017a3f0
cmp qword [0x1402e5b90], 0
je 0x14011fdc4
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402f5008]
test r15, r15
je 0x14011f432
movaps xmm6, xmmword [0x14029ca60]
lea rdx, [rsp + 0xa0]
movaps xmmword [rdx], xmm6
mov rax, qword [r15 + 8]
mov qword [rdx], rax
lea rbp, [r15 + 0x10]
mov rax, qword [r15 + 0x10]
mov qword [rdx + 8], rax
mov ecx, 2
xor r8d, r8d
mov r9d, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x14011f24a
test eax, eax
je 0x14011f2d3
cmp eax, 0x102
jne 0x14011f466
cmp dword [0x1402e5a28], 2
jg 0x14011f321
lea rdx, str.audio_capture_fx.cc
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8d, 0x63
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Timeout
mov r8d, 7
jmp 0x14011f314
lea r8, str.GlobalAdminProcess_88C44B13_F504_4ECA_A9C7_1E5A006014CA
xor ebx, ebx
mov ecx, 0x1f0003
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x14011f1af
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r14, 0xffffffffffffffff
je 0x14011fdb9
call fcn.14017a3f0
mov rbx, r14
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x14011fa38
cmp dword [0x1402e5a28], 2
jg 0x14011f20b
lea rdx, str.audio_capture_fx.cc
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov r8d, 0x4c
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_open_admin_process_event
mov r8d, 0x20
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
xor r15d, r15d
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14011f094
call fcn.14017a3f0
cmp qword [0x1402e5b90], 0
je 0x14011fee4
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402f5008]
jmp 0x14011f094
cmp dword [0x1402e5a28], 2
jg 0x14011f321
lea rdx, str.audio_capture_fx.cc
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8d, 0x6d
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_wait_for_events
mov r8d, 0x17
jmp 0x14011f314
test r12, r12
mov r15, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
je 0x14011f2ac
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x1402cbde0]
and rax, rbp
cmp rax, qword [0x1402cbdc8]
jne 0x14011f321
mov rcx, rbp
call fcn.1401509f0
jmp 0x14011f321
cmp dword [0x1402e5a28], 2
jg 0x14011f321
lea rdx, str.audio_capture_fx.cc
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8d, 0x68
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Browser_process_is_no_longer_interested_in_admin_process
mov r8d, 0x38
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
mov rsi, qword [r15 + 0x18]
test rsi, rsi
je 0x14011f36e
mov rdi, qword [r15 + 0x20]
mov rcx, rsi
cmp rdi, rsi
je 0x14011f365
add rdi, 0xffffffffffffffe8
jmp 0x14011f350
mov rcx, qword [rdi]
call fcn.1401cbbbc
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x14011f361
test rdi, rdi
je 0x14011ff28
cmp byte [rdi + 0x17], 0
jns 0x14011f344
jmp 0x14011f33c
mov rcx, qword [r15 + 0x18]
mov qword [r15 + 0x20], rsi
call fcn.1401cbbbc
mov rax, qword [rbp]
inc rax
cmp rax, 2
jb 0x14011f3b0
call fcn.14017a3f0
mov rdi, qword [rbp]
cmp qword [0x1402e5b90], 0
je 0x14011fe0c
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402f5008]
mov qword [rbp], 0
mov rax, qword [r15 + 8]
inc rax
cmp rax, 2
jb 0x14011f3f2
call fcn.14017a3f0
mov rdi, qword [r15 + 8]
cmp qword [0x1402e5b90], 0
je 0x14011fe54
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402f5008]
mov qword [r15 + 8], 0
mov rax, qword [r15]
inc rax
cmp rax, 2
jb 0x14011f42a
call fcn.14017a3f0
mov rdi, qword [r15]
cmp qword [0x1402e5b90], 0
je 0x14011fe9c
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402f5008]
mov rcx, r15
call fcn.1401cbbbc
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.1401ce5b0
movaps xmm6, xmmword [rsp + 0x310]
movaps xmm7, xmmword [rsp + 0x320]
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1402cbde0]
and rax, rbp
cmp rax, qword [0x1402cbdc8]
jne 0x14011f481
mov rcx, rbp
call fcn.1401508a0
lea rbx, [rsp + 0xf0]
mov r8d, 0x218
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d06e0
lea r14, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov rcx, rbx
mov rdx, 0xffffffff80000002
mov r8, r14
mov r9d, 0x100
call fcn.140121ca0
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14011f6dc
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14011f52f
mov rcx, qword [r15 + 8]
mov edx, 0x3a98
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14011f57d
cmp dword [0x1402e5a28], 2
jg 0x14011f57d
lea rdx, str.audio_capture_fx.cc
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8d, 0x8f
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Wait_for_admin_process_event_failed
mov r8d, 0x23
jmp 0x14011f570
cmp dword [0x1402e5a28], 2
jg 0x14011f57d
lea rdx, str.audio_capture_fx.cc
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov r8d, 0x86
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_set_main_process_event
mov r8d, 0x1e
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
mov r14, qword [r15 + 0x18]
mov r13, qword [r15 + 0x20]
cmp r14, r13
je 0x14011f2ac
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r15
xor r12d, r12d
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbp, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r15, str.audio_capture_fx.cc
jmp 0x14011f613
cmp dword [0x1402e5a28], 2
jg 0x14011f606
mov rcx, rbx
mov rdx, r15
mov r8d, 0xb2
mov r9d, 2
call fcn.1400036d0
mov r8d, 0x11
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_open_key
call fcn.140206b20
mov rcx, rax
mov rdx, r14
call fcn.140062f20
mov rcx, rbx
call fcn.1400038d0
add r14, 0x18
cmp r14, r13
je 0x14011f294
cmp byte [r14 + 0x17], 0
mov rdx, r14
jns 0x14011f620
mov rdx, qword [r14]
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x102
call rdi
test eax, eax
jne 0x14011f5b9
test r12, r12
jne 0x14011f6c3
mov r12, qword [rsp + 0xf0]
mov dword [rsp + 0xf0], 0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 4
mov rcx, r12
mov rdx, rbp
xor r8d, r8d
mov r9d, 4
call rsi
test eax, eax
je 0x14011f606
cmp dword [0x1402e5a28], 2
jg 0x14011f606
mov rcx, rbx
mov rdx, r15
mov r8d, 0xb9
mov r9d, 2
call fcn.1400036d0
mov r8d, 0x28
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_restore_capture_effects_for_key
jmp 0x14011f5ee
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14011f650
xor r13d, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14011f90e
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r15
cmp dword [rsp + 0xf8], 0xffffffff
je 0x14011f6ce
lea r8, [rsp + 0xfc]
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x48], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [0x1402a263c]
lea rdi, str.FxProperties
lea r15, [rsp + 0xb0]
xorps xmm7, xmm7
lea r12, [rsp + 0x80]
lea rbp, [rsp + 0x70]
lea rsi, [rsp + 0x50]
xor r13d, r13d
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], 0x41
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], r8
mov rcx, r8
call fcn.1401cc340
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], 0xd
mov qword [rsp + 0x70], 4
mov qword [rsp + 0x78], r15
xor eax, eax
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm7
mov rcx, r12
mov rdx, rbp
call fcn.14017a000
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x50], xmm0
cmp byte [rsp + 0x67], 0
mov rdx, rsi
mov eax, 0
mov rdi, r15
jns 0x14011f7f8
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x2011b
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea r15, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_5
jne 0x14011f8c7
test r13, r13
jne 0x14011f980
mov r13, qword [rsp + 0xb0]
mov eax, 4
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbp
mov rcx, r13
mov rdx, r15
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14011f896
mov eax, dword [rsp + 0xb0]
add eax, 0xfffffffd
cmp eax, 1
ja 0x14011f896
cmp dword [rsp + 0x80], 4
jne 0x14011f896
cmp dword [rsp + 0x70], 1
je 0x14011f8c7
mov dword [rsp + 0xb0], 1
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, r13
mov rdx, r15
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14011f92f
lea r15, [rsp + 0xf0]
cmp byte [rsp + 0x67], 0
jns 0x14011f8e0
mov rcx, qword [rsp + 0x50]
call fcn.1401cbbbc
mov eax, dword [rsp + 0xf8]
cmp eax, 0xffffffff
je 0x14011f8f5
dec eax
mov dword [rsp + 0xf8], eax
mov rcx, r15
call fcn.140208980
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
jne 0x14011f99d
test r13, r13
mov r15, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
je 0x14011f4c4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14011f4c4
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + 0x20]
cmp rax, qword [rcx + 0x28]
lea r15, [rsp + 0xf0]
jae 0x14011f98e
test rax, rax
je 0x14011f9d3
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmmword [rsp + 0x50], xmm7
mov qword [rsp + 0x60], 0
add rax, 0x18
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x20], rax
jmp 0x14011f8cf
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14011f833
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.14020a590
jmp 0x14011f972
cmp dword [rsp + 0xf8], 0xffffffff
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [0x1402a263c]
mov r15, rdi
lea rdi, str.FxProperties
lea r8, [rsp + 0xfc]
jne 0x14011f73e
jmp 0x14011f6d1
int3
xor ecx, ecx
jmp 0x14011fda0
xor ecx, ecx
jmp 0x14011fd58
xor ecx, ecx
jmp 0x14011fd13
xor ecx, ecx
jmp 0x14011fa21
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011f9eb
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fa2d
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011faf2
xor ecx, ecx
mov dl, 1
jmp 0x14011fa23
xor r14d, r14d
jmp 0x14011fa6a
lea r8, str.GlobalRegMod_E2F47AAC_E6E3_4A89_82CE_29EE26E72635
xor r14d, r14d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x14011fa72
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r15, 0xffffffffffffffff
je 0x14011fa33
call fcn.14017a3f0
mov r14, r15
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [r14 + 1]
cmp rax, 1
ja 0x14011fb0d
cmp dword [0x1402e5a28], 2
jg 0x14011face
lea rdx, str.audio_capture_fx.cc
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov r8d, 0x53
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x100]
lea rdx, str.Can_not_create_registry_modification_mutex
mov r8d, 0x2a
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
xor r15d, r15d
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14011f20e
call fcn.14017a3f0
cmp qword [0x1402e5b90], 0
je 0x14011f9ef
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402f5008]
jmp 0x14011f20e
mov ecx, 0x30
call fcn.1401cbbc4
mov r15, rax
call fcn.14017a3f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14017a3f0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14017a3f0
test rbx, rbx
je 0x14011fb53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14017a3f0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14017a3f0
test rdi, rdi
je 0x14011fb72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14017a3f0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [r15], 0
call fcn.14017a3f0
cmp qword [r15], rdi
je 0x14011fbab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jae 0x14011fcaa
mov qword [r15], rdi
call fcn.14017a3f0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [r15 + 8], 0
call fcn.14017a3f0
cmp qword [r15 + 8], rbx
je 0x14011fbe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [r15 + 8]
inc rax
cmp rax, 2
jae 0x14011fc72
mov qword [r15 + 8], rbx
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [r15 + 0x10], 0
call fcn.14017a3f0
cmp qword [r15 + 0x10], r14
je 0x14011fc21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [r15 + 0x10]
inc rax
cmp rax, 2
jae 0x14011fc3d
mov qword [r15 + 0x10], r14
call fcn.14017a3f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xorps xmm0, xmm0
movups xmmword [r15 + 0x18], xmm0
mov qword [r15 + 0x28], 0
xor edi, edi
xor ebx, ebx
xor r14d, r14d
jmp 0x14011fad1
call fcn.14017a3f0
mov rsi, r15
mov rbx, qword [r15 + 0x10]
cmp qword [0x1402e5b90], 0
je 0x14011fd6a
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402f5008]
mov r15, rsi
jmp 0x14011fc10
call fcn.14017a3f0
mov rsi, r15
mov r15, qword [r15 + 8]
cmp qword [0x1402e5b90], 0
je 0x14011fd22
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r15
call qword [0x1402f5008]
mov r15, rsi
jmp 0x14011fbd7
call fcn.14017a3f0
mov rsi, r15
mov r15, qword [r15]
cmp qword [0x1402e5b90], 0
je 0x14011fcdd
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r15
call qword [0x1402f5008]
mov r15, rsi
jmp 0x14011fb9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011f9e4
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fd1c
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011fcbf
xor ecx, ecx
mov dl, 1
jmp 0x14011fd15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011f9dd
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fd64
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011fc8c
xor ecx, ecx
mov dl, 1
jmp 0x14011fd5a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011f9d6
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fdac
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011fc57
xor ecx, ecx
mov dl, 1
jmp 0x14011fda2
xor edi, edi
jmp 0x14011f02d
xor ebx, ebx
jmp 0x14011f1a7
xor ecx, ecx
jmp 0x14011fdf6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011fdc0
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fe02
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011f0b1
xor ecx, ecx
mov dl, 1
jmp 0x14011fdf8
xor ecx, ecx
jmp 0x14011fe3e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011fe08
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fe4a
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011f392
xor ecx, ecx
mov dl, 1
jmp 0x14011fe40
xor ecx, ecx
jmp 0x14011fe86
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011fe50
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011fe92
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011f3d4
xor ecx, ecx
mov dl, 1
jmp 0x14011fe88
xor ecx, ecx
jmp 0x14011fece
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011fe98
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011feda
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011f414
xor ecx, ecx
mov dl, 1
jmp 0x14011fed0
xor ecx, ecx
jmp 0x14011ff16
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011fee0
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14011ff22
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14011f22f
xor ecx, ecx
mov dl, 1
jmp 0x14011ff18
int3