Function at 0x140036530
Capabilities:
Access the windows event log
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7f8
movaps xmmword [rsp + 0x7e0], xmm6
mov r12, r8
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x7d8], rax
movsxd rax, dword [rcx]
cmp rax, 0xb
ja 0x140036612
lea rcx, [0x14006c260]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x320], 0
mov qword [rsp + 0x338], 0xf
mov byte [rsp + 0x320], 0
mov r14, qword [rax]
mov rdi, qword [rax + 8]
cmp rdi, 0xf
jbe 0x14003663a
test rdi, rdi
js 0x14003abdb
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003ac3c
lea rcx, [rbx + 1]
call fcn.140056c48
mov r15, rax
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0x338], rbx
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
mov qword [rsp + 0x320], r15
jmp 0x140036659
xor eax, eax
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x338], 0xf
mov qword [rsp + 0x330], rax
mov byte [rsp + 0x320], 0
jmp 0x140036659
lea rcx, [rsp + 0x320]
mov qword [rcx + 0x10], rdi
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x320], 0
mov r13, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140036667
mov rsi, qword [rsi]
cmp r13, 0xf
ja 0x14003667f
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x300], xmm0
mov edi, 0xf
jmp 0x1400366d7
mov rdi, r13
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x1400366b7
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400366c3
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x300], rcx
lea r8, [r13 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x310], r13
mov qword [rsp + 0x318], rdi
cmp dword [r12], 0
mov qword [rsp + 0x2f8], 0xf
jne 0x14003671f
mov dword [rsp + 0x2e3], 0x6c616974
mov dword [rsp + 0x2e0], 0x74696e69
mov byte [rsp + 0x2e7], 0
mov eax, 7
jmp 0x14003673e
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x2e8], 0
mov eax, 8
mov qword [rsp + 0x2f0], rax
mov eax, dword [r12 + 4]
cmp eax, 2
je 0x14003678e
cmp eax, 1
jne 0x1400367cc
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 5
mov dword [rsp + 0x2c0], 0x776f6873
mov byte [rsp + 0x2c4], 0x6e
jmp 0x1400367c5
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 5
mov dword [rsp + 0x2c0], 0x6f727265
mov byte [rsp + 0x2c4], 0x72
mov eax, 5
jmp 0x140036803
mov qword [rsp + 0x2d8], 0xf
mov qword [rsp + 0x2d0], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2c0], rax
mov byte [rsp + 0x2c8], 0x6e
mov eax, 9
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x98], rdi
mov byte [rsp + rax + 0x2c0], 0
mov edx, dword [r12 + 8]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x80], rcx
call fcn.14002ff90
lea rsi, [rsp + 0x4b4]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov qword [rsp + 0x60], r13
jne 0x140036980
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbp, str.GetOSVersion
mov rcx, r13
mov edx, r14d
mov r8, rbp
mov r9d, 0x5e
call fcn.140059a40
cdqe
lea rsi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x5e
mov rcx, rdi
mov rdx, rsi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036961
mov rsi, rax
lea rax, [rsp + 0x340]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
test r14d, r14d
jne 0x140036f28
xor edi, edi
xor esi, esi
xor r13d, r13d
xor ebx, ebx
jmp 0x140036ced
lea rax, [0x14006c240]
lea r14, [rsp + 0x3c8]
mov qword [r14 - 0x88], rax
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c248]
mov qword [r14], rax
mov rax, qword [r14 - 0x88]
movsxd rax, dword [rax + 4]
lea rbp, [0x14006c238]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [r14 - 0x88]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x33c], ecx
lea r15, [rsp + 0x348]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c258]
mov qword [rsp + rax + 0x340], rcx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x33c], ecx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x340
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x33c], esi
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006c1c0]
mov qword [r15], rax
mov qword [r15 + 0x68], 0
mov dword [r15 + 0x70], 4
mov edx, dword [rsp + 0x4b4]
mov rdi, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x340]
call rdi
lea rsi, [0x1400a26f7]
mov rcx, rax
mov rdx, rsi
call fcn.14005b310
mov edx, dword [rsp + 0x4b8]
mov rcx, rax
call rdi
mov rcx, rax
mov rdx, rsi
call fcn.14005b310
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call rdi
cmp dword [rsp + 0x4b4], 0xa
jne 0x140036b24
cmp dword [rsp + 0x4b8], 0
jne 0x140036b24
lea rax, [rsp + 0x208]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x728]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a4a50]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400376d0
mov qword [rsp + 0x728], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov eax, dword [rsp + 0x3b8]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x140037827
mov rcx, qword [rsp + 0x388]
mov rdx, qword [rcx]
test rdx, rdx
je 0x140037827
lea rax, [rsp + 0x368]
mov rcx, qword [rax + 0x48]
cmp rdx, rcx
cmovb rdx, rcx
mov rax, qword [rax]
mov r13, qword [rax]
test r13, r13
je 0x14003abe0
sub rdx, r13
cmp rdx, 0xf
jbe 0x1400376f9
test rdx, rdx
js 0x14003abdb
mov rbx, rdx
mov rax, rdx
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov rdi, rcx
cmp rcx, 0xfff
jae 0x14003abea
inc rcx
call fcn.140056c48
mov rsi, rax
mov rcx, rsi
mov rdx, r13
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov qword [rsp + 0x728], rsi
mov rsi, rbx
mov rbx, qword [rsp + 0x728]
mov rax, qword [rsp + 0x340]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x340], rbp
mov rax, qword [rsp + 0x340]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x33c], ecx
lea rax, [0x14006c1c0]
mov qword [rsp + 0x348], rax
test byte [rsp + 0x3b8], 1
je 0x140036c89
mov rax, qword [rsp + 0x388]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003ac04
mov rcx, qword [rsp + rcx + 0x340]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x360]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003ac19
call fcn.140056c84
mov rax, qword [rsp + 0x360]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x380]
mov qword [rax], rcx
mov rax, qword [rsp + 0x398]
mov dword [rax], ecx
mov rax, qword [rsp + 0x368]
mov qword [rax], rcx
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a0]
mov dword [rax], ecx
mov qword [rsp + 0x3b0], rcx
and byte [rsp + 0x3b8], 0xfe
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x298], rdi
lea rsi, [rsp + 0x4b0]
mov r8d, 0xaa
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x1400370ba
lea rsi, [rsp + 0x340]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.140030940
cmp dword [rsi + 0x20], 0
jne 0x1400379fa
mov rbp, qword [rsp + 0x340]
mov rax, qword [rsp + 0x348]
mov rdi, qword [rsp + 0x350]
mov r15, qword [rsp + 0x358]
mov byte [rsp + 0x340], 0
mov qword [rsp + 0x350], 0
mov qword [rsp + 0x260], rbp
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], r15
xor eax, eax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], 0xf
mov byte [rsp + 0x240], 0
lea r8, str.PrevNotificationAction
lea r13, [rsp + 0x4b0]
mov rcx, r13
mov edx, 1
xor r9d, r9d
call fcn.14002e620
lea rsi, [rsp + 0x4d8]
mov r14d, dword [rsi]
test r14d, r14d
je 0x1400371d1
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x177
call fcn.14002cba0
cmp dword [rsp + 0x4d8], 0
je 0x140037236
test r14d, r14d
jns 0x140037248
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x140036e9a
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036e95
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140036ee1
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036edc
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r8, qword [rsp + 0x298]
cmp r8, 0x10
jb 0x140036f28
mov rcx, qword [rsp + 0x280]
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140036f23
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ac36
add r8, 0x28
mov rdx, r8
mov rcx, rax
call fcn.140056c84
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x140036f6f
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036f6a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140036fb6
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036fb1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x140036ffd
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036ff8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x140037044
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003703f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jb 0x14003708b
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037086
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rcx, qword [rsp + 0x7d8]
xor rcx, rsp
call fcn.140057bf0
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r8, str.GetOSLocale
mov rcx, rdi
mov edx, r14d
mov r9d, 0x66
call fcn.140059a40
cdqe
lea rsi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetOSLocale
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x66
mov rcx, r15
mov rdx, rsi
mov r8, 0xffffffffffffffff
mov r9, rdi
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400371b3
mov rsi, rax
lea rax, [rsp + 0x340]
mov qword [rax], r15
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
test r14d, r14d
je 0x1400376c2
mov r8, qword [rsp + 0x88]
jmp 0x140036ee9
mov rdx, rsi
lea rsi, [rsp + 0x368]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
jne 0x1400373ec
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x240], rax
mov word [rsp + 0x248], 0x6e
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
jmp 0x140038adb
lea rcx, [rsp + 0x4b0]
call fcn.14005b250
jmp 0x140036e4a
cmp dword [r12 + 4], 1
jne 0x140037308
mov r14, rsi
mov edx, dword [r12 + 8]
mov rcx, r13
call fcn.14002ff90
cmp qword [rsp + 0x4c8], 0x10
jb 0x140037277
mov r13, qword [rsp + 0x4b0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x340]
mov rcx, rsi
mov r8, r13
xor r9d, r9d
call fcn.14002da60
mov eax, dword [rsi]
test eax, eax
je 0x1400372be
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x196
call fcn.14002cba0
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
mov rsi, r14
jb 0x140037308
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037303
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r13, rsi
xor eax, eax
lea rsi, [rsp + 0x208]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.14005ab20
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x14003784f
lea rdx, [rax + 8]
mov qword [rsp + 0x218], rdx
cmp rcx, 8
jb 0x14003736f
mov rsi, qword [rsp + 0x208]
movups xmm0, xmmword [str._version]
movups xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4b0], 0
mov qword [rsp + 0x4c8], 7
mov qword [rsp + 0x4c0], 1
mov dword [rsp + 0x4b0], 0x32
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x220]
cmp rcx, rax
je 0x140037876
lea rdx, [rax + 1]
mov qword [rsp + 0x218], rdx
cmp rcx, 8
jb 0x140037549
mov rcx, qword [rsp + 0x208]
jmp 0x140037551
lea rcx, [rsp + 0x340]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.14005b1a0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rsp + 0x240]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
lea rdx, str.dismissed_by_timeout
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.dismissed_to_action_center
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.dismissed_by_button
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.dismissed_by_application_hidden
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.remind_me_later
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.make_firefox_default_button
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.toast_clicked
lea rcx, [rsp + 0x240]
call fcn.14005b2c0
test al, al
je 0x140038adb
lea rdx, str.no_action
lea rsi, [rsp + 0x240]
mov rcx, rsi
call fcn.14005b2c0
test al, al
je 0x140038adb
mov rax, qword [rsp + 0x258]
cmp rax, 9
jae 0x140038aae
mov ecx, 0x10
call fcn.140056c48
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
movabs rcx, 0x6f697463612d6f6e
mov qword [rax], rcx
mov word [rax + 8], 0x6e
mov qword [rsp + 0x240], rax
jmp 0x140038adb
lea rcx, [rsp + 0x208]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x1400375ac
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400375a7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], 2
mov dword [rsp + 0x238], 0
lea rcx, [0x1400a161d]
lea rdx, str.DisableTelemetry
call fcn.140030160
test al, al
je 0x14003761d
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x2e0]
lea r8, [rsp + 0x2c0]
lea r9, [rsp + 0x2a0]
call fcn.140035f10
mov r14d, eax
jmp 0x14003766b
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x728]
mov rcx, rsi
mov edx, 1
call fcn.1400312a0
mov r14d, dword [rsi + 0x10]
test r14d, r14d
je 0x140037732
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0xf9
call fcn.14002cba0
mov rax, qword [rsp + 0x220]
cmp rax, 8
jb 0x140036e53
mov rcx, qword [rsp + 0x208]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400376b8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x140036e53
xor r15d, r15d
xor edi, edi
xor eax, eax
xor ebp, ebp
jmp 0x140036d9e
lea rdx, [0x1400a26f7]
lea rcx, [rsp + 0x340]
call fcn.14005b310
mov edx, dword [rsp + 0x728]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036b24
mov rdi, rdx
lea rsi, [rsp + 0x728]
mov qword [rsi + 0x10], rdx
mov rcx, rsi
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x728], 0
mov r13, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov rdi, qword [rsi + 0x18]
mov rsi, rax
jmp 0x140036bf4
mov qword [rsp + 0x90], rbx
mov r14, qword [rsp + 0x728]
mov r12b, byte [rsp + 0x730]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [rsi]
test r12b, r12b
je 0x140037798
mov rax, rbx
test rbx, rbx
jne 0x14003777f
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
sub rax, r14
jbe 0x1400375e6
shr rax, 9
cmp rax, 0x6388fc53
jb 0x1400375e6
mov qword [rsp + 0x6c0], rbx
xor esi, esi
lea r14, [rsp + 0x4b0]
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov ebx, 7
mov qword [r14 + 0x18], rbx
mov word [r14], si
lea r9, str.LastPingSentAt
mov edx, 0xe
mov rcx, r14
call fcn.14005ab20
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x350], xmm1
movaps xmmword [rsp + 0x340], xmm0
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rbx
mov word [r14], si
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, r14
call fcn.14005ab20
cmp qword [rsp + 0x358], 8
jb 0x14003789e
mov r8, qword [rsp + 0x340]
jmp 0x1400378a6
test al, 4
jne 0x14003abe0
mov edi, 0xf
mov rax, qword [rsp + 0x380]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14003ac56
xor esi, esi
jmp 0x140036bf4
mov qword [rsp + 0x20], 8
lea r9, str._version
lea rcx, [rsp + 0x208]
mov edx, 8
call fcn.14005ac50
jmp 0x140037381
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea r9, [rsp + 0x4b0]
mov edx, 1
call fcn.14005ac50
jmp 0x14003755e
lea r8, [rsp + 0x340]
cmp qword [rsp + 0x4c8], 8
jb 0x1400378b9
mov r14, qword [rsp + 0x4b0]
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, r14
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
test eax, eax
jne 0x1400383b6
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x14003793c
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037937
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x358]
cmp rax, 8
jb 0x14003798a
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037985
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
test ebx, ebx
je 0x1400379b6
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x109
call fcn.14002cba0
lea rcx, [rsp + 0x208]
lea rsi, [rsp + 0x490]
mov rdx, rsi
call fcn.14002c310
mov r14d, dword [rsi]
test r14d, r14d
je 0x140037a09
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r14d
jmp 0x140038592
mov r15d, 0xf
xor ebp, ebp
xor edi, edi
jmp 0x140036d9e
lea rcx, [rsp + 0x208]
mov r8d, dword [rcx + 0x2c]
lea rsi, [rsp + 0x7b8]
mov rdx, rsi
call fcn.14002d7e0
mov eax, 0x90
lea rcx, [rsp + 0x340]
add rcx, rax
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x4b0]
add rax, rcx
mov qword [rsp + 0x58], rax
xor r14d, r14d
xorps xmm6, xmm6
xor r12d, r12d
cmp dword [rsp + 0x238], 0
je 0x14003832c
mov qword [rsp + 0x730], r14
mov qword [rsp + 0x740], r14
mov eax, 0xf
mov qword [rsp + 0x748], rax
mov byte [rsp + 0x730], r14b
mov qword [rsp + 0x750], r14
mov qword [rsp + 0x760], r14
mov qword [rsp + 0x768], rax
mov byte [rsp + 0x750], r14b
mov qword [rsp + 0x770], r14
mov qword [rsp + 0x780], r14
mov qword [rsp + 0x788], rax
mov byte [rsp + 0x770], r14b
mov byte [rsp + 0x7b0], r14b
cmp qword [rsp + 0x7d0], 8
mov r8, rsi
jb 0x140037ae4
mov r8, qword [rsp + 0x7b8]
lea rcx, [rsp + 0x340]
lea rdx, str.CacheEntryVersion
call fcn.14002c8a0
mov ebx, dword [rsp + 0x348]
test ebx, ebx
jne 0x140038353
mov rax, qword [rsp + 0x340]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x14003818b
mov dword [rsp + 0x728], eax
test eax, eax
je 0x140038208
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x6f0]
mov r8, rsi
lea r9, str.NotificationType
call fcn.14002e450
mov esi, dword [rsp + 0x718]
test esi, esi
jne 0x140038268
movaps xmmword [rsp + 0x6d0], xmm6
movaps xmmword [rsp + 0x6c0], xmm6
mov byte [rsp + 0x6e0], 0
lea rcx, [rsp + 0x6e8]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
mov esi, 4
cmp byte [rsp + 0x6e0], 0
je 0x1400382e5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jb 0x140037bfc
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037bf7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a35ae]
call fcn.14002e450
cmp dword [rsp + 0x718], 0
jne 0x140037c5b
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x140037cb5
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp byte [rsp + 0x6e0], 0
je 0x1400382e5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jb 0x140037d7b
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037d76
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x20], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a3628]
call fcn.14002e450
cmp dword [rsp + 0x718], 0
jne 0x140037ddb
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x140037e35
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp byte [rsp + 0x6e0], 0
je 0x1400382e5
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
call fcn.14005b1a0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jb 0x140037efb
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037ef6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
lea rax, [rsp + 0x730]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x70], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x7b8]
lea r9, str.PrevNotificationAction
call fcn.14002e450
cmp dword [rsp + 0x718], 0
jne 0x140037f69
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
mov ebx, dword [rsp + 0x368]
mov dword [rsp + 0x718], ebx
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x368]
call fcn.14005b4d0
cmp dword [rsp + 0x368], 0
jne 0x140037fc3
lea rcx, [rsp + 0x340]
call fcn.14005b250
mov ebx, dword [rsp + 0x718]
test ebx, ebx
jne 0x1400382c4
movaps xmmword [rsp + 0x350], xmm6
movaps xmmword [rsp + 0x340], xmm6
mov byte [rsp + 0x360], 0
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0x718]
call fcn.14005b4d0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x340]
mov rdx, rbx
call fcn.14005b660
mov rcx, rbx
call fcn.14005b250
cmp dword [rsp + 0x70], 2
jb 0x140038034
cmp byte [rsp + 0x6e0], 0
je 0x1400382e5
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x6c0]
call fcn.14005b730
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x470]
call fcn.14002e330
mov esi, dword [rsp + 0x470]
test esi, esi
jne 0x14003830e
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x728]
call fcn.14003d3b0
mov bl, 1
mov byte [rsp + 0x3d0], bl
mov r8d, 0x91
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x4b0], eax
lea rcx, [rsp + 0x368]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsp + 0x358], r14
mov edx, 0xf
mov qword [rsp + 0x360], rdx
mov byte [rsp + 0x348], r14b
lea rax, [rsp + 0x368]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm1
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x380], rdx
mov byte [rsp + 0x368], r14b
movups xmm0, xmmword [rcx + 0x20]
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rsi + 0x48], xmm0
movups xmmword [rsi + 0x58], xmm1
mov qword [rsp + 0x398], r14
mov qword [rsp + 0x3a0], rdx
mov byte [rsp + 0x388], r14b
movups xmmword [rsi + 0x68], xmm6
movups xmmword [rsi + 0x78], xmm6
mov byte [rsi + 0x88], r14b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
call fcn.14005b4d0
mov byte [rsp + 0x540], bl
cmp byte [rsp + 0x3d0], r14b
je 0x14003817b
lea rcx, [rsp + 0x340]
call fcn.14002d6d0
mov dword [rsp + 0x550], 0
jmp 0x1400382e0
cmp qword [rsp + 0x7d0], 8
mov rax, rsi
jb 0x1400381a1
mov rax, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1bb
call fcn.14002cba0
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x6f0]
call fcn.14002e330
mov ebx, dword [rsp + 0x6f0]
test ebx, ebx
jne 0x140038508
lea rcx, [rsp + 0x728]
call fcn.14002d6d0
jmp 0x1400382a7
cmp qword [rsp + 0x7d0], 8
jb 0x14003821b
mov rsi, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x208
call fcn.14002cba0
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x340]
call fcn.14002e330
mov esi, dword [rsp + 0x340]
test esi, esi
je 0x1400382bd
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], esi
mov esi, 1
lea rcx, [rsp + 0x728]
call fcn.14002d6d0
cmp esi, 4
lea rsi, [rsp + 0x7b8]
jne 0x140038533
inc r12d
cmp r12d, dword [rsp + 0x230]
jbe 0x140037a53
jmp 0x14003836f
mov esi, 4
jmp 0x140038289
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], ebx
mov esi, 1
lea rcx, [rsp + 0x6c0]
call fcn.14005b250
cmp dword [rsp + 0x718], 0
jne 0x140038289
lea rcx, [rsp + 0x6f0]
call fcn.14005b250
jmp 0x140038289
mov r8d, 0xa0
lea rcx, [rsp + 0x4b0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], esi
jmp 0x1400382e0
lea rsi, [rsp + 0x4b0]
mov r8d, 0x91
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0
jmp 0x140038533
cmp qword [rsp + 0x7d0], 8
jb 0x1400384cb
mov rax, qword [rsp + 0x7b8]
jmp 0x1400384d3
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24c
call fcn.14002cba0
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
jmp 0x140038533
mov qword [rsp + 0x78], rdi
movzx r14d, bx
or r14d, 0x80070000
test ebx, ebx
cmovle r14d, ebx
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x58], rax
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegistrySetValueQword
mov edx, r14d
mov r8, rdi
mov r9d, 0xee
call fcn.140059a40
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x70], rcx
lea rsi, [rax + rax]
add rsi, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rsi, rax
mov rcx, rsi
call fcn.140056c40
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0xee
mov rcx, r12
mov rdx, qword [rsp + 0x70]
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400384b9
mov rsi, rax
lea rax, [rsp + 0x6f0]
mov qword [rax], r12
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140056c84
mov rdi, qword [rsp + 0x78]
jmp 0x1400378ee
lea rax, [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b5
call fcn.14002cba0
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], ebx
lea rcx, [rsp + 0x728]
call fcn.14002d6d0
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x140038581
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003857c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov r14d, dword [rsp + 0x550]
test r14d, r14d
je 0x1400386c3
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x15c
call fcn.14002cba0
mov r12, rdi
cmp dword [rsp + 0x550], 0
jne 0x1400385db
cmp byte [rsp + 0x540], 0
je 0x1400385db
lea rcx, [rsp + 0x4b0]
call fcn.14002d6d0
test r14d, r14d
js 0x14003766b
mov rax, qword [rsp + 0x50]
movsxd rbx, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov edx, 1
xor r9d, r9d
call fcn.14002e620
mov r14d, dword [rsi + 0x28]
test r14d, r14d
je 0x140038af5
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x11f
call fcn.14002cba0
xor esi, esi
xor ebx, ebx
xor r13d, r13d
xor edi, edi
cmp dword [rsp + 0x4d8], 0
je 0x140038bcb
test r14d, r14d
jne 0x14003766b
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], r13
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x1c0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov rsi, qword [rsp + 0x250]
cmp qword [rsp + 0x258], 0x10
jb 0x140038c13
mov r14, qword [rsp + 0x240]
jmp 0x140038c1b
xor r14d, r14d
lea rcx, [rsp + 0x340]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x540], 0
je 0x1400385b7
lea r12, [rsp + 0x3d0]
mov eax, dword [rsp + 0x4b0]
mov dword [r12 - 0x90], eax
lea rcx, [rsp + 0x4b0]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movups xmmword [r12 - 0x88], xmm0
movups xmmword [r12 - 0x78], xmm1
xor esi, esi
mov qword [rsp + 0x4c8], rsi
mov eax, 0xf
mov qword [rsp + 0x4d0], rax
mov byte [rsp + 0x4b8], sil
movups xmm0, xmmword [r13]
movups xmm1, xmmword [r13 + 0x10]
movups xmmword [r12 - 0x68], xmm0
movups xmmword [r12 - 0x58], xmm1
mov qword [rsp + 0x4e8], rsi
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x4d8], sil
movups xmm0, xmmword [rcx + 0x48]
movups xmm1, xmmword [rcx + 0x58]
movups xmmword [r12 - 0x48], xmm0
movups xmmword [r12 - 0x38], xmm1
mov qword [rsp + 0x508], rsi
mov qword [rsp + 0x510], rax
mov byte [rsp + 0x4f8], sil
mov byte [r12 - 8], sil
xorps xmm0, xmm0
movups xmmword [r12 - 0x18], xmm0
movups xmmword [r12 - 0x28], xmm0
mov rcx, r12
mov rdx, qword [rsp + 0x58]
call fcn.14005b4d0
mov byte [r12], 1
cmp byte [rsp + 0x540], sil
je 0x1400387ed
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.14002d6d0
mov byte [rsi + 0x90], 0
cmp byte [rsp + 0x3d0], 0
je 0x1400385b7
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x208]
lea rdx, [rsp + 0x2e0]
lea r8, [rsp + 0x2c0]
lea r9, [rsp + 0x2a0]
call fcn.140035f10
cmp byte [rsp + 0x3d0], 0
je 0x14003aaa9
lea rsi, [rsp + 0x728]
lea r12, [rsp + 0x340]
mov rcx, rsi
mov rdx, r12
call fcn.14003d3b0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movaps xmmword [rsp + 0x2e0], xmm0
movaps xmmword [rsp + 0x2f0], xmm1
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], 0xf
mov byte [rsi + 8], 0
mov rcx, rsi
call fcn.14002d6d0
cmp byte [r12 + 0x90], 0
je 0x14003aaa9
lea rsi, [rsp + 0x728]
lea r12, [rsp + 0x340]
mov rcx, rsi
mov rdx, r12
call fcn.14003d3b0
movups xmm0, xmmword [rsi + 0x28]
movups xmm1, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmmword [rsp + 0x2d0], xmm1
mov qword [rsi + 0x38], 0
mov qword [rsi + 0x40], 0xf
mov byte [rsi + 0x28], 0
mov rcx, rsi
call fcn.14002d6d0
cmp byte [r12 + 0x90], 0
je 0x14003aaa9
lea rcx, [rsp + 0x728]
lea rdx, [rsp + 0x340]
call fcn.14003d3b0
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x140038945
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038940
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rax, [rsp + 0x730]
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmmword [rsp + 0x2a0], xmm0
lea rcx, [rsp + 0x728]
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
call fcn.14002d6d0
cmp byte [rsp + 0x3d0], 0
je 0x14003aaa9
lea rsi, [rsp + 0x728]
lea rdx, [rsp + 0x340]
mov rcx, rsi
call fcn.14003d3b0
mov bl, byte [rsi + 0x88]
mov rcx, rsi
call fcn.14002d6d0
test bl, bl
je 0x140039996
cmp byte [rsp + 0x3d0], 0
je 0x14003aaa9
lea rsi, [rsp + 0x728]
lea rdx, [rsp + 0x340]
mov rcx, rsi
call fcn.14003d3b0
cmp byte [rsi + 0x88], 0
je 0x14003abd0
mov rsi, qword [rsp + 0x790]
mov rbx, qword [rsp + 0x798]
mov r12, qword [rsp + 0x7a0]
mov r13, qword [rsp + 0x7a8]
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x140038a7c
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038a77
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rbx
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r13
lea rcx, [rsp + 0x728]
call fcn.14002d6d0
jmp 0x140039a11
cmp rax, 0x10
jb 0x140038abc
mov rsi, qword [rsp + 0x240]
mov qword [rsp + 0x250], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rsi], rax
mov word [rsi + 8], 0x6e
lea rcx, [rsp + 0x340]
call fcn.14005b250
lea rsi, [rsp + 0x4d8]
jmp 0x140036e3c
lea rdx, [rsp + 0x4d8]
lea rsi, [rsp + 0x368]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
jne 0x140038bdd
cmp ebx, 0xb
ja 0x140038c6c
lea rax, [0x14006c260]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x728], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov r14, qword [rax]
mov r13, qword [rax + 8]
cmp r13, 0xf
jbe 0x140039869
test r13, r13
js 0x14003abdb
mov rax, r13
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x14003ac6d
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140056c48
mov rsi, rax
mov rcx, rsi
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r13], 0
mov qword [rsp + 0x728], rsi
jmp 0x140038c8d
lea rcx, [rsp + 0x4b0]
call fcn.14005b250
jmp 0x140038655
lea rcx, [rsp + 0x340]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.14005b1a0
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x1400398aa
lea r14, [rsp + 0x240]
cmp rsi, 0xf
ja 0x140038c34
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x1c0], xmm0
mov ebx, 0xf
jmp 0x140038cb2
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038c92
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038c9e
mov qword [rsp + 0x728], 0
mov byte [rsp + 0x728], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
xor r13d, r13d
jmp 0x14003989d
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rsi + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rbx
mov qword [rsp + 0x1a0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov rsi, qword [rsp + 0x2b0]
cmp qword [rsp + 0x2b8], 0x10
jb 0x140038cfc
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x80], rax
cmp rsi, 0xf
ja 0x140038d1c
mov rax, qword [rsp + 0x80]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1a0], xmm0
mov ebx, 0xf
jmp 0x140038d79
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038d54
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038d60
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x180], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov rbx, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x140038dbd
mov rsi, qword [rsp + 0x2c0]
jmp 0x140038dc5
lea rsi, [rsp + 0x2c0]
cmp rbx, 0xf
ja 0x140038dde
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x180], xmm0
mov r14d, 0xf
jmp 0x140038e36
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140038e16
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038e22
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x180], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov rbx, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x140038e7a
mov rsi, qword [rsp + 0x2e0]
jmp 0x140038e82
lea rsi, [rsp + 0x2e0]
cmp rbx, 0xf
ja 0x140038e9b
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x160], xmm0
mov r14d, 0xf
jmp 0x140038ef3
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140038ed3
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038edf
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x160], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], r14
cmp r15, 0x10
lea rsi, [rsp + 0x260]
cmovae rsi, rbp
mov qword [rsp + 0x140], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
cmp r12, 0xf
ja 0x140038f42
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x140], xmm0
mov ebx, 0xf
jmp 0x140038f9b
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038f7a
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038f86
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x140], rcx
lea r8, [r12 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x158], rbx
cmp qword [rsp + 0x88], 0x10
lea rsi, [rsp + 0x280]
cmovae rsi, qword [rsp + 0x90]
mov qword [rsp + 0x120], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
cmp qword [rsp + 0x68], 0xf
ja 0x140038ff6
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x120], xmm0
mov ebx, 0xf
jmp 0x140039055
mov rbx, qword [rsp + 0x68]
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140039030
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003903c
lea rcx, [rbx + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0x98], 0x10
jb 0x14003906a
mov rsi, qword [rsp + 0x300]
jmp 0x140039072
lea rsi, [rsp + 0x300]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x100], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
cmp qword [rsp + 0x60], 0xf
ja 0x1400390b8
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x100], xmm0
mov edi, 0xf
jmp 0x140039117
mov rdi, qword [rsp + 0x60]
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x1400390f2
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400390fe
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0x100], rcx
mov rax, qword [rsp + 0x60]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rdi
cmp qword [rsp + 0x50], 0x10
lea rsi, [rsp + 0x1e8]
cmovae rsi, qword [rsp + 0x58]
mov qword [rsp + 0xe0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
cmp r13, 0xf
ja 0x14003916f
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov edi, 0xf
jmp 0x1400391c7
mov rdi, r13
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x1400391a7
lea rcx, [rdi + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400391b3
lea rcx, [rdi + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0xe0], rcx
lea r8, [r13 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov rbx, qword [rsp + 0x330]
cmp qword [rsp + 0x338], 0x10
jb 0x14003920b
mov rsi, qword [rsp + 0x320]
jmp 0x140039213
lea rsi, [rsp + 0x320]
cmp rbx, 0xf
ja 0x14003922c
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xc0], xmm0
mov r14d, 0xf
jmp 0x140039284
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmovae r14, rax
cmp r14, 0xfff
jb 0x140039264
lea rcx, [r14 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039270
lea rcx, [r14 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0xc0], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rsp + 0xc0]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r14
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor edx, edx
call fcn.140006130
lea rdx, [0x1400a18c4]
lea r14, [rsp + 0x4b0]
mov rcx, r14
call fcn.140004a00
lea rdx, str.build_channel
lea r8, [0x1400a1cf0]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call fcn.140001100
mov rcx, r14
call fcn.1400011a0
lea rdx, [0x1400a249c]
lea r14, [rsp + 0x4b0]
mov rcx, r14
call fcn.140004a00
lea rdx, str.build_version
lea r8, [0x1400a1c3f]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call fcn.140001100
mov rcx, r14
call fcn.1400011a0
lea r14, [rsp + 0x4b0]
mov rcx, r14
mov rdx, rdi
call fcn.1400607a0
lea rdx, [0x1400a1973]
lea r8, [0x1400a1982]
mov rcx, rsi
call fcn.140004b10
mov rcx, r14
mov rdx, rax
call fcn.140001100
mov rcx, r14
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.previous_default_browser
lea r8, [0x1400a1982]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a16d1]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x120]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.os_version
lea r8, [0x1400a1c31]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x140]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.os_locale
lea r8, [0x1400a21f5]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.notification_type
lea r8, [0x1400a2140]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.notification_shown
lea r8, [0x1400a1ab3]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, [0x1400a1b35]
lea r8, [0x1400a1b48]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rdi, [rsp + 0x4b0]
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
call fcn.1400607a0
lea rdx, str.previous_notification_action
lea r8, [0x1400a1b48]
mov rcx, rsi
call fcn.140004b10
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rcx, rdi
call fcn.1400011a0
lea rsi, [rsp + 0x340]
mov rcx, rsi
call fcn.140057dd0
lea rdx, [0x1400a281f]
lea rdi, [rsp + 0x4b0]
mov rcx, rdi
call fcn.140004a00
lea r14, [rsp + 0x6f0]
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], 0xb
movabs rax, 0x7461746e65646e69
mov qword [r14], rax
mov dword [r14 + 7], 0x6e6f6974
mov byte [r14 + 0xb], 0
mov rcx, rsi
mov rdx, r14
call fcn.140006290
mov rcx, rdi
mov rdx, rax
call fcn.140001100
mov rax, qword [r14 + 0x18]
cmp rax, 0x10
jb 0x14003961c
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039617
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.1400011a0
lea r15, [rsp + 0x6c0]
lea rdx, [rsp + 0x340]
lea r8, [rsp + 0x728]
mov rcx, r15
call fcn.140001380
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x140039a31
xorps xmm0, xmm0
lea r12, [rsp + 0x4b0]
movups xmmword [r12 + 0x3e], xmm0
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rcx, [rsp + 0x6f0]
mov rdx, r12
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
jne 0x140039b1e
lea rsi, [rsp + 0x4b2]
mov ecx, 0x50
call fcn.140056c48
mov r14, rax
mov r8d, 0x48
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + 0x48], 0
mov qword [rsp + 0x7b8], r14
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0x24
mov qword [rsp + 0x7d0], 0x27
lea rcx, section..rdata
lea r9, [rsp + 0x490]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x60], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140039c17
mov r12, qword [rsp + 0x490]
lea r14, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a41b2]
mov rcx, r14
mov rdx, r12
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x140039d01
lea rdx, [0x1400a2a38]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039d7c
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039df7
cmp qword [rsp + 0x7d0], 8
jb 0x1400397b4
mov rdx, qword [rsp + 0x7b8]
jmp 0x1400397bc
lea rdx, [rsp + 0x7b8]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140039e6f
xor eax, eax
mov qword [rsp + 0x6f0], rax
mov qword [rsp + 0x700], rax
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r14, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003a701
mov qword [rcx + 0x10], r14
mov r8, r14
add r8, r14
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + r14*2 + 0x6f0], 0
mov rbp, qword [rsp + 0x6f0]
mov rdi, qword [rsp + 0x6f8]
mov rbx, qword [rsp + 0x700]
mov r13, qword [rsp + 0x708]
xor r14d, r14d
mov sil, 1
jmp 0x140039f77
lea rsi, [rsp + 0x728]
mov qword [rsi + 0x10], r13
mov rcx, rsi
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r13 + 0x728], 0
mov rbx, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x338], 0x10
jb 0x1400398bf
mov r8, qword [rsp + 0x320]
jmp 0x1400398c7
lea r8, [rsp + 0x320]
lea rdx, str.PingCurrentDefault
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor r9d, r9d
call fcn.14002da60
mov r14d, dword [rsi]
test r14d, r14d
jne 0x1400398f8
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x140039984
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r14d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002cba0
xor esi, esi
mov ebx, 0
mov r13d, 0
mov edi, 0
cmp qword [rsp + 0x50], 0x10
jb 0x140039984
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039971
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ac36
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140056c84
xor esi, esi
xor ebx, ebx
xor r13d, r13d
xor edi, edi
lea rcx, [rsp + 0x340]
call fcn.14005b250
jmp 0x140038647
mov rax, qword [rsp + 0x258]
cmp rax, 0x10
jb 0x1400399dd
mov rcx, qword [rsp + 0x240]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400399d8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x240], rax
mov word [rsp + 0x248], 0x6e
mov qword [rsp + 0x250], 9
mov qword [rsp + 0x258], 0xf
cmp byte [rsp + 0x3d0], 0
je 0x1400385b7
lea rcx, [rsp + 0x340]
call fcn.14002d6d0
jmp 0x1400385b7
mov r14d, eax
or r14d, 0x80010000
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.GenerateUUIDStr
mov rcx, r13
mov edx, r14d
mov r8, rbx
mov r9d, 0x2e
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r12, [rax + rax]
add r12, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r12, rax
mov rcx, r12
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x2e
mov rcx, rdi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039b16
mov r15, rax
mov qword [rsp + 0x4b0], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
jmp 0x140039c0d
mov rdi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.GenerateUUIDStr
mov r14d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, r12
mov r9d, 0x35
call fcn.140059a40
cdqe
lea rbx, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x30], 0x35
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rsi
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9, r15
call fcn.140059ac0
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039c0a
mov rdi, rax
lea rax, [rsp + 0x7b8]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
jmp 0x140039fdc
mov r14d, eax
mov rdi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.GetPingFilePath
mov rcx, r13
mov edx, eax
mov r8, rbx
mov r9d, 0x75
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r15, rax
mov rcx, r15
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0x75
mov rcx, rsi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039cf4
mov rdi, rax
mov qword [rsp + 0x4b0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
jmp 0x140039f8e
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x81
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x81
jmp 0x140039ee5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x86
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x86
jmp 0x140039ee5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x8b
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x8b
jmp 0x140039ee5
mov rsi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r8, str.GetPingFilePath
mov r14d, 0x8007007a
mov rcx, r13
mov edx, 0x8007007a
mov r9d, 0x90
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetPingFilePath
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x90
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039f64
mov rbp, rax
mov qword [rsp + 0x6f0], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x6f0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbp
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
xor edi, edi
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor r13d, r13d
test r12, r12
je 0x140039f85
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
jne 0x14003a431
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x140039fdc
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140039fd7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
jb 0x14003a023
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a01e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rcx, [rsp + 0x340]
call fcn.140061c50
lea rcx, [rsp + 0x728]
call fcn.1400011a0
mov rax, qword [rsp + 0xd8]
cmp rax, 0x10
jb 0x14003a084
mov rcx, qword [rsp + 0xc0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a07f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0xf
mov byte [rsp + 0xc0], 0
mov rax, qword [rsp + 0xf8]
cmp rax, 0x10
jb 0x14003a0eb
mov rcx, qword [rsp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a0e6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rax, qword [rsp + 0x118]
cmp rax, 0x10
jb 0x14003a152
mov rcx, qword [rsp + 0x100]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a14d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
mov rax, qword [rsp + 0x138]
cmp rax, 0x10
jb 0x14003a1b9
mov rcx, qword [rsp + 0x120]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a1b4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
mov rax, qword [rsp + 0x158]
cmp rax, 0x10
jb 0x14003a220
mov rcx, qword [rsp + 0x140]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a21b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
mov rax, qword [rsp + 0x178]
cmp rax, 0x10
jb 0x14003a287
mov rcx, qword [rsp + 0x160]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a282
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
mov rax, qword [rsp + 0x198]
cmp rax, 0x10
jb 0x14003a2ee
mov rcx, qword [rsp + 0x180]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a2e9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rax, qword [rsp + 0x1b8]
cmp rax, 0x10
jb 0x14003a355
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a350
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rax, qword [rsp + 0x1d8]
cmp rax, 0x10
jb 0x14003a3bc
mov rcx, qword [rsp + 0x1c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a3b7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
cmp qword [rsp + 0x50], 0x10
jb 0x14003766b
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a422
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ac36
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140056c84
jmp 0x14003766b
mov qword [rsp + 0x490], rbp
mov qword [rsp + 0x498], rdi
mov qword [rsp + 0x4a0], rbx
cmp r13, 8
lea rax, [rsp + 0x490]
cmovb rbp, rax
mov qword [rsp + 0x4a8], r13
lea rax, [0x14006c1a8]
lea r12, [rsp + 0x558]
mov qword [r12 - 0xa8], rax
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c248]
mov qword [r12], rax
mov rax, qword [r12 - 0xa8]
movsxd rax, dword [rax + 4]
lea rdi, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rdi
mov rax, qword [r12 - 0xa8]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff58
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x4ac], ecx
lea rbx, [rsp + 0x4b8]
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c258]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4ac], ecx
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4b0], rdi
mov rax, qword [rbx - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x4ac], esi
mov rcx, rbx
call fcn.14005ba80
mov rcx, rbx
mov rdx, rbp
call fcn.14005d3c0
test rax, rax
jne 0x14003a571
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6d0]
cmp qword [rsp + 0x6d8], 0x10
jb 0x14003a58c
mov r15, qword [rsp + 0x6c0]
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov rdx, r15
call fcn.140003430
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003a716
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r13, str.SendPing
mov r14d, 0x8007045d
mov edx, 0x8007045d
mov r8, r13
mov r9d, 0xc6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xc6
mov dword [rsp + 0x20], 0x8007045d
mov rcx, rsi
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a6b2
mov r15, rax
mov qword [rsp + 0x6f0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x6f0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007045d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140056c84
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c960
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003a77b
lea r9, [rsp + 0x4b0]
mov rdx, r14
call fcn.14005ab20
jmp 0x14003983e
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c1b0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005c960
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdx, str.pingsender.exe
lea rdi, [rsp + 0x6f0]
mov rcx, rdi
call fcn.14003ac90
mov r14d, dword [rdi + 0x20]
test r14d, r14d
je 0x14003a7d2
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x140039f8e
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a7c8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x140039f8e
movups xmm0, xmmword [rsp + 0x6f0]
movups xmm1, xmmword [rsp + 0x700]
movaps xmmword [rsp + 0x480], xmm1
movaps xmmword [rsp + 0x470], xmm0
xor eax, eax
mov qword [rsp + 0x700], rax
mov ecx, 7
mov qword [rsp + 0x708], rcx
mov word [rsp + 0x6f0], ax
lea rdi, [rsp + 0x450]
mov qword [rdi], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rcx
mov word [rdi], ax
lea r9, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rdi
call fcn.14005ab20
mov r8, qword [rsp + 0x7c8]
cmp qword [rsp + 0x7d0], 8
jb 0x14003a858
mov r9, qword [rsp + 0x7b8]
jmp 0x14003a860
lea r9, [rsp + 0x7b8]
mov rax, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x468]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x14003aab4
lea rsi, [rax + r8]
mov qword [rsp + 0x460], rsi
cmp rcx, 8
jb 0x14003a899
mov rdi, qword [rsp + 0x450]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], 0
lea rdi, [rsp + 0x470]
cmp qword [rdi + 0x18], 8
mov rax, rdi
jb 0x14003a8c8
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x468], 8
jb 0x14003a8e5
mov rax, qword [rsp + 0x450]
jmp 0x14003a8ed
lea rax, [rsp + 0x450]
mov qword [rsp + 0x438], rax
cmp qword [rsp + 0x4a8], 8
jb 0x14003a90d
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x430]
mov rax, qword [rsp + 0x60]
mov qword [r8 + 0x10], rax
lea rsi, [rsp + 0xb8]
mov rcx, rsi
mov edx, 3
call fcn.140005c40
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4b0], xmm0
movaps xmmword [rsp + 0x4e0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x4d0], xmm0
movaps xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x510], 0
mov dword [rsp + 0x4b0], 0x68
mov dword [rsp + 0x4ec], 1
mov rsi, qword [rsi]
cmp qword [rsp + 0x488], 8
jb 0x14003a99e
mov rdi, qword [rsp + 0x470]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
movups xmmword [rsp + 0x30], xmm0
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003aace
mov rcx, qword [rsp + 0xa8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xa0]
call rdi
test rsi, rsi
je 0x14003aa04
mov rcx, rsi
call fcn.140056c84
mov rax, qword [rsp + 0x468]
cmp rax, 8
jb 0x14003aa52
mov rcx, qword [rsp + 0x450]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003aa4d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003a77b
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003aa9f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003ac36
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
jmp 0x14003a77b
int3
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x450]
mov rdx, r8
call fcn.14005ac50
jmp 0x14003a8ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbx, str.SendPing
mov rcx, r13
mov edx, r14d
mov r8, rbx
mov r9d, 0xe4
call fcn.140059a40
cdqe
lea rbp, [rax + 1]
lea r12, [rax + rax]
add r12, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r12, rax
mov rcx, r12
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 0xe4
mov rcx, rdi
mov rdx, rbp
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003abc3
mov r15, rax
lea rax, [rsp + 0x6b8]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
jmp 0x14003a9f7
int3
call fcn.14005aa20
mov edi, 0xf
jmp 0x140037848
add rcx, 0x28
call fcn.140056c48
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140036bd7
mov rax, qword [rsp + 0x380]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036c5b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003ac36
add rdx, 0x27
mov rcx, rax
jmp 0x140036c84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [rbx + 0x28]
call fcn.140056c48
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400365e5
lea rax, [rsp + 0x360]
mov rcx, qword [rax + 0x38]
movsxd rcx, dword [rcx]
add rdx, rcx
jmp 0x140036b80
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140056c48
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140038bab