Function at 0x14000c1b0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
movaps xmmword [rsp + 0x2e0], xmm6
mov r12, rcx
mov rax, qword [0x1402c9798]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
cmp byte [rcx + 0x1a3], 0
sete r14b
mov al, byte [rcx + 0x1a2]
test al, al
sete sil
movabs r13, 0xaaaaaaaaaaaaaaaa
test al, al
je 0x14000c9fe
call qword [r12 + 0x200]
test al, al
jne 0x14000c70d
lea rcx, str.TEMP
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000c70d
mov edi, eax
mov ecx, eax
add rcx, rcx
call fcn.14001571c
mov rbx, rax
lea rcx, str.TEMP
mov rdx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdi, [rsp + 0x70]
mov qword [rdi], r13
mov rcx, rdi
mov rdx, rbx
call fcn.14000ab40
lea rdx, str.csg_installer.exe
mov rcx, rdi
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetUBound
call fcn.14000e2e0
mov r15, qword [r12 + 0x1d8]
mov rbx, qword [rdi]
cmp dword [rbx - 8], 2
jl 0x14000c2a1
mov edx, dword [rbx - 0x10]
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.14000e1d0
mov rbx, qword [rdi]
movabs rbp, 0x7fffffffffffffef
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], 0
mov rcx, rbx
call fcn.140014954
cmp rax, rbp
ja 0x14000cc94
mov rdi, rax
cmp rax, 0xb
mov byte [rsp + 0x3f], sil
jae 0x14000c315
mov byte [rsp + 0x1b7], dil
test rdi, rdi
je 0x14000cc70
cmp rdi, 3
jne 0x14000cca9
lea rsi, [rsp + 0x1a0]
movzx eax, word [rbx + 4]
mov word [rsi + 4], ax
mov eax, dword [rbx]
mov dword [rsi], eax
mov rbp, rsi
jmp 0x14000c368
mov byte [rsp + 0x3e], r14b
lea r14, [rdi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.140014820
mov rbp, rax
lea rsi, [rsp + 0x1a0]
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rdi
mov r8, rdi
add r8, rdi
mov rcx, rbp
mov rdx, rbx
call fcn.1401c1840
mov r14b, byte [rsp + 0x3e]
mov word [rbp + rdi*2], 0
lea rcx, [rsp + 0x1a0]
call r15
mov ebx, eax
cmp byte [rsi + 0x17], 0
jns 0x14000c38f
mov rcx, qword [rsp + 0x1a0]
call fcn.140014884
test bl, bl
je 0x14000c4c5
lea rcx, [rsp + 0x180]
mov qword [rcx + 0x10], r13
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rcx], xmm0
cmp dword [r12 + 0x178], 0
lea rax, [0x1402105c8]
lea rdx, [0x1402105ca]
cmove rdx, rax
call fcn.1401eb750
lea rdx, [rsp + 0x160]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movups xmm0, xmmword [str.LOG_INFO]
movaps xmmword [rdx], xmm0
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.SDK_has_been_downloaded__installing_started.
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
mov rax, qword [r12 + 0x1e8]
mov rbp, qword [r12 + 0x180]
cmp dword [rbp - 8], 2
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x48], rax
jl 0x14000c452
lea rbx, [r12 + 0x180]
mov edx, dword [rbp - 0x10]
mov rcx, rbx
call fcn.14000e1d0
mov rbp, qword [rbx]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], 0
mov rcx, rbp
call fcn.140014954
mov rbx, rax
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x14000cc94
cmp rbx, 0xb
jae 0x14000c536
mov byte [rsp + 0x1b7], bl
test rbx, rbx
je 0x14000c584
lea rdi, [rsp + 0x1a0]
cmp rbx, 3
jne 0x14000c573
movzx eax, word [rbp + 4]
mov word [rdi + 4], ax
mov eax, dword [rbp]
mov dword [rdi], eax
jmp 0x14000c584
mov ecx, 0x20
call fcn.140014820
lea rdx, [rsp + 0x128]
mov qword [rdx], rax
movaps xmm0, xmmword [0x140210020]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [str.LOG_WARNING]
movups xmmword [rax], xmm0
mov rcx, qword [0x14021058e]
mov qword [rax + 0xe], rcx
mov word [rax + 0x16], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.There_was_an_error_during_SDK_download.
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
mov sil, byte [rsp + 0x3f]
jmp 0x14000c6d7
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.140014820
mov rdi, rax
mov qword [rsp + 0x1a0], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rsi
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1a8], rbx
mov r8, rbx
add r8, rbx
mov rcx, rdi
mov rdx, rbp
call fcn.1401c1840
mov word [rdi + rbx*2], 0
mov rbp, qword [rsp + 0x70]
cmp dword [rbp - 8], 2
jl 0x14000c5a8
mov edx, dword [rbp - 0x10]
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.14000e1d0
mov rbp, qword [rdi]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 0
mov rcx, rbp
call fcn.140014954
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14000ccbe
cmp rdi, 0xb
jae 0x14000c618
mov byte [rsp + 0x157], dil
test rdi, rdi
je 0x14000cc7d
cmp rdi, 3
jne 0x14000cccb
lea rsi, [rsp + 0x140]
movzx eax, word [rbp + 4]
mov word [rsi + 4], ax
mov eax, dword [rbp]
mov dword [rsi], eax
mov rbx, rsi
jmp 0x14000c66b
mov byte [rsp + 0x3e], r14b
lea r14, [rdi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.140014820
mov rbx, rax
lea rsi, [rsp + 0x140]
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rdi
mov r8, rdi
add r8, rdi
mov rcx, rbx
mov rdx, rbp
call fcn.1401c1840
mov r14b, byte [rsp + 0x3e]
mov word [rbx + rdi*2], 0
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x1a0]
lea r8, [rsp + 0x180]
call qword [rsp + 0x48]
cmp byte [rsi + 0x17], 0
mov sil, byte [rsp + 0x3f]
jns 0x14000c6a5
mov rcx, qword [rsp + 0x140]
call fcn.140014884
cmp byte [rsp + 0x1b7], 0
mov bl, byte [rsp + 0x40]
jns 0x14000c6c0
mov rcx, qword [rsp + 0x1a0]
call fcn.140014884
cmp byte [rsp + 0x197], 0
jns 0x14000c6d7
mov rcx, qword [rsp + 0x180]
call fcn.140014884
mov rdx, qword [rsp + 0x70]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jg 0x14000c6f9
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000c70d
call qword [r12 + 0x200]
test al, al
je 0x14000c9fe
lea rdx, [rsp + 0x110]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movups xmm6, xmmword [str.LOG_INFO]
movaps xmmword [rdx], xmm6
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.Will_use_Comodo_solution
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
call qword [r12 + 0x210]
test al, al
je 0x14000c7b7
lea rdx, [rsp + 0xd0]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movaps xmmword [rdx], xmm6
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.IE_already_set_before.
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
jmp 0x14000c93e
mov byte [rsp + 0x3e], r14b
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movaps xmmword [rdx], xmm6
mov word [rdx + 0x10], 0
lea r15, [rsp + 0x1a0]
mov rcx, r15
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.Overriding_IE
call fcn.14000d8b0
mov rcx, r15
call fcn.14000acd0
cmp dword [r12 + 0x178], 1
mov r14d, 2
sbb r14d, 0
mov rax, qword [r12 + 0x220]
mov rbx, qword [r12 + 0x180]
cmp dword [rbx - 8], 2
mov byte [rsp + 0x3f], sil
mov qword [rsp + 0x40], rax
jl 0x14000c84e
lea rdi, [r12 + 0x180]
mov edx, dword [rbx - 0x10]
mov rcx, rdi
call fcn.14000e1d0
mov rbx, qword [rdi]
movabs rsi, 0x7fffffffffffffef
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], 0
mov rcx, rbx
call fcn.140014954
cmp rax, rsi
ja 0x14000cc94
mov rbp, rax
cmp rax, 0xb
jae 0x14000c8bb
mov byte [rsp + 0x1b7], bpl
lea r15, [rsp + 0x1a0]
test rbp, rbp
je 0x14000c8b6
cmp rbp, 3
jne 0x14000cca1
movzx eax, word [rbx + 4]
mov word [r15 + 4], ax
mov eax, dword [rbx]
mov dword [r15], eax
mov rdi, r15
jmp 0x14000c90b
lea r13, [rbp + 8]
and r13, 0xfffffffffffffff8
mov rcx, r13
add rcx, r13
call fcn.140014820
mov rdi, rax
mov qword [rsp + 0x1a0], rax
add rsi, 0x11
or rsi, r13
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1a8], rbp
mov r8, rbp
add r8, rbp
mov rcx, rdi
mov rdx, rbx
call fcn.1401c1840
movabs r13, 0xaaaaaaaaaaaaaaaa
mov word [rdi + rbp*2], 0
lea rcx, [rsp + 0x1a0]
mov edx, r14d
call qword [rsp + 0x40]
cmp byte [r15 + 0x17], 0
jns 0x14000c934
mov rcx, qword [rsp + 0x1a0]
call fcn.140014884
mov r14b, byte [rsp + 0x3e]
mov sil, byte [rsp + 0x3f]
call qword [r12 + 0x208]
test al, al
jne 0x14000c9b5
mov rcx, qword [r12 + 0x198]
lea rdx, str.Yahoo_
call fcn.1401d4d38
test eax, eax
jne 0x14000c9b5
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movaps xmmword [rdx], xmm6
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.Adding_extension_to_Chrome
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
call qword [r12 + 0x218]
jmp 0x14000c9fe
lea rdx, [rsp + 0x90]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movaps xmmword [rdx], xmm6
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.Chrome_already_set_before.
call fcn.14000d8b0
mov rcx, rdi
call fcn.14000acd0
lea rcx, [rsp + 0x180]
mov qword [rcx + 0x10], r13
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rcx], xmm6
cmp dword [r12 + 0x178], 0
lea rax, [0x1402106a4]
lea rdx, [0x1402106a6]
cmove rdx, rax
call fcn.1401eb750
mov qword [rsp + 0x150], r13
movaps xmmword [rsp + 0x140], xmm6
mov qword [rsp + 0x70], r13
mov rax, qword [r12 + 0x180]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14000ca65
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14000ca7c
call fcn.14001fccc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x14000cc8a
or r14b, sil
movzx esi, r14b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
lea rdi, [rsp + 0x70]
mov qword [rdi], rax
mov rdx, qword [r12 + 0x180]
mov r9, qword [r12 + 0x188]
mov eax, dword [r9 - 0x10]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.14000e5f0
mov rdx, qword [rdi]
lea rbx, [rsp + 0x1a8]
mov qword [rbx - 8], rbx
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov r8d, 3
call fcn.14000e6f0
mov rdx, qword [rdi]
lea rcx, [rsp + 0x140]
call fcn.1401eb750
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x14000cafe
call fcn.140014870
mov rdx, qword [rsp + 0x70]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
inc esi
dec eax
test eax, eax
jg 0x14000cb22
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, [rsp + 0x140]
lea rbp, [rsp + 0x180]
mov rcx, rbx
mov rdx, rbp
call qword [r12 + 0x228]
lea rdi, [rsp + 0x70]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
cmp dword [r12 + 0x178], 0
lea rax, str.eh_pien
lea rdx, str.eh_pupd
cmove rdx, rax
mov rcx, rdi
call fcn.1401eb750
xor r9d, r9d
cmp byte [r12 + 0x1a0], 0
sete r9b
add r9d, r9d
mov rax, qword [r12 + 0x198]
mov eax, dword [rax - 0x10]
test eax, eax
cmove esi, eax
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call qword [r12 + 0x230]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x10], 0
mov byte [rdx + 0x17], 8
movups xmm0, xmmword [str.LOG_INFO]
movaps xmmword [rdx], xmm0
mov word [rdx + 0x10], 0
lea rbx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14000abd0
lea rcx, [rsp + 0x1b0]
lea rdx, str.Removing_itself_from_autorun
call fcn.14000d8b0
mov rcx, rbx
call fcn.14000acd0
call qword [r12 + 0x1d0]
cmp byte [rdi + 0x17], 0
jns 0x14000cc14
mov rcx, qword [rsp + 0x70]
call fcn.140014884
cmp byte [rsp + 0x157], 0
jns 0x14000cc2b
mov rcx, qword [rsp + 0x140]
call fcn.140014884
cmp byte [rsp + 0x197], 0
jns 0x14000cc42
mov rcx, qword [rsp + 0x180]
call fcn.140014884
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.14003e9d0
mov al, 1
movaps xmm6, xmmword [rsp + 0x2e0]
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x1a0]
jmp 0x14000c310
lea rsi, [rsp + 0x140]
jmp 0x14000c613
mov ecx, 0x80004005
call fcn.14000dcd0
lea rcx, [rsp + 0x1a0]
call fcn.1401eb7f0
mov rdi, r15
jmp 0x14000c8f0
mov byte [rsp + 0x3e], r14b
lea rsi, [rsp + 0x1a0]
mov rbp, rsi
jmp 0x14000c352
lea rcx, [rsp + 0x140]
call fcn.1401eb7f0
mov byte [rsp + 0x3e], r14b
lea rsi, [rsp + 0x140]
mov rbx, rsi
jmp 0x14000c655