Function at 0x1400018c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov r14, r8
mov rbp, rdx
mov r13d, ecx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x58]
mov dl, 1
call qword [method.mozilla::TimeStamp.Now_bool_]
lea rcx, [rsp + 0x38]
call qword [method.mozilla::baseprofiler.profiler_init_void_]
call qword [method.mozilla::baseprofiler::AutoProfilerLabel.GetProfilingStack__]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000195c
mov rbx, rax
mov esi, dword [rax + 0x10]
cmp esi, dword [rax]
jae 0x140001f19
mov rax, qword [rbx + 8]
lea rcx, [rsi + rsi*4]
lea rdx, str.nsBrowserApp_main
mov qword [rax + rcx*8], rdx
mov qword [rax + rcx*8 + 8], 0
lea rdx, [rsp + 0x30]
mov qword [rax + rcx*8 + 0x10], rdx
mov dword [rax + rcx*8 + 0x24], 0x10001
add dword [rbx + 0x10], 1
cmp r13d, 2
jl 0x140001988
lea rbx, [rbp + 8]
mov rax, qword [rbp + 8]
mov cl, byte [rax]
cmp cl, 0x2f
je 0x140001999
cmp cl, 0x2d
jne 0x1400019b1
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
jmp 0x1400019a0
mov ecx, dword [0x140153508]
call qword [sym.imp.mozglue.dll_DllBlocklist_Initialize_unsigned_int_]
jmp 0x140001bbc
add rax, 1
mov rcx, rax
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400019e9
mov ecx, dword [0x140153508]
call qword [sym.imp.mozglue.dll_DllBlocklist_Initialize_unsigned_int_]
mov rax, qword [rbx]
mov cl, byte [rax]
cmp cl, 0x2f
je 0x140001b8c
cmp cl, 0x2d
jne 0x140001bbc
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
jmp 0x140001b93
mov ecx, dword [0x140153508]
or ecx, 1
call qword [sym.imp.mozglue.dll_DllBlocklist_Initialize_unsigned_int_]
mov rax, qword [rbx]
test rax, rax
je 0x140001ab6
mov qword [rsp + 0x28], rbp
lea rsi, [rbp + 0x10]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea r14, str.win32klockeddown
jmp 0x140001a31
mov rax, qword [rbx + 8]
add rbx, 8
add rsi, 8
test rax, rax
je 0x140001aaa
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x140001a20
lea rbp, [rax + 1]
lea rcx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rbp, rcx
mov r12b, 0x77
xor r15d, r15d
nop word cs:[rax + rax]
nop dword [rax + rax]
movsx ecx, byte [rbp + r15]
test ecx, ecx
je 0x140001a20
call rdi
movsx eax, al
movsx ecx, r12b
cmp eax, ecx
jne 0x140001a20
movzx r12d, byte [r15 + r14 + 1]
add r15, 1
test r12b, r12b
jne 0x140001a60
cmp byte [rbp + r15], 0
jne 0x140001a20
nop
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x140001a90
add r13d, 0xffffffff
call qword [method.mozilla.SetWin32kLockedDownInPolicy__]
mov r15, qword [0x1400f7448]
mov rbp, qword [rsp + 0x28]
call sym.firefox.exe_IsSandboxedProcess
test al, al
je 0x140001acd
call fcn.140071180
test rax, rax
je 0x140001dc6
call qword [method.mozilla.WindowsDpiInitialization__]
xor ecx, ecx
call fcn.140002130
test eax, eax
js 0x140001f12
mov rbx, qword [0x140153510]
test r13d, r13d
jle 0x140001db3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
call sym.firefox.exe_IsSandboxedProcess
test al, al
je 0x140001b37
call fcn.140071180
mov qword [rsp + 0x90], rax
test rax, rax
je 0x140001f08
lea rax, [0x14001e1d0]
mov qword [rsp + 0x98], rax
add r13d, 0xffffffff
mov rdx, qword [rbp + r13*8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
cmp eax, 9
jne 0x140001b64
call fcn.140071310
mov qword [rsp + 0xa0], rax
mov rax, qword [rbx]
lea r9, [rsp + 0x90]
mov rcx, rbx
mov edx, r13d
mov r8, rbp
call qword [rax + 0x60]
mov esi, eax
shr esi, 0x1f
mov rbx, qword [0x140153510]
jmp 0x140001db8
add rax, 1
mov rcx, rax
lea rdx, str.silentmode
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140001bbc
lea rcx, str.MOZ_APP_SILENT_START1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
lea rcx, str.MOZ_APP_ALLOW_WINDOWLESS1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
call qword [method.mozilla.WindowsDpiInitialization__]
call fcn.140016e50
mov rcx, qword [0x1400f7440]
call sub.ntdll.dll_RtlRunOnceInitialize
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, r13d
mov r8, rbp
call qword [method.mozilla.CreateAndStorePreXULSkeletonUI_HINSTANCE____int__char_]
mov ecx, 1
call fcn.140002130
test eax, eax
js 0x140001f12
mov rcx, qword [0x140153510]
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 1
call qword [rax + 0x30]
mov rcx, qword [0x140153510]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov dword [rsp + 0x3c], r13d
lea rcx, str.XUL_APP_FILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rbx, rax
test rax, rax
je 0x140001c6c
mov al, byte [rbx]
cmp r13d, 2
jl 0x140001c59
test al, al
je 0x140001c76
cmp r13d, 1
jg 0x140001cb4
test al, al
jne 0x140001d01
jmp 0x140001dfa
cmp r13d, 1
jle 0x140001dfa
mov rax, qword [rbp + 8]
mov cl, byte [rax]
cmp cl, 0x2f
je 0x140001c98
cmp cl, 0x2d
jne 0x140001cb4
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
jmp 0x140001c9f
add rax, 1
mov rcx, rax
lea rdx, [0x1400f7355]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001d56
mov rax, qword [rbp + 8]
mov cl, byte [rax]
cmp cl, 0x2f
je 0x140001cd6
cmp cl, 0x2d
jne 0x140001cee
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
jmp 0x140001cdd
add rax, 1
mov rcx, rax
lea rdx, str.xpcshell
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001d08
test rbx, rbx
je 0x140001dfa
mov al, byte [rbx]
test al, al
je 0x140001dfa
xor eax, eax
jmp 0x140001e08
lea rcx, [rbp + 8]
lea rdx, [rbp + 0x10]
add r13d, 0xffffffff
lea r8, [r13*8]
call sub.ntdll.dll_memmove
call fcn.140071310
mov qword [rsp + 0x90], rax
mov rcx, qword [0x140153510]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rdx
mov edx, r13d
mov r8, rbp
mov r9, r14
call qword [rax + 0x48]
jmp 0x140001e83
cmp r13d, 2
jne 0x140001d68
lea rcx, str.Incorrect_number_of_arguments_passed_to__app
jmp 0x140001e8e
mov rbx, qword [rbp + 0x10]
lea rdx, str.XUL_APP_FILE_s
lea r14, [rsp + 0x90]
mov rcx, r14
mov r8, rbx
call fcn.1400022e0
mov rcx, r14
call sub.mozglue.dll_strdup
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
test eax, eax
je 0x140001ddc
lea rcx, str.Couldnt_set__s._n
lea rdx, [rsp + 0x90]
call fcn.140002020
jmp 0x140001e93
mov esi, 3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
jmp 0x140001ec8
lea rcx, str.Failed_to_initialize_the_sandbox_target_services.
call fcn.140002020
mov esi, 0xff
jmp 0x140001ec8
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
add rbp, 0x10
add r13d, 0xfffffffe
mov dword [rsp + 0x3c], r13d
test rbx, rbx
jne 0x140001cf7
lea rbx, str.browser
lea rax, str.Mozilla
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
call fcn.140071310
mov rdi, rax
call fcn.1400713f0
test rdi, rdi
je 0x140001e87
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rax
mov rax, qword [0x1400f7410]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1400f7400]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x3c]
lea r8, [rsp + 0x70]
mov rdx, rbp
call fcn.1400023a0
mov rcx, qword [0x140153510]
mov edx, dword [rsp + 0x3c]
mov rax, qword [rcx]
lea r9, [rsp + 0x90]
mov r8, rbp
call qword [rax + 0x38]
mov esi, eax
jmp 0x140001e98
lea rcx, str.Couldnt_initialize_the_broker_services._n
call fcn.140002020
mov esi, 0xff
call qword [method.mozilla.CleanupProcessRuntime__]
mov rcx, qword [0x140153510]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x140153510]
mov qword [0x140153510], 0
test rcx, rcx
je 0x140001ec8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140001ed9
add dword [rax + 0x10], 0xffffffff
call qword [method.mozilla::baseprofiler.profiler_shutdown__]
mov rax, qword [rsp + 0x1a0]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140001f27
mov eax, esi
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 1
jmp 0x140001b80
mov esi, 0xff
jmp 0x140001ec8
mov rcx, rbx
call qword [method.mozilla::baseprofiler::ProfilingStack.ensureCapacitySlow__]
jmp 0x140001927
call fcn.1400763e0
int3