Function at 0x1400ae0f0
Capabilities:
Delete registry value
Set current directory
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3e8
movaps xmmword [rsp + 0x3d0], xmm6
mov r12, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x3c8], rax
call sub.chrome_elf.dll_IsBrowserProcess
movabs r15, 0xaaaaaaaaaaaaaaaa
test al, al
je 0x1400ae257
lea rdi, [rsp + 0x172]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401851f0
mov word [rdi - 2], 0
lea rdi, [rsp + 0x170]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x1400ae257
mov eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.140109400
lea rbx, [rsp + 0x130]
mov rcx, rdi
mov rdx, rbx
call fcn.140144e40
lea rdi, [rsp + 0x380]
mov qword [rdi + 0x40], r15
movdqa xmm0, xmmword [0x140268c70]
movdqa xmmword [rdi + 0x30], xmm0
movdqa xmmword [rdi + 0x20], xmm0
movdqa xmmword [rdi + 0x10], xmm0
movdqa xmmword [rdi], xmm0
lea rdx, [0x140276bf7]
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r9d, 0x42c
call fcn.1400e92c0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.14011f810
cmp byte [rbx + 0x17], 0
jns 0x1400ae218
mov rbx, qword [rsp + 0x130]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call fcn.14011f330
cmp byte [rsp + 0x147], 0
jns 0x1400ae240
mov rcx, qword [rsp + 0x130]
call fcn.14018039c
cmp byte [rsp + 0x127], 0
jns 0x1400ae257
mov rcx, qword [rsp + 0x110]
call fcn.14018039c
call qword [sym.imp.chrome_elf.dll_GetInstallDetailsPayload]
mov rdi, rax
mov ecx, 0x10
call fcn.1401803a4
lea rcx, [0x140269df0]
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [0x1402acbf0], rax
call sub.chrome_elf.dll_SignalInitializeCrashReporting
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x1400ae294
mov byte [0x1402a8adc], 1
lea rcx, [0x1401ea070]
call fcn.140181494
mov dword [0x1402aca30], 1
mov byte [0x1402aca2c], 1
xor ecx, ecx
xor edx, edx
call fcn.1400257c0
mov rdi, qword [0x1402acbd0]
lea rbx, [rsp + 0x70]
mov qword [rbx + 0x10], r15
movaps xmm6, xmmword [0x140268c70]
movaps xmmword [rbx], xmm6
lea rax, str.type
lea r8, [rsp + 0x60]
mov qword [r8], rax
mov qword [r8 + 8], 4
mov rcx, rdi
mov rdx, rbx
call fcn.140145be0
movzx eax, byte [rbx + 0x17]
test al, al
js 0x1400ae303
and eax, 0x7f
jmp 0x1400ae30d
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rax, rax
js 0x1400af15d
test rbx, rbx
jne 0x1400ae324
test rax, rax
jne 0x1400af179
cmp rax, 0x10
jne 0x1400ae360
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [str.crashpad_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400aeeaf
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [str.fallback_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400aecc3
mov qword [rsp + 0x90], r15
mov rax, qword [fcn.1401038f0]
lea rcx, [0x14017e8a0]
cmp rax, rcx
jne 0x1400af132
lea rbx, [rsp + 0x170]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af6
cmp rax, rcx
jg 0x1400af1b4
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402ac9c8]
mov qword [rsp + 0x90], rax
call sub.chrome_elf.dll_SignalChromeElf
mov qword [rsp + 0x3a8], r15
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x380], xmm0
movdqa xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x3a0], 0
mov rbx, qword [0x1402acbe8]
movabs rax, 0xfffffffc00000000
and rax, rbx
cmp rax, qword [0x1402a6e88]
je 0x1400af16c
lea rax, [rsp + 0x380]
mov qword [rax + 0x28], rbx
mov qword [0x1402acbe8], rax
cmp qword [rdi + 0x40], 1
ja 0x1400ae59d
mov rax, qword [rdi + 0x30]
add rdi, 0x38
cmp rax, rdi
jne 0x1400ae561
pxor xmm0, xmm0
lea rcx, [rsp + 0x170]
movdqa xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14005b170
test al, al
je 0x1400ae586
lea rdx, [rsp + 0x170]
mov rcx, 0xffffffff80000002
call fcn.14005e080
test al, al
jne 0x1400ae495
lea rdx, [rsp + 0x170]
mov rcx, 0xffffffff80000001
call fcn.14005e080
lea rcx, [rsp + 0x170]
call fcn.1400b57e0
test rax, rax
je 0x1400ae586
mov rcx, rax
call fcn.1400b58f0
mov edi, eax
cmp byte [rsp + 0x187], 0
jns 0x1400ae4cc
mov rcx, qword [rsp + 0x170]
call fcn.14018039c
test edi, edi
jne 0x1400ae59d
xor esi, esi
jmp 0x1400ae861
mov rcx, qword [rax + 0x28]
mov rdx, qword [rax + 0x20]
test rcx, rcx
js 0x1400af14e
test rdx, rdx
jne 0x1400ae4fa
test rcx, rcx
jne 0x1400af157
cmp rcx, 0x11
jne 0x1400ae59d
movdqu xmm0, xmmword [rdx]
movzx ecx, byte [rdx + 0x10]
movzx edx, byte [0x140277d80]
movd xmm1, ecx
movd xmm2, edx
pcmpeqb xmm0, xmmword [str.profile_directory]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb ecx, xmm0
cmp ecx, 0xffff
jne 0x1400ae59d
test rax, rax
je 0x1400af151
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1400ae579
mov rcx, qword [rax + 0x10]
cmp qword [rcx], rax
mov rax, rcx
jne 0x1400ae549
mov rax, rcx
cmp rcx, rdi
je 0x1400ae444
movzx ecx, byte [rax + 0x37]
test cl, cl
js 0x1400ae4db
lea rdx, [rax + 0x20]
and ecx, 0x7f
jmp 0x1400ae4e3
mov rcx, rdx
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400ae555
jmp 0x1400ae579
cmp byte [rsp + 0x187], 0
jns 0x1400ae59d
mov rcx, qword [rsp + 0x170]
call fcn.14018039c
pxor xmm0, xmm0
lea rdx, [rsp + 0x150]
movdqa xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov ecx, 1
call fcn.140055580
test al, al
je 0x1400ae721
lea rdi, [rsp + 0x150]
mov rcx, rdi
call fcn.1400b5760
test al, al
je 0x1400ae721
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
xor eax, eax
mov qword [rsp + 0x188], rax
lea rcx, [0x140269da8]
mov qword [rsp + 0x170], rcx
lea rcx, [rsp + 0x130]
mov qword [rcx], rax
mov qword [rsp + 0x20], rcx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ae6cb
mov rcx, qword [rsp + 0x178]
test rcx, rcx
jne 0x1400af1db
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x178], rax
mov dword [rsp + 0x180], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
cmp byte [rsp + 0x167], 0
jns 0x1400ae691
mov rdi, qword [rsp + 0x150]
lea rcx, [rsp + 0x170]
lea rbx, [rsp + 0x130]
mov rdx, rdi
mov r8, rbx
call fcn.14002b2a0
test eax, eax
je 0x1400ae8fa
cmp byte [rsp + 0x147], 0
jns 0x1400ae6cb
mov rcx, qword [rsp + 0x130]
call fcn.14018039c
lea rax, [0x140269da0]
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1400ae704
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x178], 0
mov dword [rsp + 0x180], 0
mov rcx, qword [rsp + 0x188]
mov qword [rsp + 0x188], 0
test rcx, rcx
jne 0x1400af123
cmp byte [rsp + 0x167], 0
jns 0x1400ae738
mov rcx, qword [rsp + 0x150]
call fcn.14018039c
mov rcx, qword [0x1402acb58]
test rcx, rcx
jne 0x1400af18d
xor ecx, ecx
sub ecx, dword [0x1402acb48]
mov eax, 0xffffffff
cmovns eax, ecx
test eax, eax
jg 0x1400ae8b0
mov ecx, 0x28
call fcn.1401803a4
mov rdi, rax
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm0
lea rax, [0x14026b5b0]
mov qword [rdi], rax
mov r8, qword [rsp + 0x90]
mov rcx, rdi
mov rdx, r12
call fcn.1400af1f0
mov esi, eax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400ae7b4
movzx eax, byte [rdi + 0x27]
test al, al
js 0x1400af160
test rax, rax
je 0x1400ae824
test rdi, rdi
je 0x1400ae7d5
lea rax, [0x14026b5a0]
mov qword [rdi], rax
cmp byte [rdi + 0x27], 0
js 0x1400af17f
mov rcx, rdi
call fcn.14018039c
lea rax, [rsp + 0x70]
movzx edx, byte [rax + 0x17]
mov ecx, edx
and ecx, 0x7f
test dl, dl
cmovs rcx, qword [rax + 8]
cmovs rax, qword [rax]
test rcx, rcx
js 0x1400af169
test rax, rax
jne 0x1400ae805
test rcx, rcx
jne 0x1400af17c
cmp rcx, 5
je 0x1400ae845
cmp rcx, 7
jne 0x1400ae861
mov ecx, dword [rax]
xor ecx, dword [str.utility]
mov eax, dword [rax + 3]
xor eax, dword [0x14026f50c]
jmp 0x1400ae859
lea rdx, str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400af1b1
call qword [case.0x1401e9be0.0]
jmp 0x1400ae7b4
mov ecx, dword [rax]
xor ecx, dword [str.ppapi]
mov al, byte [rax + 4]
xor al, byte [0x14026f502]
movzx eax, al
or eax, ecx
je 0x1400aecb6
lea rcx, [rsp + 0x380]
call fcn.140071550
cmp byte [rsp + 0x87], 0
jns 0x1400ae882
mov rcx, qword [rsp + 0x70]
call fcn.14018039c
mov rcx, qword [rsp + 0x3c8]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x3d0]
add rsp, 0x3e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.....chrome_appchrome_exe_main_win.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, 0x184
mov r9d, 0xffffffff
call fcn.140004b00
lea rcx, [rsp + 0x180]
lea rdx, str.About_to_load_main_DLL.
mov r8d, 0x17
call fcn.1401bd290
mov rcx, rdi
call fcn.140004bf0
jmp 0x1400ae760
mov qword [rsp + 0x38], r12
lea rdi, [rsp + 0x110]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
lea rdx, [0x14026eeea]
lea r8, [rsp + 0xb8]
movzx eax, byte [rsp + 0x147]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rbx, qword [rsp + 0x130]
mov qword [r8], rdx
mov qword [r8 + 8], 1
lea rdx, [rsp + 0xa0]
mov qword [rdx], rbx
cmovs rcx, qword [rsp + 0x138]
mov qword [rdx + 8], rcx
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov r9d, 1
call fcn.14002bca0
lea r12, str.WIN95
mov r14, qword [rdi + 8]
lea r13, str.WIN95
jmp 0x1400aea25
mov rbx, rbp
jmp 0x1400ae992
mov r14, qword [rsp + 0x118]
mov rsi, r14
sub rsi, rbx
jb 0x1400af15a
je 0x1400aea18
mov rax, rbx
add rax, rsi
cmp rax, r14
je 0x1400aea08
cmp byte [rbx + 0x17], 0
jns 0x1400ae9b9
mov rcx, qword [rbx]
call fcn.14018039c
lea rax, [rbx + rsi]
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x10], rcx
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
lea rax, [rbx + rsi]
add rax, 0x18
mov byte [rax - 1], 0
mov word [rax - 0x18], 0
add rbx, 0x18
cmp rax, r14
jne 0x1400ae9ab
mov r14, qword [rsp + 0x118]
jmp 0x1400aea08
mov rcx, qword [r14 - 0x18]
call fcn.14018039c
jmp 0x1400aea04
cmp byte [r14 - 1], 0
js 0x1400ae9f2
add r14, 0xffffffffffffffe8
cmp r14, rbx
jne 0x1400ae9fd
mov qword [rsp + 0x118], rbx
mov r14, rbx
add r12, 8
cmp r12, r13
je 0x1400aeb50
mov rbp, qword [rsp + 0x110]
cmp rbp, r14
je 0x1400aea18
mov rdi, qword [r12]
test rdi, rdi
je 0x1400aecbd
mov rcx, rdi
call fcn.140180ff4
jmp 0x1400aea52
add rbp, 0x18
cmp rbp, r14
je 0x1400aea18
movzx edx, byte [rbp + 0x17]
test dl, dl
js 0x1400aea62
and edx, 0x7f
mov rcx, rbp
jmp 0x1400aea6a
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp]
test rdx, rdx
js 0x1400af14b
test rcx, rcx
jne 0x1400aea81
test rdx, rdx
jne 0x1400af154
cmp rdx, rax
jne 0x1400aea49
test rax, rax
je 0x1400aeaa1
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rdi + rdx*2]
jne 0x1400aea49
inc rdx
cmp rax, rdx
jne 0x1400aea8d
lea rax, [rbp + 0x18]
cmp rax, r14
je 0x1400ae985
mov rbx, rbp
jmp 0x1400aeaed
cmp byte [rbx + 0x17], 0
jns 0x1400aeac1
mov rcx, qword [rbx]
call fcn.14018039c
mov rax, qword [rbp + 0x10]
mov qword [rbx + 0x10], rax
movdqu xmm0, xmmword [rbp]
movdqu xmmword [rbx], xmm0
mov byte [rsi + 0x2f], 0
mov word [rbp], 0
add rbx, 0x18
lea rax, [rbp + 0x18]
cmp rax, r14
je 0x1400ae98a
mov rsi, rbp
mov rbp, rax
mov rcx, rdi
call fcn.140180ff4
movzx edx, byte [rsi + 0x2f]
test dl, dl
jns 0x1400aeb0d
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rbp]
jmp 0x1400aeb13
and edx, 0x7f
mov rcx, rbp
test rdx, rdx
js 0x1400af145
test rcx, rcx
jne 0x1400aeb2a
test rdx, rdx
jne 0x1400af148
cmp rdx, rax
jne 0x1400aeab3
test rax, rax
je 0x1400aeae0
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rdi + rdx*2]
jne 0x1400aeab3
inc rdx
cmp rax, rdx
jne 0x1400aeb36
jmp 0x1400aeae0
mov rax, qword [rsp + 0x110]
cmp rax, r14
je 0x1400aec30
lea rdi, [rsp + 0xf0]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
lea r8, [rsp + 0xe0]
lea rcx, [0x14026eeea]
mov qword [r8], rcx
mov qword [r8 + 8], 1
sub r14, rax
sar r14, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rcx, r14
lea rdx, [rsp + 0xd0]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, rdi
call fcn.14006ea40
cmp byte [rdi + 0x17], 0
jns 0x1400aebc4
mov rdi, qword [rsp + 0xf0]
cmp byte [rsp + 0x167], 0
mov r12, qword [rsp + 0x38]
js 0x1400aebdd
lea rbx, [rsp + 0x150]
jmp 0x1400aebe5
mov rbx, qword [rsp + 0x150]
mov rcx, rdi
call fcn.140180ff4
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x178]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [rsp + 0x107], 0
jns 0x1400aec5f
mov rcx, qword [rsp + 0xf0]
call fcn.14018039c
jmp 0x1400aec5f
cmp byte [rsp + 0x167], 0
js 0x1400aec44
lea rdx, [rsp + 0x150]
jmp 0x1400aec4c
mov rdx, qword [rsp + 0x150]
mov r12, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rsp + 0x110]
test rsi, rsi
je 0x1400ae6b4
mov rdi, qword [rsp + 0x118]
mov rcx, rsi
cmp rdi, rsi
jne 0x1400aec94
jmp 0x1400aeca4
mov rcx, qword [rdi - 0x18]
call fcn.14018039c
add rdi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x1400aec9c
cmp byte [rdi - 1], 0
jns 0x1400aec8b
jmp 0x1400aec82
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x118], rsi
call fcn.14018039c
jmp 0x1400ae6b4
mov ecx, esi
call fcn.1400b4ac0
int3
int3
lea rsi, [rsp + 0x170]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.1401851f0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400aecc0
pxor xmm0, xmm0
lea rsi, [rsp + 0x380]
movdqa xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
lea rbx, [rsp + 0x150]
mov qword [rbx + 0x10], rax
movdqa xmmword [rbx], xmm0
lea r12, [rsp + 0x130]
mov qword [r12 + 0x10], rax
movdqa xmmword [r12], xmm0
lea r14, [rsp + 0x110]
mov qword [r14 + 0x10], rax
movdqa xmmword [r14], xmm0
lea r15, [rsp + 0xf0]
lea rdx, [rsp + 0x170]
mov rcx, r15
call fcn.1401bf270
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, rsi
mov r8, rbx
mov r9, r14
call fcn.1400b6dc0
cmp byte [r15 + 0x17], 0
jns 0x1400aed7c
mov rcx, qword [rsp + 0xf0]
call fcn.14018039c
movzx eax, byte [rsp + 0x147]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs r12, qword [rsp + 0x130]
lea rdx, [rsp + 0xe0]
mov qword [rdx], r12
cmovs rcx, qword [rsp + 0x138]
mov qword [rdx + 8], rcx
lea r14, [rsp + 0xf0]
mov rcx, r14
call fcn.140145eb0
movzx eax, byte [rsp + 0x167]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rbx, qword [rsp + 0x150]
lea rdx, [rsp + 0xd0]
mov qword [rdx], rbx
cmovs rcx, qword [rsp + 0x158]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0xb8]
mov rcx, rbx
call fcn.140145eb0
movzx eax, byte [rsp + 0x397]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rsi, qword [rsp + 0x380]
lea rdx, [rsp + 0x90]
mov qword [rdx], rsi
cmovs rcx, qword [rsp + 0x388]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.140145eb0
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
mov r9, r14
call fcn.1401ef190
mov esi, eax
cmp byte [rsp + 0x127], 0
jns 0x1400aee66
mov rcx, qword [rsp + 0x110]
call fcn.14018039c
cmp byte [rsp + 0x147], 0
jns 0x1400aee7d
mov rcx, qword [rsp + 0x130]
call fcn.14018039c
cmp byte [rsp + 0x167], 0
jns 0x1400aee94
mov rcx, qword [rsp + 0x150]
call fcn.14018039c
cmp byte [rsp + 0x397], 0
jns 0x1400ae86e
mov rcx, qword [rsp + 0x380]
jmp 0x1400af119
mov rcx, rdi
call fcn.14001c920
lea rdx, str.no_periodic_tasks
mov rcx, rdi
call fcn.1400e7a70
test al, al
jne 0x1400af00e
lea rsi, [rsp + 0x170]
mov qword [rsi + 0x40], r15
pxor xmm0, xmm0
movdqa xmmword [rsi], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], 0xffffffffffffffff
mov qword [rsi + 0x38], 0
mov byte [rsi + 0x40], 0
lea rax, str.initial_client_data
lea r8, [rsp + 0x50]
mov qword [r8], rax
mov qword [r8 + 8], 0x13
lea r14, [rsp + 0x380]
mov rcx, rdi
mov rdx, r14
call fcn.140145be0
mov rcx, rsi
mov rdx, r14
call fcn.140053c70
mov ebx, eax
cmp byte [r14 + 0x17], 0
jns 0x1400aef4b
mov rcx, qword [rsp + 0x380]
call fcn.14018039c
test bl, bl
je 0x1400af00e
lea rsi, [rsp + 0x150]
mov qword [rsi], 0xffffffffffffffff
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
mov r14, qword [rsp + 0x1a8]
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov rcx, rax
mov rdx, r14
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400af00e
lea rsi, [rsp + 0x380]
movaps xmmword [rsi], xmm6
mov rdx, qword [rsp + 0x150]
mov rcx, rsi
call fcn.14006eb80
mov ecx, 0xa8
call fcn.1401803a4
mov rbx, rax
mov rcx, rax
call fcn.140065b40
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rsi
call fcn.1400314b0
mov rcx, rbx
mov rdx, r14
call fcn.14003b760
test al, al
je 0x1400aefff
mov rcx, rbx
call fcn.140024aa0
lea rcx, [rsp + 0x380]
call fcn.140031410
jmp 0x1400af010
xor ebx, ebx
lea rsi, [rsp + 0x380]
mov qword [rsi + 0x10], r15
movaps xmmword [rsi], xmm6
lea rax, str.user_data_dir
lea r8, [rsp + 0x130]
mov qword [r8], rax
mov qword [r8 + 8], 0xd
lea r14, [rsp + 0x170]
mov rcx, rdi
mov rdx, r14
call fcn.140162400
movzx eax, byte [r14 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r14]
cmovns rax, r14
lea rdx, [rsp + 0x150]
mov qword [rdx], rax
cmovs rcx, qword [r14 + 8]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.140109400
cmp byte [r14 + 0x17], 0
js 0x1400af0df
mov rcx, qword [0x1402acbd0]
lea r8, str.type
lea r9, str.user_data_dir
lea rdx, [rsp + 0x380]
call fcn.1400b7120
mov esi, eax
test rbx, rbx
je 0x1400af0ee
test esi, esi
je 0x1400af0ee
mov rcx, qword [rbx + 0xa0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400af0c6
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [rsp + 0x397], 0
jns 0x1400af10e
mov rcx, qword [rsp + 0x380]
call fcn.14018039c
jmp 0x1400af10e
mov rcx, qword [rsp + 0x170]
call fcn.14018039c
jmp 0x1400af082
cmp byte [rsp + 0x397], 0
jns 0x1400af105
mov rcx, qword [rsp + 0x380]
call fcn.14018039c
test rbx, rbx
je 0x1400ae86e
mov rcx, rbx
call fcn.140057310
mov rcx, rbx
call fcn.14018039c
jmp 0x1400ae86e
mov edx, 1
call fcn.14004e5c0
jmp 0x1400ae721
lea rcx, [rsp + 0x90]
call qword [case.0x1401e9be0.0]
jmp 0x1400ae3c5
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov rax, qword [rdi + 0x18]
jmp 0x1400ae7af
int3
mov rcx, rbx
call fcn.1400d8270
jmp 0x1400ae415
int3
int3
mov rcx, qword [rdi + 0x10]
call fcn.14018039c
jmp 0x1400ae7cd
lea rax, str.....chrome_appchrome_exe_main_win.cc
lea rdx, [rsp + 0x170]
mov qword [rdx], rax
mov qword [rdx + 8], 0x27
call fcn.1401f8cf0
jmp 0x1400ae758
int3
mov rcx, qword [0x1402ac9c8]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x1400ae3bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ae64b