Function at 0x1401ebca0
Capabilities:
Gather firefox profile information
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov r12d, r8d
mov rbx, rdx
mov r13, rcx
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x70], edi
lea ecx, [rdi + 0x30]
call fcn.1402bcb4c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ebd0b
lea r8d, [rdi + 1]
mov rdx, rbx
mov rcx, rax
call fcn.14020be90
mov r14, rax
mov qword [rsp + 0x90], rax
jmp 0x1401ebd16
mov r14, rdi
mov qword [rsp + 0x90], rdi
lea rax, vtable.Core::SharedPtr_class_Core::Data::SqliteConnection_.0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], r14
mov rdx, rdi
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0xc0], rdx
test r14, r14
je 0x1401ebd84
mov ecx, 4
call fcn.1402bcb4c
mov rdx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1401ebd6b
mov dword [rax], edi
mov qword [rsp + 0xc0], rax
jmp 0x1401ebd7e
mov rdx, rdi
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0xc0], rdx
mov dword [rdx], 1
mov dword [r14 + 0x24], 0x3e8
mov rax, qword [r14 + 0x28]
mov rcx, qword [rax]
test rcx, rcx
je 0x1401ebda2
mov edx, 0x3e8
call fcn.1402925b0
lea rdx, [r14 + 0x10]
mov r8d, dword [r14 + 0x24]
mov rcx, qword [r14 + 0x28]
call fcn.14020bd00
mov byte [r14 + 0x20], al
test al, al
jne 0x1401ec1a5
mov rax, qword [r13 + 0x18]
cmp byte [rax + 0x30], 0
je 0x1401ebeee
mov ecx, 0x108
call fcn.1402bcb4c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ebdf6
mov r8, qword [r13 + 0x18]
mov rdx, qword [r8 + 0x2f0]
mov rcx, rax
call fcn.1400d0aa0
jmp 0x1401ebdf9
mov rax, rdi
mov rcx, rax
call fcn.1400d15a0
cmp eax, 1
jne 0x1401ec018
xor ecx, ecx
mov r14d, ecx
lea rsi, str.msedge.exe
lea rax, [0x14034d1a0]
nop dword [rax]
movsxd rdi, r14d
cmp rdi, 9
jae 0x1401ebece
add rdi, rdi
cmp r12d, dword [rsi + rdi*8 + 8]
jne 0x1401ebec6
mov rdi, qword [rsi + rdi*8]
test rdi, rdi
jne 0x1401ebe4d
mov ebx, ecx
mov qword [rsp + 0x38], rdi
jmp 0x1401ebe68
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401ebe51
mov qword [rsp + 0x38], 0
test ebx, ebx
jne 0x1401ebe6f
mov qword [rsp + 0x30], rax
jmp 0x1401ebe94
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
lea rcx, [rsp + 0x30]
call fcn.1401bd8c0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401ebebd
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
xor ecx, ecx
lea rax, [0x14034d1a0]
inc r14d
jmp 0x1401ebe20
mov r14, qword [rsp + 0x90]
lea rdx, [r14 + 0x10]
mov r8d, dword [r14 + 0x24]
mov rcx, qword [r14 + 0x28]
call fcn.14020bd00
xor edi, edi
jmp 0x1401ebff3
mov eax, dword [0x140431ac0]
test al, 1
jne 0x1401ebf26
or eax, 1
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
test rax, rax
je 0x1401ec018
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], 4
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.CookieCloseBrowsers
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1401ec010
cmp dword [rsp + 0x78], 1
jne 0x1401ec010
mov ebx, edi
lea rsi, str.msedge.exe
nop dword [rax]
movsxd rdx, ebx
cmp rdx, 9
jae 0x1401ebfe2
add rdx, rdx
cmp r12d, dword [rsi + rdx*8 + 8]
jne 0x1401ebfde
mov rdx, qword [rsi + rdx*8]
lea rcx, [rsp + 0x30]
call fcn.140200840
nop
lea rcx, [rsp + 0x30]
call fcn.1401bd8c0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401ebfde
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
inc ebx
jmp 0x1401ebfa0
lea rdx, [r14 + 0x10]
mov r8d, dword [r14 + 0x24]
mov rcx, qword [r14 + 0x28]
call fcn.14020bd00
lea rsi, [0x14034d1a0]
mov byte [r14 + 0x20], al
test al, al
jne 0x1401ec1ac
mov rbx, qword [rsp + 0x148]
jmp 0x1401ec01f
mov rbx, qword [rsp + 0x148]
lea rsi, [0x14034d1a0]
lea r9, str.Access_Denied
lea r8, [0x14034cf98]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140201ed0
nop
mov ecx, 0x70
call fcn.1402bcb4c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec112
mov qword [rsp + 0x38], 0
mov edx, 0xd
lea rcx, [rsp + 0x30]
call fcn.1402028a0
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r9d, 0xd
lea r8, str.Access_Denied
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, 0xd
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
or r15d, 1
mov dword [rsp + 0x70], r15d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400da430
nop
lea r13, vtable.HitmanPro35::Cookie.0
mov qword [rbx], r13
mov qword [rbx + 0x58], rsi
xor eax, eax
mov qword [rbx + 0x60], rax
mov edx, dword [rsp + 0x3c]
lea rcx, [rbx + 0x58]
call fcn.1402028a0
movsxd r9, dword [rsp + 0x3c]
mov eax, dword [rbx + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x58]
call fcn.1402c06dc
mov edx, dword [rsp + 0x3c]
lea rcx, [rbx + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieChromium.0
mov qword [rbx], rax
mov dword [rbx + 0x68], 0x11
jmp 0x1401ec115
mov rbx, rdi
mov qword [rsp + 0x88], rbx
test r15b, 1
je 0x1401ec134
cmp dword [rsp + 0x38], 0
jle 0x1401ec134
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
movzx eax, byte [0x140431252]
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x158]
call fcn.1401ed480
nop
cmp dword [rsp + 0x58], 0
jle 0x1401ec16f
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1401ec1a0
mov eax, dword [rbx]
test eax, eax
jle 0x1401ec186
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401ec1a0
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
mov rcx, rbx
call fcn.14021ae20
jmp 0x1401ecf7c
lea rsi, [0x14034d1a0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0
cmp r12d, 1
je 0x1401ec20a
lea eax, [r12 - 0xa]
cmp eax, 4
jbe 0x1401ec20a
mov edx, 0x38
lea rcx, [rsp + 0x30]
call fcn.1402028a0
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r9d, 0x38
lea r8, str.SELECT_DISTINCT_host_key_FROM_cookies_ORDER_BY_host_key_
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, 0x38
lea rcx, [rsp + 0x30]
call fcn.140203bb0
jmp 0x1401ec248
mov edx, 0x33
lea rcx, [rsp + 0x30]
call fcn.1402028a0
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r9d, 0x33
lea r8, str.SELECT_DISTINCT_host_FROM_moz_cookies_ORDER_BY_host
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, 0x33
lea rcx, [rsp + 0x30]
call fcn.140203bb0
mov ecx, 0x20
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x40], rax
xor r15d, r15d
test rax, rax
je 0x1401ec2bd
lea rax, vtable.Core::Data::SqliteCommand.0
mov qword [rdi], rax
mov qword [rdi + 0x10], r15
mov edx, dword [rsp + 0x3c]
test edx, edx
jne 0x1401ec286
mov qword [rdi + 8], rsi
jmp 0x1401ec2aa
lea rcx, [rdi + 8]
call fcn.1402028a0
movsxd r9, dword [rsp + 0x3c]
mov eax, dword [rdi + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
call fcn.1402c06dc
mov edx, dword [rsp + 0x3c]
lea rcx, [rdi + 8]
call fcn.140203bb0
mov qword [rdi + 0x18], r14
jmp 0x1401ec2c8
mov rdi, r15
mov qword [rsp + 0x88], r15
lea rax, vtable.Core::SharedPtr_class_Core::Data::SqliteCommand_.0
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rdi
mov rbx, r15
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0xf0], rbx
test rdi, rdi
je 0x1401ec32e
mov ecx, 4
call fcn.1402bcb4c
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1401ec318
mov dword [rax], r15d
mov qword [rsp + 0xf0], rax
jmp 0x1401ec328
mov rbx, r15
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0xf0], rbx
mov dword [rbx], 1
mov ecx, 0x18
call fcn.1402bcb4c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec35a
mov rdx, rdi
mov rcx, rax
call fcn.140212cc0
mov rsi, rax
mov qword [rsp + 0x98], rax
jmp 0x1401ec365
mov rsi, r15
mov qword [rsp + 0x98], r15
lea rax, vtable.Core::SharedPtr_class_Core::Data::SqliteDataReader_.0
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0xd8], r15
test rsi, rsi
je 0x1401ec3c9
mov ecx, 4
call fcn.1402bcb4c
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401ec3b2
mov dword [rax], r15d
mov qword [rsp + 0xd8], rax
jmp 0x1401ec3c2
mov r14, r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0xd8], r15
mov dword [r14], 1
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
call fcn.14000a340
mov qword [rsp + 0x60], rax
nop dword [rax]
mov rcx, qword [rsi + 0x10]
mov rcx, qword [rcx]
call fcn.140240730
cmp eax, 0x64
jne 0x1401ec55d
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140213040
nop
cmp dword [rsp + 0x5c], 1
jl 0x1401ec498
mov r8d, 1
lea rdx, [0x14034bd50]
mov rcx, qword [rsp + 0x50]
call fcn.1402c213c
test eax, eax
sete al
test al, al
je 0x1401ec498
mov r8d, 1
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140204810
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x50]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rsp + 0x58]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x50]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x50]
call fcn.140203bb0
nop
cmp dword [rsp + 0xa8], 0
jle 0x1401ec498
mov rcx, qword [rsp + 0xa0]
call fcn.1402bd0e0
lea rdx, [rsp + 0x50]
mov rcx, qword [r13 + 8]
call fcn.1400fd3c0
test al, al
je 0x1401ec543
mov rax, qword [rsp + 0x60]
mov rbx, qword [rax + 8]
mov rdi, rax
cmp byte [rbx + 0x19], 0
jne 0x1401ec511
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx + 0x20]
call fcn.1402bcf6c
test eax, eax
jns 0x1401ec4d8
mov rbx, qword [rbx + 0x10]
jmp 0x1401ec4de
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ec4c0
mov rax, qword [rsp + 0x60]
cmp rdi, rax
je 0x1401ec511
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1402bcf6c
test eax, eax
mov rax, qword [rsp + 0x60]
js 0x1401ec511
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
jmp 0x1401ec51b
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1401ec543
movzx eax, byte [0x14043124a]
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x60]
call fcn.1400eac70
nop
cmp dword [rsp + 0x58], 0
jle 0x1401ec3e0
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
jmp 0x1401ec3e0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rdi]
lea r13, vtable.HitmanPro35::Cookie.0
lea r15, vtable.HitmanPro35::CookieChromium.0
cmp rbx, rdi
je 0x1401ecdc0
lea r9, [rbx + 0x20]
lea r8, [0x14034cf98]
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x50]
call fcn.140201960
nop
cmp r12d, 2
jne 0x1401ec622
lea ecx, [r12 + 0x66]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec61b
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieChrome.0
mov qword [rdi], rax
jmp 0x1401ec61d
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 4
jne 0x1401ec6ae
lea ecx, [r12 + 0x6c]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec6a7
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieEdgeChromium.0
mov qword [rdi], rax
mov dword [rdi + 0x68], r12d
jmp 0x1401ec6a9
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 5
jne 0x1401ec733
lea ecx, [r12 + 0x6b]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec72c
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], r12d
jmp 0x1401ec72e
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 6
jne 0x1401ec7b8
lea ecx, [r12 + 0x6a]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec7b1
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], r12d
jmp 0x1401ec7b3
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 7
jne 0x1401ec83d
lea ecx, [r12 + 0x69]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec836
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], r12d
jmp 0x1401ec838
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 8
jne 0x1401ec8c2
lea ecx, [r12 + 0x68]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec8bb
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], r12d
jmp 0x1401ec8bd
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 9
jne 0x1401ec947
lea ecx, [r12 + 0x67]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec940
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], r12d
jmp 0x1401ec942
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 1
jne 0x1401ec9d3
lea ecx, [r12 + 0x6f]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ec9cc
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], r12d
jmp 0x1401ec9ce
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 3
jne 0x1401eca5b
lea ecx, [r12 + 0x6d]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401eca54
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
mov qword [rdi], r15
mov dword [rdi + 0x68], 0xa
jmp 0x1401eca56
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 0xa
jne 0x1401ecaea
lea ecx, [r12 + 0x66]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ecae3
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], 0xe
jmp 0x1401ecae5
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 0xb
jne 0x1401ecb76
lea ecx, [r12 + 0x65]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ecb6f
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], r12d
jmp 0x1401ecb71
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 0xc
jne 0x1401ecc05
lea ecx, [r12 + 0x64]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ecbfe
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], 0xf
jmp 0x1401ecc00
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 0xd
jne 0x1401ecc94
lea ecx, [r12 + 0x63]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ecc8d
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], 0xc
jmp 0x1401ecc8f
xor edi, edi
jmp 0x1401ecd1e
cmp r12d, 0xe
jne 0x1401ecd23
lea ecx, [r12 + 0x62]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401ecd1c
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400da430
nop
mov qword [rdi], r13
lea rax, [0x14034d1a0]
mov qword [rdi + 0x58], rax
xor eax, eax
mov qword [rdi + 0x60], rax
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rdi + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x58]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rdi + 0x58]
call fcn.140203bb0
nop
lea rax, vtable.HitmanPro35::CookieFirefox.0
mov qword [rdi], rax
mov dword [rdi + 0x68], 0xd
jmp 0x1401ecd1e
xor edi, edi
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x140431252]
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x158]
call fcn.1401ed480
nop
cmp dword [rsp + 0x58], 0
jle 0x1401ecd5a
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
je 0x1401ecd6a
mov rdi, qword [rsp + 0x60]
jmp 0x1401ec573
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ecd96
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ecd8c
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ecd80
mov rdi, qword [rsp + 0x60]
jmp 0x1401ec573
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ecdb3
cmp rbx, qword [rax + 0x10]
jne 0x1401ecdb3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ecda0
mov rbx, rax
mov rdi, qword [rsp + 0x60]
jmp 0x1401ec573
mov rbx, qword [rdi]
cmp rbx, rbx
jne 0x1401ece36
mov rsi, qword [rdi + 8]
mov rbx, rsi
cmp byte [rsi + 0x19], 0
jne 0x1401ece16
nop word [rax + rax]
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000a240
mov rbx, qword [rbx]
cmp dword [rsi + 0x28], 0
jle 0x1401ece00
mov rcx, qword [rsi + 0x20]
call fcn.1402bd0e0
mov rcx, rsi
call fcn.14021ae20
mov rsi, rbx
cmp byte [rbx + 0x19], 0
je 0x1401ecde0
mov rdi, qword [rsp + 0x60]
mov qword [rdi + 8], rdi
mov rax, qword [rsp + 0x60]
mov qword [rax], rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x68], 0
jmp 0x1401ecea2
cmp rbx, rdi
je 0x1401ecea7
nop dword [rax + rax]
mov r8, rbx
cmp byte [rbx + 0x19], 0
jne 0x1401ece8e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ece6e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ece8e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ece60
jmp 0x1401ece8e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ece8b
cmp rbx, qword [rax + 0x10]
jne 0x1401ece8b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ece78
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140008e20
cmp rbx, rdi
jne 0x1401ece40
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14021ae20
nop
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x1401eceef
mov eax, dword [r14]
test eax, eax
jle 0x1401ecec6
dec eax
mov dword [r14], eax
cmp dword [r14], 0
jne 0x1401eceef
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x1401ecee6
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov rcx, r14
call fcn.14021ae20
nop
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1401ecf28
mov eax, dword [rbx]
test eax, eax
jle 0x1401ecf03
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401ecf28
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1401ecf1f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, rbx
call fcn.14021ae20
nop
cmp dword [rsp + 0x38], 0
jle 0x1401ecf3a
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
nop
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1401ecf78
mov eax, dword [rbx]
test eax, eax
jle 0x1401ecf51
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401ecf78
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x1401ecf70
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
mov rcx, rbx
call fcn.14021ae20
mov al, 1
jmp 0x1401ecf7e
xor al, al
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret