Function at 0x140036900
Capabilities:
Check os version
Create process on windows
Get common file path
Load assembly via iassembly
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7f8
movaps xmmword [rsp + 0x7e0], xmm6
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x7d8], rax
movsxd rax, dword [rcx]
cmp rax, 0xb
ja 0x140036989
lea rcx, [0x14006aff0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x360], 0
mov qword [rsp + 0x368], 0xf
mov byte [rsp + 0x350], 0
mov r9, qword [rax]
mov rdi, qword [rax + 8]
lea rcx, [rsp + 0x350]
cmp rdi, 0xf
jbe 0x1400369ab
mov rdx, rdi
call fcn.1400011a0
jmp 0x1400369c2
mov qword [rsp + 0x368], 0xf
mov qword [rsp + 0x360], 0
mov byte [rsp + 0x350], 0
jmp 0x1400369c2
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x350], 0
mov rbx, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x1400369d0
mov rsi, qword [rsi]
cmp rbx, 0xf
ja 0x140037284
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x330], xmm0
mov r12d, 0xf
mov qword [rsp + 0x340], rbx
mov qword [rsp + 0x348], r12
cmp dword [r14], 0
mov qword [rsp + 0x328], 0xf
je 0x140036a37
mov qword [rsp + 0x320], 8
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x310], rax
mov byte [rsp + 0x318], 0
jmp 0x140036a61
mov qword [rsp + 0x320], 7
mov dword [rsp + 0x310], 0x74696e69
mov dword [rsp + 0x313], 0x6c616974
mov byte [rsp + 0x317], 0
mov eax, dword [r14 + 4]
cmp eax, 2
je 0x140036a9c
cmp eax, 1
jne 0x140036ace
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 5
mov dword [rsp + 0x2f0], 0x776f6873
mov byte [rsp + 0x2f4], 0x6e
jmp 0x140036ac7
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 5
mov dword [rsp + 0x2f0], 0x6f727265
mov byte [rsp + 0x2f4], 0x72
mov eax, 5
jmp 0x140036b05
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2f0], rax
mov byte [rsp + 0x2f8], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x2f0], 0
mov edx, dword [r14 + 8]
lea rcx, [rsp + 0x2d0]
call fcn.140031990
lea rsi, [rsp + 0x4b4]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140036ecd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSVersion
mov edx, edi
mov r9d, 0x59
call fcn.14002cd80
test edi, edi
jne 0x140036da4
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x68], rbx
xor ebx, ebx
xor r15d, r15d
xor edi, edi
xor r13d, r13d
mov qword [rsp + 0x2b0], r13
mov qword [rsp + 0x2b8], rdi
mov qword [rsp + 0x2c0], r15
mov qword [rsp + 0x2c8], rbx
lea rsi, [rsp + 0x4b0]
mov r8d, 0xaa
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x140036d63
lea rsi, [rsp + 0x370]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.140032220
cmp dword [rsi + 0x20], 0
jne 0x140039aeb
mov rcx, qword [rsp + 0x370]
mov rax, qword [rsp + 0x378]
mov rdx, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x388]
mov byte [rsp + 0x370], 0
mov qword [rsp + 0x380], 0
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rax
mov r15, rdx
mov qword [rsp + 0x2a0], rdx
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x288], 0xf
mov byte [rsp + 0x270], 0
lea r8, str.PrevNotificationAction
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov edx, 1
xor r9d, r9d
call fcn.14002f6b0
lea rdx, [rsp + 0x4d8]
mov edi, dword [rdx]
test edi, edi
je 0x1400372f2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x186
call fcn.14002ce90
cmp dword [rsp + 0x4d8], 0
jne 0x140036d1b
cmp byte [rsp + 0x4d0], 0
je 0x140036d1b
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
jae 0x1400372cf
test edi, edi
jns 0x140037400
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
mov rbx, qword [rsp + 0xb8]
jae 0x140037261
cmp rsi, 0x10
jb 0x140036d9a
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jae 0x14003b9c8
mov rcx, qword [rsp + 0xb0]
call fcn.140057540
jmp 0x140036d9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSLocale
mov edx, edi
mov r9d, 0x61
call fcn.14002cd80
test edi, edi
je 0x140037226
cmp rbx, 0x10
jae 0x140037243
mov rax, qword [rsp + 0x2e8]
cmp rax, 0x10
jae 0x140036e1c
mov rax, qword [rsp + 0x308]
cmp rax, 0x10
jae 0x140036e3f
mov rax, qword [rsp + 0x328]
cmp rax, 0x10
jae 0x140036e62
cmp r12, 0x10
jae 0x140036e85
mov rax, qword [rsp + 0x368]
cmp rax, 0x10
jae 0x140036eaa
mov rcx, qword [rsp + 0x7d8]
xor rcx, rsp
call fcn.140058660
mov eax, edi
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b88b
call fcn.140057540
jmp 0x140036db2
mov rcx, qword [rsp + 0x2f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b8af
call fcn.140057540
jmp 0x140036dc0
mov rcx, qword [rsp + 0x310]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b8d3
call fcn.140057540
jmp 0x140036dd2
mov rcx, qword [rsp + 0x330]
cmp r12, 0xfff
jae 0x14003b86a
inc r12
mov rdx, r12
call fcn.140057540
jmp 0x140036ddc
mov rcx, qword [rsp + 0x350]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b8f7
call fcn.140057540
jmp 0x140036dee
mov qword [rsp + 0x60], r12
lea rax, [0x14006afd0]
lea rsi, [rsp + 0x3f8]
mov qword [rsi - 0x88], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006afd8]
mov qword [rsi], rax
mov rax, qword [rsi - 0x88]
movsxd rax, dword [rax + 4]
lea r15, [0x14006afc8]
mov qword [rsp + rax + 0x370], r15
mov rax, qword [rsi - 0x88]
movsxd rax, dword [rax + 4]
mov edi, 0xffffff78
lea ecx, [rax + rdi]
mov dword [rsp + rax + 0x36c], ecx
lea rsi, [rsp + 0x378]
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006afe8]
mov qword [rsp + rax + 0x370], rcx
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x36c], ecx
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x370
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x370], r15
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
add edi, eax
mov dword [rsp + rax + 0x36c], edi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006af50]
mov qword [rsi], rax
mov qword [rsi + 0x68], 0
mov dword [rsi + 0x70], 4
mov edx, dword [rsp + 0x4b4]
mov r12, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x370]
call r12
lea rdi, [0x1400a1246]
mov rcx, rax
mov rdx, rdi
call fcn.14005b230
mov edx, dword [rsp + 0x4b8]
mov rcx, rax
call r12
mov rcx, rax
mov rdx, rdi
call fcn.14005b230
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call r12
cmp dword [rsp + 0x4b4], 0xa
jne 0x140037078
cmp dword [rsp + 0x4b8], 0
jne 0x140037078
lea rax, [rsp + 0x238]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x728]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a357c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140037867
mov qword [rsp + 0x738], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov eax, dword [rsp + 0x3e8]
test al, 2
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0xa8], rbp
jne 0x140038eec
mov rcx, qword [rsp + 0x3b8]
mov rdi, qword [rcx]
test rdi, rdi
je 0x140038eec
mov rax, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x3e0]
mov r9, qword [rax]
cmp rdi, rcx
cmovb rdi, rcx
sub rdi, r9
cmp rdi, 0xf
mov r12, qword [rsp + 0x60]
lea rcx, [rsp + 0x728]
jbe 0x140037890
mov rdx, rdi
call fcn.1400011a0
mov r13, qword [rsp + 0x728]
mov rdi, qword [rsp + 0x730]
mov r15, qword [rsp + 0x738]
mov rbx, qword [rsp + 0x740]
mov rax, qword [rsp + 0x370]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006afc8]
mov qword [rsp + rax + 0x370], rcx
mov rax, qword [rsp + 0x370]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x36c], ecx
lea rax, [0x14006af50]
mov qword [rsp + 0x378], rax
test byte [rsp + 0x3e8], 1
je 0x1400371b8
mov rax, qword [rsp + 0x3b8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b98d
mov rcx, qword [rsp + rcx + 0x370]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x390]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b9a2
call fcn.140057540
mov rax, qword [rsp + 0x390]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x398]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3d0]
mov dword [rax], ecx
mov qword [rsp + 0x3e0], rcx
and byte [rsp + 0x3e8], 0xfe
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x3f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x140036ba1
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xb8], rbx
xor esi, esi
xor edx, edx
xor eax, eax
xor ecx, ecx
jmp 0x140036c55
lea rdx, [rbx + 1]
cmp rdx, 0x1000
jae 0x14003b969
mov rcx, r13
call fcn.140057540
jmp 0x140036da4
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b9f9
call fcn.140057540
jmp 0x140036d3d
mov r12, rbx
or r12, 0xf
movabs rax, 0x7fffffffffffffff
cmp r12, rax
cmovae r12, rax
cmp r12, 0xfff
jae 0x140038e83
lea rcx, [r12 + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x330], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400369ed
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003ba1d
call fcn.140057540
jmp 0x140036d1b
mov qword [rsp + 0x58], rsi
lea rsi, [rsp + 0x398]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
je 0x1400376a7
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x370]
mov rcx, qword [rax]
mov rbx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
cmp rdx, 0x10
mov r12, rax
cmovae r12, rcx
cmp rbx, 0xf
ja 0x140038e9e
cmp rdx, 0x10
mov rsi, qword [r12]
cmovae rax, rcx
mov rax, qword [rax + 8]
mov ecx, 0xf
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rcx
cmp rbx, 0x14
mov r12, qword [rsp + 0x60]
jne 0x14003ba41
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movd xmm1, dword [rax + 0x10]
pcmpeqb xmm1, xmmword [0x14006ac40]
pcmpeqb xmm0, xmmword [str.dismissed_by_tim]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400376e1
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovb rsi, rax
mov qword [rax + 0x10], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rsi], rax
mov word [rsi + 8], 0x6e
jmp 0x1400376e1
cmp dword [r14 + 4], 1
jne 0x140037485
mov rdi, rsi
mov edx, dword [r14 + 8]
mov rcx, rbp
call fcn.140031990
cmp qword [rsp + 0x4c8], 0x10
jb 0x140037429
mov rbp, qword [rsp + 0x4b0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x370]
mov rcx, rsi
mov r8, rbp
xor r9d, r9d
call fcn.14002ebb0
mov eax, dword [rsi]
test eax, eax
je 0x140037470
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x1a5
call fcn.14002ce90
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
mov rsi, rdi
jae 0x1400378ac
mov qword [rsp + 0x58], rsi
lea rsi, [rsp + 0x238]
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.14005b130
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x140037818
lea rdx, [rax + 8]
mov qword [rsp + 0x248], rdx
cmp rcx, 8
jb 0x1400374ed
mov rsi, qword [rsp + 0x238]
movdqu xmm0, xmmword [str._version]
movdqu xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4c8], 7
mov qword [rsp + 0x4c0], 1
mov dword [rsp + 0x4b0], 0x32
mov rax, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
cmp rcx, rax
mov rsi, qword [rsp + 0x58]
je 0x14003783f
lea rdx, [rax + 1]
mov qword [rsp + 0x248], rdx
cmp rcx, 8
jb 0x14003755e
mov rcx, qword [rsp + 0x238]
jmp 0x140037566
lea rcx, [rsp + 0x238]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x1400375a3
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140039d77
call fcn.140057540
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x260], 2
mov dword [rsp + 0x268], 0
lea rcx, [0x1400a0205]
lea rdx, str.DisableTelemetry
call fcn.140031b10
test al, al
je 0x14003761b
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
call fcn.140035ba0
mov edi, eax
jmp 0x140037666
lea r8, str.LastPingSentAt
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov edx, 1
call fcn.1400327e0
mov edi, dword [rbp + 0x10]
test edi, edi
je 0x140037729
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x108
call fcn.14002ce90
mov rax, qword [rsp + 0x250]
cmp rax, 8
mov r13, qword [rsp + 0x98]
jb 0x140036d23
mov rcx, qword [rsp + 0x238]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140039da3
call fcn.140057540
jmp 0x140036d23
mov byte [rsp + 0x270], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x271], rax
mov byte [rsp + 0x279], 0
mov qword [rsp + 0x280], 9
mov qword [rsp + 0x288], 0xf
cmp byte [rsp + 0x390], 0
mov rsi, qword [rsp + 0x58]
je 0x140036cf5
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jb 0x140036cf5
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc01
call fcn.140057540
jmp 0x140036cf5
mov rdi, qword [rsp + 0x4b0]
mov bl, byte [rsp + 0x4b8]
lea rsi, [rsp + 0x370]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rsi, qword [rsi]
test bl, bl
je 0x140037785
mov rax, rsi
test rsi, rsi
jne 0x14003776c
lea rbx, [rsp + 0x370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x1400378cf
shr rax, 9
cmp rax, 0x6388fc53
jb 0x1400378cf
lea rdx, str.LastPingSentAt
lea r13, [rsp + 0x370]
mov rcx, r13
mov r8, rsi
call fcn.1400329f0
cmp dword [r13], 0
je 0x1400377ce
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x118
call fcn.14002ce90
lea rcx, [rsp + 0x238]
lea rsi, [rsp + 0x480]
mov rdx, rsi
call fcn.14002d040
mov edi, dword [rsi]
test edi, edi
je 0x14003790d
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], edi
mov rsi, qword [rsp + 0x58]
jmp 0x140039014
mov qword [rsp + 0x20], 8
lea r9, str._version
lea rcx, [rsp + 0x238]
mov edx, 8
call fcn.14005afe0
jmp 0x140037501
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
lea r9, [rsp + 0x4b0]
mov edx, 1
call fcn.14005afe0
jmp 0x140037573
lea rdx, [0x1400a1246]
lea rcx, [rsp + 0x370]
call fcn.14005b230
mov edx, dword [rsp + 0x728]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140037078
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x728], 0
jmp 0x140037104
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc2a
call fcn.140057540
jmp 0x140037485
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
call fcn.140035ba0
mov edi, eax
mov rsi, qword [rsp + 0x58]
jmp 0x140037666
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x238]
mov r8d, dword [rcx + 0x2c]
lea rbx, [rsp + 0x7b8]
mov rdx, rbx
call fcn.14002e990
mov eax, 0x90
lea rcx, [rax + r13]
mov qword [rsp + 0xa0], rcx
add rax, rbp
mov qword [rsp + 0x70], rax
xorps xmm6, xmm6
xor r12d, r12d
mov r14d, 0xf
xor esi, esi
cmp dword [rsp + 0x268], 0
je 0x140038f48
mov qword [rsp + 0x740], r12
mov qword [rsp + 0x748], r14
mov byte [rsp + 0x730], r12b
mov qword [rsp + 0x760], r12
mov qword [rsp + 0x768], r14
mov byte [rsp + 0x750], r12b
mov qword [rsp + 0x780], r12
mov qword [rsp + 0x788], r14
mov byte [rsp + 0x770], r12b
mov byte [rsp + 0x7b0], r12b
cmp qword [rsp + 0x7d0], 8
mov r8, rbx
jb 0x1400379c9
mov r8, qword [rsp + 0x7b8]
mov rcx, r13
lea rdx, str.CacheEntryVersion
call fcn.14002dc10
mov edi, dword [rsp + 0x378]
test edi, edi
je 0x140037b22
cmp qword [rsp + 0x7d0], 8
jb 0x1400379fa
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rbx
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b4
call fcn.14002ce90
mov r8d, 0xa0
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], edi
mov ebx, 1
cmp byte [rsp + 0x7b0], 0
je 0x140037a87
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x140037ebf
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x140037ded
mov qword [rsp + 0x780], 0
mov qword [rsp + 0x788], 0xf
mov byte [rsp + 0x770], 0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x140037e10
mov qword [rsp + 0x760], 0
mov qword [rsp + 0x768], 0xf
mov byte [rsp + 0x750], 0
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x140037e33
cmp ebx, 4
jne 0x140038fcb
inc esi
cmp esi, dword [rsp + 0x260]
lea rbx, [rsp + 0x7b8]
jbe 0x140037955
jmp 0x140038f89
mov rax, qword [rsp + 0x370]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x140037d88
mov dword [rsp + 0x728], eax
test eax, eax
je 0x140037e56
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x6f0]
mov r8, rbx
lea r9, str.NotificationType
call fcn.14002f440
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x140037a2f
movaps xmmword [rsp + 0x6d0], xmm6
movaps xmmword [rsp + 0x6c0], xmm6
mov byte [rsp + 0x6e0], 0
lea rcx, [rsp + 0x6e8]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
mov ebx, 4
cmp byte [rsp + 0x6e0], 0
je 0x140037d37
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x14003876f
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xd0], rax
mov eax, 0xf
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x140037ee2
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x730], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x738], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x748], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a20bc]
call fcn.14002f440
cmp dword [rsp + 0x718], 0
jne 0x140037ce9
cmp byte [rsp + 0x710], 0
je 0x140037ce9
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x140037f28
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
je 0x140037f4b
mov r8d, 0xa0
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], edi
mov ebx, 1
cmp byte [rsp + 0x6e0], 0
je 0x140037d37
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
jae 0x140037f05
cmp dword [rsp + 0x718], 0
jne 0x140037a4b
cmp byte [rsp + 0x710], 0
je 0x140037a4b
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jb 0x140037a4b
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038b17
call fcn.140057540
jmp 0x140037a4b
cmp qword [rsp + 0x7d0], 8
jb 0x140037d9b
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rbx
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1ba
call fcn.14002ce90
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x6f0]
call fcn.14002f320
mov edi, dword [rsp + 0x6f0]
jmp 0x140037ead
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038a19
call fcn.140057540
jmp 0x140037a99
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038a3d
call fcn.140057540
jmp 0x140037acb
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038a61
call fcn.140057540
jmp 0x140037afd
cmp qword [rsp + 0x7d0], 8
jb 0x140037e69
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x207
call fcn.14002ce90
lea rcx, [rsp + 0x238]
mov rdx, r13
call fcn.14002f320
mov edi, dword [rsp + 0x370]
test edi, edi
jne 0x140037a2f
mov ebx, 4
jmp 0x140037a4b
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038a85
call fcn.140057540
jmp 0x140037a67
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038af3
call fcn.140057540
jmp 0x140037c45
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038b3b
call fcn.140057540
jmp 0x140037d37
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038b5f
call fcn.140057540
jmp 0x140037cc9
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005b4d0
cmp dword [rsp + 0x398], 0
jne 0x140037f9e
cmp byte [rsp + 0x390], 0
je 0x140037f9e
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x1400387d0
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x140037cff
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005b540
cmp byte [rsp + 0x390], 0
je 0x140038006
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038817
cmp byte [rsp + 0x6e0], 0
je 0x140037d37
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x140038880
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
mov eax, 0xf
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003883a
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x750], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x758], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x768], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a2136]
call fcn.14002f440
cmp dword [rsp + 0x718], 0
jne 0x140038142
cmp byte [rsp + 0x710], 0
je 0x140038142
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x14003885d
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
jne 0x140037cff
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005b4d0
cmp dword [rsp + 0x398], 0
jne 0x1400381ab
cmp byte [rsp + 0x390], 0
je 0x1400381ab
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x1400388e1
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x140037cff
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005b540
cmp byte [rsp + 0x390], 0
je 0x140038213
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038928
cmp byte [rsp + 0x6e0], 0
je 0x140037d37
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x140038991
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0], rax
mov eax, 0xf
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003894b
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x770], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x778], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x780], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x788], rax
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x50], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, str.PrevNotificationAction
call fcn.14002f440
cmp dword [rsp + 0x718], 0
jne 0x14003835d
cmp byte [rsp + 0x710], 0
je 0x14003835d
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x14003896e
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
jne 0x140037cff
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005b4d0
cmp dword [rsp + 0x398], 0
jne 0x1400383c6
cmp byte [rsp + 0x390], 0
je 0x1400383c6
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x1400389f6
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x140037cff
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005b540
cmp byte [rsp + 0x390], 0
je 0x14003842e
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038ad0
cmp dword [rsp + 0x50], 2
jb 0x140038443
cmp byte [rsp + 0x6e0], 0
je 0x140037d37
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x6c0]
call fcn.14005b5e0
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x460]
call fcn.14002f320
mov edi, dword [rsp + 0x460]
test edi, edi
jne 0x140037cff
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x370], eax
lea rax, [rsp + 0x398]
movups xmmword [rax - 0x10], xmm6
cmp qword [rsp + 0x748], 0x10
lea rax, [rsp + 0x730]
mov qword [rsp + 0x50], rax
jb 0x1400384bb
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x740]
cmp rdi, 0xf
ja 0x140038b83
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax - 0x20], xmm0
mov ebx, 0xf
mov qword [rsp + 0x388], rdi
mov qword [rsp + 0x390], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x10], xmm6
mov rdi, qword [rsp + 0x760]
cmp qword [rsp + 0x768], 0x10
lea rax, [rsp + 0x750]
mov qword [rsp + 0x50], rax
jb 0x140038531
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x50], rax
cmp rdi, 0xf
ja 0x140038bcf
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3a8], rdi
mov qword [rsp + 0x3b0], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x30], xmm6
mov rdi, qword [rsp + 0x780]
cmp qword [rsp + 0x788], 0x10
lea rax, [rsp + 0x770]
mov qword [rsp + 0x50], rax
jb 0x14003859e
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x50], rax
cmp rdi, 0xf
ja 0x140038c1b
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax + 0x20], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
mov byte [rax + 0x60], 0
cmp byte [rsp + 0x7b0], 0
je 0x140038667
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x50], xmm6
cmp qword [rsp + 0x7a8], 0x10
lea rax, [rsp + 0x790]
mov qword [rsp + 0x50], rax
jb 0x140038622
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x7a0]
cmp rdi, 0xf
ja 0x140038c8b
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax + 0x40], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3e8], rdi
mov qword [rsp + 0x3f0], rbx
mov byte [rsp + 0x3f8], 1
mov bl, 1
mov byte [rsp + 0x400], bl
mov r8d, 0x91
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x370]
mov dword [rsp + 0x4b0], eax
lea rdx, [rsp + 0x398]
movups xmm0, xmmword [rdx - 0x20]
movups xmm1, xmmword [rdx - 0x10]
lea rcx, [rsp + 0x4b8]
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov qword [rsp + 0x388], r12
mov qword [rsp + 0x390], r14
mov byte [rsp + 0x378], r12b
lea rax, [rsp + 0x398]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x4d8]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x3a8], r12
mov qword [rsp + 0x3b0], r14
mov byte [rsp + 0x398], r12b
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
movdqu xmmword [rcx + 0x40], xmm0
movdqu xmmword [rcx + 0x50], xmm1
mov qword [rsp + 0x3c8], r12
mov qword [rsp + 0x3d0], r14
mov byte [rsp + 0x3b8], r12b
movups xmmword [rcx + 0x60], xmm6
movups xmmword [rcx + 0x70], xmm6
mov byte [rcx + 0x80], r12b
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xa0]
call fcn.14005b4d0
mov byte [rsp + 0x540], bl
mov rcx, r13
call fcn.14003e240
mov dword [rsp + 0x550], 0
mov rcx, r13
call fcn.14002fd10
jmp 0x140037d16
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jae 0x1400387f3
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140057550
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140037c33
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038c67
call fcn.140057540
jmp 0x140037f9e
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x78], rcx
mov qword [rcx - 8], rax
jmp 0x1400387b0
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038cd7
call fcn.140057540
jmp 0x140038006
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038cfb
call fcn.140057540
jmp 0x14003809e
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038d1f
call fcn.140057540
jmp 0x140038122
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jae 0x140038904
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140057550
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003808c
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038dab
call fcn.140057540
jmp 0x1400381ab
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x78], rcx
mov qword [rcx - 8], rax
jmp 0x1400388c1
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038dcf
call fcn.140057540
jmp 0x140038213
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038df3
call fcn.140057540
jmp 0x1400382ab
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038e17
call fcn.140057540
jmp 0x14003833d
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x78], rcx
cmp rcx, 0xfff
jae 0x140038aa9
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 1]
call fcn.140057550
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038299
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038e3b
call fcn.140057540
jmp 0x1400383c6
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037e06
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037e29
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037e4c
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037ed8
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x80], rcx
mov qword [rcx - 8], rax
jmp 0x1400389d3
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038e5f
call fcn.140057540
jmp 0x14003842e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037efb
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037d7e
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037f1e
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140037f41
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140038d43
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x378], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400384e8
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140038d5d
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x398], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038555
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140038d77
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x3b8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400385c3
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400387e9
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140038d91
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x3d8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003864f
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038830
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038853
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038876
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038bb4
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038c00
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038c4c
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038cbc
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400388fa
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038941
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038964
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038987
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038a0f
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038ae9
lea rcx, [r12 + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400372b6
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0x70], rcx
jae 0x14003a84d
inc rcx
call fcn.140057550
mov rsi, rax
lea r8, [rbx + 1]
mov rcx, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x70]
jmp 0x140037365
test al, 4
mov r12, qword [rsp + 0x60]
jne 0x140037104
mov rax, qword [rsp + 0x3b0]
mov rdi, qword [rax]
test rdi, rdi
je 0x140037104
mov rax, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x3c8]
mov r9, qword [rax]
movsxd rax, dword [rcx]
add rdi, rax
sub rdi, r9
lea rcx, [rsp + 0x728]
cmp rdi, 0xf
jbe 0x14003bc51
mov rdx, rdi
call fcn.1400011a0
jmp 0x14003bc68
lea rsi, [rsp + 0x370]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x4b0]
mov dword [rcx + 0xa0], 0
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
call fcn.14002fd10
jmp 0x140038fcb
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24b
call fcn.14002ce90
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jb 0x140039005
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a927
call fcn.140057540
mov edi, dword [rsp + 0x550]
test edi, edi
je 0x140039138
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x16b
call fcn.14002ce90
cmp dword [rsp + 0x550], 0
jne 0x14003904f
lea rcx, [rsp + 0x4b0]
call fcn.14002fd10
test edi, edi
js 0x140037666
mov rax, qword [rsp + 0xa8]
movsxd rbx, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov edx, 1
xor r9d, r9d
call fcn.14002f6b0
mov edi, dword [rsi + 0x28]
test edi, edi
je 0x140039b27
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002ce90
xor ecx, ecx
xor r13d, r13d
xor ebp, ebp
xor r14d, r14d
cmp dword [rsp + 0x4d8], 0
mov rsi, qword [rsp + 0x58]
jne 0x1400390e6
cmp byte [rsp + 0x4d0], 0
je 0x1400390e6
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
jae 0x140039af9
test edi, edi
jne 0x140037666
mov qword [rsp + 0x218], rcx
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], rbp
mov qword [rsp + 0x230], r14
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x200], xmm0
mov rdi, qword [rsp + 0x280]
cmp qword [rsp + 0x288], 0x10
jb 0x14003916f
mov rsi, qword [rsp + 0x270]
jmp 0x140039177
xor edi, edi
lea rcx, [rsp + 0x370]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x540], 0
jne 0x140039e31
lea rcx, [rsp + 0x370]
call fcn.14002fd10
jmp 0x140039038
lea rsi, [rsp + 0x270]
cmp rdi, 0xf
mov rax, qword [rsp + 0x98]
ja 0x14003a25b
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x1f0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x208], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1e0], xmm0
mov rsi, qword [rsp + 0x2e0]
cmp qword [rsp + 0x2e8], 0x10
lea rbx, [rsp + 0x2d0]
jb 0x1400391db
mov rbx, qword [rsp + 0x2d0]
cmp rsi, 0xf
ja 0x14003a2b3
movdqu xmm0, xmmword [rbx]
movdqa xmmword [rsp + 0x1d0], xmm0
mov edi, 0xf
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c0], xmm0
mov rdi, qword [rsp + 0x300]
cmp qword [rsp + 0x308], 0x10
jb 0x140039231
mov rsi, qword [rsp + 0x2f0]
jmp 0x140039239
lea rsi, [rsp + 0x2f0]
cmp rdi, 0xf
ja 0x14003a30b
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x1b0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1a0], xmm0
mov rdi, qword [rsp + 0x320]
cmp qword [rsp + 0x328], 0x10
jb 0x14003928f
mov rsi, qword [rsp + 0x310]
jmp 0x140039297
lea rsi, [rsp + 0x310]
cmp rdi, 0xf
ja 0x14003a363
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x190], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1a0], rdi
cmp qword [rsp + 0x58], 0x10
lea rsi, [rsp + 0x290]
cmovae rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x1a8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x180], xmm0
cmp r15, 0xf
ja 0x14003a3bb
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x170], xmm0
mov edi, 0xf
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x180], r15
cmp qword [rsp + 0xb8], 0x10
lea rsi, [rsp + 0x2b0]
cmovae rsi, rax
mov qword [rsp + 0x188], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
cmp qword [rsp + 0x88], 0xf
ja 0x14003a418
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x150], xmm0
mov edi, 0xf
cmp r12, 0x10
jb 0x14003936b
mov rsi, qword [rsp + 0x330]
jmp 0x140039373
lea rsi, [rsp + 0x330]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x140], xmm0
cmp rbx, 0xf
ja 0x14003a475
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x130], xmm0
mov edi, 0xf
mov qword [rsp + 0x140], rbx
cmp r14, 0x10
lea rsi, [rsp + 0x218]
cmovae rsi, rcx
mov qword [rsp + 0x148], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
cmp rbp, 0xf
ja 0x14003a4cb
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x110], xmm0
mov edi, 0xf
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x128], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x100], xmm0
mov rdi, qword [rsp + 0x360]
cmp qword [rsp + 0x368], 0x10
jb 0x140039437
mov rsi, qword [rsp + 0x350]
jmp 0x14003943f
lea rsi, [rsp + 0x350]
cmp rdi, 0xf
mov qword [rsp + 0xa8], rcx
ja 0x14003a51b
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0xf0], xmm0
mov ebp, 0xf
mov r15, r12
lea rbx, [rsp + 0xf0]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rbp
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor edx, edx
call fcn.140005af0
lea rdx, str.release
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
call fcn.1400015d0
lea rdx, str.build_channel
lea r8, [0x1400a083b]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rdx, [0x1400a0fee]
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
call fcn.1400015d0
lea rdx, str.build_version
lea r8, [0x1400a078a]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov rdx, rbx
call fcn.14005fa70
lea rdx, [0x1400a04e4]
lea r8, [0x1400a04f3]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.previous_default_browser
lea r8, [0x1400a04f3]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a02b9]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x150]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.os_version
lea r8, [0x1400a077c]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x170]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.os_locale
lea r8, [0x1400a0d6b]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x190]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.notification_type
lea r8, [0x1400a0cb1]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1b0]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.notification_shown
lea r8, [0x1400a0624]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1d0]
mov rcx, rbx
call fcn.14005fa70
lea rdx, [0x1400a06ac]
lea r8, [0x1400a06bf]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1f0]
mov rcx, rbx
call fcn.14005fa70
lea rdx, str.previous_notification_action
lea r8, [0x1400a06bf]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rax, [0x14006b0a0]
lea rbp, [rsp + 0x378]
mov r13, rax
mov qword [rbp - 8], rax
and dword [rbp + 8], 0xfffffe00
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 0
mov rcx, rbp
call fcn.1400012d0
lea rdx, [0x1400a136e]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.1400015d0
lea rbx, [rsp + 0x6f0]
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0xb
movabs rax, 0x7461746e65646e69
mov qword [rbx], rax
mov dword [rbx + 7], 0x6e6f6974
mov byte [rbx + 0xb], 0
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.140005c60
mov rcx, rsi
mov rdx, rax
call fcn.140001500
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jae 0x140039ba6
lea rcx, [rsp + 0x4b0]
call fcn.140001070
lea r12, [rsp + 0x6c0]
lea rdx, [rsp + 0x370]
lea r8, [rsp + 0x728]
mov rcx, r12
call fcn.140002b60
lea rcx, [rsp + 0x7b8]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
mov rsi, qword [rsp + 0x58]
je 0x14003985b
mov edi, eax
or edi, 0x80010000
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov edx, edi
mov r9d, 0x2c
call fcn.14002cd80
jmp 0x1400398c7
pxor xmm0, xmm0
lea rdx, [rsp + 0x4b0]
movdqu xmmword [rdx + 0x3e], xmm0
movdqa xmmword [rdx + 0x30], xmm0
movdqa xmmword [rdx + 0x20], xmm0
movdqa xmmword [rdx + 0x10], xmm0
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x7b8]
mov rcx, rsi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
je 0x14003a58a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x33
call fcn.14002cd80
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
mov r12, r15
jae 0x140039bc9
mov qword [rsp + 0x370], r13
mov rcx, rbp
call fcn.140001070
lea rcx, [rsp + 0x728]
call fcn.140001070
mov rax, qword [rsp + 0x108]
cmp rax, 0x10
jae 0x140039bf4
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jae 0x140039c1f
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0xf
mov byte [rsp + 0x110], 0
mov rax, qword [rsp + 0x148]
cmp rax, 0x10
jae 0x140039c4a
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0xf
mov byte [rsp + 0x130], 0
mov rax, qword [rsp + 0x168]
cmp rax, 0x10
jae 0x140039c75
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0xf
mov byte [rsp + 0x150], 0
mov rax, qword [rsp + 0x188]
cmp rax, 0x10
jae 0x140039ca0
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
mov rax, qword [rsp + 0x1a8]
cmp rax, 0x10
jae 0x140039ccb
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0xf
mov byte [rsp + 0x190], 0
mov rax, qword [rsp + 0x1c8]
cmp rax, 0x10
jae 0x140039cf6
mov esi, 0xf
xor edx, edx
xor ecx, ecx
jmp 0x140036c45
mov rbx, rcx
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc72
call fcn.140057540
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
jmp 0x1400390e6
mov qword [rsp + 0x60], r12
lea rdx, [rsp + 0x4d8]
lea rsi, [rsp + 0x398]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
je 0x140039dd7
mov rax, qword [rsp + 0x370]
mov rbp, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x388]
cmp rcx, 0x10
mov rbx, r13
cmovae rbx, rax
cmp rbp, 0xf
ja 0x14003a958
cmp rcx, 0x10
mov r12, qword [rbx]
cmovae r13, rax
mov r13, qword [r13 + 8]
mov esi, 0xf
jmp 0x14003a783
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bcc7
call fcn.140057540
jmp 0x1400397f2
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bceb
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x1400398dc
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd0f
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x14003990b
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd33
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x14003993d
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd57
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x14003996f
mov rcx, qword [rsp + 0x150]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd7b
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x1400399a1
mov rcx, qword [rsp + 0x170]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd9f
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x1400399d3
mov rcx, qword [rsp + 0x190]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bdc3
call fcn.140057540
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039a05
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov rsi, qword [rsp + 0x58]
jmp 0x14003759e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov r13, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x58]
jmp 0x14003769d
cmp ebx, 0xb
ja 0x14003a565
lea rax, [0x14006aff0]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x738], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov r9, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rsp + 0x728]
cmp rsi, 0xf
jbe 0x14003a74c
mov rdx, rsi
call fcn.1400011a0
jmp 0x14003a763
lea rsi, [rsp + 0x400]
lea rbp, [rsp + 0x4b0]
mov eax, dword [rbp]
mov dword [rsi - 0x90], eax
lea rdx, [rsp + 0x4b8]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsi - 0x88], xmm0
movups xmmword [rsi - 0x78], xmm1
xor ebx, ebx
mov qword [rbp + 0x18], rbx
mov eax, 0xf
mov qword [rbp + 0x20], rax
mov byte [rbp + 8], bl
lea rcx, [rsp + 0x4d8]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi - 0x68], xmm0
movups xmmword [rsi - 0x58], xmm1
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x28], bl
movdqu xmm0, xmmword [rdx + 0x40]
movdqu xmm1, xmmword [rdx + 0x50]
movdqu xmmword [rsi - 0x48], xmm0
movdqu xmmword [rsi - 0x38], xmm1
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x48], bl
mov byte [rsi - 8], bl
pxor xmm0, xmm0
movdqu xmmword [rsi - 0x18], xmm0
movdqu xmmword [rsi - 0x28], xmm0
mov rcx, rsi
mov rdx, qword [rsp + 0x70]
call fcn.14005b4d0
mov byte [rsi], 1
mov rcx, rbp
call fcn.14003e240
cmp byte [rsi], bl
mov rsi, qword [rsp + 0x58]
je 0x14003915d
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rsi, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
mov rdx, rsi
call fcn.140035ba0
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036630
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jae 0x14003a9c0
lea rax, [rsp + 0x730]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x320], xmm1
movdqa xmmword [rsp + 0x310], xmm0
cmp byte [rax + 0x80], 0
je 0x140039f83
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003ab87
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003a9e3
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003aa06
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036630
mov rax, qword [rsp + 0x308]
cmp rax, 0x10
jae 0x14003aa29
lea rax, [rsp + 0x750]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x300], xmm1
movdqa xmmword [rsp + 0x2f0], xmm0
cmp byte [rax + 0x60], 0
je 0x14003a015
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003abaa
mov qword [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003aa4c
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003aa6f
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036630
mov rax, qword [rsp + 0x2e8]
cmp rax, 0x10
jae 0x14003aa92
lea rax, [rsp + 0x770]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x2e0], xmm1
movdqa xmmword [rsp + 0x2d0], xmm0
mov qword [rax + 0x10], 0
cmp byte [rax + 0x40], 0
je 0x14003a0af
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003abcd
mov qword [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003aab5
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003aad8
lea rcx, [rsp + 0x370]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.140036630
mov sil, byte [rsi + 0x88]
test sil, sil
je 0x14003a121
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003abf0
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003aafb
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003ab1e
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003ab41
test sil, sil
je 0x14003a887
lea rcx, [rsp + 0x370]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.140036630
cmp byte [rsi + 0x88], 0
je 0x14003b81e
mov bpl, byte [rsp + 0x790]
mov rsi, qword [rsp + 0x7a0]
mov rbx, qword [rsp + 0x7a8]
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
jae 0x14003ac13
lea rax, [rsp + 0x791]
mov byte [rsp + 0x270], bpl
mov rcx, qword [rax]
mov rdx, qword [rax + 7]
mov qword [rsp + 0x271], rcx
mov qword [rsp + 0x278], rdx
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], rbx
mov rax, qword [rax - 9]
cmp rax, 0x10
jae 0x14003ac36
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003ac59
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jb 0x14003a8d3
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0dc
call fcn.140057540
jmp 0x14003a8d3
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003afd0
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x1f0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x14003919b
mov r13, rcx
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003afea
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x1d0], rcx
lea r8, [rsi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x1400391f7
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003b004
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x1b0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x140039255
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003b01e
lea rcx, [rbx + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x190], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x1400392b3
mov r13, rcx
mov rdi, r15
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b038
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x170], rcx
lea r8, [r15 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x68]
mov rcx, r13
jmp 0x140039308
mov r15, rcx
mov rdi, qword [rsp + 0x88]
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b052
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x150], rcx
mov rax, qword [rsp + 0x88]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
jmp 0x14003935b
mov r13, rcx
mov r15, rbx
mov rdi, rbx
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b06c
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x130], rcx
mov rbx, r15
lea r8, [r15 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r13
jmp 0x1400393b4
mov rbx, rcx
mov rdi, rbp
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b086
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x110], rcx
lea r8, [rbp + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
jmp 0x1400393fd
mov rbp, rdi
or rbp, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
cmovae rbp, rax
cmp rbp, 0xfff
jae 0x14003b0a0
lea rcx, [rbp + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0xf0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140039463
mov qword [rsp + 0x740], 0xf
mov qword [rsp + 0x738], 0
mov byte [rsp + 0x728], 0
jmp 0x14003a763
lea rdi, [rsp + 0x6f0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [rsp + 0x4b2]
mov edx, 0x24
mov rcx, rdi
call fcn.14005b130
movzx eax, word [rdi]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x4a6], rcx
mov rcx, qword [rdi + 2]
mov qword [rsp + 0x4a0], rcx
mov qword [rsp + 0x60], rdi
movdqu xmm0, xmmword [rdi + 0x10]
mov word [rsp + 0x7b8], ax
mov rax, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x4a6]
mov qword [rsp + 0x7ba], rax
mov qword [rsp + 0x7c0], rcx
movdqu xmmword [rsp + 0x7c8], xmm0
lea rcx, section..rdata
lea r9, [rsp + 0x480]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x88], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14003a8e2
mov rdi, qword [rsp + 0x480]
lea rbx, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a2d34]
mov rcx, rbx
mov qword [rsp + 0x68], rdi
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003a904
lea rdx, [0x1400a1588]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003a99d
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ab64
cmp qword [rsp + 0x7d0], 8
jb 0x14003a6c9
mov rsi, qword [rsp + 0x7b8]
lea rcx, [rsp + 0x4b0]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ac7c
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003b0ba
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x6f0], 0
jmp 0x14003b0ca
mov qword [rcx + 0x10], rsi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x728], 0
mov r12, qword [rsp + 0x728]
mov r13, qword [rsp + 0x730]
mov rbp, qword [rsp + 0x738]
mov rsi, qword [rsp + 0x740]
cmp qword [rsp + 0x368], 0x10
jb 0x14003a798
mov r8, qword [rsp + 0x350]
jmp 0x14003a7a0
lea r8, [rsp + 0x350]
lea rdx, str.PingCurrentDefault
lea rbx, [rsp + 0x728]
mov rcx, rbx
xor r9d, r9d
call fcn.14002ebb0
mov edi, dword [rbx]
test edi, edi
je 0x14003a822
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x13d
call fcn.14002ce90
xor ebx, ebx
mov r13d, 0
mov ebp, 0
mov r14d, 0
cmp rsi, 0x10
jb 0x14003a828
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jae 0x14003be53
mov rcx, r12
call fcn.140057540
xor ebx, ebx
xor r13d, r13d
xor ebp, ebp
xor r14d, r14d
jmp 0x14003a828
mov rbx, r12
mov r14, rsi
cmp byte [rsp + 0x390], 0
je 0x14003a840
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x14003a867
mov r12, qword [rsp + 0x60]
mov rcx, rbx
jmp 0x1400390bb
add rcx, 0x28
call fcn.140057550
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140038ed3
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be78
call fcn.140057540
jmp 0x14003a840
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
jae 0x14003ad0c
mov byte [rsp + 0x270], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x271], rax
mov byte [rsp + 0x279], 0
mov qword [rsp + 0x280], 9
mov qword [rsp + 0x288], 0xf
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x14003915d
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edx, eax
mov r9d, 0x70
call fcn.14002cd80
jmp 0x14003acd3
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x7c
jmp 0x14003ac9a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x140039000
mov rsi, rbp
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003b269
lea rcx, [rsi + 1]
call fcn.140057550
mov r12, rax
lea r8, [rbp + 1]
mov rcx, r12
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003a783
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x81
jmp 0x14003ac9a
mov rcx, qword [rsp + 0x310]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be9c
call fcn.140057540
jmp 0x140039f45
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bec0
call fcn.140057540
jmp 0x140039f95
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bee4
call fcn.140057540
jmp 0x140039fa7
mov rcx, qword [rsp + 0x2f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf08
call fcn.140057540
jmp 0x140039fce
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf2c
call fcn.140057540
jmp 0x14003a027
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf50
call fcn.140057540
jmp 0x14003a039
mov rcx, qword [rsp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf74
call fcn.140057540
jmp 0x14003a060
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf98
call fcn.140057540
jmp 0x14003a0c1
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bfbc
call fcn.140057540
jmp 0x14003a0d3
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bfe0
call fcn.140057540
jmp 0x14003a133
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c004
call fcn.140057540
jmp 0x14003a145
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c028
call fcn.140057540
jmp 0x14003a157
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x86
jmp 0x14003ac9a
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c04c
call fcn.140057540
jmp 0x140039f83
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c070
call fcn.140057540
jmp 0x14003a009
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c094
call fcn.140057540
jmp 0x14003a0a3
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0b8
call fcn.140057540
jmp 0x14003a109
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c100
call fcn.140057540
jmp 0x14003a1cf
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c120
call fcn.140057540
jmp 0x14003a214
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c140
call fcn.140057540
jmp 0x14003a226
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x8b
call fcn.14002cd80
xor eax, eax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0xa0], rax
xor esi, esi
xor eax, eax
mov qword [rsp + 0x50], rax
xor ebx, ebx
cmp qword [rsp + 0x68], 0
je 0x14003acce
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
jne 0x14003ad2f
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x1400398c2
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b284
call fcn.140057540
jmp 0x1400398c2
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c160
call fcn.140057540
jmp 0x14003a899
mov qword [rsp + 0x480], rbx
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x50]
cmp rcx, 8
lea rax, [rsp + 0x480]
cmovb rbx, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x498], rcx
lea rax, [0x14006af38]
lea rsi, [rsp + 0x558]
mov qword [rsi - 0xa8], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006afd8]
mov qword [rsi], rax
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006af40]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff58
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x4ac], ecx
lea rdi, [rsp + 0x4b8]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006afe8]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4ac], ecx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
xor esi, esi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006af40]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x4ac], ebx
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006aec0]
mov qword [rdi], rax
mov byte [rdi + 0x7c], sil
mov byte [rdi + 0x71], sil
lea rax, [rsp + 0x4c0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4c8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4e0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4e8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x500]
mov qword [rax + 8], rax
lea rax, [rsp + 0x504]
mov qword [rax + 0xc], rax
mov qword [rax - 4], rsi
mov qword [rax + 0x34], rsi
pxor xmm0, xmm0
movdqu xmmword [rax - 0x44], xmm0
movdqu xmmword [rax - 0x24], xmm0
mov rcx, qword [0x1400aa4d4]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x1c], rsi
mov rbx, rdi
mov rcx, rdi
mov rdx, qword [rsp + 0x68]
call fcn.14005cf90
test rax, rax
jne 0x14003af10
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6d0]
cmp qword [rsp + 0x6d8], 0x10
jb 0x14003af2b
mov r12, qword [rsp + 0x6c0]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov rdx, r12
call fcn.1400046e0
mov rax, qword [rsi]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003b106
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov edi, 0x8007045d
mov edx, 0x8007045d
mov r9d, 0xd6
call fcn.14002cd80
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006af40]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c6f0
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003b304
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a28f
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a2e7
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a33f
lea rcx, [rbx + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a397
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a3ef
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a451
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a4ac
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a4ff
lea rcx, [rbp + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a54c
lea r9, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14005b130
mov rbx, qword [rsp + 0x6f0]
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x700]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x708]
mov qword [rsp + 0x50], rax
xor edi, edi
mov sil, 1
jmp 0x14003acbb
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006af40]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c6f0
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rsi, [rsp + 0x460]
mov rcx, rsi
xor edx, edx
call fcn.1400024e0
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003b216
lea rsi, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x460]
lea r8, str.pingsender.exe
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003b236
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003b2ab
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x6f0], 0
jmp 0x14003b2bb
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x99
jmp 0x14003b254
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0xa0
call fcn.14002cd80
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x68], rax
xor esi, esi
xor r12d, r12d
jmp 0x14003b2e2
lea rcx, [rsi + 0x28]
call fcn.140057550
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14003a989
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003ad02
lea r9, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14005b130
mov rbx, qword [rsp + 0x6f0]
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x68], rax
mov rsi, qword [rsp + 0x700]
mov r12, qword [rsp + 0x708]
xor edi, edi
mov rcx, qword [rsp + 0x460]
mov qword [rsp + 0x460], 0
test rcx, rcx
je 0x14003b300
call fcn.140057540
test edi, edi
je 0x14003b33d
mov rax, qword [rsp + 0x498]
cmp rax, 8
jb 0x14003acd3
mov rcx, qword [rsp + 0x480]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b843
call fcn.140057540
jmp 0x14003acd3
mov qword [rsp + 0x6f0], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x6f8], rax
mov qword [rsp + 0x700], rsi
mov qword [rsp + 0x708], r12
lea rsi, [rsp + 0x460]
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rsi
call fcn.14005b130
mov r8, qword [rsp + 0x7c8]
cmp qword [rsp + 0x7d0], 8
jb 0x14003b3b0
mov r9, qword [rsp + 0x7b8]
jmp 0x14003b3b8
lea r9, [rsp + 0x7b8]
mov rax, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x478]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x14003b829
lea rbx, [rax + r8]
mov qword [rsp + 0x470], rbx
cmp rcx, 8
jb 0x14003b3f1
mov rsi, qword [rsp + 0x460]
lea rcx, [rsi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbx*2], 0
cmp qword [rsp + 0x708], 8
jb 0x14003b41e
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x478], 8
jb 0x14003b433
mov rax, qword [rsp + 0x460]
jmp 0x14003b43b
lea rax, [rsp + 0x460]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x498], 8
jb 0x14003b45b
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ecx, [rsi + 2]
test rax, rax
cmove ecx, esi
mov qword [rsp + 0x70], rcx
test rbx, rbx
jne 0x14003c186
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea r12d, [rsi + 2]
test rax, rax
cmove r12d, esi
test rbx, rbx
jne 0x14003c1bd
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ecx, [rsi + 2]
test rax, rax
cmove ecx, esi
test rbx, rbx
jne 0x14003c1ec
mov rax, qword [rsp + 0x70]
add eax, r12d
add eax, ecx
add eax, 3
test eax, eax
mov ecx, 1
cmovne ecx, eax
movsxd rax, ecx
add rax, rax
mov rsi, 0xffffffffffffffff
cmovae rsi, rax
mov rcx, rsi
call fcn.14005766c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
mov qword [rsp + 0x70], rbx
test rax, rax
jne 0x14003c21c
test rsi, rsi
jne 0x14003c22f
mov rcx, rbx
mov rsi, qword [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c286
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
test rax, rax
jne 0x14003c294
add rbx, 2
test rsi, rsi
jne 0x14003c2a3
mov rcx, rbx
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c2fa
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006af48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
test rax, rax
jne 0x14003c308
add rbx, 2
test rsi, rsi
jne 0x14003c317
mov rcx, rbx
mov rsi, qword [rsp + 0x88]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c377
mov word [rbx], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x4b0], xmm0
movdqa xmmword [rsp + 0x4e0], xmm0
movdqa xmmword [rsp + 0x500], xmm0
movdqa xmmword [rsp + 0x4f0], xmm0
movdqa xmmword [rsp + 0x4d0], xmm0
movdqa xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x510], 0
mov dword [rsp + 0x4b0], 0x68
mov dword [rsp + 0x4ec], 1
cmp qword [rsp + 0x708], 8
jb 0x14003b718
mov rcx, qword [rsp + 0x6f0]
jmp 0x14003b720
lea rcx, [rsp + 0x6f0]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
xor edi, edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003b77c
mov rcx, qword [rsp + 0xe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xd8]
call rsi
jmp 0x14003b7ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov edx, edi
mov r9d, 0xf3
call fcn.14002cd80
mov rcx, qword [rsp + 0x70]
call fcn.140057540
mov rax, qword [rsp + 0x478]
cmp rax, 8
jb 0x14003b7e5
mov rcx, qword [rsp + 0x460]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b91b
call fcn.140057540
mov rax, qword [rsp + 0x708]
cmp rax, 8
jb 0x14003b304
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b942
call fcn.140057540
jmp 0x14003b304
int3
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x460]
mov rdx, r8
call fcn.14005afe0
jmp 0x14003b406
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003b333
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c180
add r12, 0x28
mov rcx, rax
jmp 0x140036e9d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036e35
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036e58
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036e7b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036ec3
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003b7e0
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003b814
mov rax, qword [r13 - 8]
add r13, 0xfffffffffffffff8
sub r13, rax
cmp r13, 0x20
jae 0x14003c180
add rbx, 0x28
mov rdx, rbx
mov r13, rax
jmp 0x140037254
mov rax, qword [rsp + 0x3b0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x14003718a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c180
add rdx, 0x27
mov rcx, rax
mov r12, qword [rsp + 0x60]
jmp 0x1400371b3
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c180
mov rdx, rsi
add rdx, 0x28
mov qword [rsp + 0xb0], rax
jmp 0x140036d54
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003727a
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x1400372e8
cmp rbx, 0x12
jg 0x14003ba7a
cmp rbx, 9
jne 0x14003bab5
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rdx, 0x6f697463612d6f6e
xor rdx, qword [rax]
movzx eax, byte [rax + 8]
xor rax, 0x6e
or rax, rdx
jmp 0x14003bb2f
cmp rbx, 0x1a
jg 0x14003baef
cmp rbx, 0x13
jne 0x14003bb3f
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 3]
pcmpeqb xmm1, xmmword [0x14006ac00]
pcmpeqb xmm0, xmmword [0x14006ac10]
jmp 0x14003bb22
cmp rbx, 0xd
jne 0x14003bb7c
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rbx, 0x6c632d7473616f74
xor rbx, qword [rax]
movabs rdx, 0x64656b63696c632d
xor rdx, qword [rax + 5]
or rdx, rbx
jmp 0x14003bb2f
cmp rbx, 0x1b
jne 0x14003bbc4
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xb]
pcmpeqb xmm1, xmmword [str.x_default_buttonmake_firefox_defplication_hiddendismissed_by_appmissed_by_buttondismissed_by_butto_action_centerdismissed_to_acteout]
pcmpeqb xmm0, xmmword [0x14006abd0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
mov r12, qword [rsp + 0x60]
jne 0x1400373d0
jmp 0x1400376e1
cmp rbx, 0x1a
mov r12, qword [rsp + 0x60]
jne 0x1400373d0
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xa]
pcmpeqb xmm1, xmmword [0x14006ac20]
pcmpeqb xmm0, xmmword [0x14006ac30]
jmp 0x1400373bd
cmp rbx, 0xf
mov r12, qword [rsp + 0x60]
jne 0x1400373d0
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rbx, 0x6d2d646e696d6572
xor rbx, qword [rax]
movabs rdx, 0x726574616c2d656d
xor rdx, qword [rax + 7]
or rdx, rbx
jne 0x1400373d0
jmp 0x1400376e1
cmp rbx, 0x1f
mov r12, qword [rsp + 0x60]
jne 0x1400373d0
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xf]
pcmpeqb xmm1, xmmword [0x14006abe0]
pcmpeqb xmm0, xmmword [0x14006abf0]
jmp 0x1400373bd
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbx
mov rsi, qword [rsp + 0x58]
jmp 0x14003771f
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
mov rsi, rdi
jmp 0x1400378c5
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x728], 0
mov r12, qword [rsp + 0x60]
jmp 0x140037104
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x140039b15
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x140039bbf
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x140039be2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039c0d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039c38
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039c63
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039c8e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039cb9
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140039ce4
mov rax, qword [r12 - 8]
add r12, 0xfffffffffffffff8
sub r12, rax
cmp r12, 0x20
jae 0x14003c180
add rsi, 0x28
mov rdx, rsi
mov r12, rax
jmp 0x14003a80e
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x14003a880
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a9d9
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a9fc
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aa1f
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aa42
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aa65
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aa88
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aaab
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aace
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aaf1
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ab14
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ab37
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ab5a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aba0
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003abc3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003abe6
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac09
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a251
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003ac2c
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac4f
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac72
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c180
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ad25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ecx, ecx
mov rax, qword [rsp + 0x60]
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c1a3
cmp edx, 0x5c
je 0x14003c1b5
test edx, edx
jne 0x14003c1b1
jmp 0x14003b4a1
mov rdx, qword [rsp + 0x70]
add edx, ecx
inc edx
mov qword [rsp + 0x70], rdx
xor ecx, ecx
jmp 0x14003c1b7
inc ecx
add rax, 2
jmp 0x14003c18d
xor ecx, ecx
mov rax, qword [rsp + 0x68]
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c1da
cmp edx, 0x5c
je 0x14003c1e4
test edx, edx
jne 0x14003c1e0
jmp 0x14003b4e4
add r12d, ecx
inc r12d
xor ecx, ecx
jmp 0x14003c1e6
inc ecx
add rax, 2
jmp 0x14003c1c4
xor edx, edx
mov rax, qword [rsp + 0x88]
movzx ebx, word [rax]
cmp ebx, 0x22
je 0x14003c20c
cmp ebx, 0x5c
je 0x14003c214
test ebx, ebx
jne 0x14003c210
jmp 0x14003b528
add ecx, edx
inc ecx
xor edx, edx
jmp 0x14003c216
inc edx
add rax, 2
jmp 0x14003c1f6
mov rbx, qword [rsp + 0x70]
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b59d
xor eax, eax
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c24c
cmp ecx, 0x5c
je 0x14003c269
test ecx, ecx
jne 0x14003c275
jmp 0x14003b5c3
test eax, eax
js 0x14003c271
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c252
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax]
jmp 0x14003c275
inc eax
mov cx, 0x5c
jmp 0x14003c277
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x60], 2
jmp 0x14003c231
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b5cc
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003b605
xor eax, eax
mov rcx, qword [rsp + 0x68]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c2c0
cmp ecx, 0x5c
je 0x14003c2dd
test ecx, ecx
jne 0x14003c2e9
jmp 0x14003b62b
test eax, eax
js 0x14003c2e5
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c2c6
mov rax, qword [rsp + 0x68]
movzx ecx, word [rax]
jmp 0x14003c2e9
inc eax
mov cx, 0x5c
jmp 0x14003c2eb
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x68], 2
jmp 0x14003c2a5
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b634
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003b670
xor eax, eax
mov rcx, qword [rsp + 0x88]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c337
cmp ecx, 0x5c
je 0x14003c357
test ecx, ecx
jne 0x14003c363
jmp 0x14003b699
test eax, eax
js 0x14003c35f
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c33d
mov rax, qword [rsp + 0x88]
movzx ecx, word [rax]
jmp 0x14003c363
inc eax
mov cx, 0x5c
jmp 0x14003c365
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x88], 2
jmp 0x14003c319
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b6a2