Function at 0x1003f7f0
Capabilities:
Create thread
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [esp + 0x238], eax
lea eax, [esp + 0x88]
push 1
push eax
call sym.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::NowUnfuzzed_bool_
add esp, 8
mov eax, dword [0x1007a858]
cmp eax, 0x9ffffff
ja 0x1003f8eb
mov eax, dword [0x1007a040]
xor ecx, ecx
inc ecx
mov dword [esp + 8], ecx
cmp eax, 0xa000001
jb 0x1003f8b9
lea esi, [esp + 0x124]
xor edi, edi
push 0x110
push edi
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [sym.imp.ntdll.dll_VerSetConditionMask]
mov dword [esi - 0xc], 0x11c
mov dword [esi - 8], 0xa
mov dword [esi - 4], edi
mov dword [esi + 0x108], edi
mov esi, 3
push esi
push 2
push edi
push edi
call ebx
push esi
push 1
push edx
push eax
call ebx
push esi
push 0x20
push edx
push eax
call ebx
push esi
push 0x10
push edx
push eax
call ebx
lea ecx, [esp + 0x118]
push edx
push eax
push 0x33
push ecx
call dword [sym.imp.kernel32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1003f8e0
mov eax, 0xa000000
xchg dword [0x1007a040], eax
mov ebx, dword [esp + 8]
mov dword [0x1007b5f8], ebx
mov byte [0x1007b5fc], 1
mov ecx, dword [esp + 0x238]
xor ecx, ebp
call fcn.10069260
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xa000000
xchg dword [0x1007a858], eax
lea esi, [esp + 0x118]
mov ecx, esi
call fcn.1003f530
cmp byte [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
je 0x1003f8b9
lea esi, [esp + 0x118]
mov ecx, esi
call fcn.1003c6e0
cmp byte [esi + 4], 1
je 0x10040047
mov edx, dword [esp + 0x118]
lea edi, [esp + 0x100]
mov ecx, edi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], 0
mov dword [esp + 0xc], edx
call fcn.100424a0
mov ecx, edi
mov edx, str.Progress
push 9
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea esi, [esp + 0xa0]
mov ecx, esi
push edi
call fcn.10041ab0
add esp, 4
cmp byte [esi + 4], 0
je 0x1003ff19
xor eax, eax
cmp dword [esp + 0x114], 7
mov dword [esp + 0x118], eax
jbe 0x1003f994
mov edi, dword [esp + 0x100]
mov ebx, 4
push ebx
lea ecx, [esp + 0x11c]
push ecx
push ebx
push eax
push edi
push dword [esp + 0x1c]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
jne 0x1004005d
xor eax, eax
lea ecx, [esp + 0x118]
mov dword [esp + 4], 0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx], 4
push 0xe
call fcn.10037010
mov cl, 1
test al, al
mov dword [esp], ecx
je 0x1003fc1a
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
mov dword [eax + ecx*4], str.new_instance
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.no_remote
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], 0x1006d95b
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.foreground
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.setDefaultBrowser
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.attach_console
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.wait_for_browser
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.osint
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.new_tab
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.new_window
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.marionette
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.preferences
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], str.search
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
lea edx, [ecx + 1]
mov dword [esp + 0x11c], edx
mov dword [eax + ecx*4 + 4], 0x1006dc8e
mov ecx, dword [esp + 0x11c]
inc ecx
cmp dword [ebp + 0xc], 2
mov eax, ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x11c], ecx
jl 0x1003fc0b
xor edi, edi
inc edi
xor eax, eax
dec eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + edi*4]
push 2
push 0x1006ef5b
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
je 0x1003fc06
mov al, byte [esi]
or al, 2
cmp al, 0x2f
jne 0x1003fbfb
inc esi
push str.marionette
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x1003ff33
inc edi
cmp dword [ebp + 0xc], edi
jne 0x1003fbc2
jmp 0x1003ff86
add esi, 2
jmp 0x1003fbe5
mov dword [esp], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 0x118]
cmp esi, 4
je 0x1003fc30
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp byte [esp], 0
jne 0x10040067
push str.MOZ_SAFE_MODE_RESTART
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x1003fc80
cmp byte [eax], 0
je 0x1003fc80
mov ebx, 6
mov al, 1
mov dword [esp], eax
cmp dword [esp + 0x114], 7
mov dword [esp + 0x118], 1
jbe 0x1003feb8
mov eax, dword [esp + 0x100]
jmp 0x1003febf
push str.XRE_PROFILE_PATH
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x1003fc97
cmp byte [eax], 0
jne 0x1003fc51
push str.MOZ_RESET_PROFILE_RESTART
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x1003fcae
cmp byte [eax], 0
jne 0x1003fc51
push str.MOZ_HEADLESS
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x1003fcc5
cmp byte [eax], 0
jne 0x1003fc51
mov edx, dword [esp + 0xc]
lea edi, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, edi
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, edi
mov edx, str.Enabled
push 8
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea esi, [esp + 0xa8]
mov ecx, esi
push edi
call fcn.10041ab0
add esp, 4
cmp byte [esi + 4], 1
je 0x100400a1
mov esi, dword [esp + 0xa8]
lea ecx, [esp + 0x118]
call fcn.10042450
mov al, 1
test esi, esi
mov ebx, 2
mov dword [esp], eax
je 0x1003fc5b
mov byte [0x1007b5e4], 1
push 0xc
call sym.mozglue.dll_moz_xmalloc
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x118]
mov dword [0x1007b5cc], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax], 0x24
call fcn.1003f5b0
cmp byte [esi + 4], 1
je 0x100402b9
lea esi, [esp + 0x118]
mov ecx, esi
call fcn.10041750
cmp byte [esi + 4], 1
je 0x100402b9
cmp byte [esp + 4], 0
je 0x1004007d
mov ecx, dword [ebp + 8]
mov edi, dword [0x1007b568]
lea ebx, [esp + 0xd8]
xor eax, eax
mov dword [ebx], 8
mov dword [ebx + 4], 0x1003f410
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ecx, edi
mov esi, eax
call dword [section..00cfg]
push 0x7f00
push esi
call edi
mov ecx, dword [0x1007b56c]
mov dword [ebx + 0x14], eax
call dword [section..00cfg]
push 0x7f02
mov eax, dword [ebp + 8]
mov edi, eax
push eax
call ecx
mov ecx, dword [0x1007b564]
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], str.MozillaWindowClass
call dword [section..00cfg]
push ebx
call ecx
mov cl, 1
mov ebx, 0xd
test ax, ax
mov dword [esp], ecx
je 0x1003fc5b
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.ScreenX
push 8
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea esi, [esp + 0xa8]
mov ecx, esi
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
cmp byte [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jne 0x10040245
mov ebx, dword [esp + 4]
jmp 0x1003fc5b
lea eax, [esp + 0x100]
mov ecx, 4
push ecx
lea edx, [esp + 0x11c]
push edx
push ecx
push 0
push eax
push dword [esp + 0x1c]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
lea ecx, [esp + 0x100]
call fcn.10042450
cmp dword [esp + 0xc], 0
je 0x1003fefa
push dword [esp + 0xc]
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [esp + 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp byte [esp], 0
jne 0x1003f8bd
je 0x1003f8ca
jmp 0x1004006d
cmp dword [esp + 0xa0], 1
je 0x1003f97a
mov ebx, 0x15
mov al, 1
mov dword [esp], eax
jmp 0x1003fedb
mov eax, dword [esp + 4]
cmp eax, dword [esp + 0x120]
jne 0x1003ff61
lea ecx, [esp + 0x118]
push 1
call fcn.10037010
test al, al
je 0x1003fc12
mov eax, dword [esp + 0x11c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 4]
mov dword [eax + ecx*4], str.profile
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x10], eax
inc eax
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 4], 0
inc eax
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp]
mov edi, dword [eax + ecx*4]
push 2
push 0x1006ef5b
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
je 0x10040013
mov al, byte [edi]
or al, 2
cmp al, 0x2f
jne 0x10040003
inc edi
mov ebx, dword [esp + 0x11c]
mov esi, dword [esp + 0x118]
test ebx, ebx
je 0x10040027
shl ebx, 2
push dword [esi]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x1003ffe9
add esi, 4
add ebx, 0xfffffffc
jne 0x1003ffcf
jmp 0x10040018
mov eax, dword [esp]
mov ecx, 1
cmp eax, dword [esp + 0x10]
mov eax, dword [esp + 4]
movzx eax, al
cmove eax, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov eax, ecx
mov dword [esp], ecx
jne 0x1003ff94
jmp 0x10040036
add edi, 2
jmp 0x1003ffba
mov al, 1
mov ebx, 5
mov dword [esp], eax
jmp 0x1003fc1a
mov al, 1
mov ebx, 5
mov dword [esp], eax
jmp 0x1003fc21
mov ebx, 5
mov dword [esp], 0
jmp 0x1003fc1a
mov ebx, dword [esp + 0x118]
push dword [esp + 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x1003f8bd
mov ebx, 8
jmp 0x1003ff2c
jne 0x1003fc5b
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_is_T____
int3
lea edi, [esp + 0x50]
mov edx, 0x1006b008
mov ecx, edi
call fcn.10041d30
mov eax, dword [edi]
test eax, eax
mov dword [esp + 4], eax
jne 0x100400b7
mov ebx, 0xb
jmp 0x1003fc5b
lea ecx, [esp + 0x118]
call fcn.10042450
mov ebx, 3
jmp 0x1003fc56
mov edx, dword [esp + 4]
lea edi, [esp + 0xd8]
mov eax, 7
mov ecx, edi
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], 0
mov word [edi], 0
call fcn.100424a0
mov ecx, edi
mov edx, str.MozillaFirefoxprofiles.ini
push 0x1d
call fcn.10042600
add esp, 4
cmp dword [edi + 0x14], 7
jbe 0x100400fb
mov edi, dword [esp + 0xd8]
lea ebx, [esp + 0x188]
mov ecx, ebx
mov dword [ebx - 0x70], 0x1006c400
call dword [sym.imp.msvcp140.dll_protected:_void___thiscall_std::ios_base::constructor_void_]
lea esi, [esp + 0x118]
mov edx, edi
mov dword [ebx], 0x1006c074
mov ecx, esi
call fcn.10041db0
mov eax, dword [ebx - 0x70]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x118], 0x1006c408
mov eax, dword [ebx - 0x70]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esp + eax + 0x114], ecx
mov eax, dword [ebx - 0x70]
mov ecx, dword [eax + 4]
add ecx, esi
call dword [sym.imp.msvcp140.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
mov cl, 1
test al, al
mov ebx, 0xb
mov al, 1
mov dword [esp], ecx
mov dword [esp + 0x10], eax
jne 0x100401e0
mov eax, dword [esp + 0x118]
lea edi, [esp + 0xa8]
lea esi, [esp + 0x118]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov ecx, dword [eax + 4]
add ecx, esi
push 0xa
call dword [sym.imp.msvcp140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movsx eax, al
mov ecx, esi
mov edx, edi
push eax
call fcn.100420c0
add esp, 4
mov eax, dword [esp + 0x118]
mov ecx, dword [eax + 4]
add ecx, esi
call dword [sym.imp.msvcp140.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
test al, al
je 0x100402c5
mov dword [esp + 0x10], 0
lea ecx, [esp + 0xa8]
call fcn.1001a3d0
mov ebx, 0xc
mov eax, dword [esp + 0x118]
lea esi, [esp + 0x188]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x118], 0x1006c408
mov eax, dword [esp + 0x118]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esp + eax + 0x114], ecx
lea ecx, [esi - 0x60]
call fcn.10038260
mov ecx, esi
call dword [sym.imp.msvcp140.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
lea ecx, [esp + 0xd8]
call fcn.10042450
mov ecx, dword [esp + 4]
call fcn.100421c0
cmp byte [esp + 0x10], 0
je 0x1003fdad
jmp 0x1003fc5b
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.ScreenY
push 8
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea esi, [esp + 0xa8]
mov ecx, esi
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
cmp byte [esi + 4], 1
mov esi, dword [esi]
jne 0x10040439
mov ebx, esi
jmp 0x1003fc5b
mov ebx, dword [esp + 0x118]
jmp 0x1003fc5b
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0xb8]
mov edi, dword [esp + 0xbc]
test eax, eax
jne 0x10040381
mov ecx, dword [esp + 0xa8]
xor ebx, ebx
cmp eax, ebx
lea esi, [esp + 0xa8]
cmovb ebx, eax
cmp edi, 0xf
cmovbe ecx, esi
sub eax, ebx
mov dword [esp + 0xb8], eax
inc eax
add ebx, ecx
push eax
push ebx
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov ecx, esi
call fcn.10042080
mov bl, 1
test eax, eax
jne 0x100403b4
mov eax, dword [esp + 0x118]
lea esi, [esp + 0x118]
mov ecx, dword [eax + 4]
add ecx, esi
push 0xa
call dword [sym.imp.msvcp140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movsx eax, al
mov ecx, esi
lea edx, [esp + 0xa8]
push eax
call fcn.100420c0
add esp, 4
mov eax, dword [esp + 0x118]
mov ecx, dword [eax + 4]
add ecx, esi
call dword [sym.imp.msvcp140.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
test al, al
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ebx
je 0x100402cd
jmp 0x100401cf
mov ecx, dword [esp + 0xa8]
cmp edi, 0xf
lea esi, [esp + 0xa8]
cmova esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx]
cmp dl, 0x20
je 0x100403a8
cmp dl, 9
jne 0x100402ec
inc ebx
cmp eax, ebx
jne 0x10040397
mov ebx, eax
jmp 0x100402ec
test byte [esp + 0x14], 1
jne 0x100403c4
mov ebx, dword [esp + 0x14]
jmp 0x10040326
cmp dword [esp + 0xbc], 0xf
lea eax, [esp + 0xa8]
jbe 0x100403dc
mov eax, dword [esp + 0xa8]
cmp byte [eax], 0x5b
jne 0x100403e8
xor ebx, ebx
jmp 0x10040326
push 0x15
push str.StartWithLastProfile
push 0
push dword [esp + 0xc4]
push eax
call fcn.10036c60
add esp, 0x14
test eax, eax
jne 0x100403bb
cmp dword [esp + 0xbc], 0xf
lea eax, [esp + 0xa8]
jbe 0x1004041d
mov eax, dword [esp + 0xa8]
mov al, byte [eax + 0x15]
cmp al, 0x30
je 0x100404b4
cmp al, 0x31
mov ebx, dword [esp + 0x14]
je 0x100401c7
jmp 0x10040326
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.Width
push 6
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 4], 1
mov eax, dword [eax]
mov dword [esp + 0x10], eax
jne 0x100404bf
mov ebx, dword [esp + 0x10]
jmp 0x1003fc5b
mov al, 1
mov dword [esp + 0x10], eax
jmp 0x100401cf
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.Height
push 7
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 4], 1
mov eax, dword [eax]
mov dword [esp + 0x14], eax
jne 0x1004053a
mov ebx, dword [esp + 0x14]
jmp 0x1003fc5b
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.Maximized
push 0xa
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ebx, [esp + 0xa8]
lea eax, [esp + 0x118]
mov ecx, ebx
push eax
call fcn.10041ab0
add esp, 4
cmp byte [ebx + 4], 1
mov ebx, dword [ebx]
lea ecx, [esp + 0x118]
je 0x10040924
call fcn.10042450
mov edx, dword [esp + 0xc]
test ebx, ebx
lea ecx, [esp + 0x118]
mov eax, 7
setne byte [0x1007b5c0]
mov dword [ecx + 0x14], eax
xor eax, eax
mov ebx, ecx
mov dword [ecx + 0x10], eax
mov word [ecx], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.CssToDevPixelScaling
push 0x15
call fcn.10042600
add esp, 4
xor eax, eax
mov ebx, 8
mov dword [esp + 0xac], eax
mov dword [esp + 0xa8], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x50], ebx
cmp dword [eax + 0x14], 7
jbe 0x1004061e
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0xac]
push ecx
mov ecx, 0
push ecx
push ebx
push eax
push ecx
push dword [esp + 0x20]
call dword [sym.imp.advapi32.dll_RegGetValueW]
lea ecx, [esp + 0x50]
movsd xmm0, qword [esp + 0xa8]
mov dword [esp + 0x1c], eax
xor ebx, dword [ecx]
lea ecx, [esp + 0x118]
movsd qword [esp + 0x20], xmm0
call fcn.10042450
or ebx, dword [esp + 0x1c]
je 0x10040677
movsd xmm0, qword [0x1006c390]
movsd qword [esp + 0x20], xmm0
jne 0x1004092e
movsd xmm0, qword [esp + 0x20]
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov ecx, ebx
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], 0
mov word [ebx], 0
movsd qword [0x1007b5b8], xmm0
call fcn.100424a0
mov ecx, ebx
mov edx, str.UrlbarCSSSpan
push 0xe
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041b20
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 0xc], 1
je 0x10040943
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x20], 0x10
cmp eax, 0x10
mov dword [esp], ecx
je 0x1004072b
xor ecx, ecx
mov dword [esp + 0xa8], 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xac], ecx
mov edx, dword [esp + 0xc]
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.SearchbarCSSSpan
push 0x11
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041b20
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 0xc], 1
je 0x1004094f
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x1c], 0x10
cmp eax, 0x10
mov dword [esp + 0x18], ecx
je 0x100407d9
xor ecx, ecx
mov dword [esp + 0xa8], 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xac], ecx
mov edx, dword [esp + 0xc]
mov ecx, 7
lea ebx, [esp + 0x118]
xor eax, eax
mov dword [esp + 0x12c], ecx
mov ecx, ebx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x7c], 0x10
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.SpringsCSSSpan
push 0xf
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041b20
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 0xc], 1
je 0x1004095d
mov edx, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
cmp edx, 0x10
mov dword [esp + 0x2c], edx
je 0x100408ae
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 0xa8], 0x10
mov dword [esp + 0x84], eax
mov dword [esp + 0xb0], edx
mov dword [esp + 0xac], edx
mov dword [esp + 0x7c], ecx
jmp 0x100408c4
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], 0x10
cmp dword [esp], 0
mov ebx, 0xe
mov al, 1
mov dword [esp], eax
je 0x100408df
cmp dword [esp + 0x18], 0
jne 0x1004096b
cmp dword [esp + 0x2c], 0x10
je 0x100408f3
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [esp + 0x1c], 0x10
je 0x10040907
push dword [esp + 0x1c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [esp + 0x20], 0x10
je 0x1003fc5b
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x1003fc5b
call fcn.10042450
jmp 0x1003fc5b
movsd xmm0, qword [esp + 0x20]
movsd qword [esp + 0x30], xmm0
mov ebx, dword [esp + 0x30]
jmp 0x1003fc5b
mov ebx, dword [esp + 0xa8]
jmp 0x1003fc5b
mov ebx, dword [esp + 0xa8]
mov al, 1
mov dword [esp], eax
jmp 0x10040907
mov ebx, dword [esp + 0xa8]
mov al, 1
mov dword [esp], eax
jmp 0x100408f3
mov edx, dword [esp + 0xc]
mov ecx, 7
lea ebx, [esp + 0x118]
xor eax, eax
mov dword [esp + 0x12c], ecx
mov ecx, ebx
mov dword [esp + 0x128], eax
mov dword [esp + 0x78], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.Flags
push 6
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 4], 1
mov ebx, dword [eax]
mov al, 1
mov dword [esp], eax
je 0x100408df
mov edx, dword [esp + 0xc]
mov dword [esp + 0x78], ebx
lea ebx, [esp + 0x118]
mov eax, 7
mov dword [esp + 0x128], 0
mov ecx, ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x118], 0
call fcn.100424a0
mov ecx, ebx
mov edx, str.Theme
push 6
call fcn.10042600
add esp, 4
mov edx, dword [esp + 8]
lea ecx, [esp + 0xa8]
push ebx
call fcn.10041ab0
add esp, 4
mov ecx, ebx
call fcn.10042450
lea eax, [esp + 0xa8]
cmp byte [eax + 4], 1
mov ebx, dword [eax]
je 0x100408df
cmp ebx, 1
je 0x10040aa3
xorps xmm0, xmm0
cmp ebx, 3
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
je 0x10040ae6
cmp ebx, 2
jne 0x10040ab9
mov dword [esp + 0x50], 0x323234
mov edx, 0x5a5a5c
mov dword [esp], 0x474749
mov ebx, 0xc0c0d
mov ecx, 0x6a6a6b
mov eax, 0xc0c0d
mov dword [esp + 0x18], 0x474749
jmp 0x10040b11
call fcn.1003f4b0
xorps xmm0, xmm0
test al, al
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
jne 0x10040a76
mov dword [esp + 0x50], 0xf9f9fa
mov dword [esp + 0x18], 0xf9f9fa
mov edx, 0xbebebe
mov dword [esp], 0xffffff
mov eax, 0xe2e1e3
mov ebx, 0x202340
mov ecx, 0xe5e5e5
jmp 0x10040b11
mov eax, 0xcccccc
mov ebx, 0xe3e4e6
mov ecx, 0xd9dadb
mov edx, 0xcccccc
mov dword [esp + 0x50], 0xf5f6f7
mov dword [esp + 0x18], 0xf5f6f7
mov dword [esp], 0xffffff
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], eax
mov eax, dword [esp]
mov dword [esp + 0x60], 0xa84ff
cmp dword [esp + 0x10], 0x10000
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
mov al, 1
mov dword [esp], eax
ja 0x10040cf0
cmp dword [esp + 0x14], 0x10000
ja 0x10040cf0
movzx ebx, byte [0x1007b5c0]
mov ecx, dword [0x1007b570]
mov dword [esp + 0x18], ebx
shl ebx, 0x18
or ebx, 0x2cf0000
call dword [section..00cfg]
xor eax, eax
push eax
push edi
push eax
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
push dword [esp + 0x20]
push ebx
push 0x100724b2
push str.MozillaWindowClass
push 0x100
call ecx
test eax, eax
mov dword [0x1007b5d8], eax
je 0x10040cfd
mov edi, eax
xor eax, eax
cmp byte [esp + 0x18], 0
mov ecx, dword [0x1007b574]
setne al
lea ebx, [eax + eax + 1]
call dword [section..00cfg]
push ebx
push edi
call ecx
mov ecx, dword [0x1007b560]
mov edi, dword [0x1007b5d8]
call dword [section..00cfg]
push edi
call ecx
mov ecx, dword [0x1007b55c]
mov edi, eax
mov dword [0x1007b5ec], eax
call dword [section..00cfg]
push edi
push 0x20
call ecx
mov ecx, dword [0x1007b55c]
mov ebx, dword [0x1007b5ec]
mov edi, eax
call dword [section..00cfg]
mov esi, 0x5c
push ebx
push esi
call ecx
mov ecx, dword [0x1007b55c]
add eax, edi
mov edi, dword [0x1007b5ec]
mov dword [0x1007b5c8], eax
call dword [section..00cfg]
push edi
push 0x21
call ecx
mov ecx, dword [0x1007b55c]
mov ebx, dword [0x1007b5ec]
mov edi, eax
call dword [section..00cfg]
push ebx
push esi
call ecx
add eax, edi
cmp byte [0x1007b5c0], 0
mov dword [0x1007b5c4], eax
je 0x10040d0a
mov ecx, dword [0x1007b58c]
mov esi, dword [0x1007b5d8]
call dword [section..00cfg]
push 0
push esi
call ecx
test eax, eax
je 0x10040ce3
mov ecx, dword [0x1007b590]
mov edi, eax
xor eax, eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x118], 0x28
call dword [section..00cfg]
lea eax, [esp + 0x118]
push eax
push edi
call ecx
test eax, eax
jne 0x10040d19
mov dword [esp + 4], 0x10
jmp 0x10040eea
mov dword [esp + 4], 0xf
jmp 0x10040eea
mov dword [esp + 4], 0x11
jmp 0x10040eea
mov eax, dword [esp + 0x10]
mov dword [0x1007b5a4], eax
mov eax, dword [esp + 0x14]
jmp 0x10040d4b
mov eax, dword [esp + 0x134]
mov edx, dword [0x1007b5c8]
mov ecx, dword [esp + 0x138]
sub eax, dword [esp + 0x12c]
sub ecx, dword [esp + 0x130]
lea eax, [eax + edx*2]
mov dword [0x1007b5a4], eax
mov eax, dword [0x1007b5c4]
lea eax, [ecx + eax*2]
mov ecx, dword [0x1007b578]
mov esi, dword [0x1007b5d8]
mov dword [0x1007b5d0], eax
call dword [section..00cfg]
xor eax, eax
push 0x237
push eax
push eax
push eax
push eax
push eax
push esi
call ecx
mov eax, dword [esp + 0x1c]
mov edx, dword [0x1007b5d8]
movsd xmm2, qword [eax]
movsd xmm3, qword [eax + 8]
mov eax, dword [esp + 0x20]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
sub esp, 0x18
lea ecx, [esp + 0x94]
lea ebx, [esp + 0x130]
lea eax, [esp + 0x90]
lea esi, [esp + 0x68]
movsd qword [esp], xmm3
mov dword [esp + 8], ecx
mov ecx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
call fcn.1003d310
add esp, 0x18
cmp byte [ebx + 4], 1
je 0x10040edf
cmp dword [0x1007b5cc], 0
je 0x10040df6
xor eax, eax
push eax
push eax
push eax
push 0x1003eee0
push 0x40000
push eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x1007b5e0], eax
push 1
push ebx
call sym.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::NowUnfuzzed_bool_
add esp, 8
movsd xmm1, qword [esp + 0x90]
lea eax, [esp + 0x120]
lea esi, [esp + 0xa8]
movsd xmm0, qword [esp + 0x98]
movsd xmm3, qword [esp + 0x88]
xor edx, edx
mov ecx, 0xc
movsd xmm2, qword [eax - 8]
mov edi, eax
movsd qword [esi + 8], xmm1
movsd xmm1, qword [eax]
movsd qword [esi + 0x10], xmm0
movsd qword [esi], xmm3
movsd qword [esi + 0x18], xmm2
movsd qword [esi + 0x20], xmm1
movsd xmm1, qword [eax + 8]
mov dword [eax - 8], edx
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], edx
movsd qword [esi + 0x28], xmm1
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x44]
mov byte [eax + 0x30], 1
lea ecx, [esp + 0x38]
mov dword [esi], str.CreatePreXULSkeletonUI
mov dword [esi + 4], 0x16
mov dword [esi + 8], edx
mov edx, esi
push ebx
call fcn.10042340
add esp, 4
cmp dword [esi + 8], 2
jne 0x10040eb0
mov eax, dword [esp + 0x44]
test eax, eax
je 0x10040eb0
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
mov esi, dword [esp + 0x15c]
mov dword [esp + 0x15c], 0
test esi, esi
je 0x10040ed6
mov ecx, esi
call fcn.10018c30
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
mov dword [esp], 0
jmp 0x10040eea
mov eax, dword [esp + 0x118]
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
jmp 0x100408df