Function at 0x14005da40
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, reloc.SHELL32.dll_IsUserAnAdmin
movaps xmmword [rsp + 0x290], xmm6
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x288], rax
call fcn.1401772e0
mov rbp, rax
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov eax, dword [rax + 0xc]
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rbx
movaps xmm6, xmmword [0x14032f5c0]
movaps xmmword [rdi], xmm6
mov dword [rsp + 0x20], eax
lea rdx, [0x14033610c]
mov rcx, rdi
call fcn.14007dc90
mov ecx, 0x80
call fcn.1401b9cac
mov r15, rax
lea rdx, str.https:__support.google.com_chrome_pchrome_uninstall_survey
mov r8d, 0x76
mov rcx, rax
call fcn.1401bcb50
mov word [r15 + 0x76], 0
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
cmp byte [rdi + 0x17], 0
jns 0x14005daf7
mov rdi, qword [rsp + 0x60]
lea rbx, [rsp + 0x1c0]
mov rcx, rsi
mov rdx, rbx
call fcn.1400804f0
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
cmovs rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.14007df40
cmp byte [rsi + 0x17], 0
jns 0x14005db4b
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdi
lea rdx, str._lscrversion_lsos_ls
lea r14, [rsp + 0x40]
mov rcx, r14
mov r8, r15
mov r9, rsi
call fcn.14007dc90
cmp byte [rsp + 0x97], 0
jns 0x14005db81
mov rcx, qword [rsp + 0x80]
call fcn.1401b9ce8
cmp byte [rsp + 0x1d7], 0
movabs rbx, 0xaaaaaaaaaaaaaaaa
jns 0x14005dba2
mov rcx, qword [rsp + 0x1c0]
call fcn.1401b9ce8
movzx eax, byte [r12 + 0x17]
test al, al
jns 0x14005dbb3
mov rax, qword [r12 + 8]
jmp 0x14005dbb6
and eax, 0x7f
test rax, rax
je 0x14005dd6b
lea rsi, [rsp + 0x80]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov rdx, r13
mov r8d, 0x3c
call fcn.1400c8c90
lea rdi, [rsp + 0x268]
mov qword [rdi], rbx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.1400c8d00
mov rsi, qword [rdi]
test rsi, rsi
je 0x14005dd5e
cmp byte [rsi + 0x20], 6
jne 0x14005dd42
lea rdi, [rsp + 0x1c0]
mov qword [rdi + 0x10], rbx
movaps xmmword [rdi], xmm6
lea rax, [0x140331414]
lea rbx, [rsp + 0x250]
mov qword [rbx], rax
mov qword [rbx + 8], 1
lea rcx, [0x140376f40]
lea rsi, [rsp + 0x238]
mov qword [rsi], rcx
call fcn.1401e25c0
mov qword [rsi + 8], rax
mov dword [rsp + 0x20], 1
xor r13d, r13d
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.140168380
mov rcx, qword [rsp + 0x268]
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
sub rbx, rax
sar rbx, 4
lea rdx, [rsp + 0x278]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
mov r8b, 1
call fcn.1402293f0
test rax, rax
je 0x14005dcb2
mov rcx, rax
call fcn.14016b9d0
mov r13d, eax
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
movabs rbx, 0xaaaaaaaaaaaaaaaa
je 0x14005dcd6
mov qword [rsp + 0x1c8], rcx
call fcn.1401b9ce8
mov rdi, qword [rsp + 0x268]
mov qword [rsp + 0x268], 0
test rdi, rdi
je 0x14005dcff
mov rcx, rdi
call fcn.14016cfe0
mov rcx, rdi
call fcn.1401b9ce8
lea rcx, [rsp + 0x80]
call fcn.1400c8cd0
test r13b, r13b
je 0x14005dd6b
lea rdx, [0x1403360d2]
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005d450
movzx r8d, byte [r12 + 0x17]
test r8b, r8b
jns 0x14005e04d
mov r8, qword [r12 + 8]
mov r12, qword [r12]
jmp 0x14005e051
mov qword [rsp + 0x268], 0
mov rcx, rsi
call fcn.14016cfe0
mov rcx, rsi
call fcn.1401b9ce8
lea rcx, [rsp + 0x80]
call fcn.1400c8cd0
cmp dword [rbp], 7
jl 0x14005de56
lea rsi, [rsp + 0x250]
mov qword [rsi + 0x10], rbx
movaps xmmword [rsi], xmm6
lea rdx, str.microsoft_edge:
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140043780
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
movups xmmword [rsp + 0x1d8], xmm0
movups xmmword [rsp + 0x1e8], xmm0
movups xmmword [rsp + 0x218], xmm0
movups xmmword [rsp + 0x208], xmm0
movups xmmword [rsp + 0x1f8], xmm0
mov qword [rsp + 0x228], 0
movabs rax, 0x10000000070
mov qword [rsp + 0x1c0], rax
lea rax, str.open
mov qword [rsp + 0x1d0], rax
cmp byte [rsi + 0x17], 0
jns 0x14005de06
mov rsi, qword [rsp + 0x250]
lea rcx, [rsp + 0x1c0]
mov qword [rcx + 0x18], rsi
mov dword [rcx + 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test eax, eax
jne 0x14005de37
mov ecx, 2
call fcn.140160660
test al, al
jne 0x14005e061
cmp byte [rsp + 0x267], 0
jns 0x14005de4e
mov rcx, qword [rsp + 0x250]
call fcn.1401b9ce8
test esi, esi
jne 0x14005dff7
lea rsi, [rsp + 0x80]
mov qword [rsi + 0x10], rbx
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.14015ea60
mov ecx, 0x67
mov rdx, rsi
call fcn.140079900
test al, al
je 0x14005dfea
lea rax, [0x140336255]
lea r8, [rsp + 0x278]
mov qword [r8], rax
mov qword [r8 + 8], 0x11
lea rdi, [rsp + 0x80]
lea rsi, [rsp + 0x1c0]
mov rcx, rdi
mov rdx, rsi
call fcn.140074560
mov rcx, rdi
mov rdx, rsi
call fcn.14015ec30
mov rcx, rsi
call fcn.14015ebb0
lea rax, str.iexplore.exe
lea r8, [rsp + 0x268]
mov qword [r8], rax
mov qword [r8 + 8], ntohl
lea rsi, [rsp + 0x1c0]
mov rcx, rdi
mov rdx, rsi
call fcn.140074560
mov rcx, rdi
mov rdx, rsi
call fcn.14015ec30
mov rcx, rsi
call fcn.14015ebb0
lea rdx, [0x14033627a]
lea rbx, [rsp + 0x238]
mov rcx, rbx
mov r8, rdi
call fcn.140043780
lea rdx, [0x140336274]
mov rcx, rbx
call fcn.14005d450
mov rcx, qword [rax + 0x10]
lea rdi, [rsp + 0x250]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rdi], xmm0
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor ebx, ebx
mov qword [rax + 0x10], rbx
movzx eax, byte [rsp + 0x57]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0x48]
cmovs r14, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, r14
call fcn.14015cb00
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsi], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], rbx
cmp byte [rdi + 0x17], 0
jns 0x14005dfa2
mov rcx, qword [rsp + 0x250]
call fcn.1401b9ce8
cmp byte [rsp + 0x24f], 0
jns 0x14005dfb9
mov rcx, qword [rsp + 0x238]
call fcn.1401b9ce8
lea rdx, [rsp + 0x250]
mov dword [rdx], 0
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
call fcn.140284460
cmp byte [rsi + 0x17], 0
jns 0x14005dfea
mov rcx, qword [rsp + 0x1c0]
call fcn.1401b9ce8
lea rcx, [rsp + 0x80]
call fcn.14015ebb0
cmp byte [rsp + 0x57], 0
jns 0x14005e008
mov rcx, qword [rsp + 0x40]
call fcn.1401b9ce8
mov rcx, r15
call fcn.1401b9ce8
cmp byte [rsp + 0x77], 0
jns 0x14005e021
mov rcx, qword [rsp + 0x60]
call fcn.1401b9ce8
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1401bb0d0
movaps xmm6, xmmword [rsp + 0x290]
add rsp, reloc.SHELL32.dll_IsUserAnAdmin
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
and r8d, 0x7f
mov rcx, rsi
mov rdx, r12
call fcn.14015cb00
jmp 0x14005dd6b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstaller_setupgoogle_chrome_behaviors.cc
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r8d, 0x33
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_launch_Edge_for_uninstall_survey
mov r8d, 0x2a
call fcn.1401f9cc0
mov rcx, rdi
call fcn.140224690
jmp 0x14005de37