Function at 0x436f40
Capabilities:
Access the windows event log
Check mutex on windows
Delete registry key
Delete registry value
Query or enumerate registry value
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2b0
mov ebx, dword [ebp + 8]
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [esp + 0x2a8], eax
mov edi, 0x80070057
cmp ebx, 2
jl 0x437286
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], 0
je 0x437286
xor eax, eax
push eax
push eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x437181
mov dword [esp + 0x20], 0
mov byte [esp + 0x24], 0
push str.uninstall
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x437188
push str.unregister_task
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x437210
push str.debug_remote_disabled
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x437574
mov ecx, 0x497032
mov edx, str.DisableDefaultBrowserAgent
call fcn.0042d710
mov edi, 0x800704ec
test al, al
jne 0x437225
push 0x49910c
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43729e
push str.update_task
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43730c
push str.do_task
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4374fe
push str.set_default_browser_user_choice
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4375c4
push str.set_default_extension_handlers_user_choice
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
mov edi, 0x80070057
cmp ebx, 3
jb 0x437225
test eax, eax
jne 0x437225
mov eax, dword [esi + 8]
mov dword [esp + 0x14], eax
test eax, eax
je 0x437225
lea edi, [esp + 0x70]
push edi
call fcn.00451050
add esp, 4
mov eax, dword [edi]
mov dword [esp + 0xc], eax
test eax, eax
je 0x4377ef
lea edi, [esi + 0xc]
add esi, 0x10
cmp dword [edi], 0
je 0x4377d4
mov eax, dword [esi]
test eax, eax
je 0x4377d4
push dword [esp + 0x14]
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00453080
add esp, 0xc
mov ecx, dword [edi]
mov edx, dword [esp + 0xc]
push dword [esp + 0xa0]
call fcn.00431e60
add esp, 4
test al, al
je 0x437119
mov edx, dword [esp + 0xa0]
mov ecx, dword [edi]
call fcn.004324b0
test al, al
je 0x437123
add edi, 8
add esi, 8
mov bl, 1
jmp 0x43712d
mov dword [esp + 0x10], 0x80004005
jmp 0x43712b
mov dword [esp + 0x10], 0xa0000003
xor ebx, ebx
mov eax, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0
test eax, eax
je 0x43714c
push eax
call fcn.0044fa50
add esp, 4
test bl, bl
jne 0x4370bc
mov eax, dword [esp + 0x10]
sub esp, 0x10
movaps xmm0, xmmword [0x4620a0]
cmp eax, 0xa0000003
jne 0x437a10
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 0xa0000003
jmp 0x437a2b
mov edi, eax
jmp 0x437286
cmp ebx, 3
jb 0x437225
cmp dword [esi + 8], 0
je 0x437225
lea ecx, [esp + 0x20]
call 0x438960
lea edi, [esp + 0xa0]
push 0
push edi
call section..text
add esp, 8
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4371e9
xor edi, edi
lea eax, [esp + 0x70]
mov dword [eax], edi
push eax
push 0x20107
push edi
push str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4374a3
mov eax, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0
test eax, eax
je 0x437208
push eax
call fcn.0044fa50
add esp, 4
mov ecx, dword [esi + 8]
xor edx, edx
inc edx
jmp 0x43721e
cmp ebx, 3
jb 0x437225
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x437225
xor edx, edx
call fcn.00431070
mov edi, eax
cmp byte [esp + 0x24], 0
je 0x43726d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x437250
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x43726d
push 0xca
push str.Release
push str.Failed_to_release_registry_mutex
jmp 0x43725f
push 0xc5
push str.Release
push str.Unexpectedly_missing_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x10
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x437280
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x2a8]
xor ecx, ebp
call fcn.00450100
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0x80070057
cmp ebx, 3
jb 0x437225
cmp dword [esi + 8], 0
je 0x437225
lea ecx, [esp + 0x20]
call 0x438960
lea edi, [esp + 0xa0]
mov ecx, edi
xor edx, edx
push 1
push str.Installed
call fcn.0042e3c0
add esp, 8
mov eax, dword [edi]
test eax, eax
je 0x4372fd
push eax
push 0x84
push str.WriteInstallationRegistryEntry
push str.Failed_to_write_installation_registry_entry:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x14
mov ecx, dword [esi + 8]
xor edx, edx
call fcn.0042ef10
jmp 0x437223
mov edi, 0x80070057
cmp ebx, 3
jb 0x437225
cmp dword [esi + 8], 0
je 0x437225
lea ecx, [esp + 0x20]
call 0x438960
lea ebx, [esp + 0xa0]
xor edi, edi
mov ecx, ebx
xor edx, edx
push 1
push str.Installed
call fcn.0042e3c0
add esp, 8
mov eax, dword [ebx]
test eax, eax
je 0x43736d
push eax
push 0x84
push str.WriteInstallationRegistryEntry
push str.Failed_to_write_installation_registry_entry:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x14
mov eax, dword [esi + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x6c]
mov dword [eax], edi
push eax
push 0x45d020
push 1
push edi
push 0x45d030
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437a70
mov esi, dword [esp + 0x6c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
call dword [section..00cfg]
sub esp, 0x44
movaps xmm0, xmmword [esp + 0xb4]
movups xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esp + 0xd4]
movups xmmword [esp + 0x24], xmm0
movaps xmm0, xmmword [esp + 0x94]
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [esp + 0x84]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call ecx
test eax, eax
js 0x437acb
xor esi, esi
mov dword [esp + 0x3c], esi
push 0x4999f4
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x3c], esi
test ebx, ebx
je 0x437436
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
lea eax, [esp + 0x3c]
push eax
mov esi, dword [esp + 0x10]
push esi
push edi
call ecx
test eax, eax
jns 0x437b8f
mov ecx, dword [esp + 0x14]
xor edx, edx
call fcn.0042ef10
mov edi, eax
test esi, esi
je 0x43746e
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x437484
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x437225
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
jmp 0x437225
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x90]
mov dword [eax], edi
sub esp, 0x30
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4375ec
test edi, edi
je 0x4371e9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4371e9
mov edi, 0x80070057
cmp ebx, 3
jb 0x437225
cmp dword [esi + 8], 0
je 0x437225
cmp ebx, 4
jb 0x43773f
push str.__force
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4377f9
push 0x4994fe
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
mov ebx, eax
lea ecx, [esp + 0x20]
call 0x438960
mov edi, 0x80070020
test al, al
je 0x437225
test ebx, ebx
jne 0x437755
mov al, 1
mov dword [esp + 0x14], eax
jmp 0x437815
call fcn.0042e860
movzx esi, al
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push str.default_browser_agent:_IsAgentRemoteDisabled:
push eax
call fcn.00453ba0
add esp, 8
mov ecx, eax
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov esi, eax
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, esi
push 0xa
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movsx eax, al
mov ecx, esi
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::flush_void_]
xor edi, edi
jmp 0x437225
mov edi, 0x80070057
cmp ebx, 3
jb 0x437225
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x437225
add esi, 0xc
mov edx, esi
call fcn.00431950
jmp 0x437223
mov eax, dword [esp + 0x90]
lea edx, [eax + 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x90], edx
add eax, eax
add eax, 2
xor esi, esi
dec esi
test edx, edx
cmovns esi, eax
push esi
call fcn.0044fa47
add esp, 4
mov ebx, eax
xor eax, eax
push esi
push eax
xor esi, esi
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 0x34], 0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [esp + 0xc], 0
test eax, eax
jne 0x43770c
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0xa0]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
push eax
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4376c1
mov esi, dword [esp + 0x14]
inc esi
push 0x7c
push ebx
call sub.VCRUNTIME140.dll_wcschr
add esp, 8
test eax, eax
mov eax, dword [esp + 0xc]
movzx eax, al
mov ecx, 1
cmovne eax, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x10]
jmp 0x4376d1
push ebx
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x90]
mov dword [esp + 0x50], eax
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x437676
test edi, edi
je 0x437717
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [esp + 0xc], 1
mov esi, dword [ebp + 0xc]
jne 0x437731
push str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push ebx
call fcn.0044fa50
add esp, 4
jmp 0x4371e9
lea ecx, [esp + 0x20]
call 0x438960
mov edi, 0x80070020
test al, al
je 0x437225
lea edi, [esp + 0xa0]
mov ecx, edi
xor edx, edx
push str.AppLastRunTime
call fcn.0042e5e0
add esp, 4
cmp dword [edi + 0x10], 0
jne 0x437a06
cmp byte [esp + 0xa8], 0
je 0x437a06
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
lea ebx, [esp + 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [ebx]
mov ebx, dword [ebx + 4]
mov ecx, edx
sub ecx, esi
mov eax, ebx
sbb eax, edi
mov dword [esp + 0x14], 0
cmp esi, edx
sbb edi, ebx
jae 0x437815
mov edi, 0x80041324
mov edx, 0xe92d7fff
cmp edx, ecx
mov ecx, 0x46b8
sbb ecx, eax
jb 0x437225
jmp 0x437815
sub esp, 0x10
movaps xmm0, xmmword [0x4620a0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor edi, edi
jmp 0x437a4e
mov edi, 0x80004005
jmp 0x437225
lea ecx, [esp + 0x20]
call 0x438960
mov edi, 0x80070020
mov cl, 1
mov dword [esp + 0x14], ecx
test al, al
je 0x437225
xor edi, edi
call fcn.0042e860
test al, al
jne 0x437225
xor ebx, ebx
lea eax, [esp + 0x90]
mov dword [eax], ebx
push eax
push str._n_vSN
push 3
push ebx
push 0x45d084
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437e0d
mov edi, dword [esp + 0x90]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [section..00cfg]
lea edx, [esp + 0x70]
xor eax, eax
inc eax
push edx
push eax
push eax
push str.http
push edi
call ecx
test eax, eax
js 0x437ede
mov edi, dword [esp + 0x70]
xor ebx, ebx
lea esi, [esp + 0xa0]
push 0x200
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x50]
mov dword [eax], 0x100
push eax
push esi
push ebx
mov dword [esp + 0x18], edi
push edi
push 4
push ebx
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x437fa9
push 7
push 0x49827a
lea edi, [esp + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4380c0
push 0xd
push str.Google_Chrome
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
xor ebx, ebx
inc ebx
test eax, eax
je 0x4380c0
add byte [eax], al
push 0xe
push str.Microsoft_Edge
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x437d28
push 0x11
push str.Internet_Explorer
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x437e03
push 5
push 0x4999e8
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x438074
push 5
push str.Brave
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4380a6
push 6
push str.Yandex
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4380ad
push 9
push str.QQBrowser
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4380b4
push 8
push str.360
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4380bb
push 7
push 0x498062
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
mov dword [esp + 0x10], 0
mov edi, 0
test eax, eax
mov ebx, dword [esp + 0xc]
jne 0x4380f2
mov ebx, 9
jmp 0x4380c0
mov edi, 0x80041324
jmp 0x437225
movups xmmword [esp], xmm0
mov ebx, eax
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor edi, edi
mov esi, 0x80004005
cmp ebx, 0x80004005
jne 0x437a4e
push dword [esp + 0x14]
push 0x14b
push str.SetDefaultExtensionHandlersUserChoice
push str.Failed_setting_default_with__s
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x14
mov edi, esi
mov eax, dword [esp + 0x70]
mov dword [esp + 0x70], 0
test eax, eax
je 0x437225
push eax
call fcn.0044fa50
add esp, 4
jmp 0x437225
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0xc], eax
mov ecx, 0xfe
mov edx, str.UpdateTask
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x14], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.0044fa47
add esp, 4
xor ecx, ecx
push esi
push ecx
push eax
mov esi, eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0xfe
jmp 0x437b24
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0xc], eax
mov ecx, 0x100
mov edx, str.UpdateTask
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x14], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.0044fa47
add esp, 4
xor ecx, ecx
push esi
push ecx
push eax
mov esi, eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x100
push eax
mov eax, str.UpdateTask
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
mov dword [esp + 0x2c], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0xc]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x437b7e
mov esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa0], eax
xor eax, eax
inc eax
xor ecx, ecx
push ecx
push ebx
push ecx
push eax
push ecx
push edi
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [esp + 0x14]
call fcn.0044fa50
add esp, 4
jmp 0x437484
xor eax, eax
lea edi, [esp + 0xa0]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [esp + 0x44]
mov byte [esp + 4], al
mov dword [esp + 8], 0x49a5d2
mov dword [esp], 0x1e
mov ecx, edi
call fcn.00453440
push dword [esp + 0x14]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
mov esi, edx
sub esi, ecx
cmp esi, eax
jb 0x43807b
lea ebx, [ecx + eax]
mov dword [esp + 0xb0], ebx
cmp edx, 8
jb 0x437bfe
mov edi, dword [esp + 0xa0]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push dword [esp + 0x18]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
cmp dword [esp + 0xb4], 8
jb 0x437c2a
mov eax, dword [esp + 0xa0]
jmp 0x437c31
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov esi, dword [esp + 0x3c]
lea edi, [esp + 0x38]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x34]
call dword [section..00cfg]
push edi
mov dword [esp + 0x14], ebx
push ebx
push esi
call ecx
test eax, eax
js 0x437d0a
mov esi, dword [esp + 0x38]
lea edi, [esp + 0x34]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x4c]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x437d19
mov esi, dword [esp + 0x34]
lea edi, [esp + 0x30]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x24]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
js 0x437d57
mov esi, dword [esp + 0x30]
lea edi, [esp + 0x2c]
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
call dword [section..00cfg]
push edi
push 1
push esi
call ecx
test eax, eax
js 0x437d32
mov esi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ecx, dword [eax + 0x38]
call dword [section..00cfg]
lea eax, [esp + 0x28]
push eax
push esi
call ecx
test eax, eax
js 0x437d32
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, ebx
call fcn.0042ef10
mov edi, eax
test ebx, ebx
je 0x437d3f
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x437d3f
mov ecx, dword [esp + 0x14]
xor edx, edx
call fcn.0042ef10
mov edi, eax
jmp 0x437d90
mov ecx, dword [esp + 0x14]
xor edx, edx
call fcn.0042ef10
mov edi, eax
jmp 0x437d7a
mov ebx, 2
jmp 0x4380c0
mov ecx, dword [esp + 0x14]
xor edx, edx
call fcn.0042ef10
mov edi, eax
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x437d64
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
jmp 0x437d64
mov ecx, dword [esp + 0x14]
xor edx, edx
call fcn.0042ef10
mov edi, eax
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x437d7a
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x437d90
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x437da6
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x437db5
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0xb4]
cmp eax, 8
jb 0x437dfa
mov ecx, dword [esp + 0xa0]
lea ebx, [eax + eax]
add ebx, 2
cmp ebx, 0x1000
jb 0x437df0
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43895a
add eax, eax
add eax, 0x25
mov ebx, eax
mov ecx, edx
push ebx
push ecx
call fcn.0044fa85
add esp, 8
mov esi, dword [esp + 0xc]
jmp 0x437463
mov ebx, 3
jmp 0x4380c0
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x10], eax
mov ecx, 0x42
mov edx, str.GetDefaultBrowser
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
lea ecx, [eax + eax]
add ecx, 2
xor edx, edx
dec edx
cmp eax, 0xffffffff
cmovge edx, ecx
mov dword [esp + 0x18], edx
push edx
call fcn.0044fa47
add esp, 4
mov esi, eax
push dword [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x42
push eax
mov eax, str.GetDefaultBrowser
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x20]
mov dword [esp + 0x24], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x437ec5
mov ebx, eax
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
xor edx, edx
inc edx
push ecx
push eax
push ecx
push edx
push ecx
push edi
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [esp + 0xc]
call fcn.0044fa50
add esp, 4
mov dword [esp + 0x10], 0
jmp 0x4380fd
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0xc], eax
mov ecx, 0x4d
mov edx, str.GetDefaultBrowser
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
lea ecx, [eax + eax]
add ecx, 2
xor ebx, ebx
dec ebx
cmp eax, 0xffffffff
cmovge ebx, ecx
push ebx
call fcn.0044fa47
add esp, 4
mov esi, eax
xor eax, eax
push ebx
push eax
xor ebx, ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x4d
push eax
mov eax, str.GetDefaultBrowser
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x24]
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0xc]
mov dword [esp + 0x14], 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x437f9b
mov ebx, eax
lea eax, [esp + 0xa0]
mov dword [eax], esi
xor ecx, ecx
push ecx
push eax
push ecx
xor eax, eax
inc eax
push eax
push ecx
push edi
mov dword [esp + 0x28], 0
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push esi
call fcn.0044fa50
add esp, 4
jmp 0x4380fd
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x10], eax
mov ecx, 0x5d
mov edx, str.GetDefaultBrowser
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x18], ecx
lea ecx, [eax + eax]
add ecx, 2
xor ebx, ebx
dec ebx
cmp eax, 0xffffffff
cmovge ebx, ecx
push ebx
call fcn.0044fa47
add esp, 4
mov esi, eax
xor eax, eax
push ebx
push eax
xor ebx, ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x5d
push eax
mov eax, str.GetDefaultBrowser
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x2c]
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x10]
mov dword [esp + 0x14], 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x438065
mov ebx, eax
mov dword [esp + 0x70], esi
xor eax, eax
inc eax
xor ecx, ecx
push ecx
lea edx, [esp + 0x74]
push edx
push ecx
push eax
push ecx
push edi
mov dword [esp + 0x28], 0
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push esi
call fcn.0044fa50
add esp, 4
mov ebx, dword [esp + 0xc]
jmp 0x4380f2
mov ebx, 4
jmp 0x4380c0
sub esp, 0x10
mov cl, byte [esp + 0x48]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [esp + 0xb0]
call fcn.00453550
jmp 0x437c17
mov ebx, 5
jmp 0x4380c0
mov ebx, 6
jmp 0x4380c0
mov ebx, 7
jmp 0x4380c0
mov ebx, 8
lea eax, [ebx + ebx*2]
mov eax, dword [eax*4 + 0x46218c]
mov dword [esp + 0x10], eax
cmp eax, 4
mov ebx, dword [esp + 0xc]
jne 0x4380f0
push 0x24
push str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4383ec
xor edi, edi
test ebx, ebx
je 0x4380fd
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebx, dword [esp + 0x90]
test ebx, ebx
je 0x438116
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push ebx
call ecx
test edi, edi
jne 0x437225
lea edi, [esp + 0xa0]
mov ecx, edi
mov edx, dword [esp + 0x10]
call fcn.0042bf20
mov edi, dword [edi + 4]
test edi, edi
jne 0x437225
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], eax
xor ebx, ebx
lea eax, [esp + 0x40]
mov dword [eax], ebx
push eax
push str._n_vSN
push 3
push ebx
push 0x45d084
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43854e
mov edi, dword [esp + 0x40]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [section..00cfg]
lea eax, [esp + 0x6c]
mov esi, eax
push eax
push 1
push 0
push str..pdf
push edi
call ecx
test eax, eax
js 0x4385fe
mov eax, dword [esp + 0x6c]
xor ebx, ebx
mov dword [esp + 0x6c], ebx
push esi
push ebx
push ebx
mov dword [esp + 0x18], eax
push eax
push 4
push ebx
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x4386e3
mov ebx, dword [esp + 0x6c]
lea edi, [ebx + ebx]
xor eax, eax
dec eax
test ebx, ebx
cmovs edi, eax
push edi
call fcn.0044fa47
add esp, 4
push edi
push 0
mov edi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
je 0x43894f
xor eax, eax
push esi
push edi
push eax
push dword [esp + 0x18]
push 4
push eax
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x4387cb
lea ecx, [esp + 0xa0]
mov edx, edi
call fcn.0042de50
push edi
call fcn.0044fa50
add esp, 4
cmp dword [esp + 0xc], 0
je 0x438230
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [esp + 0x40]
test edi, edi
je 0x438246
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push edi
call ecx
mov edi, dword [esp + 0xb8]
test edi, edi
jne 0x437225
mov eax, dword [esp + 0xa0]
movsd xmm0, qword [esp + 0xa4]
movsd qword [esp + 0x90], xmm0
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x98], ecx
mov edx, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x70], eax
movsd qword [esp + 0x74], xmm0
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], eax
mov eax, dword [0x49f6a0]
cmp eax, 0x9ffffff
ja 0x43834e
mov eax, dword [0x49f0a0]
cmp eax, 0xa000001
jb 0x43853e
lea esi, [esp + 0xac]
xor edi, edi
push 0x110
push edi
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi - 0xc], 0x11c
mov dword [esi - 8], 0xa
mov dword [esi - 4], edi
sub esp, 0x10
movaps xmm0, xmmword [0x462090]
movups xmmword [esp], xmm0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call esi
mov edi, 3
push edi
push 1
push edx
push eax
call esi
push edi
push 0x20
push edx
push eax
call esi
push edi
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x438533
mov eax, 0xa000000
xchg dword [0x49f6a0], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
cmp eax, 1
jne 0x438372
lea ecx, [esp + 0xa0]
xor edx, edx
inc edx
push str.InitialNotificationShown
call fcn.0042c330
add esp, 4
lea esi, [esp + 0xa0]
xor edx, edx
inc edx
mov ecx, esi
push str.InitialNotificationShown
call fcn.0042e180
add esp, 4
cmp dword [esi + 4], 0
jne 0x4383b0
movzx eax, word [esp + 0xa0]
cmp eax, 0x100
setb cl
test al, al
sete al
or al, cl
or al, byte [esp + 0x14]
cmp al, 1
jne 0x4383fb
mov ecx, dword [esp + 0x10]
xor ecx, 4
mov eax, dword [esp + 0x54]
xor eax, 1
or eax, ecx
sete al
mov ecx, dword [esp + 0x14]
or cl, al
cmp cl, 1
jne 0x43853e
lea ecx, [esp + 0xa0]
xor edx, edx
push dword [esp + 0xc]
call fcn.0042c540
add esp, 4
jmp 0x4388f5
xor edi, edi
mov dword [esp + 0x10], 3
jmp 0x4380f2
lea edi, [esp + 0xa0]
xor esi, esi
inc esi
mov ecx, edi
mov edx, esi
push str.FollowupRequestTime
call fcn.0042e5e0
add esp, 4
xor ebx, ebx
cmp dword [edi + 0x10], ebx
setne al
cmp byte [edi + 8], 0
sete cl
or cl, al
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
jne 0x43844f
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], eax
lea edi, [esp + 0xa0]
mov ecx, edi
mov edx, esi
push str.FollowupNotificationShown
call fcn.0042e180
add esp, 4
cmp dword [edi + 4], 0
jne 0x438484
movzx eax, word [esp + 0xa0]
cmp eax, 0x100
setae cl
test al, al
setne bl
and bl, cl
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
je 0x4388d4
test bl, bl
jne 0x4388d4
lea esi, [esp + 0xa0]
xor edx, edx
inc edx
mov ecx, esi
push str.FollowupNotificationSuppressed
call fcn.0042e180
add esp, 4
cmp dword [esi + 4], 0
jne 0x4384d4
movzx eax, word [esp + 0xa0]
cmp eax, 0x100
jb 0x4384d4
movzx eax, al
test ax, ax
jne 0x4388d4
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov ecx, edx
mov ebx, dword [esp + 0x18]
sub ecx, ebx
mov eax, esi
mov edi, dword [esp + 0x14]
sbb eax, edi
cmp ebx, edx
sbb edi, esi
jae 0x4388d4
shrd ecx, eax, 0xe
shr eax, 0xe
cmp ecx, 0x1600a391
sbb eax, 0
jb 0x4388d4
cmp dword [esp + 0x10], 4
jne 0x4388bb
lea ecx, [esp + 0xa0]
xor edx, edx
inc edx
jmp 0x4383db
mov eax, 0xa000000
xchg dword [0x49f0a0], eax
mov dword [esp + 0xa0], 0
jmp 0x4388df
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x10], eax
mov ecx, 0x1d
mov edx, str.GetDefaultPdf
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
lea ecx, [eax + eax]
add ecx, 2
xor edx, edx
dec edx
cmp eax, 0xffffffff
cmovge edx, ecx
mov dword [esp + 0x18], edx
push edx
call fcn.0044fa47
add esp, 4
mov esi, eax
push dword [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x1d
push eax
mov eax, str.GetDefaultPdf
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x20]
mov dword [esp + 0x24], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x4386b0
mov ebx, eax
lea eax, [esp + 0x70]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
xor edx, edx
inc edx
push ecx
push eax
push ecx
push edx
push ecx
push edi
push ecx
push edx
jmp 0x4386a2
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x10], eax
mov ecx, 0x27
mov edx, str.GetDefaultPdf
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
lea ecx, [eax + eax]
add ecx, 2
xor ebx, ebx
dec ebx
cmp eax, 0xffffffff
cmovge ebx, ecx
push ebx
call fcn.0044fa47
add esp, 4
mov esi, eax
xor eax, eax
push ebx
push eax
xor ebx, ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x27
push eax
mov eax, str.GetDefaultPdf
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x20]
mov dword [esp + 0x24], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x4386b0
mov ebx, eax
lea eax, [esp + 0x70]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
xor ecx, ecx
inc ecx
xor edx, edx
push edx
push eax
push edx
push ecx
push edx
push edi
push edx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [esp + 0xc]
call fcn.0044fa50
add esp, 4
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb8], edi
jmp 0x438230
mov edi, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x18], eax
mov ecx, 0x36
mov edx, str.GetDefaultPdf
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push edi
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
lea ecx, [eax + eax]
add ecx, 2
xor edx, edx
dec edx
cmp eax, 0xffffffff
cmovge edx, ecx
mov dword [esp + 0x1c], edx
push edx
call fcn.0044fa47
add esp, 4
mov esi, eax
push dword [esp + 0x1c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x36
push eax
mov eax, str.GetDefaultPdf
push eax
push edi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x24]
mov dword [esp + 0x28], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x438798
mov ebx, eax
lea eax, [esp + 0x70]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
xor ecx, ecx
xor edx, edx
inc edx
push ecx
push eax
push ecx
push edx
push ecx
push edi
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [esp + 0x10]
call fcn.0044fa50
add esp, 4
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb8], edi
jmp 0x43821f
mov ebx, eax
mov eax, dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [esp + 0x18], eax
mov ecx, 0x3f
mov edx, str.GetDefaultPdf
mov eax, str.0x_X_in__S:_d
push ecx
push edx
push ebx
push eax
call fcn.00452540
add esp, 0x10
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
lea ecx, [eax + eax]
add ecx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ecx, eax
mov dword [esp + 0x1c], ecx
push ecx
call fcn.0044fa47
add esp, 4
mov esi, eax
push dword [esp + 0x1c]
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0x3f
push eax
mov eax, str.GetDefaultPdf
push eax
push ebx
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push dword [esp + 0x24]
mov dword [esp + 0x28], esi
push esi
call fcn.004525a0
add esp, 0x1c
push dword [esp + 0x18]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x438888
mov edx, eax
lea eax, [esp + 0x70]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
xor ecx, ecx
xor esi, esi
inc esi
push ecx
push eax
push ecx
push esi
push ecx
push ebx
push ecx
push esi
mov esi, edx
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push dword [esp + 0x10]
call fcn.0044fa50
add esp, 4
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb8], ebx
jmp 0x438216
lea ecx, [esp + 0xa0]
xor edx, edx
inc edx
push 1
push str.FollowupNotificationSuppressed
call fcn.0042e3c0
add esp, 8
mov dword [esp + 0xa0], 1
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], 0
lea ecx, [esp + 0x50]
lea esi, [esp + 0x70]
mov edx, esi
lea eax, [esp + 0xa0]
push eax
call fcn.00432cf0
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x437225
mov ecx, dword [esp + 0x70]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x438940
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43895a
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fa85
add esp, 8
jmp 0x437225
int3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
push edi
push esi
mov al, 1
cmp byte [ecx + 4], 0
jne 0x438a30
mov esi, ecx
mov edi, dword [ecx]
test edi, edi
jne 0x4389a5
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43899b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
test edi, edi
je 0x438a34
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4389e9
cmp eax, 0x80
je 0x438a08
test eax, eax
je 0x438a25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xbb
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x14
jmp 0x438a29
push 0xae
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x10
jmp 0x438a29
push 0xb5
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x10
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xa4
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a490
add esp, 0x14
xor eax, eax
jmp 0x438a30