Function at 0x14003c390
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov edi, 0x80070057
cmp ecx, 2
jl 0x14003c638
mov rsi, rdx
cmp qword [rdx + 8], 0
je 0x14003c638
mov ebx, ecx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003c4f6
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c4fd
mov rcx, qword [rsi + 8]
lea rdx, str.unregister_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c5a1
mov rcx, qword [rsi + 8]
lea rdx, str.debug_remote_disabled
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cbd7
lea rcx, [0x1400a0353]
lea rdx, str.DisableDefaultBrowserAgent
call fcn.140031b10
mov edi, 0x800704ec
test al, al
jne 0x14003c5bd
mov rcx, qword [rsi + 8]
lea rdx, [0x1400a242a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c666
mov rcx, qword [rsi + 8]
lea rdx, str.update_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c6df
mov rcx, qword [rsi + 8]
lea rdx, str.do_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c8f4
mov rcx, qword [rsi + 8]
lea rdx, str.set_default_browser_user_choice
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
test eax, eax
jne 0x14003c5bd
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003c5bd
add rsi, 0x18
mov rdx, rsi
call fcn.1400350e0
jmp 0x14003c5bb
mov edi, eax
jmp 0x14003c638
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
cmp qword [rsi + 0x10], 0
je 0x14003c5bd
lea rcx, [rsp + 0x68]
call fcn.14003deb0
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400024e0
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003c578
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20107
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003c88e
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
test rcx, rcx
je 0x14003c596
call fcn.140057540
mov rcx, qword [rsi + 0x10]
mov edx, 1
jmp 0x14003c5b6
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003c5bd
xor edx, edx
call fcn.140034ad0
mov edi, eax
cmp byte [rsp + 0x70], 0
mov rsi, qword [rsp + 0x68]
je 0x14003c61f
test rsi, rsi
je 0x14003c5fd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14003c61f
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_release_registry_mutex
lea r8, str.Release
mov r9d, 0xc8
call fcn.14002ce90
jmp 0x14003c61f
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpectedly_missing_registry_mutex
lea r8, str.Release
mov r9d, 0xc3
call fcn.14002ce90
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003c632
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.140058660
mov eax, edi
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
cmp qword [rsi + 0x10], 0
je 0x14003c5bd
lea rcx, [rsp + 0x68]
call fcn.14003deb0
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032600
mov eax, dword [rdi]
test eax, eax
je 0x14003c6cf
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002ce90
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.140033390
jmp 0x14003c5bb
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
cmp qword [rsi + 0x10], 0
je 0x14003c5bd
lea rcx, [rsp + 0x68]
call fcn.14003deb0
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032600
mov eax, dword [rdi]
test eax, eax
je 0x14003c748
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002ce90
mov rbx, qword [rsi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140065030]
lea r9, [0x140065020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003cd4f
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
lea rbp, [rsp + 0x2e0]
movaps xmmword [rbp], xmm0
xor eax, eax
mov qword [rbp + 0x10], rax
lea r9, [rsp + 0x2b0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x330]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x310]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], rbp
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cd69
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
lea rcx, [0x1400a2d34]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
test rcx, rcx
je 0x14003c82e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x14005783e.0]
test eax, eax
jns 0x14003cdb3
mov rcx, rbx
xor edx, edx
call fcn.140033390
mov edi, eax
test rsi, rsi
je 0x14003c86b
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14003cd86
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
jmp 0x14003cd86
mov r15, qword [rsp + 0x2e0]
lea rax, [rsp + 0x2b0]
mov dword [rax], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x58], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14003cc2d
test r15, r15
je 0x14003c578
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003c578
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c5bd
cmp qword [rsi + 0x10], 0
je 0x14003c5bd
lea rcx, [rsp + 0x68]
call fcn.14003deb0
mov edi, 0x80070020
test al, al
je 0x14003c5bd
lea r8, str.AppLastRunTime
lea rbp, [rsp + 0xb0]
mov rcx, rbp
xor edx, edx
call fcn.1400327e0
cmp dword [rbp + 0x10], 0
jne 0x14003cda9
cmp byte [rsp + 0xb8], 0
je 0x14003cda9
mov rdi, qword [rsp + 0xb0]
lea rbx, [rsp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x14003c98e
mov edi, 0x80041324
movabs rcx, 0x46b8e92d7fff
cmp rax, rcx
ja 0x14003c5bd
xor edi, edi
call fcn.140032c20
test al, al
jne 0x14003c5bd
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x20], rbx
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor r15d, r15d
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003ce4b
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rbp
lea rdx, str.http
mov r8d, 1
mov r9d, 1
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cf81
mov r14, qword [rsp + 0xb0]
xor r15d, r15d
mov r8d, 0x200
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2b0]
mov dword [rax], 0x100
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov edx, 4
mov r8, r14
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003cfb7
lea rdx, [0x1400a1588]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cfe7
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0xb0]
mov r8d, 0xd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0d4
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0xb0]
mov r8d, 0xe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0db
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0xb0]
mov r8d, 0x11
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0e2
lea rdx, [0x1400a2d28]
lea rcx, [rsp + 0xb0]
mov edi, 5
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0e9
lea rdx, str.Brave
lea rcx, [rsp + 0xb0]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0ee
lea rdx, str.Yandex
lea rcx, [rsp + 0xb0]
mov edi, 6
mov r8d, 6
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0ee
lea rdx, str.QQBrowser
lea rcx, [rsp + 0xb0]
mov r8d, 9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d69a
lea rdx, str.360
lea rcx, [rsp + 0xb0]
mov edi, 8
mov r8d, 8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d0ee
lea rdx, [0x1400a1370]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
xor r15d, r15d
mov edi, 0
test eax, eax
jne 0x14003d124
mov edi, 9
jmp 0x14003d0ee
call fcn.140032c20
movzx esi, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_IsAgentRemoteDisabled:
call fcn.14005b230
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor edi, edi
jmp 0x14003c5bd
mov edi, dword [rsp + 0x2b0]
inc edi
mov dword [rsp + 0x2b0], edi
lea r14, [rdi + rdi]
mov rcx, r14
call fcn.14005766c
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x330]
mov dword [r9], edi
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
xor edx, edx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0
test eax, eax
jne 0x14003cd1a
xorps xmm6, xmm6
lea r14, [rsp + 0x330]
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
mov rdi, qword [rsp + 0xb0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cce3
inc r12d
mov rcx, rbx
mov dx, 0x7c
call sub.VCRUNTIME140.dll_wcschr
test rax, rax
movzx ebp, bpl
mov eax, 1
cmovne ebp, eax
jmp 0x14003ccef
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsp + 0x2b0]
mov dword [rsp + 0x330], eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov edx, r12d
mov r8, rbx
mov r9, r14
call r13
test eax, eax
je 0x14003cca0
test r15, r15
je 0x14003cd28
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, 1
jne 0x14003cd42
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, rbx
call fcn.140057540
jmp 0x14003c578
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfc
jmp 0x14003cd81
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfe
call fcn.14002cd80
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14003c5bd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
jmp 0x14003c5bd
mov edi, 0x80041324
jmp 0x14003c5bd
lea rdi, [rsp + 0xb0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [0x1400a38c4]
mov edx, 0x1e
mov rcx, rdi
call fcn.14005b130
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rdi + 0x10]
mov rbp, qword [rdi + 0x18]
mov rdx, rbp
sub rdx, rcx
cmp rdx, rax
jb 0x14003d0b7
lea r14, [rcx + rax]
mov qword [rsp + 0xc0], r14
cmp rbp, 8
jb 0x14003ce1d
mov rdi, qword [rsp + 0xb0]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rbx
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], 0
cmp qword [rsp + 0xc8], 8
jb 0x14003ce6d
mov rcx, qword [rsp + 0xb0]
jmp 0x14003ce75
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x41
call fcn.14002cd80
jmp 0x14003d132
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x98]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov rdx, r14
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cfa6
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cfd9
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003d016
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov edx, 1
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cfee
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x78]
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003cfee
mov rbp, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, rbp
call fcn.140033390
mov edi, eax
test rbp, rbp
je 0x14003cffa
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003cffa
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x4c
call fcn.14002cd80
xor r15d, r15d
jmp 0x14003d132
mov rcx, rbx
xor edx, edx
call fcn.140033390
mov edi, eax
jmp 0x14003d056
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x5c
call fcn.14002cd80
jmp 0x14003d124
mov rcx, rbx
xor edx, edx
call fcn.140033390
mov edi, eax
jmp 0x14003d03c
xor edi, edi
jmp 0x14003d0ee
mov rcx, rbx
xor edx, edx
call fcn.140033390
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14003d022
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
jmp 0x14003d022
mov rcx, rbx
xor edx, edx
call fcn.140033390
mov edi, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14003d03c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14003d056
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14003d070
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
test r14, r14
je 0x14003d07e
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x14003c85d
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003d7b6
call fcn.140057540
jmp 0x14003c85d
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
mov rdx, rax
mov r9, rbx
call fcn.14005afe0
jmp 0x14003ce36
mov edi, 1
jmp 0x14003d0ee
mov edi, 2
jmp 0x14003d0ee
mov edi, 3
jmp 0x14003d0ee
mov edi, 4
lea rax, [rdi + rdi*2]
lea rcx, [0x14006ad90]
mov r15d, dword [rcx + rax*8 + 0x10]
cmp r15d, 4
jne 0x14003d122
lea rdx, str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
mov r8d, 0x24
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d1a7
xor edi, edi
test r14, r14
je 0x14003d132
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003d14c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
test edi, edi
jne 0x14003c5bd
cmp r15d, 0xb
ja 0x14003d1b4
movsxd rax, r15d
lea rcx, [0x14006aff0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov r9, qword [rax]
mov rdi, qword [rax + 8]
lea rcx, [rsp + 0x330]
cmp rdi, 0xf
jbe 0x14003d1d6
mov rdx, rdi
call fcn.1400011a0
jmp 0x14003d1ed
xor edi, edi
mov r15d, 3
jmp 0x14003d124
mov qword [rsp + 0x348], 0xf
mov qword [rsp + 0x340], 0
mov byte [rsp + 0x330], 0
jmp 0x14003d1ed
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x330], 0
lea r8, [0x1400a1980]
lea rcx, [rsp + 0xb0]
mov edx, 1
xor r9d, r9d
call fcn.14002f6b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov rbp, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d231
mov r14, qword [rsp + 0x330]
jmp 0x14003d239
lea r14, [rsp + 0x330]
cmp rbp, 0xf
ja 0x14003d722
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x2b0], xmm0
mov edi, 0xf
mov qword [rsp + 0x2c0], rbp
mov qword [rsp + 0x2c8], rdi
mov byte [rsp + 0x2d0], 1
cmp dword [rsp + 0xd8], 0
lea rcx, [rsp + 0x308]
jne 0x14003dda5
lea rdx, [rsp + 0xd8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2f0], xmm0
movaps xmmword [rsp + 0x2e0], xmm0
mov byte [rsp + 0x300], 0
call fcn.14005b4d0
cmp byte [rsp + 0x2d0], 0
je 0x14003d2e6
mov rax, qword [rsp + 0x2c8]
cmp rax, 0x10
jae 0x14003d631
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2c8], 0xf
mov byte [rsp + 0x2b0], 0
cmp byte [rsp + 0x300], 0
je 0x14003d30d
mov rdi, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x14003d332
mov rbx, qword [rsp + 0x2e0]
jmp 0x14003d332
mov rdi, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d32a
mov rbx, qword [rsp + 0x330]
jmp 0x14003d332
lea rbx, [rsp + 0x330]
cmp rdi, 0xf
ja 0x14003d76c
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x310], xmm0
mov ebp, 0xf
cmp byte [rsp + 0x300], 0
je 0x14003d388
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jae 0x14003d654
mov qword [rsp + 0x2f0], 0
mov qword [rsp + 0x2f8], 0xf
mov byte [rsp + 0x2e0], 0
cmp dword [rsp + 0xd8], 0
jne 0x14003d3ae
cmp byte [rsp + 0xd0], 0
je 0x14003d3ae
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x14003d677
cmp qword [rsp + 0x348], 0x10
jb 0x14003d3c3
mov r8, qword [rsp + 0x330]
jmp 0x14003d3cb
lea r8, [rsp + 0x330]
lea rdx, [0x1400a1980]
lea rcx, [rsp + 0xb0]
xor r9d, r9d
call fcn.14002ebb0
cmp rbp, 0x10
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
cmovae rax, rcx
cmp rdi, 0xb
ja case.0x14003d40d.1
lea rdx, [0x14003de80]
movsxd rbx, dword [rdx + rdi*4]
add rbx, rdx
jmp rbx
movzx eax, word [rax]
rol ax, 8
movzx eax, ax
cmp eax, 0x6965
jne case.0x14003d40d.1
movabs rdi, 0x500000000
jmp case.0x14003d40d.0
mov edx, dword [rax]
bswap edx
mov ebx, 0x66697265
cmp edx, 0x66697265
jne 0x14003d458
mov edx, dword [rax + 3]
bswap edx
mov ebx, 0x65666f78
xor eax, eax
cmp edx, 0x65666f78
je 0x14003d463
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d40d.1
movabs rdi, 0x100000000
jmp case.0x14003d40d.0
movabs rbx, 0x71712d62726f7773
mov rdx, qword [rax]
bswap rdx
cmp rdx, rbx
jne 0x14003d4a9
movzx eax, word [rax + 8]
rol ax, 8
movzx edx, ax
xor eax, eax
cmp edx, 0x6572
je 0x14003d4b5
mov ebx, 0x6572
xor eax, eax
cmp rdx, rbx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d40d.1
movabs rdi, 0x900000000
jmp case.0x14003d40d.0
movabs rdx, 0x656467652d636872
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d4f9
movabs rdx, 0x652d6368726f6d65
mov rbx, qword [rax + 3]
bswap rbx
xor edi, edi
cmp rbx, rdx
je 0x14003d506
xor edi, edi
cmp rbx, rdx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003d6c7
movabs rdx, 0x3336302d62726f77
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d53b
movabs rdx, 0x2d62726f77736572
mov rbx, qword [rax + 3]
bswap rbx
xor eax, eax
cmp rbx, rdx
je 0x14003d547
xor eax, eax
cmp rbx, rdx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d40d.1
movabs rdi, 0xa00000000
jmp case.0x14003d40d.0
mov eax, dword [rax]
bswap eax
xor edx, edx
cmp eax, 0x65646766
setae dl
cmp eax, 0x65646765
sbb edx, 0
jne case.0x14003d40d.1
movabs rdi, 0x300000000
jmp case.0x14003d40d.0
mov edx, dword [rax]
bswap edx
cmp edx, 0x6f706572
jne 0x14003d6a4
movzx edx, byte [rax + 4]
add edx, 0xffffff9f
jmp 0x14003d6ae
mov edx, dword [rax]
bswap edx
mov ebx, 0x6368726f
cmp edx, 0x6368726f
jne 0x14003d5d0
movzx edx, word [rax + 4]
rol dx, 8
movzx edx, dx
mov ebx, 0x6d65
xor edi, edi
cmp edx, 0x6d65
je 0x14003d5dc
xor edi, edi
cmp edx, ebx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003d6e5
mov edx, dword [rax]
bswap edx
mov ebx, 0x79616e64
cmp edx, 0x79616e64
jne 0x14003d60f
movzx eax, word [rax + 4]
rol ax, 8
movzx edx, ax
mov ebx, 0x6578
xor eax, eax
cmp edx, 0x6578
je 0x14003d61a
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d40d.1
movabs rdi, 0x800000000
jmp case.0x14003d40d.0
mov rcx, qword [rsp + 0x2b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003de17
call fcn.140057540
jmp 0x14003d2c6
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003de37
call fcn.140057540
jmp 0x14003d368
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003de57
call fcn.140057540
jmp 0x14003d3ae
mov edi, 7
jmp 0x14003d0ee
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003d6d6
mov edx, dword [rax]
bswap edx
cmp edx, 0x62726176
jne 0x14003d6f4
movzx edx, byte [rax + 4]
add edx, 0xffffff9b
jmp 0x14003d6fe
movabs rdi, 0x400000000
jmp case.0x14003d40d.0
movabs rdi, 0x600000000
jmp case.0x14003d40d.0
movabs rdi, 0x200000000
jmp case.0x14003d40d.0
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003d7dd
mov edx, dword [rax]
bswap edx
cmp edx, 0x736f676f
jne 0x14003d7e9
movzx eax, byte [rax + 4]
add eax, 0xffffff8b
jmp 0x14003d7f3
mov rdi, rbp
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003dd71
lea rcx, [rdi + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x2b0], rcx
lea r8, [rbp + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d254
mov rbp, rdi
or rbp, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
cmovae rbp, rax
cmp rbp, 0xfff
jae 0x14003dd8b
lea rcx, [rbp + 1]
call fcn.140057550
mov rcx, rax
mov qword [rsp + 0x310], rcx
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d34c
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003de77
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003d0ad
movabs rdi, 0x700000000
jmp case.0x14003d40d.0
setae al
movzx eax, al
add eax, eax
dec eax
test eax, eax
je 0x14003dd62
xor edi, edi
cmp rbp, 0x10
jae 0x14003d9c0
mov rax, qword [rsp + 0x348]
cmp rax, 0x10
jae 0x14003d9dd
mov eax, r15d
or rdi, rax
mov qword [rsp + 0x330], rdi
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003d931
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea r14, [rsp + 0x2b0]
mov qword [rsp + 0x20], r14
lea rdx, str..pdf
xor r8d, r8d
mov r9d, 1
call qword [case.0x14005783e.0]
test eax, eax
js 0x14003d94b
mov rdi, qword [rsp + 0x2b0]
mov dword [rsp + 0x2b0], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003d987
mov ebp, dword [rsp + 0x2b0]
add rbp, rbp
mov rcx, rbp
call fcn.14005766c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003da00
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140032220
jmp 0x14003da37
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x1d
jmp 0x14003d963
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x27
call fcn.14002cd80
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], edi
jmp 0x14003da4d
mov ebx, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x36
call fcn.14002cd80
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebx
jmp 0x14003da3f
cmp rbp, 0xfff
jae 0x14003ddb2
inc rbp
mov rdx, rbp
call fcn.140057540
jmp 0x14003d807
mov rcx, qword [rsp + 0x330]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003ddd3
call fcn.140057540
jmp 0x14003d819
mov ebp, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x3f
call fcn.14002cd80
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebp
mov rcx, rbx
call fcn.140057540
test rdi, rdi
je 0x14003da4d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003da67
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14005783e.0]
mov edi, dword [rsp + 0xd0]
test edi, edi
jne 0x14003c5bd
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x2e0], xmm0
movups xmmword [rsp + 0x2f0], xmm1
mov rsi, qword [rsi + 0x10]
mov eax, dword [0x1400aa4c0]
cmp eax, 0x9ffffff
ja 0x14003db4c
mov eax, dword [0x1400aa088]
cmp eax, 0xa000001
jb 0x14003dcc9
lea rdi, [rsp + 0xbc]
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0xa0000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rdi
lea rcx, [rsp + 0xb0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14003dcbe
mov eax, 0xa000000
xchg dword [0x1400aa4c0], eax
lea r8, str.InitialNotificationShown
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032400
cmp dword [rdi + 4], 0
jne 0x14003dc96
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003dc96
movzx eax, al
test ax, ax
je 0x14003dc96
lea r8, str.FollowupRequestTime
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.1400327e0
xor ebp, ebp
cmp byte [rdi + 8], 0
mov ebx, 0
je 0x14003dbc2
mov rbx, qword [rsp + 0xb0]
lea rdi, [rsp + 0xb0]
cmp dword [rdi + 0x10], 0
cmovne rbx, rbp
lea r8, str.FollowupNotificationShown
mov rcx, rdi
mov edx, 1
call fcn.140032400
cmp dword [rdi + 4], 0
jne 0x14003dc05
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
setae cl
test al, al
setne bpl
and bpl, cl
test rbx, rbx
je 0x14003dcf2
test bpl, bpl
jne 0x14003dcf2
lea r8, str.FollowupNotificationSuppressed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032400
cmp dword [rdi + 4], 0
jne 0x14003dc54
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003dc54
movzx eax, al
test ax, ax
jne 0x14003dcf2
lea rdi, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rdi]
sub rax, rbx
jbe 0x14003dcf2
shr rax, 0xe
cmp rax, 0x1600a391
jb 0x14003dcf2
cmp dword [rsp + 0x330], 4
jne 0x14003dcd6
lea rcx, [rsp + 0xb0]
mov edx, 1
jmp 0x14003dcb4
cmp dword [rsp + 0x330], 4
jne 0x14003dcc9
cmp dword [rsp + 0x334], 1
jne 0x14003dcc9
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rsi
call fcn.140030040
jmp 0x14003dd0f
mov eax, 0xa000000
xchg dword [0x1400aa088], eax
mov dword [rsp + 0xb0], 0
jmp 0x14003dcfd
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0xb0]
mov edx, 1
mov r9b, 1
call fcn.140032600
mov dword [rsp + 0xb0], 1
movabs rax, 0x700000000
mov qword [rsp + 0xb4], rax
lea rcx, [rsp + 0x330]
lea rsi, [rsp + 0x2e0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
call fcn.140036900
mov edi, eax
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14003c5bd
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003ddf7
call fcn.140057540
jmp 0x14003c5bd
movabs rdi, 0xb00000000
jmp case.0x14003d40d.0
lea rcx, [rdi + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003d753
lea rcx, [rbp + 0x28]
call fcn.140057550
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003d79d
lea rdx, [rsp + 0x2d8]
jmp 0x14003d28a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003de77
add rbp, 0x28
mov rcx, rax
jmp 0x14003d9d0
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003de77
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003d9f6
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003de77
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003dd58
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003de77
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003d64a
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003de77
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003d66d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003de77
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003d690
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3