Function at 0x140020fe0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Create process on windows
Encrypt data using speck
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb68
movaps xmmword [rsp + 0xb50], xmm6
mov rsi, r9
mov r15, r8
mov r13, rdx
mov r14, rcx
mov rax, qword [0x140062018]
xor rax, rsp
mov qword [rsp + 0xb48], rax
mov ecx, dword [rdx]
mov rdx, r8
call fcn.140023990
test al, al
je 0x140022f1f
mov qword [0x140062cd8], rsi
lea r12, [r15 + 8]
mov r8, qword [r15 + 8]
test r8, r8
je 0x1400211b9
lea rcx, [r15 + 0x10]
mov r9d, 0xff
mov rax, r8
mov rbp, r12
movzx ebx, word [rax]
cmp ebx, 0x2d
je 0x14002107a
cmp ebx, 0x2f
je 0x140022f13
mov rax, qword [rbp + 8]
add rbp, 8
add rcx, 8
test rax, rax
jne 0x140021053
jmp 0x14002110f
lea rbx, [rax + 2]
lea rdi, [rax + 4]
cmp word [rax + 2], 0x2d
cmove rbx, rdi
mov sil, 0x6c
xor r10d, r10d
movzx edi, word [rbx + r10*2]
test di, di
je 0x140021064
cmp sil, 0x2d
je 0x1400210b1
lea edx, [rsi - 0x30]
cmp dl, 0xa
jb 0x1400210b1
lea edx, [rsi - 0x61]
cmp dl, 0x19
ja 0x140021064
movzx edx, di
cmp edx, r9d
cmovae edi, r9d
lea edx, [rdi - 0x41]
mov eax, edi
or al, 0x20
cmp dl, 0x1a
movzx eax, al
cmovae eax, edi
cmp al, sil
jne 0x140021064
lea rax, str.log_launcher_error
mov sil, byte [r10 + rax + 1]
inc r10
cmp r10, 0x12
jne 0x140021091
cmp word [rbx + 0x24], 0
jne 0x140021064
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400210f0
dec dword [r13]
mov byte [0x140062ce0], 1
mov r8, qword [r12]
test r8, r8
je 0x1400211b9
mov ebp, 0xff
lea r9, str.contentproc
mov r10, r12
movzx eax, word [r8]
cmp eax, 0x2d
jne 0x14002119f
lea rax, [r8 + 2]
lea rbx, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rax, rbx
mov dil, 0x63
xor ebx, ebx
movzx esi, word [rax + rbx*2]
test si, si
je 0x1400211a8
cmp dil, 0x2d
je 0x140021166
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x140021166
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x1400211a8
movzx edx, si
cmp edx, ebp
cmovae esi, ebp
lea edx, [rsi - 0x41]
mov ecx, esi
or cl, 0x20
cmp dl, 0x1a
movzx ecx, cl
cmovae ecx, esi
cmp cl, dil
jne 0x1400211a8
mov dil, byte [rbx + r9 + 1]
inc rbx
cmp rbx, 0xb
jne 0x140021147
cmp word [rax + 0x16], 0
je 0x140021540
jmp 0x1400211a8
cmp eax, 0x2f
je 0x140022f7c
mov r8, qword [r10 + 8]
add r10, 8
test r8, r8
jne 0x140021127
lea rcx, [rsp + 0x1c8]
call fcn.140024130
pxor xmm0, xmm0
lea r8, [rsp + 0x6f0]
movdqa xmmword [r8 + 0x20], xmm0
movdqa xmmword [r8 + 0x10], xmm0
movdqa xmmword [r8], xmm0
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x88], r13
js 0x140022f94
mov r8, qword [rsp + 0x718]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140022fca
lea rsi, [rsp + 0x710]
mov dword [rsi - 0x20], 0
mov byte [rsi - 8], 0
lea r9, [rsp + 0x2b0]
mov dword [r9], 0x209
mov rcx, rbp
mov edx, 1
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140022fff
cmp byte [rsp + 0x708], 1
je 0x140023026
mov r8d, dword [rsp + 0x6f0]
lea rdi, [rsp + 0x130]
mov rcx, rdi
mov rdx, rsi
call fcn.140024700
cmp byte [rdi + 0x18], 1
je 0x140023045
lea rsi, [rsp + 0x2d0]
mov dword [rsi - 0x20], 1
mov byte [rsi - 8], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x1400212db
test eax, eax
jne 0x140022b56
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r13d, 0x29
mov sil, 1
lea rdi, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, rbp
inc rax
cmp rax, 2
jb 0x140021314
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x140022fa9
test dil, dil
sete r14b
lea rcx, [0x140057fd6]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400230a5
mov rbx, qword [r12]
test rbx, rbx
je 0x140021576
lea rcx, [r15 + 0x10]
mov esi, 0xff
mov rax, rbx
movzx ebp, word [rax]
cmp ebp, 0x2d
je 0x140021375
cmp ebp, 0x2f
je 0x140022f88
mov rax, qword [rcx]
add rcx, 8
test rax, rax
jne 0x140021353
jmp 0x140021576
lea rbp, [rax + 2]
lea rdi, [rax + 4]
cmp word [rax + 2], 0x2d
cmove rbp, rdi
movzx eax, word [rbp]
test ax, ax
je 0x140021364
movzx edi, ax
cmp edi, esi
cmovae eax, esi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x6c
jne 0x140021364
movzx eax, word [rbp + 2]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x61
jne 0x140021364
movzx eax, word [rbp + 4]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x75
jne 0x140021364
movzx eax, word [rbp + 6]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x6e
jne 0x140021364
movzx eax, word [rbp + 8]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x63
jne 0x140021364
movzx eax, word [rbp + 0xa]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x68
jne 0x140021364
movzx eax, word [rbp + 0xc]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x65
jne 0x140021364
movzx eax, word [rbp + 0xe]
test ax, ax
je 0x140021364
movzx edx, ax
mov edi, 0xff
cmp edx, edi
cmovae eax, edi
lea edi, [rax - 0x41]
mov edx, eax
or dl, 0x20
cmp dil, 0x1a
movzx edx, dl
cmovae edx, eax
cmp dl, 0x72
jne 0x140021364
cmp word [rbp + 0x10], 0
jne 0x140021364
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140021520
mov rax, qword [rsp + 0x88]
dec dword [rax]
mov rbx, qword [r12]
jmp 0x140021585
mov qword [r14], 0
mov rcx, qword [rsp + 0xb48]
xor rcx, rsp
call fcn.14002fae0
mov rax, r14
movaps xmm6, xmmword [rsp + 0xb50]
add rsp, 0xb68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13b, 1
mov r10b, 1
test r14b, r14b
je 0x14002161e
mov r10b, 1
test rbx, rbx
je 0x14002161b
lea rcx, [r15 + 0x10]
mov r8d, 0xff
mov rbp, r12
movzx eax, word [rbx]
cmp eax, 0x2d
jne 0x140021601
lea rdx, [rbx + 2]
lea rax, [rbx + 4]
cmp word [rbx + 2], 0x2d
cmove rdx, rax
mov dil, 0x66
xor r9d, r9d
movzx esi, word [rdx + r9*2]
test si, si
je 0x14002160a
cmp dil, 0x2d
je 0x1400215dd
lea ebx, [rdi - 0x30]
cmp bl, 0xa
jb 0x1400215dd
lea ebx, [rdi - 0x61]
cmp bl, 0x19
ja 0x14002160a
movzx ebx, si
cmp ebx, r8d
cmovae esi, r8d
lea ebx, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x14002160a
jmp 0x1400230c2
cmp eax, 0x2f
je 0x14002310b
mov rbx, qword [rbp + 8]
add rbp, 8
add rcx, 8
test rbx, rbx
jne 0x14002159e
xor r13d, r13d
mov dword [rsp + 0x80], r10d
mov r14d, 1
cmp qword [rsp + 0x1e8], 0
lea rbx, [rsp + 0x6f0]
je 0x140022bd9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x140022f2a
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140022f2a
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140022f2a
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x140022f2a
cmp dword [rax + rcx + 0x50], 0x148
jb 0x140022f2a
mov esi, dword [rax + rcx + 8]
lea rdi, [rsp + 0x210]
cmp qword [rdi + 0x10], 0
jne 0x140021773
mov rbp, qword [rsp + 0x200]
cmp qword [rsp + 0x208], 8
jb 0x1400216c8
mov r9, qword [rsp + 0x1f0]
jmp 0x1400216d0
lea r9, [rsp + 0x1f0]
mov rax, qword [rsp + 0x228]
cmp rax, rbp
jb 0x140022b46
mov rbx, rdi
cmp rax, 8
jb 0x1400216f2
mov rbx, qword [rsp + 0x210]
mov qword [rsp + 0x220], rbp
mov r8, rbp
add r8, rbp
mov rcx, rbx
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rbx + rbp*2], 0
lea rbx, [rsp + 0x6f0]
mov rax, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x228]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jb 0x140022eb9
lea rdx, [rax + 6]
mov qword [rsp + 0x220], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x140021756
mov rdx, qword [rsp + 0x210]
movabs rcx, 0x61006d0049007c
mov qword [rdx + rax*2], rcx
mov dword [rdx + rax*2 + 8], 0x650067
mov word [rdx + rax*2 + 0xc], 0
mov dword [rsp + 0x2b0], 4
mov rcx, qword [rsp + 0x1e8]
cmp qword [rsp + 0x228], 8
jb 0x140021799
mov rdi, qword [rsp + 0x210]
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x130]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022de7
cmp dword [rsp + 0x130], 4
jne 0x140023147
cmp dword [rsp + 0x6f0], esi
jne 0x140022df0
test r13b, r13b
je 0x14002183f
lea rsi, [rsp + 0x6f0]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1e0]
mov qword [rcx - 8], rax
mov eax, 1
mov byte [rcx], 1
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x130], eax
mov cl, 1
mov qword [rsp + 0x80], rcx
test eax, eax
jne 0x14002191d
mov r13b, 1
jmp 0x14002194c
cmp r14d, 1
jne 0x140022e45
lea rcx, [rsp + 0x1c8]
lea rsi, [rsp + 0x6f0]
mov rdx, rsi
call fcn.1400322e0
cmp byte [rsi + 0x10], 0
jne 0x140023635
lea rcx, [rsp + 0x1c8]
lea rsi, [rsp + 0x2b0]
mov rdx, rsi
call fcn.140032280
cmp byte [rsi + 0x10], 0
jne 0x140022e37
mov dl, byte [rsp + 0x6f8]
test dl, dl
setne bl
mov cl, byte [rsp + 0x2b8]
test cl, cl
setne al
xor al, bl
test dl, dl
mov edx, dword [rsp + 0x80]
je 0x14002375b
test cl, cl
lea rbx, [rsp + 0x6f0]
je 0x1400218d5
mov rax, qword [rsp + 0x6f0]
cmp rax, qword [rsp + 0x2b0]
setae al
and dl, al
mov edi, edx
cmp dl, 1
je 0x140023768
lea rsi, [rsp + 0x130]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1d0]
mov qword [rcx - 8], rax
movzx eax, dil
mov byte [rcx], 1
mov byte [rsp + 0x140], 0
jmp 0x140021825
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400231cb
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
jne 0x1400231df
xor r13d, r13d
cmp qword [rsp + 0x1e8], 0
je 0x140022c62
lea rbp, [rsp + 0x290]
cmp qword [rbp + 0x10], 0
jne 0x140021a2b
mov rsi, qword [rsp + 0x200]
cmp qword [rsp + 0x208], 8
jb 0x14002198b
mov r9, qword [rsp + 0x1f0]
jmp 0x140021993
lea r9, [rsp + 0x1f0]
mov rax, qword [rsp + 0x2a8]
cmp rax, rsi
jb 0x140022b36
mov rdi, rbp
cmp rax, 8
jb 0x1400219b5
mov rdi, qword [rsp + 0x290]
mov qword [rsp + 0x2a0], rsi
lea r8, [rsi + rsi]
mov rcx, rdi
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rdi + rsi*2], 0
mov rax, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x2a8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xa
jb 0x140022e97
lea rdx, [rax + 0xa]
mov qword [rsp + 0x2a0], rdx
mov rdx, rbp
cmp rcx, 8
jb 0x140021a0f
mov rdx, qword [rsp + 0x290]
movdqa xmm0, xmmword [str.Blocklist]
movdqu xmmword [rdx + rax*2], xmm0
mov dword [rdx + rax*2 + 0x10], 0x740073
mov word [rdx + rax*2 + 0x14], 0
mov rcx, qword [rsp + 0x1e8]
cmp qword [rsp + 0x2a8], 8
mov r8, rbp
jb 0x140021a49
mov r8, qword [rsp + 0x290]
mov qword [rsp + 0x30], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140022d0b
mov edi, dword [rsp + 0x6f0]
and edi, 0xfffffffe
mov rcx, rdi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x1e8]
cmp qword [rsp + 0x2a8], 8
jb 0x140021aac
mov rbp, qword [rsp + 0x290]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rbp
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140023193
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rbx, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x140022e7c
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rdx, rsi
call sub.ntdll.dll_memcpy
mov word [rsp + rbx*2 + 0x6f0], 0
mov rbp, qword [rsp + 0x6f0]
mov r14, qword [rsp + 0x6f8]
mov rbx, qword [rsp + 0x700]
mov rdi, qword [rsp + 0x708]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], rdi
mov bl, 1
mov al, 1
mov byte [rsp + 0x1c0], al
test byte [rsp + 0x80], r13b
je 0x14002221b
call fcn.140024020
test al, al
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rbx
jne 0x14002321d
call fcn.140032220
call int.140024340
test r15, r15
mov r13, qword [rsp + 0x88]
je 0x14002328a
lea rsi, [rsp + 0x6f0]
mov rcx, rsi
call fcn.140024250
mov rax, qword [rsi]
test rax, rax
je 0x140023285
mov qword [r15], rax
mov r14, qword [r15 + 8]
test r14, r14
je 0x1400220f2
lea rax, [r15 + 0x10]
mov r10d, 0xff
lea r9, str.wait_for_browser
mov rbp, r14
mov r8, r12
movzx ebx, word [rbp]
cmp ebx, 0x2d
jne 0x140021c88
lea rbx, [rbp + 2]
lea rdi, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rbx, rdi
mov dil, 0x77
xor esi, esi
movzx ebp, word [rbx + rsi*2]
test bp, bp
je 0x140021c91
cmp dil, 0x2d
je 0x140021c4d
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x140021c4d
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x140021c91
movzx edx, bp
cmp edx, r10d
cmovae ebp, r10d
lea edx, [rbp - 0x41]
mov ecx, ebp
or cl, 0x20
cmp dl, 0x1a
movzx ecx, cl
cmovae ecx, ebp
cmp cl, dil
jne 0x140021c91
mov dil, byte [rsi + r9 + 1]
inc rsi
cmp rsi, 0x10
jne 0x140021c2e
cmp word [rbx + 0x20], 0
je 0x140022125
jmp 0x140021c91
cmp ebx, 0x2f
je 0x1400232bf
mov rbp, qword [r8 + 8]
add r8, 8
add rax, 8
test rbp, rbp
jne 0x140021c0f
mov r10, r13
lea rax, [r15 + 0x10]
mov edi, 0xff
mov rdx, r14
movzx ebp, word [rdx]
cmp ebp, 0x2f
je 0x140021cd9
cmp ebp, 0x2d
jne 0x140021e11
lea rbp, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rbp, rbx
jmp 0x140021ce0
add rdx, 2
mov rbp, rdx
movzx edx, word [rbp]
test dx, dx
je 0x140021e11
movzx ebx, dx
cmp ebx, edi
cmovae edx, edi
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x6d
jne 0x140021e11
movzx edx, word [rbp + 2]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x61
jne 0x140021e11
movzx edx, word [rbp + 4]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x72
jne 0x140021e11
movzx edx, word [rbp + 6]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x69
jne 0x140021e11
movzx edx, word [rbp + 8]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6f
jne 0x140021e11
movzx edx, word [rbp + 0xa]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6e
jne 0x140021e11
movzx edx, word [rbp + 0xc]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
je 0x140023859
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140021cb5
mov r9d, 0xff
lea r8, str.backgroundtask
mov rbp, r14
mov rdx, r12
movzx ecx, word [rbp]
cmp ecx, 0x2f
je 0x140021e55
cmp ecx, 0x2d
jne 0x140021ebb
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
jmp 0x140021e5c
add rbp, 2
mov rcx, rbp
mov dil, 0x62
xor ebx, ebx
movzx esi, word [rcx + rbx*2]
test si, si
je 0x140021ebb
cmp dil, 0x2d
je 0x140021e82
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x140021e82
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x140021ebb
movzx ebp, si
cmp ebp, r9d
cmovae esi, r9d
lea ebp, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bpl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x140021ebb
mov dil, byte [rbx + r8 + 1]
inc rbx
cmp rbx, 0xe
jne 0x140021e61
cmp word [rcx + 0x1c], 0
je 0x140023932
mov rbp, qword [rdx + 8]
add rdx, 8
test rbp, rbp
jne 0x140021e34
lea rax, [r15 + 0x10]
mov edi, 0xff
mov rdx, r14
movzx ebp, word [rdx]
cmp ebp, 0x2f
je 0x140021efc
cmp ebp, 0x2d
jne 0x140022034
lea rbp, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rbp, rbx
jmp 0x140021f03
add rdx, 2
mov rbp, rdx
movzx edx, word [rbp]
test dx, dx
je 0x140022034
movzx ebx, dx
cmp ebx, edi
cmovae edx, edi
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x68
jne 0x140022034
movzx edx, word [rbp + 2]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140022034
movzx edx, word [rbp + 4]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x61
jne 0x140022034
movzx edx, word [rbp + 6]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x64
jne 0x140022034
movzx edx, word [rbp + 8]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6c
jne 0x140022034
movzx edx, word [rbp + 0xa]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140022034
movzx edx, word [rbp + 0xc]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x73
je 0x1400238f8
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140021ed8
mov r9d, 0xff
lea r8, str.remote_debugging_port
mov rbp, r14
mov rdx, r12
movzx ecx, word [rbp]
cmp ecx, 0x2f
je 0x140022078
cmp ecx, 0x2d
jne 0x1400220de
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
jmp 0x14002207f
add rbp, 2
mov rcx, rbp
mov dil, 0x72
xor ebx, ebx
movzx esi, word [rcx + rbx*2]
test si, si
je 0x1400220de
cmp dil, 0x2d
je 0x1400220a5
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x1400220a5
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x1400220de
movzx ebp, si
cmp ebp, r9d
cmovae esi, r9d
lea ebp, [rsi - 0x41]
mov eax, esi
or al, 0x20
cmp bpl, 0x1a
movzx eax, al
cmovae eax, esi
cmp al, dil
jne 0x1400220de
mov dil, byte [rbx + r8 + 1]
inc rbx
cmp rbx, 0x15
jne 0x140022084
cmp word [rcx + 0x2a], 0
je 0x140023932
mov rbp, qword [rdx + 8]
add rdx, 8
test rbp, rbp
mov r13, r10
jne 0x140022057
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140022109
cmp byte [rax], 0
jne 0x14002213d
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor r11d, r11d
test rax, rax
je 0x140022143
cmp byte [rax], 0
je 0x140022143
jmp 0x14002213d
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140022125
dec dword [r13]
mov r14, qword [r12]
mov r11d, 1
test r14, r14
je 0x140022336
lea rax, [r15 + 0x10]
mov r8d, 0xff
mov rbp, r14
mov rdx, r12
movzx ecx, word [rbp]
cmp ecx, 0x2d
je 0x140022184
cmp ecx, 0x2f
je 0x140023117
mov rbp, qword [rdx + 8]
add rdx, 8
add rax, 8
test rbp, rbp
jne 0x14002215c
jmp 0x14002224e
lea rcx, [rbp + 2]
lea rbx, [rbp + 4]
cmp word [rbp + 2], 0x2d
cmove rcx, rbx
mov dil, 0x6e
xor r9d, r9d
movzx esi, word [rcx + r9*2]
test si, si
je 0x14002216e
cmp dil, 0x2d
je 0x1400221bd
lea ebp, [rdi - 0x30]
cmp bpl, 0xa
jb 0x1400221bd
lea ebp, [rdi - 0x61]
cmp bpl, 0x19
ja 0x14002216e
movzx ebp, si
cmp ebp, r8d
cmovae esi, r8d
lea ebp, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp bpl, 0x1a
movzx ebp, bl
cmovae ebp, esi
cmp bpl, dil
jne 0x14002216e
lea rbp, str.no_deelevate
mov dil, byte [r9 + rbp + 1]
inc r9
cmp r9, 0xc
jne 0x14002219b
cmp word [rcx + 0x18], 0
jne 0x14002216e
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x1400221fe
dec dword [r13]
mov r14, qword [r12]
xor r8d, r8d
jmp 0x140022251
lea rcx, [rsp + 0x1c8]
lea rsi, [rsp + 0x6f0]
mov rdx, rsi
call fcn.140024450
cmp byte [rsi + 0x10], 1
mov r14, qword [rsp + 0x60]
je 0x1400232cb
mov qword [r14], 0
jmp 0x140022b12
mov r8b, 1
test r14, r14
je 0x14002232d
lea rcx, [r15 + 0x10]
mov r9d, 0xff
mov rbp, r12
movzx eax, word [r14]
cmp eax, 0x2d
je 0x14002228f
cmp eax, 0x2f
je 0x140023123
mov r14, qword [rbp + 8]
add rbp, 8
add rcx, 8
test r14, r14
jne 0x140022267
jmp 0x14002232d
lea rsi, [r14 + 2]
lea rax, [r14 + 4]
cmp word [r14 + 2], 0x2d
cmove rsi, rax
mov dil, 0x61
xor r10d, r10d
movzx eax, word [rsi + r10*2]
test ax, ax
je 0x140022279
cmp dil, 0x2d
je 0x1400222c7
lea edx, [rdi - 0x30]
cmp dl, 0xa
jb 0x1400222c7
lea edx, [rdi - 0x61]
cmp dl, 0x19
ja 0x140022279
movzx edx, ax
cmp edx, r9d
cmovae eax, r9d
lea edx, [rax - 0x41]
mov ebx, eax
or bl, 0x20
cmp dl, 0x1a
movzx edx, bl
cmovae edx, eax
cmp dl, dil
jne 0x140022279
lea rax, str.attempting_deelevation
mov dil, byte [r10 + rax + 1]
inc r10
cmp r10, 0x16
jne 0x1400222a7
cmp word [rsi + 0x2c], 0
jne 0x140022279
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140022307
dec dword [r13]
lea eax, [r11 + 2]
test r8b, r8b
cmovne eax, r11d
or eax, 4
mov edi, eax
jmp 0x140022339
test r8b, r8b
je 0x140022e8c
mov rdi, r11
lea r9, [rsp + 0xc8]
mov qword [r9], 0
mov rdx, qword [r15]
lea rsi, [rsp + 0x188]
mov rcx, rsi
mov r8d, edi
call fcn.140033150
cmp byte [rsi + 0x10], 1
je 0x1400232df
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x140023316
mov eax, dword [rsp + 0x188]
test eax, eax
jne 0x140023321
xor eax, eax
cmp edi, 4
setae al
lea r14d, [rax + rax]
inc r14d
lea rcx, [rsp + 0x1c8]
lea rsi, [rsp + 0x170]
mov rdx, rsi
call fcn.140024450
cmp byte [rsi + 0x10], 1
je 0x14002338f
mov edx, dword [r13]
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov r8, r15
xor r9d, r9d
call fcn.140025110
mov r13, qword [rsi]
test r13, r13
je 0x140023399
mov rdx, qword [r12]
test rdx, rdx
je 0x140022613
lea rax, [r15 + 0x10]
mov esi, 0xff
movzx ebp, word [rdx]
cmp ebp, 0x2d
je 0x140022428
cmp ebp, 0x2f
je 0x14002312f
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140022406
jmp 0x140022613
lea rbp, [rdx + 2]
lea rbx, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rbp, rbx
movzx edx, word [rbp]
test dx, dx
je 0x140022417
movzx ebx, dx
cmp ebx, esi
cmovae edx, esi
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x73
jne 0x140022417
movzx edx, word [rbp + 2]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x61
jne 0x140022417
movzx edx, word [rbp + 4]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x66
jne 0x140022417
movzx edx, word [rbp + 6]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140022417
movzx edx, word [rbp + 8]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x2d
jne 0x140022417
movzx edx, word [rbp + 0xa]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6d
jne 0x140022417
movzx edx, word [rbp + 0xc]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6f
jne 0x140022417
movzx edx, word [rbp + 0xe]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x64
jne 0x140022417
movzx edx, word [rbp + 0x10]
test dx, dx
je 0x140022417
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140022417
cmp word [rbp + 0x12], 0
jne 0x140022417
lea rcx, str.DisableSafeMode
call fcn.140024e20
mov esi, eax
xor sil, 1
jmp 0x140022615
xor esi, esi
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400233ec
mov dword [rsp + 0x98], esi
mov dword [rsp + 0x9c], r14d
mov qword [rsp + 0x80], rdi
xor eax, eax
lea rcx, [rsp + 0x150]
mov qword [rcx - 0x20], rax
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], 3
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
call fcn.140024020
test al, al
jne 0x140023400
lea r14, [rsp + 0x138]
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov rbp, rax
mov ecx, 0xfffffff5
call rsi
mov rbx, rax
mov ecx, 0xfffffff4
call rsi
mov rsi, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x1400226f1
mov rcx, rbp
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400226f1
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x14002366c
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], rbp
inc qword [rsp + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140022744
mov rcx, rbx
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140022744
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x140023689
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], rbx
inc qword [rsp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x140022797
mov rcx, rsi
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140022797
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0x148]
je 0x1400236a6
mov rcx, qword [rsp + 0x138]
mov qword [rcx + rax*8], rsi
inc qword [rsp + 0x140]
lea rcx, [rsp + 0x130]
lea rdi, [rsp + 0x118]
lea r14, [rsp + 0x6f0]
mov rdx, rdi
mov r8, r14
call fcn.140032ef0
cmp byte [rdi + 0x10], 1
je 0x14002340d
mov qword [rsp + 0x88], r13
xor edi, edi
cmp byte [rsp + 0x118], 0
je 0x140023444
mov r13d, 0x80404
cmp qword [rsp + 0x140], 0
je 0x140022812
or byte [rsp + 0x72d], 1
mov qword [rsp + 0x740], rbp
mov qword [rsp + 0x748], rbx
mov qword [rsp + 0x750], rsi
mov edi, 1
xorps xmm6, xmm6
lea rsi, [rsp + 0x2b0]
movaps xmmword [rsi], xmm6
movaps xmmword [rsi + 0x50], xmm6
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
mov qword [rsi + 0x60], 0
mov dword [rsi], 0x68
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsi + 0x3d], 8
mov rbp, qword [rsp + 0x68]
je 0x140022867
mov rax, qword [rsp + 0x2c8]
test rax, rax
jne 0x14002377d
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
mov rdx, qword [r15]
cmp qword [rsp + 0x90], 0
jne 0x14002344f
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
mov rcx, rdx
mov rdx, qword [rsp + 0x88]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14002349b
mov r14, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
test byte [rsp + 0x80], 1
je 0x1400234f1
lea rsi, [rsp + 0xb30]
mov rcx, rsi
mov rdx, r14
call fcn.1400323a0
mov rax, qword [rsi]
mov rdx, qword [r12]
test rdx, rdx
je 0x140022edb
mov r8d, 0xff
movzx ecx, word [rdx]
cmp ecx, 0x2d
je 0x140022939
cmp ecx, 0x2f
je 0x14002313b
mov rdx, qword [r12 + 8]
add r12, 8
test rdx, rdx
jne 0x140022918
jmp 0x1400229b8
lea rcx, [rdx + 2]
lea rbp, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, rbp
mov bpl, 0x64
xor edx, edx
movzx edi, word [rcx + rdx*2]
test di, di
je 0x140022929
cmp bpl, 0x2d
je 0x140022970
lea esi, [rbp - 0x30]
cmp sil, 0xa
jb 0x140022970
lea esi, [rbp - 0x61]
cmp sil, 0x19
ja 0x140022929
movzx esi, di
cmp esi, r8d
cmovae edi, r8d
lea esi, [rdi - 0x41]
mov ebx, edi
or bl, 0x20
cmp sil, 0x1a
movzx ebx, bl
cmovae ebx, edi
cmp bl, bpl
jne 0x140022929
lea rbp, str.disabledynamicblocklist
mov bpl, byte [rdx + rbp + 1]
inc rdx
cmp rdx, 0x17
jne 0x14002294f
cmp word [rcx + 0x2e], 0
jne 0x140022929
mov r12, rax
mov al, 1
jmp 0x1400229bd
mov r12, rax
xor eax, eax
mov rbp, qword [rsp + 0x68]
cmp byte [rsp + 0x98], 0
setne bl
or bl, al
lea rcx, [rsp + 0xf8]
lea rdx, [rsp + 0x1c8]
pxor xmm0, xmm0
movdqa xmmword [rcx - 0x28], xmm0
movdqa xmmword [rcx - 0x18], xmm0
mov byte [rcx - 8], 0
call fcn.140023f20
mov rdx, qword [r15]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea rsi, [rsp + 0x100]
mov rcx, rsi
mov r8, r14
mov r9d, dword [rsp + 0x9c]
call fcn.1400325e0
cmp byte [rsi + 0x10], 1
je 0x1400234f8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
je 0x140023526
test byte [rsp + 0x80], 1
je 0x140023580
mov rcx, r14
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140023604
lea rdx, [rsp + 0xb30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140023604
mov eax, dword [rsp + 0xb30]
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rcx + 4], 1
lea rax, [r12 + 1]
cmp rax, 2
jb 0x140022aae
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
jb 0x140022ac1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140022ad4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
lea rcx, [rsp + 0x130]
call fcn.140032230
test r13, r13
je 0x140022b04
mov rcx, r13
call qword [sym.imp.mozglue.dll_free]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140023627
cmp rdi, 8
setae al
and bl, al
cmp bl, 1
je 0x140022ce7
lea rcx, [rsp + 0x1c8]
call fcn.140024a50
jmp 0x140021547
mov rcx, rbp
mov rdx, rsi
call fcn.14000c9d0
jmp 0x1400219d2
mov rcx, rdi
mov rdx, rbp
call fcn.14000c9d0
jmp 0x140021719
cmp byte [rsp + 0x2c8], 1
je 0x1400236c3
mov r8d, dword [rsp + 0x2b0]
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov rdx, rsi
call fcn.140024700
cmp byte [rdi + 0x18], 1
je 0x1400236e2
cmp byte [rsp + 0x148], 0
jne 0x140023701
movdqu xmm0, xmmword [rsp + 0x1a0]
movq xmm1, qword [rsp + 0x140]
movq xmm2, qword [rsp + 0x1b0]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x130]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor edi, edi
cmp eax, 0xffff
sete dil
xor esi, esi
jmp 0x1400212ff
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023708
mov rsi, qword [rsp + 0x6f0]
mov rcx, qword [rsp + 0x1e8]
test rcx, rcx
jne 0x140023745
mov qword [rsp + 0x1e8], rsi
mov eax, dword [rsp + 0x2b0]
cmp eax, 2
jne 0x140022ee5
mov r14d, 1
jmp 0x140021643
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002319c
mov rsi, qword [rsp + 0x6f0]
mov rcx, qword [rsp + 0x1e8]
test rcx, rcx
jne 0x140023750
mov qword [rsp + 0x1e8], rsi
mov eax, dword [rsp + 0x2b0]
dec eax
cmp eax, 1
jbe 0x14002195b
jmp 0x14002319c
inc rdi
movabs rax, 0x7ffffffffffff800
test rdi, rax
jne 0x140022ef6
mov rcx, rbp
call qword [sym.imp.mozglue.dll_free]
jmp 0x140022b24
cmp eax, 2
jne 0x14002319c
lea rcx, [rsp + 0x1c8]
lea rsi, [rsp + 0x6f0]
mov rdx, rsi
call fcn.140025cb0
cmp byte [rsi + 0x20], 0
jne 0x14002319c
cmp qword [rsp + 0x2a0], 0
je 0x140023792
mov eax, dword [rsp + 0x700]
cmp qword [rsp + 0x708], 8
jb 0x140022d5f
mov rsi, qword [rsp + 0x6f0]
add eax, eax
add eax, 2
mov rcx, qword [rsp + 0x1e8]
cmp qword [rsp + 0x2a8], 8
jb 0x140022d7f
mov rbp, qword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rbp
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov cl, byte [rsp + 0x710]
test eax, eax
jne 0x1400237bc
test cl, cl
jne 0x14002319c
lea rcx, [rsp + 0x6f0]
mov rbp, qword [rcx]
mov r14, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
call fcn.14001eb50
jmp 0x140021b5c
cmp eax, 2
jne 0x1400237d6
lea rcx, [rsp + 0x1c8]
lea rdi, [rsp + 0x6f0]
mov rdx, rdi
call fcn.1400328e0
cmp byte [rdi + 0x10], 0
jne 0x140023635
lea rcx, [rsp + 0x1c8]
lea rdi, [rsp + 0x2b0]
mov rdx, rdi
mov r8d, esi
call fcn.140032340
cmp byte [rdi + 0x10], 0
je 0x1400217e2
movdqu xmm0, xmmword [rsp + 0x2b0]
jmp 0x14002363e
test r14d, r14d
jne 0x1400237ee
lea rsi, [rsp + 0x6f0]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
lea rcx, [rsp + 0x1d0]
mov qword [rcx - 8], rax
xor eax, eax
jmp 0x140021813
mov rdx, rbx
mov r9, rsi
call fcn.14000c9d0
jmp 0x140021b33
mov rdi, r11
or edi, 2
jmp 0x140022339
mov qword [rsp + 0x20], 0xa
lea r9, str.Blocklist
mov edx, 0xa
mov rcx, rbp
call fcn.14000a110
jmp 0x140021a2b
mov qword [rsp + 0x20], 6
lea r9, str.Image
mov edx, 6
mov rcx, rdi
call fcn.14000a110
jmp 0x140021773
mov r12, rax
xor eax, eax
jmp 0x1400229c2
cmp eax, 1
jne 0x14002384a
xor r14d, r14d
jmp 0x140021643
mov rax, qword [rbp - 8]
add rbp, 0xfffffffffffffff8
sub rbp, rax
cmp rbp, 0x20
jae 0x140023958
mov rbp, rax
jmp 0x140022cfd
add rax, 2
mov rbx, rax
jmp 0x14002108b
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [rsp + 0x140], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rax
movabs rax, 0x800700c100000024
mov qword [rsp + 0x138], rax
xor eax, eax
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.140034150
xor r13d, r13d
lea rbx, [rsp + 0x6f0]
jmp 0x14002194c
add r8, 2
mov rax, r8
jmp 0x140021142
add rax, 2
mov rbp, rax
jmp 0x140021386
mov ebx, eax
or ebx, 0x10000000
lea rdi, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
mov r13d, 0x50b
lea rcx, [rsp + 0x6f0]
mov qword [rcx], rdi
mov dword [rcx + 8], r13d
mov dword [rcx + 0xc], ebx
xor r14d, r14d
xor edx, edx
call fcn.140034150
jmp 0x140021324
xor edi, edi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400212ff
cmp eax, 0x57
je 0x1400212ff
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r13d, 0x5c
jmp 0x1400212f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov byte [rsp + 0x708], 1
mov r13d, 0x1e
jmp 0x1400212f5
mov rdi, qword [rsp + 0x6f8]
mov r13d, dword [rsp + 0x700]
mov sil, 1
mov ebx, dword [rsp + 0x704]
jmp 0x1400212ff
mov ebx, dword [rsp + 0x13c]
cmp ebx, 0xd000003a
jne 0x140023654
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
lea rdx, [rsp + 0x130]
mov qword [rdx], rax
lea rdi, [rsp + 0x2b0]
mov rcx, rdi
call fcn.140039050
cmp byte [rdi + 0x18], 1
jne 0x140023814
mov rdi, qword [rsp + 0x2b8]
mov r13d, dword [rsp + 0x2c0]
mov sil, 1
mov ebx, dword [rsp + 0x2c4]
jmp 0x14002382e
cmp byte [rax], 0
je 0x14002133a
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov r14b, 1
jmp 0x14002133a
lea rax, str.force_launcher
mov dil, byte [r9 + rax + 1]
inc r9
cmp r9, 0xe
jne 0x1400215bd
cmp word [rdx + 0x1c], 0
jne 0x14002160a
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400230e6
mov rax, qword [rsp + 0x88]
dec dword [rax]
xor r13d, r13d
xor r10d, r10d
jmp 0x14002161e
add rbx, 2
mov rdx, rbx
jmp 0x1400215b7
add rbp, 2
mov rcx, rbp
jmp 0x140022195
add r14, 2
mov rsi, r14
jmp 0x1400222a1
add rdx, 2
mov rbp, rdx
jmp 0x140022439
add rdx, 2
mov rcx, rdx
jmp 0x14002294a
mov eax, 0x42
mov ecx, 0x8007065d
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs rbp, 0xffffff0000000000
and rbp, rdx
mov ebx, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, rbp
or rbx, rdx
mov qword [rsp + 0x130], rbx
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], ecx
jmp 0x140023647
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1c0], 0
xor ebp, ebp
xor edi, edi
xor ebx, ebx
xor eax, eax
jmp 0x140021b80
cmp byte [rax], 0
je 0x140021933
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140021949
cmp word [rax], 0
je 0x140022f6c
xor r13d, r13d
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul esi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140039170
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140022f6f
mov eax, dword [0x140062cf8]
mov ecx, dword [0x1400624b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002395e
mov rax, qword [0x140062cf0]
test rax, rax
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
je 0x140021bb1
lea rdx, [rsp + 0x6f0]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [case.0x14002f18e.0]
jmp 0x140021bb1
mov rbp, qword [rsp + 0x68]
lea rcx, [rsp + 0x6f0]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000158
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140034150
mov r14, qword [rsp + 0x60]
jmp 0x140022242
add rbp, 2
mov rbx, rbp
jmp 0x140021c29
lea rcx, [rsp + 0x6f0]
xor edx, edx
call fcn.140034150
jmp 0x140022242
lea rcx, [rsp + 0x188]
xor edx, edx
call fcn.140034150
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x140022b04
mov r14d, 4
jmp 0x14002239f
xor r14d, r14d
cmp eax, 1
jne 0x14002239f
mov r14d, 2
test dil, 3
jne 0x14002239f
mov r14d, 5
cmp edi, 3
ja 0x14002239f
mov edx, dword [r13]
lea rsi, [rsp + 0x6f0]
mov rcx, rsi
mov r8, r15
call fcn.140034410
cmp byte [rsi + 0x10], 1
jne 0x14002393a
xor esi, esi
lea rcx, [rsp + 0x6f0]
xor edx, edx
call fcn.140034150
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x140023948
lea rcx, [rsp + 0x170]
jmp 0x1400233bd
lea rcx, [rsp + 0x6f0]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x80070507000001a0
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140034150
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
jmp 0x140022b04
cmp byte [rax], 0
movzx eax, sil
mov esi, 1
cmove esi, eax
jmp 0x14002262b
or byte [rsp + 0x137], 0x10
jmp 0x140022671
lea rcx, [rsp + 0x118]
xor edx, edx
call fcn.140034150
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
jmp 0x140022ae9
mov r13d, 0x404
jmp 0x140022812
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1400228c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb30]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1e6
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.140034150
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x140022ad4
xor eax, eax
jmp 0x140022905
lea rcx, [rsp + 0x100]
xor edx, edx
call fcn.140034150
mov rcx, r14
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x140023618
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb30]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x201
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.140034150
mov rcx, r14
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x140022a9a
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
xor edi, edi
neg eax
mov esi, 0
sbb esi, esi
mov dword [rsp + 0x80], 0
test ebx, ebx
jne 0x1400235af
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x80], eax
or esi, 0x2710
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jne 0x1400235cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [rsp + 0x80]
mov ebp, esi
sub ebp, edi
jbe 0x140023604
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
mov edx, ebp
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x140023604
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x140023604
mov ecx, 0xa
call r15
jmp 0x1400235bc
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov byte [rax + 4], 1
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x140022a9a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140022b12
movdqu xmm0, xmmword [rsp + 0x6f0]
movdqa xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x140], 1
jmp 0x140022f53
mov rdi, qword [rsp + 0x130]
mov sil, 1
mov r13d, dword [rsp + 0x138]
jmp 0x1400212ff
mov rcx, r14
call fcn.140039310
test al, al
je 0x1400226f1
mov rax, qword [rsp + 0x140]
jmp 0x1400226dd
mov rcx, r14
call fcn.140039310
test al, al
je 0x140022744
mov rax, qword [rsp + 0x140]
jmp 0x140022730
mov rcx, r14
call fcn.140039310
test al, al
je 0x140022797
mov rax, qword [rsp + 0x140]
jmp 0x140022783
mov rdi, qword [rsp + 0x2b8]
mov r13d, dword [rsp + 0x2c0]
mov sil, 1
mov ebx, dword [rsp + 0x2c4]
jmp 0x1400212ff
mov rdi, qword [rsp + 0x1a0]
mov r13d, dword [rsp + 0x1a8]
mov sil, 1
mov ebx, dword [rsp + 0x1ac]
jmp 0x1400212ff
xor edi, edi
jmp 0x140022bd2
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa4
mov byte [rsp + 0x140], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rdx
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], ecx
jmp 0x140022f53
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140022c3f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140022cc8
lea rbx, [rsp + 0x6f0]
jmp 0x1400218d5
lea rcx, [rsp + 0x1e0]
mov qword [rcx - 8], 0
jmp 0x140021909
or byte [rsp + 0x72d], 8
mov qword [rsp + 0x708], rax
jmp 0x140022867
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
call fcn.1400245f0
lea rdx, str.Blocklist
mov r8d, 0xa
mov rcx, rbp
call fcn.14000a0a0
jmp 0x140022d45
test cl, cl
jne 0x14002319c
lea rcx, [rsp + 0x6f0]
call fcn.14001eb50
jmp 0x14002319c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3e
jmp 0x140023151
mov byte [rsp + 0x140], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x130], rax
movabs rax, 0x8007050700000118
jmp 0x140022f4b
lea rcx, [rsp + 0x6f0]
lea rdx, [rsp + 0x2b0]
call fcn.1400390e0
movzx edi, al
xor esi, esi
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400212ff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400212ff
mov eax, 0xb3
mov ecx, 0x80070507
jmp 0x14002371b
movzx edx, word [rbp + 0xe]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x74
jne 0x140021e11
movzx edx, word [rbp + 0x10]
test dx, dx
je 0x140021e11
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x74
jne 0x140021e11
movzx edx, word [rbp + 0x12]
test dx, dx
je 0x140021e11
movzx ecx, dx
mov ebx, 0xff
cmp ecx, ebx
cmovae edx, ebx
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x65
jne 0x140021e11
cmp word [rbp + 0x14], 0
jne 0x140021e11
jmp 0x140023932
movzx edx, word [rbp + 0xe]
test dx, dx
je 0x140022034
movzx ecx, dx
cmp ecx, edi
cmovae edx, edi
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x73
jne 0x140022034
cmp word [rbp + 0x10], 0
jne 0x140022034
mov r13, r10
jmp 0x14002213d
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov sil, 1
mov r14, qword [rsp + 0x60]
mov byte [r14 + 4], sil
xor esi, esi
jmp 0x140023302
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [0x140062cf8]
call fcn.14002e8cc
cmp dword [0x140062cf8], 0xffffffff
jne 0x140023242
call fcn.1400392a0
lea rcx, [0x140062cf8]
call fcn.14002e86c
jmp 0x140023242