Function at 0x140084eb0
Capabilities:
Delete registry value
Set current directory
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3f8
movaps xmmword [rsp + 0x3e0], xmm6
mov r12, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x3d8], rax
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x140085009
lea rdi, [rsp + 0x1c2]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140130d40
mov word [rdi - 2], 0
lea rdi, [rsp + 0x1c0]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x140085009
mov eax, eax
lea rdx, [rsp + 0x100]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
lea rbx, [rsp + 0x120]
mov rcx, rbx
call fcn.1400f4ba0
lea rdi, [rsp + 0x140]
mov rcx, rbx
mov rdx, rdi
call fcn.1400fddd0
movdqa xmm0, xmmword [0x1401ee3a0]
lea rbx, [rsp + 0x180]
movdqa xmmword [rbx + 0x30], xmm0
movdqa xmmword [rbx + 0x20], xmm0
movdqa xmmword [rbx + 0x10], xmm0
movdqa xmmword [rbx], xmm0
lea rdx, [0x1401f98a3]
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x160]
mov rcx, r14
mov r9d, 0x437
call fcn.1400ba440
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400d84a0
cmp byte [rdi + 0x17], 0
jns 0x140084fca
mov rdi, qword [rsp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call fcn.1400ae170
cmp byte [rsp + 0x157], 0
jns 0x140084ff2
mov rcx, qword [rsp + 0x140]
call fcn.14012c25c
cmp byte [rsp + 0x137], 0
jns 0x140085009
mov rcx, qword [rsp + 0x120]
call fcn.14012c25c
call qword [sym.imp.chrome_elf.dll_GetInstallDetailsPayload]
mov rdi, rax
mov ecx, 0x10
call fcn.14012c264
lea rcx, [0x1401ef3d8]
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [0x140231c08], rax
call sub.chrome_elf.dll_SignalInitializeCrashReporting
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x140085046
mov byte [0x14022a150], 1
lea rcx, [0x14018fac0]
call fcn.14012cf58
mov dword [0x14022c924], 1
mov byte [0x14022c920], 1
xor ecx, ecx
xor edx, edx
call fcn.140106b40
mov rdi, qword [0x140231be8]
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x80]
mov qword [rbx + 0x10], r15
movaps xmm6, xmmword [0x1401ee3a0]
movaps xmmword [rbx], xmm6
lea rax, str.type
lea r8, [rsp + 0x70]
mov qword [r8], rax
mov qword [r8 + 8], 4
mov rcx, rdi
mov rdx, rbx
call fcn.1400dcc20
movzx eax, byte [rbx + 0x17]
test al, al
js 0x1400850c2
and eax, 0x7f
jmp 0x1400850d2
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test rax, rax
js 0x140085fc5
test rbx, rbx
jne 0x1400850e9
test rax, rax
jne 0x140085fe1
cmp rax, 0x10
jne 0x140085125
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [str.crashpad_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14008569b
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [str.fallback_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140085d56
lea rcx, [rsp + 0xa0]
mov qword [rcx], r15
mov rax, qword [fcn.1400c93d0]
call qword [0x140243008]
call sub.chrome_elf.dll_SignalChromeElf
mov qword [rsp + 0x1a8], r15
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x180], xmm0
movdqa xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], 0
mov rbx, qword [0x140231c00]
movabs rax, 0xfffffffc00000000
and rax, rbx
cmp rax, qword [0x140219dc8]
je 0x140085fd4
lea rax, [rsp + 0x180]
mov qword [rax + 0x28], rbx
mov qword [0x140231c00], rax
cmp qword [rdi + 0x40], 1
ja 0x14008530c
mov rax, qword [rdi + 0x30]
add rdi, 0x38
cmp rax, rdi
jne 0x1400852cf
pxor xmm0, xmm0
lea rcx, [rsp + 0x1c0]
movdqa xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.1400453c0
test al, al
je 0x1400852f5
lea rdx, [rsp + 0x1c0]
mov rcx, 0xffffffff80000002
call fcn.140045b60
test al, al
jne 0x14008520d
lea rdx, [rsp + 0x1c0]
mov rcx, 0xffffffff80000001
call fcn.140045b60
lea rcx, [rsp + 0x1c0]
call fcn.140088de0
test rax, rax
je 0x1400852f5
mov rcx, rax
call fcn.140088ef0
mov edi, eax
cmp byte [rsp + 0x1d7], 0
jns 0x140085244
mov rcx, qword [rsp + 0x1c0]
call fcn.14012c25c
test edi, edi
jne 0x14008530c
xor esi, esi
jmp 0x1400855bb
mov rcx, qword [rax + 0x28]
mov rdx, qword [rax + 0x20]
test rcx, rcx
js 0x140085fb9
test rdx, rdx
jne 0x140085272
test rcx, rcx
jne 0x140085fc2
cmp rcx, 0x11
jne 0x14008530c
movdqu xmm0, xmmword [rdx]
movzx ecx, byte [rdx + 0x10]
movzx edx, byte [0x1401fcd40]
movd xmm1, ecx
movd xmm2, edx
pcmpeqb xmm0, xmmword [str.profile_directory]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb ecx, xmm0
cmp ecx, 0xffff
jne 0x14008530c
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400852e7
mov rcx, rdx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400852b8
mov rax, rcx
cmp rcx, rdi
je 0x1400851bc
movzx ecx, byte [rax + 0x37]
test cl, cl
js 0x140085253
lea rdx, [rax + 0x20]
and ecx, 0x7f
jmp 0x14008525b
mov rcx, qword [rax + 0x10]
cmp qword [rcx], rax
mov rax, rcx
jne 0x1400852e7
jmp 0x1400852c3
cmp byte [rsp + 0x1d7], 0
jns 0x14008530c
mov rcx, qword [rsp + 0x1c0]
call fcn.14012c25c
pxor xmm0, xmm0
lea rdx, [rsp + 0x1c0]
movdqa xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov ecx, 1
call fcn.14003f9b0
test al, al
je 0x140085480
lea rdi, [rsp + 0x1c0]
mov rcx, rdi
call fcn.140088d50
test al, al
je 0x140085480
mov qword [rsp + 0x168], r15
xor eax, eax
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], 0
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x140]
mov qword [rcx], rax
mov qword [rsp + 0x20], rcx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140085439
mov rcx, qword [rsp + 0x160]
test rcx, rcx
jne 0x14008601a
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 0
cmp byte [rsp + 0x1d7], 0
jns 0x1400853ff
mov rdi, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x160]
lea rbx, [rsp + 0x140]
mov rdx, rdi
mov r8, rbx
call fcn.14002c840
test eax, eax
je 0x1400858d0
cmp byte [rsp + 0x157], 0
jns 0x140085439
mov rcx, qword [rsp + 0x140]
call fcn.14012c25c
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x140085463
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x168], 0
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
jne 0x140085657
cmp byte [rsp + 0x1d7], 0
jns 0x140085497
mov rcx, qword [rsp + 0x1c0]
call fcn.14012c25c
mov rdi, qword [0x140231b70]
test rdi, rdi
jne 0x140085fed
xor ecx, ecx
sub ecx, dword [0x140231b60]
mov eax, 0xffffffff
cmovns eax, ecx
test eax, eax
jg 0x14008560d
mov ecx, 0x28
call fcn.14012c264
mov rdi, rax
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm0
lea rax, [0x1401f0d98]
mov qword [rdi], rax
mov r8, qword [rsp + 0xa0]
mov rcx, rdi
mov rdx, r12
call fcn.140086050
mov esi, eax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140085513
movzx eax, byte [rdi + 0x27]
test al, al
js 0x140085fc8
test rax, rax
je 0x14008557e
test rdi, rdi
je 0x14008552c
mov rax, qword [rdi]
mov rax, qword [rax]
mov rcx, rdi
mov edx, 1
call qword [0x140243008]
lea rax, [rsp + 0x80]
movzx edx, byte [rax + 0x17]
mov ecx, edx
and ecx, 0x7f
test dl, dl
cmovs rcx, qword [rax + 8]
cmovs rax, qword [rax]
test rcx, rcx
js 0x140085fd1
test rax, rax
jne 0x14008555f
test rcx, rcx
jne 0x140085fe7
cmp rcx, 5
je 0x14008559f
cmp rcx, 7
jne 0x1400855bb
mov ecx, dword [rax]
xor ecx, dword [str.utility]
mov eax, dword [rax + 3]
xor eax, dword [0x1401f368c]
jmp 0x1400855b3
lea rdx, str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140085fea
call qword [0x140243008]
jmp 0x140085513
mov ecx, dword [rax]
xor ecx, dword [str.ppapi]
mov al, byte [rax + 4]
xor al, byte [0x1401f3682]
movzx eax, al
or eax, ecx
je 0x140085fa6
lea rcx, [rsp + 0x180]
call fcn.14005ba60
cmp byte [rsp + 0x97], 0
jns 0x1400855df
mov rcx, qword [rsp + 0x80]
call fcn.14012c25c
mov rcx, qword [rsp + 0x3d8]
xor rcx, rsp
call fcn.14012ec00
mov eax, esi
movaps xmm6, xmmword [rsp + 0x3e0]
add rsp, 0x3f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.....chrome_appchrome_exe_main_win.cc
lea rdi, [rsp + 0x1c0]
mov rcx, rdi
mov r8d, 0x184
mov r9d, 0xffffffff
call fcn.1400066f0
lea rcx, [rsp + 0x1d0]
lea rdx, str.About_to_load_main_DLL.
mov r8d, 0x17
call fcn.140167320
mov rcx, rdi
call fcn.1400068f0
jmp 0x1400854bf
mov edx, 1
call fcn.140030210
jmp 0x140085480
cmp byte [rsp + 0x1d7], 0
jns 0x14008567d
mov rcx, qword [rsp + 0x1c0]
call fcn.14012c25c
test rbx, rbx
je 0x1400855c8
mov rcx, rbx
call fcn.14003f140
mov rcx, rbx
call fcn.14012c25c
jmp 0x1400855c8
mov rcx, rdi
call fcn.140013450
lea rdx, str.no_periodic_tasks
mov rcx, rdi
call fcn.1401114c0
test al, al
jne 0x14008573f
lea rsi, [rsp + 0x1c0]
mov qword [rsi + 0x40], r15
pxor xmm0, xmm0
movdqa xmmword [rsi], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], 0xffffffffffffffff
mov qword [rsi + 0x38], 0
mov byte [rsi + 0x40], 0
lea rax, str.initial_client_data
lea r8, [rsp + 0x60]
mov qword [r8], rax
mov qword [r8 + 8], 0x13
lea r14, [rsp + 0x180]
mov rcx, rdi
mov rdx, r14
call fcn.1400dcc20
mov rcx, rsi
mov rdx, r14
call fcn.140040910
mov ebx, eax
cmp byte [r14 + 0x17], 0
jns 0x140085737
mov rcx, qword [rsp + 0x180]
call fcn.14012c25c
test bl, bl
jne 0x1400857d5
xor ebx, ebx
lea rsi, [rsp + 0x1c0]
mov qword [rsi + 0x10], r15
movaps xmmword [rsi], xmm6
lea r14, str.user_data_dir
lea r8, [rsp + 0x40]
mov qword [r8], r14
mov qword [r8 + 8], 0xd
mov rcx, rdi
mov rdx, rsi
call fcn.140013cd0
mov rcx, qword [0x140231be8]
lea r8, str.type
mov rdx, rsi
mov r9, r14
call fcn.14008a710
mov esi, eax
test rbx, rbx
je 0x140085666
test esi, esi
je 0x140085666
mov rcx, qword [rbx + 0x98]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400857b5
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [rsp + 0x1d7], 0
jns 0x140085686
mov rcx, qword [rsp + 0x1c0]
call fcn.14012c25c
jmp 0x140085686
lea rsi, [rsp + 0x160]
mov qword [rsi], 0xffffffffffffffff
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
mov r14, qword [rsp + 0x1f8]
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov rcx, rax
mov rdx, r14
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14008573f
lea rsi, [rsp + 0x180]
movaps xmmword [rsi], xmm6
mov rdx, qword [rsp + 0x160]
mov rcx, rsi
call fcn.140058e60
mov ecx, 0xa0
call fcn.14012c264
mov rbx, rax
mov rcx, rax
call fcn.140051610
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rsi
call fcn.140058f40
mov rcx, rbx
mov rdx, r14
call fcn.140050ba0
test al, al
je 0x140085885
mov rcx, rbx
call fcn.14001dc70
mov rax, qword [rsp + 0x180]
inc rax
cmp rax, 2
jb 0x140085741
call fcn.1400b90a0
mov rsi, qword [rsp + 0x180]
cmp qword [0x140231c98], 0
je 0x140085d05
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [0x140243008]
jmp 0x140085741
mov qword [rsp + 0x130], r15
movaps xmmword [rsp + 0x120], xmm6
lea rdx, [0x1401f30ba]
movzx ecx, byte [rsp + 0x157]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x148]
mov qword [rsp + 0xc8], rdx
cmovs rbx, qword [rsp + 0x140]
mov qword [rsp + 0xd0], 1
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rax
test rax, rax
js 0x140086025
mov qword [rsp + 0x38], r12
test rbx, rbx
jne 0x140085948
test rax, rax
jne 0x140086028
mov dword [rsp + 0x20], 1
lea rdi, [rsp + 0x120]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0xc8]
mov rcx, rdi
mov r9d, 1
call fcn.140058840
lea r12, str.WIN95
mov r14, qword [rdi + 8]
lea r13, str.WIN95
jmp 0x140085a3b
mov r14, qword [rsp + 0x128]
jmp 0x14008599a
mov rbp, rbx
mov rsi, r14
sub rsi, rbp
jb 0x140085fbf
je 0x140085a2e
mov rax, rbp
add rax, rsi
cmp rax, r14
je 0x1400859fe
cmp byte [rbp + 0x17], 0
jns 0x1400859c6
mov rcx, qword [rbp]
call fcn.14012c25c
lea rax, [rsi + rbp]
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x10], rcx
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbp], xmm0
lea rax, [rsi + rbp]
add rax, 0x18
mov byte [rax - 1], 0
mov word [rax - 0x18], 0
add rbp, 0x18
cmp rax, r14
jne 0x1400859b7
mov r14, qword [rsp + 0x128]
cmp r14, rbp
je 0x140085a23
add r14, 0xffffffffffffffe8
test r14, r14
je 0x140085fb6
cmp byte [r14 + 0x17], 0
js 0x140085a62
lea rax, [r14 - 0x18]
cmp r14, rbp
mov r14, rax
jne 0x140085a07
mov qword [rsp + 0x128], rbp
mov r14, rbp
add r12, 8
cmp r12, r13
je 0x140085b90
mov rdi, qword [r12]
mov rbp, qword [rsp + 0x120]
mov rbx, r14
cmp rbp, r14
je 0x140085ac7
test rdi, rdi
je 0x140085d50
mov rcx, rdi
call fcn.14012cc94
jmp 0x140085a75
mov rcx, qword [r14]
call fcn.14012c25c
jmp 0x140085a17
add rbp, 0x18
cmp rbp, r14
je 0x140085aee
movzx edx, byte [rbp + 0x17]
test dl, dl
js 0x140085a85
and edx, 0x7f
mov rcx, rbp
jmp 0x140085a8d
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp]
test rdx, rdx
js 0x140085fb3
test rcx, rcx
jne 0x140085aa4
test rdx, rdx
jne 0x140085fbc
cmp rdx, rax
jne 0x140085a6c
test rax, rax
je 0x140085ac4
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rdi + rdx*2]
jne 0x140085a6c
inc rdx
cmp rax, rdx
jne 0x140085ab0
mov rbx, rbp
cmp rbx, r14
je 0x140085997
mov rax, rbx
add rax, 0x18
cmp rax, r14
je 0x140085997
test rdi, rdi
je 0x140085d4d
mov rbp, rbx
jmp 0x140085b2d
mov rbx, r14
jmp 0x140085ac7
cmp byte [rbp + 0x17], 0
jns 0x140085b02
mov rcx, qword [rbp]
call fcn.14012c25c
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x10], rax
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rbp], xmm0
mov byte [rsi + 0x2f], 0
mov word [rbx], 0
add rbp, 0x18
lea rax, [rbx + 0x18]
cmp rax, r14
je 0x14008598d
mov rsi, rbx
mov rbx, rax
mov rcx, rdi
call fcn.14012cc94
movzx edx, byte [rsi + 0x2f]
test dl, dl
js 0x140085b4b
and edx, 0x7f
mov rcx, rbx
jmp 0x140085b53
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
test rdx, rdx
js 0x140085fad
test rcx, rcx
jne 0x140085b6a
test rdx, rdx
jne 0x140085fb0
cmp rdx, rax
jne 0x140085af3
test rax, rax
je 0x140085b20
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rdi + rdx*2]
jne 0x140085af3
inc rdx
cmp rax, rdx
jne 0x140085b76
jmp 0x140085b20
mov rax, qword [rsp + 0x120]
cmp rax, r14
je 0x140085c70
lea rdi, [rsp + 0x100]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
lea r8, [rsp + 0xf0]
lea rcx, [0x1401f30ba]
mov qword [r8], rcx
mov qword [r8 + 8], 1
sub r14, rax
sar r14, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rcx, r14
lea rdx, [rsp + 0xe0]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, rdi
call fcn.140058700
cmp byte [rdi + 0x17], 0
jns 0x140085c04
mov rdi, qword [rsp + 0x100]
cmp byte [rsp + 0x1d7], 0
mov r12, qword [rsp + 0x38]
js 0x140085c1d
lea rbx, [rsp + 0x1c0]
jmp 0x140085c25
mov rbx, qword [rsp + 0x1c0]
mov rcx, rdi
call fcn.14012cc94
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x160]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [rsp + 0x117], 0
jns 0x140085c9f
mov rcx, qword [rsp + 0x100]
call fcn.14012c25c
jmp 0x140085c9f
cmp byte [rsp + 0x1d7], 0
jns 0x140085c84
mov rdx, qword [rsp + 0x1c0]
jmp 0x140085c8c
lea rdx, [rsp + 0x1c0]
mov r12, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rsp + 0x120]
test rsi, rsi
je 0x140085422
mov rdi, qword [rsp + 0x128]
mov rcx, rsi
cmp rdi, rsi
je 0x140085cf3
add rdi, 0xffffffffffffffe8
jmp 0x140085cda
mov rcx, qword [rdi]
call fcn.14012c25c
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x140085ceb
test rdi, rdi
je 0x140085fe4
cmp byte [rdi + 0x17], 0
jns 0x140085cce
jmp 0x140085cc6
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x128], rsi
call fcn.14012c25c
jmp 0x140085422
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008603d
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140085d47
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x1400858b5
xor ecx, ecx
mov dl, 1
jmp 0x140085d3d
int3
int3
int3
lea rsi, [rsp + 0x1c0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140130d40
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140085d53
pxor xmm0, xmm0
lea rsi, [rsp + 0x180]
movdqa xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
lea rbx, [rsp + 0x160]
mov qword [rbx + 0x10], rax
movdqa xmmword [rbx], xmm0
lea r12, [rsp + 0x140]
mov qword [r12 + 0x10], rax
movdqa xmmword [r12], xmm0
lea r14, [rsp + 0x120]
mov qword [r14 + 0x10], rax
movdqa xmmword [r14], xmm0
lea r15, [rsp + 0x100]
lea rdx, [rsp + 0x1c0]
mov rcx, r15
call fcn.140167e60
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, rsi
mov r8, rbx
mov r9, r14
call fcn.14008a3c0
cmp byte [r15 + 0x17], 0
jns 0x140085e0f
mov rcx, qword [rsp + 0x100]
call fcn.14012c25c
movzx ecx, byte [rsp + 0x157]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x148]
cmovs r12, qword [rsp + 0x140]
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], rax
test rax, rax
js 0x14008602b
test r12, r12
jne 0x140085e57
test rax, rax
jne 0x140086034
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
call fcn.1400dcf10
movzx ecx, byte [rsp + 0x177]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x168]
cmovs rbx, qword [rsp + 0x160]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rax
test rax, rax
js 0x14008602e
test rbx, rbx
jne 0x140085eb4
test rax, rax
jne 0x140086037
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0xe0]
call fcn.1400dcf10
movzx ecx, byte [rsp + 0x197]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x188]
cmovs rsi, qword [rsp + 0x180]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rax
test rax, rax
js 0x140086031
test rsi, rsi
jne 0x140085f11
test rax, rax
jne 0x14008603a
lea rsi, [rsp + 0xb0]
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400dcf10
lea r8, [rsp + 0xc8]
lea r9, [rsp + 0x100]
mov rcx, rdi
mov rdx, rsi
call fcn.140194230
mov esi, eax
cmp byte [rsp + 0x137], 0
jns 0x140085f5d
mov rcx, qword [rsp + 0x120]
call fcn.14012c25c
cmp byte [rsp + 0x157], 0
jns 0x140085f74
mov rcx, qword [rsp + 0x140]
call fcn.14012c25c
cmp byte [rsp + 0x177], 0
jns 0x140085f8b
mov rcx, qword [rsp + 0x160]
call fcn.14012c25c
cmp byte [rsp + 0x197], 0
jns 0x1400855c8
mov rcx, qword [rsp + 0x180]
jmp 0x140085691
mov ecx, esi
call fcn.140088000
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov rax, qword [rdi + 0x18]
jmp 0x14008550e
int3
mov rcx, rbx
call fcn.1400b1f30
jmp 0x14008518d
int3
int3
int3
int3
lea rdx, str.....chrome_appchrome_exe_main_win.cc
lea rbx, [rsp + 0x1c0]
mov r8d, 0x27
mov rcx, rbx
call fcn.14012a370
mov rcx, rdi
mov rdx, rbx
call fcn.14019df40
jmp 0x1400854b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400853b9
int3
int3
int3
int3
int3
int3
int3
int3
xor ecx, ecx
jmp 0x140085d3b