Function at 0x14011d0e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
movaps xmmword [rsp + 0x440], xmm7
movaps xmmword [rsp + 0x430], xmm6
mov rdi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x428], rax
call sub.browser_elf.dll_IsBrowserProcess
test al, al
je 0x14011d1c7
lea rsi, [rsp + 0x212]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1401d06e0
mov word [rsi - 2], 0
lea rsi, [rsp + 0x210]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x14011d1c7
mov eax, eax
lea rdx, [rsp + 0x1d0]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.1401b5140
lea rbx, [rsp + 0x70]
mov rcx, rsi
mov rdx, rbx
call fcn.140188050
mov rcx, rbx
call fcn.140018090
cmp byte [rbx + 0x17], 0
jns 0x14011d1b0
mov rcx, qword [rsp + 0x70]
call fcn.1401cbbbc
cmp byte [rsp + 0x207], 0
jns 0x14011d1c7
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cbbbc
call qword [sym.imp.browser_elf.dll_GetInstallDetailsPayload]
mov rsi, rax
mov ecx, 0x10
call fcn.1401cbbc4
lea rcx, [0x14029e8a8]
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov qword [0x1402e5ad0], rax
call sub.browser_elf.dll_SignalInitializeCrashReporting
call sub.browser_elf.dll_IsBrowserProcess
test al, al
je 0x14011d204
mov byte [0x1402dc5b8], 1
lea rcx, [0x140235ff0]
call fcn.1401cc768
mov dword [0x1402deda4], 1
mov byte [0x1402deda0], 1
xor r15d, r15d
xor ecx, ecx
xor edx, edx
call fcn.1400207e0
mov r14, qword [0x1402e5ab0]
lea rdx, str.disable_audio_effects
mov rcx, r14
call fcn.1401a49f0
test al, al
je 0x14011d301
call fcn.14011efc0
mov rcx, qword [rsp + 0x428]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x430]
movaps xmm7, xmmword [rsp + 0x440]
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x148]
mov qword [rsp + 0x150], rsi
call fcn.1401cbbbc
lea rcx, [rsp + 0x70]
call fcn.140064c40
test r12, r12
je 0x14011d2bb
mov rcx, r12
call fcn.140209ed0
mov rcx, r12
call fcn.1401cbbbc
cmp byte [rsp + 0x127], 0
jns 0x14011d250
mov rcx, qword [rsp + 0x110]
call fcn.1401cbbbc
jmp 0x14011d250
lea rsi, [rsp + 0x210]
mov rcx, rsi
call fcn.14005dc10
mov r12, qword [rsi]
movzx ecx, byte [rsp + 0x127]
mov rdx, qword [rsp + 0x118]
mov eax, ecx
and eax, 0x7f
jmp 0x14011d36d
mov qword [rsp + 0x48], rdi
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x110]
mov qword [rbx + 0x10], r13
movaps xmm6, xmmword [0x14029ca60]
movaps xmmword [rbx], xmm6
lea rax, [0x1402a2191]
lea r8, [rsp + 0x100]
mov qword [r8], rax
mov qword [r8 + 8], 4
mov rcx, r14
mov rdx, rbx
call fcn.14017d0a0
movzx ecx, byte [rbx + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
mov rdx, qword [rbx + 8]
mov r8, rax
cmovs r8, rdx
test r8, r8
je 0x14011d2d7
xor r12d, r12d
test cl, cl
cmovs rax, rdx
mov rcx, qword [rsp + 0x110]
cmovns rcx, rbx
test rax, rax
js 0x14011e8aa
je 0x14011d393
test rcx, rcx
je 0x14011e8c6
cmp rax, 0x10
jne 0x14011d3cf
movdqu xmm0, xmmword [rcx]
pcmpeqb xmm0, xmmword [str.crashpad_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14011e4f9
movdqu xmm0, xmmword [rcx]
pcmpeqb xmm0, xmmword [str.fallback_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14011e2b0
lea rcx, [rsp + 0xc8]
mov qword [rcx], r13
mov rax, qword [fcn.1401c9410]
call qword [0x1402f5008]
call sub.browser_elf.dll_SignalChromeElf
movzx eax, byte [rsp + 0x127]
test al, al
js 0x14011d3fd
and eax, 0x7f
jmp 0x14011d405
mov rax, qword [rsp + 0x118]
test rax, rax
jne 0x14011d4d6
xor eax, eax
mov byte [rsp + 0x1b0], al
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
xorps xmm7, xmm7
movaps xmmword [rsp + 0x70], xmm7
mov byte [rsp + 0x80], al
mov ecx, 0x18
call fcn.1401cbbc4
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x98], rcx
test rax, rax
je 0x14011e8d2
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
lea rax, [rsp + 0xa8]
mov qword [rax - 0x18], rcx
movups xmmword [rax], xmm7
mov qword [rax - 8], rax
mov qword [rax + 0x10], 1
lea rax, [0x14029ca70]
lea rcx, [rsp + 0x210]
mov qword [rcx], rax
lea r15, [rsp + 0x1b0]
lea r8, [rsp + 0x70]
mov rdx, r15
call fcn.140058280
cmp byte [r15], 0
jne 0x14011e711
lea rcx, [rsp + 0x70]
call fcn.14002ca30
mov qword [rsp + 0x98], r13
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
mov r15, qword [0x1402e5ac8]
mov rax, qword [0x1402cbde0]
and rax, r15
cmp rax, qword [0x1402cbdc8]
je 0x14011e8b9
lea rax, [rsp + 0x70]
mov qword [rax + 0x28], r15
mov qword [0x1402e5ac8], rax
lea r15, [rsp + 0x148]
mov rcx, r14
mov rdx, r15
call fcn.140064930
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0x18
jne 0x14011d5d5
cmp rcx, rax
je 0x14011e8c9
movzx ecx, byte [rax + 0x17]
test cl, cl
js 0x14011d673
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
test rax, rax
jne 0x14011d582
test rcx, rcx
jne 0x14011e8d5
lea r15, [rsp + 0x210]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1401b5140
lea rax, str..infected
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], 9
mov rcx, r15
call fcn.14005a890
mov ebp, eax
cmp byte [r15 + 0x17], 0
jns 0x14011d5cc
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
test bpl, bpl
jne case.0x14011e06b.7
cmp qword [r14 + 0x40], 0xb
ja case.0x14011e06b.7
lea rdx, str.app_id
mov rcx, r14
call fcn.1401a49f0
test al, al
je 0x14011d656
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
xor eax, eax
mov qword [rsp + 0x1e0], rax
lea rdx, [rsp + 0x210]
mov qword [rdx + 0x10], rax
movdqa xmmword [rdx], xmm0
mov ecx, 0x3e9
call fcn.140026680
test al, al
jne 0x14011d692
cmp byte [rsp + 0x227], 0
jns 0x14011d63f
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
cmp byte [rsp + 0x1e7], 0
jns 0x14011d656
mov rcx, qword [rsp + 0x1d0]
call fcn.1401cbbbc
mov rcx, qword [r14 + 0x30]
add r14, 0x38
cmp rcx, r14
je 0x14011e108
lea rax, [0x1402a1d4c]
jmp 0x14011e015
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
test rcx, rcx
jns 0x14011d574
jmp 0x14011e905
lea rax, str.First_Run
lea r8, [rsp + 0x1b0]
mov qword [r8], rax
mov qword [r8 + 8], 9
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x1f0]
call fcn.140176790
cmp byte [rsp + 0x1e7], 0
jns 0x14011d6d8
mov rcx, qword [rsp + 0x1d0]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x1e0], rax
movdqu xmm0, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x1d0], xmm0
cmp byte [rsp + 0x227], 0
jns 0x14011d711
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
lea r15, [rsp + 0x1d0]
mov rcx, r15
call fcn.140059940
mov ebp, eax
cmp byte [r15 + 0x17], 0
jns 0x14011d737
mov rcx, qword [rsp + 0x1d0]
call fcn.1401cbbbc
test bpl, bpl
je case.0x14011e06b.7
jmp 0x14011d656
cmp byte [rsp + 0x227], 0
jns case.0x14011e06b.7
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
pxor xmm0, xmm0
lea rdx, [rsp + 0x210]
movdqa xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov ecx, 1
call fcn.140026680
test al, al
je 0x14011d8cc
lea r14, [rsp + 0x210]
mov rcx, r14
call fcn.140122930
test al, al
je 0x14011d8cc
mov qword [rsp + 0x1f8], r13
xor eax, eax
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x1f8], 0
mov qword [rsp + 0x200], rax
lea rcx, [rsp + 0x1d0]
mov qword [rcx], rax
mov qword [rsp + 0x20], rcx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14011d885
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
jne 0x14011e87c
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x1f8], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], 0
cmp byte [rsp + 0x227], 0
jns 0x14011d84b
mov r14, qword [rsp + 0x210]
lea rcx, [rsp + 0x1f0]
lea r15, [rsp + 0x1d0]
mov rdx, r14
mov r8, r15
call fcn.14002fee0
test eax, eax
je 0x14011daca
cmp byte [rsp + 0x1e7], 0
jns 0x14011d885
mov rcx, qword [rsp + 0x1d0]
call fcn.1401cbbbc
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
je 0x14011d8af
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x1f0], 0
mov dword [rsp + 0x1f8], 0
mov rcx, qword [rsp + 0x200]
mov qword [rsp + 0x200], 0
test rcx, rcx
jne 0x14011e86d
cmp byte [rsp + 0x227], 0
jns 0x14011d8e3
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
mov r14, qword [0x1402e5a38]
test r14, r14
jne 0x14011e8d8
xor ecx, ecx
sub ecx, dword [0x1402e5a28]
mov eax, 0xffffffff
cmovns eax, ecx
test eax, eax
jg 0x14011da80
lea rcx, str.ExitCodeWatcher
call fcn.1400518e0
mov ebp, eax
mov ecx, 0x28
call fcn.1401cbbc4
mov r14, rax
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm0
lea rax, [0x14029f6a8]
lea rcx, [0x14029f698]
test bpl, bpl
cmovne rcx, rax
mov qword [r14], rcx
mov r8, qword [rsp + 0xc8]
mov rcx, r14
mov rdx, qword [rsp + 0x48]
call fcn.14011e930
mov r15d, eax
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14011d97f
movzx eax, byte [r14 + 0x27]
test al, al
js 0x14011e8ad
test rax, rax
je 0x14011d9ef
test r14, r14
je 0x14011d998
mov rax, qword [r14]
mov rax, qword [rax]
mov rcx, r14
mov edx, 1
call qword [0x1402f5008]
movzx ecx, byte [rsp + 0x127]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x118]
cmovs rbx, qword [rsp + 0x110]
test rax, rax
js 0x14011e8b6
test rbx, rbx
jne 0x14011d9d0
test rax, rax
jne 0x14011e8cc
cmp rax, 5
je 0x14011da10
cmp rax, 7
jne 0x14011da2c
mov eax, dword [rbx]
xor eax, dword [str.utility]
mov ecx, dword [rbx + 3]
xor ecx, dword [0x1402a2199]
jmp 0x14011da24
lea rdx, str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011e908
call qword [0x1402f5008]
jmp 0x14011d97f
mov eax, dword [rbx]
xor eax, dword [str.ppapi]
mov cl, byte [rbx + 4]
xor cl, byte [0x1402a218f]
movzx ecx, cl
or ecx, eax
je 0x14011e887
mov rsi, qword [rsp + 0x148]
test rsi, rsi
je 0x14011d29c
mov rdi, qword [rsp + 0x150]
mov rcx, rsi
cmp rdi, rsi
je 0x14011d28f
add rdi, 0xffffffffffffffe8
jmp 0x14011da6f
mov rcx, qword [rdi]
call fcn.1401cbbbc
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x14011d287
test rdi, rdi
je 0x14011e895
cmp byte [rdi + 0x17], 0
jns 0x14011da5f
jmp 0x14011da57
lea rdx, str.chrome_exe_main_win.cc
lea r14, [rsp + 0x210]
mov rcx, r14
mov r8d, 0x1f2
mov r9d, 0xffffffff
call fcn.1400036d0
lea rcx, [rsp + 0x220]
lea rdx, str.About_to_load_main_DLL.
mov r8d, 0x17
call fcn.140206b20
mov rcx, r14
call fcn.1400038d0
jmp 0x14011d90b
mov qword [rsp + 0x1c0], r13
movaps xmmword [rsp + 0x1b0], xmm6
lea rdx, [0x1402a19ba]
movzx ecx, byte [rsp + 0x1e7]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x130], rdx
cmovs r15, qword [rsp + 0x1d0]
mov qword [rsp + 0x138], 1
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], rax
test rax, rax
js 0x14011e90b
mov qword [rsp + 0x40], r12
test r15, r15
jne 0x14011db42
test rax, rax
jne 0x14011e911
mov dword [rsp + 0x20], 1
lea r14, [rsp + 0x1b0]
lea rdx, [rsp + 0x1a0]
lea r8, [rsp + 0x130]
mov rcx, r14
mov r9d, 1
call fcn.1400552e0
lea rbp, str.WIN95
mov rsi, qword [r14 + 8]
lea r12, str.WIN95
jmp 0x14011dc34
mov rsi, qword [rsp + 0x1b8]
jmp 0x14011db94
mov r15, r13
mov rdi, rsi
sub rdi, r15
jb 0x14011e8a4
je 0x14011dc27
mov rax, r15
add rax, rdi
cmp rax, rsi
je 0x14011dbf8
cmp byte [r15 + 0x17], 0
jns 0x14011dbc0
mov rcx, qword [r15]
call fcn.1401cbbbc
lea rax, [r15 + rdi]
mov rcx, qword [rax + 0x10]
mov qword [r15 + 0x10], rcx
movdqu xmm0, xmmword [rax]
movdqu xmmword [r15], xmm0
lea rax, [r15 + rdi]
add rax, 0x18
mov byte [rax - 1], 0
mov word [rax - 0x18], 0
add r15, 0x18
cmp rax, rsi
jne 0x14011dbb1
mov rsi, qword [rsp + 0x1b8]
cmp rsi, r15
je 0x14011dc1c
add rsi, 0xffffffffffffffe8
test rsi, rsi
je 0x14011e89b
cmp byte [rsi + 0x17], 0
js 0x14011dc5b
lea rax, [rsi - 0x18]
cmp rsi, r15
mov rsi, rax
jne 0x14011dc01
mov qword [rsp + 0x1b8], r15
mov rsi, r15
add rbp, 8
cmp rbp, r12
je 0x14011dd8d
mov r14, qword [rbp]
mov r15, qword [rsp + 0x1b0]
mov r13, rsi
cmp r15, rsi
je 0x14011dcc0
test r14, r14
je 0x14011df11
mov rcx, r14
call fcn.1401cc340
jmp 0x14011dc6e
mov rcx, qword [rsi]
call fcn.1401cbbbc
jmp 0x14011dc10
add r15, 0x18
cmp r15, rsi
je 0x14011dce7
movzx edx, byte [r15 + 0x17]
test dl, dl
js 0x14011dc7f
and edx, 0x7f
mov rcx, r15
jmp 0x14011dc86
mov rdx, qword [r15 + 8]
mov rcx, qword [r15]
test rdx, rdx
js 0x14011e898
test rcx, rcx
jne 0x14011dc9d
test rdx, rdx
jne 0x14011e8a1
cmp rdx, rax
jne 0x14011dc65
test rax, rax
je 0x14011dcbd
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [r14 + rdx*2]
jne 0x14011dc65
inc rdx
cmp rax, rdx
jne 0x14011dca9
mov r13, r15
cmp r13, rsi
je 0x14011db91
mov rax, r13
add rax, 0x18
cmp rax, rsi
je 0x14011db91
test r14, r14
je 0x14011df0e
mov r15, r13
jmp 0x14011dd2a
mov r13, rsi
jmp 0x14011dcc0
cmp byte [r15 + 0x17], 0
jns 0x14011dcfb
mov rcx, qword [r15]
call fcn.1401cbbbc
mov rax, qword [r13 + 0x10]
mov qword [r15 + 0x10], rax
movdqu xmm0, xmmword [r13]
movdqu xmmword [r15], xmm0
mov byte [rdi + 0x2f], 0
mov word [r13], 0
add r15, 0x18
lea rax, [r13 + 0x18]
cmp rax, rsi
je 0x14011db87
mov rdi, r13
mov r13, rax
mov rcx, r14
call fcn.1401cc340
movzx edx, byte [rdi + 0x2f]
test dl, dl
js 0x14011dd48
and edx, 0x7f
mov rcx, r13
jmp 0x14011dd50
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
test rdx, rdx
js 0x14011e88f
test rcx, rcx
jne 0x14011dd67
test rdx, rdx
jne 0x14011e892
cmp rdx, rax
jne 0x14011dcec
test rax, rax
je 0x14011dd1d
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [r14 + rdx*2]
jne 0x14011dcec
inc rdx
cmp rax, rdx
jne 0x14011dd73
jmp 0x14011dd1d
mov rax, qword [rsp + 0x1b0]
cmp rax, rsi
je 0x14011de79
lea r14, [rsp + 0x180]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rcx
movaps xmmword [r14], xmm6
lea r8, [rsp + 0x170]
lea rcx, [0x1402a19ba]
mov qword [r8], rcx
mov qword [r8 + 8], 1
sub rsi, rax
sar rsi, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rcx, rsi
lea rdx, [rsp + 0x160]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, r14
call fcn.140235d70
cmp byte [r14 + 0x17], 0
jns 0x14011de0d
mov r14, qword [rsp + 0x180]
cmp byte [rsp + 0x227], 0
mov r12, qword [rsp + 0x40]
js 0x14011de26
lea r15, [rsp + 0x210]
jmp 0x14011de2e
mov r15, qword [rsp + 0x210]
mov rcx, r14
call fcn.1401cc340
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1f0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov rdx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [rsp + 0x197], 0
jns 0x14011dea8
mov rcx, qword [rsp + 0x180]
call fcn.1401cbbbc
jmp 0x14011dea8
cmp byte [rsp + 0x227], 0
js 0x14011de8d
lea rdx, [rsp + 0x210]
jmp 0x14011de95
mov rdx, qword [rsp + 0x210]
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rsp + 0x1b0]
test rsi, rsi
je 0x14011d86e
mov rdi, qword [rsp + 0x1b8]
mov rcx, rsi
cmp rdi, rsi
je 0x14011defc
add rdi, 0xffffffffffffffe8
jmp 0x14011dee3
mov rcx, qword [rdi]
call fcn.1401cbbbc
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x14011def4
test rdi, rdi
je 0x14011e8cf
cmp byte [rdi + 0x17], 0
jns 0x14011ded7
jmp 0x14011decf
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x1b8], rsi
call fcn.1401cbbbc
jmp 0x14011d86e
int3
int3
movdqu xmm0, xmmword [rdx]
movzx r8d, byte [rdx + 0x10]
movzx r9d, byte [0x1402acfa0]
movd xmm1, r8d
movd xmm2, r9d
pcmpeqb xmm0, xmmword [str.profile_directory]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb r8d, xmm0
cmp r8d, 0xffff
je 0x14011dff5
movdqu xmm0, xmmword [rdx]
movzx edx, byte [rdx + 0x10]
movzx r8d, byte [0x1402ace80]
movd xmm1, edx
movd xmm2, r8d
pcmpeqb xmm0, xmmword [str.open_alice_dialog]
jmp 0x14011dfbe
mov r8, qword [rdx]
xor r8, qword [str.user_agent_info]
mov r9, qword [rdx + 7]
xor r9, qword [0x1402aa657]
or r9, r8
je 0x14011dff5
mov r8, qword [rdx]
xor r8, qword [str.source_shortcut]
mov rdx, qword [rdx + 7]
xor rdx, qword [0x1402acff7]
jmp 0x14011dfec
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 3]
movdqu xmm2, xmmword [0x1402acfb3]
pcmpeqb xmm0, xmmword [str.win_jumplist_action]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x14011dff5
jmp case.0x14011e06b.7
mov r8, qword [rdx]
xor r8, qword [str.open_from_pin]
mov rdx, qword [rdx + 5]
xor rdx, qword [0x1402ace87]
or rdx, r8
jne case.0x14011e06b.7
mov r8, qword [rcx + 8]
test r8, r8
je 0x14011e029
mov rdx, r8
mov r8, qword [r8]
test r8, r8
jne 0x14011dffe
mov rcx, rdx
cmp rdx, r14
je 0x14011e108
movzx r8d, byte [rcx + 0x37]
test r8b, r8b
js 0x14011e037
lea rdx, [rcx + 0x20]
and r8d, 0x7f
jmp 0x14011e03f
mov rdx, qword [rcx + 0x10]
cmp qword [rdx], rcx
mov rcx, rdx
jne 0x14011e029
jmp 0x14011e009
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
test r8, r8
js 0x14011e89e
test rdx, rdx
jne 0x14011e056
test r8, r8
jne 0x14011e8a7
add r8, 0xfffffffffffffffa
cmp r8, 0xd
ja case.0x14011e06b.7
movsxd r8, dword [rax + r8*4]
add r8, rax
jmp r8
mov r8, qword [rdx]
xor r8, qword [str.image_search]
mov edx, dword [rdx + 8]
xor edx, dword [0x1402ace01]
jmp 0x14011dfec
mov r8, qword [rdx]
xor r8, qword [str.incognito]
mov dl, byte [rdx + 8]
xor dl, byte [0x1402acf81]
movzx edx, dl
jmp 0x14011dfec
mov r8d, dword [rdx]
xor r8d, dword [str.app_id]
movzx edx, word [rdx + 4]
xor dx, word [0x1402acf76]
movzx edx, dx
or edx, r8d
je 0x14011dff5
jmp case.0x14011e06b.7
mov r8, qword [rdx]
xor r8, qword [str.launch_way]
movzx r9d, word [rdx + 8]
xor r9w, word [0x1402aa6d6]
movzx r9d, r9w
or r9, r8
je 0x14011dff5
mov r8, qword [rdx]
xor r8, qword [str.new_window]
movzx edx, word [rdx + 8]
xor dx, word [0x1402acf8b]
movzx edx, dx
jmp 0x14011dfec
pxor xmm0, xmm0
lea rcx, [rsp + 0x210]
movdqa xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140065080
test al, al
je 0x14011d741
lea rdx, [rsp + 0x210]
mov rcx, 0xffffffff80000002
call fcn.14004f9c0
test al, al
jne 0x14011e159
lea rdx, [rsp + 0x210]
mov rcx, 0xffffffff80000001
call fcn.14004f9c0
lea rcx, [rsp + 0x210]
call fcn.1401229c0
test rax, rax
je 0x14011d741
mov r14, rax
mov rsi, r12
lea rcx, [rsp + 0x1d0]
mov qword [rcx], r13
mov rax, qword [fcn.1401c9410]
call qword [0x1402f5008]
call fcn.14023ea30
mov rax, qword [fcn.1401c9410]
lea r12, [rsp + 0x1f0]
mov rcx, r12
call qword [0x1402f5008]
mov r15, qword [0x1402e5ab0]
test r15, r15
je 0x14011e277
mov rax, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
cmp rdx, rax
setns cl
movabs r8, 0x7fffffffffffffff
add r8, rcx
sub rdx, rax
cmovo rdx, r8
mov rcx, r12
call fcn.1401c9cf0
movzx eax, byte [rsp + 0x207]
test al, al
js 0x14011e1ff
and eax, 0x7f
jmp 0x14011e20f
mov rax, qword [rsp + 0x1f8]
mov r12, qword [rsp + 0x1f0]
mov qword [rsp + 0x180], r12
mov qword [rsp + 0x188], rax
test rax, rax
js 0x14011e90e
test r12, r12
jne 0x14011e236
test rax, rax
jne 0x14011e91d
lea rax, str.external_app_data_calc_time_us
lea rdx, [rsp + 0x130]
mov qword [rdx], rax
mov qword [rdx + 8], 0x1e
lea r8, [rsp + 0x180]
mov rcx, r15
call fcn.14002d590
cmp byte [rsp + 0x207], 0
jns 0x14011e277
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cbbbc
mov rcx, r14
mov dl, 1
call fcn.140122ad0
mov ebp, eax
cmp byte [rsp + 0x227], 0
jns 0x14011e29a
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
test ebp, ebp
mov r12, rsi
jne case.0x14011e06b.7
xor r15d, r15d
jmp 0x14011da2c
int3
mov r13, r12
lea rdi, [rsp + 0x210]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.1401d06e0
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14011e2ad
pxor xmm0, xmm0
lea rdi, [rsp + 0x70]
movdqa xmmword [rdi], xmm0
xor eax, eax
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x1f0]
mov qword [rbx + 0x10], rax
movdqa xmmword [rbx], xmm0
lea rsi, [rsp + 0x1d0]
mov qword [rsi + 0x10], rax
movdqa xmmword [rsi], xmm0
lea r15, [rsp + 0x1b0]
mov qword [r15 + 0x10], rax
movdqa xmmword [r15], xmm0
lea r12, [rsp + 0x180]
lea rdx, [rsp + 0x210]
mov rcx, r12
call fcn.140207340
mov qword [rsp + 0x20], rsi
mov rcx, r12
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.1401244e0
cmp byte [r12 + 0x17], 0
jns 0x14011e367
mov rcx, qword [rsp + 0x180]
call fcn.1401cbbbc
movzx ecx, byte [rsp + 0x1e7]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x1d8]
cmovs rsi, qword [rsp + 0x1d0]
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rax
test rax, rax
js 0x14011e914
test rsi, rsi
mov r12, r13
jne 0x14011e3b2
test rax, rax
jne 0x14011e920
lea rcx, [rsp + 0x180]
lea rdx, [rsp + 0x1a0]
call fcn.14017d440
movzx ecx, byte [rsp + 0x207]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x1f8]
cmovs rbx, qword [rsp + 0x1f0]
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rax
test rax, rax
js 0x14011e917
test rbx, rbx
jne 0x14011e40f
test rax, rax
jne 0x14011e923
lea rcx, [rsp + 0x148]
lea rdx, [rsp + 0x170]
call fcn.14017d440
movzx ecx, byte [rsp + 0x87]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x78]
cmovs rdi, qword [rsp + 0x70]
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rax
test rax, rax
js 0x14011e91a
test rdi, rdi
jne 0x14011e466
test rax, rax
jne 0x14011e926
lea rdi, [rsp + 0x130]
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.14017d440
lea r8, [rsp + 0x148]
lea r9, [rsp + 0x180]
mov rcx, r14
mov rdx, rdi
call fcn.14023ef30
mov r15d, eax
cmp byte [rsp + 0x1c7], 0
jns 0x14011e4b3
mov rcx, qword [rsp + 0x1b0]
call fcn.1401cbbbc
cmp byte [rsp + 0x1e7], 0
jns 0x14011e4ca
mov rcx, qword [rsp + 0x1d0]
call fcn.1401cbbbc
cmp byte [rsp + 0x207], 0
jns 0x14011e4e1
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cbbbc
cmp byte [rsp + 0x87], 0
jns 0x14011d2a6
mov rcx, qword [rsp + 0x70]
jmp 0x14011e707
mov rcx, r14
call fcn.14002c690
lea rdx, str.no_periodic_tasks
mov rcx, r14
call fcn.1401a49f0
test al, al
jne 0x14011e650
lea rdi, [rsp + 0x210]
mov qword [rdi + 0x40], r13
pxor xmm0, xmm0
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm0
movdqa xmmword [rdi + 0x20], xmm0
mov qword [rdi + 0x30], 0xffffffffffffffff
mov qword [rdi + 0x38], 0
mov byte [rdi + 0x40], 0
lea rax, str.initial_client_data
lea r8, [rsp + 0xf0]
mov qword [r8], rax
mov qword [r8 + 8], 0x13
lea r15, [rsp + 0x70]
mov rcx, r14
mov rdx, r15
call fcn.14017d0a0
mov rcx, rdi
mov rdx, r15
call fcn.140049020
mov ebx, eax
cmp byte [r15 + 0x17], 0
jns 0x14011e592
mov rcx, qword [rsp + 0x70]
call fcn.1401cbbbc
test bl, bl
je 0x14011e650
lea rdi, [rsp + 0x1f0]
mov qword [rdi], 0xffffffffffffffff
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rsi
mov rbx, rax
mov r15, qword [rsp + 0x248]
call rsi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov rcx, rax
mov rdx, r15
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14011e650
lea rbx, [rsp + 0x70]
movaps xmmword [rbx], xmm6
mov rdx, qword [rsp + 0x1f0]
mov rcx, rbx
call fcn.14001ecd0
mov ecx, 0xa8
call fcn.1401cbbc4
mov rdi, rax
mov rcx, rax
call fcn.140058070
lea r15, [rsp + 0xe0]
mov rcx, r15
mov rdx, rbx
call fcn.140060a20
mov rcx, rdi
mov rdx, r15
call fcn.140057e70
test al, al
je 0x14011e644
mov rcx, rdi
call fcn.14001b020
lea rcx, [rsp + 0x70]
call fcn.14004ffb0
jmp 0x14011e652
xor edi, edi
lea rbx, [rsp + 0x210]
mov qword [rbx + 0x10], r13
movaps xmmword [rbx], xmm6
lea r15, str.user_data_dir
lea r8, [rsp + 0xd0]
mov qword [r8], r15
mov qword [r8 + 8], 0xd
mov rcx, r14
mov rdx, rbx
call fcn.14002cf20
mov rcx, qword [0x1402e5ab0]
lea r8, [0x1402a2191]
mov rdx, rbx
mov r9, r15
call fcn.140124900
mov r15d, eax
test rdi, rdi
je 0x14011e6dc
test r15d, r15d
je 0x14011e6dc
mov rcx, qword [rdi + 0xa0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14011e6c3
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [rsp + 0x227], 0
jns 0x14011e6fc
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
jmp 0x14011e6fc
cmp byte [rsp + 0x227], 0
jns 0x14011e6f3
mov rcx, qword [rsp + 0x210]
call fcn.1401cbbbc
test rdi, rdi
je 0x14011d2a6
mov rcx, rdi
call fcn.14004ff00
mov rcx, rdi
call fcn.1401cbbbc
jmp 0x14011d2a6
xor esi, esi
lea rax, [rsp + 0x2a8]
mov byte [rax - 0x98], sil
pxor xmm0, xmm0
movdqu xmmword [rax - 0x5c], xmm0
movdqu xmmword [rax - 0x4c], xmm0
mov qword [rax - 0x3f], 0
movdqu xmmword [rax - 0x30], xmm0
movdqu xmmword [rax - 0x20], xmm0
mov dword [rax - 0x11], esi
movdqu xmmword [rax], xmm0
movdqu xmmword [rax - 0x90], xmm0
movdqu xmmword [rax - 0x80], xmm0
movdqu xmmword [rax - 0x70], xmm0
mov dword [rax - 0x61], esi
mov qword [rax - 8], rax
mov byte [rax + 0x10], sil
lea rcx, [rsp + 0x70]
lea r15, [rsp + 0x1f0]
mov rdx, r15
call fcn.14001d8e0
lea rcx, [rsp + 0x1d0]
lea r8, [rsp + 0x210]
mov rdx, r15
call fcn.14001e140
cmp byte [r15 + 0x17], sil
jns 0x14011e7a6
mov rcx, qword [rsp + 0x1f0]
call fcn.1401cbbbc
lea r15, [rsp + 0x2a0]
mov rax, qword [rsp + 0x1d0]
inc rax
cmp rax, 1
ja 0x14011e85c
cmp byte [rsp + 0x1d8], 0
setne sil
lea rcx, [rsp + 0x1d0]
call fcn.14004ffb0
mov rdx, qword [rsp + 0x2a8]
mov rcx, r15
call fcn.140206930
mov rcx, qword [rsp + 0x250]
test rcx, rcx
je 0x14011e813
mov rax, qword [rsp + 0x258]
cmp rax, rcx
jne 0x14011e864
mov qword [rsp + 0x258], rcx
call fcn.1401cbbbc
cmp byte [rsp + 0x247], 0
jns 0x14011e82a
mov rcx, qword [rsp + 0x230]
call fcn.1401cbbbc
cmp byte [rsp + 0x22f], 0
jns 0x14011e841
mov rcx, qword [rsp + 0x218]
call fcn.1401cbbbc
lea rcx, [rsp + 0x70]
call fcn.14002ca30
xor r15d, r15d
test sil, sil
je 0x14011d4d6
jmp 0x14011d2a6
mov sil, 1
jmp 0x14011e7cf
add rax, 0xfffffffffffffff8
jne 0x14011e801
int3
mov edx, 1
call fcn.140040de0
jmp 0x14011d8cc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14011d805
mov ecx, r15d
call fcn.140121f10
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov rax, qword [r14 + 0x18]
jmp 0x14011d97a
int3
mov rcx, r15
call fcn.1401508a0
jmp 0x14011d51b
int3
int3
int3
int3
int3
int3
lea rdx, str.....chrome_appchrome_exe_main_win.cc
lea r15, [rsp + 0x210]
mov r8d, 0x27
mov rcx, r15
call fcn.1401c8260
mov rcx, r14
mov rdx, r15
call fcn.14024b030
jmp 0x14011d903
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3