Function at 0x140005c50
Capabilities:
Check os version
Create process on windows
Query environment variable
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xab8
mov rsi, r9
mov r13, r8
mov qword [rsp + 0x58], rcx
mov rax, qword [0x1400f6380]
mov rax, qword [rax]
xor rax, rsp
mov qword [rsp + 0xab0], rax
movdqa xmm0, xmmword [0x1400f65f0]
movdqa xmmword [rsp + 0x200], xmm0
lea r8, [rsp + 0x200]
mov qword [rsp + 0x60], rdx
mov rcx, rdx
mov rdx, r13
call fcn.140007740
mov qword [0x14012e238], rsi
lea r15, [r13 + 8]
mov rax, qword [r13 + 8]
test rax, rax
je 0x140005d58
lea r14, [r13 + 0x10]
lea rbx, str.log_launcher_error
mov rbp, r15
jmp 0x140005cf1
mov rax, qword [rbp + 8]
add rbp, 8
add r14, 8
test rax, rax
je 0x140005d58
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140005ce0
lea rdi, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rdi, rax
xor esi, esi
movzx ecx, word [rdi + rsi]
test cx, cx
je 0x140005ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, word [rsi + rbx]
jne 0x140005ce0
lea rax, [rsi + 2]
cmp word [rsi + rbx + 2], 0
mov rsi, rax
jne 0x140005d10
cmp word [rdi + rax], 0
jne 0x140005ce0
nop word [rax + rax]
mov rax, qword [r14]
mov qword [r14 - 8], rax
add r14, 8
test rax, rax
jne 0x140005d40
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
lea rcx, [rsp + 0xa0]
call fcn.140004370
mov rax, qword [r15]
test rax, rax
je 0x140005edb
lea rsi, [r13 + 0x10]
jmp 0x140005d90
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140005edb
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140005d80
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140005d80
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140005d80
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140005d80
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140005d80
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140005d80
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140005d80
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140005d80
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x70
jne 0x140005d80
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140005d80
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140005d80
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140005d80
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140005d80
cmp word [rbx + 0x16], 0
jne 0x140005d80
jmp 0x1400063ff
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x690], xmm0
movdqa xmmword [rsp + 0x680], xmm0
movdqa xmmword [rsp + 0x670], xmm0
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x670]
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
mov qword [rsp + 0x68], r15
js 0x140005fbe
mov r8d, dword [rsp + 0x698]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140005fd5
mov dword [rsp + 0x670], 0
mov byte [rsp + 0x688], 0
mov dword [rsp + 0x238], 0x209
lea rsi, [rsp + 0x690]
lea r9, [rsp + 0x238]
mov rcx, rbp
mov edx, 1
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140006001
cmp byte [rsp + 0x688], 0
je 0x140006844
mov r15, qword [rsp + 0x678]
mov r12d, dword [rsp + 0x680]
mov r14b, 1
mov ebx, dword [rsp + 0x684]
jmp 0x140006025
mov ebx, eax
or ebx, 0x10000000
lea r15, [0x1400f6821]
mov r12d, 0x502
jmp 0x140006037
xor r15d, r15d
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140006025
cmp eax, 0x57
je 0x140006025
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r12d, 0x5c
jmp 0x14000601b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r12d, 0x1e
mov r14b, 1
lea r15, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_SameBinary.h
mov rax, rbp
add rax, 1
cmp rax, 2
jae 0x14000605f
test r14b, r14b
je 0x14000606d
mov qword [rsp + 0x670], r15
mov dword [rsp + 0x678], r12d
mov dword [rsp + 0x67c], ebx
lea rcx, [rsp + 0x670]
call fcn.140004250
xor esi, esi
jmp 0x140006074
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x140006037
test r15b, r15b
sete sil
lea rcx, [0x1400f6a96]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
mov rdi, qword [rsp + 0x68]
je 0x14000609e
cmp byte [rax], 0
je 0x14000609e
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov sil, 1
mov rax, qword [rdi]
test rax, rax
je 0x1400061d1
lea rbx, [r13 + 0x10]
jmp 0x1400060c0
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x1400061d1
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400060b0
lea rbp, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbp, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x1400060b0
movzx ecx, word [rbp + 2]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400060b0
movzx ecx, word [rbp + 4]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x1400060b0
movzx ecx, word [rbp + 6]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400060b0
movzx ecx, word [rbp + 8]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x1400060b0
movzx ecx, word [rbp + 0xa]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x1400060b0
movzx ecx, word [rbp + 0xc]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400060b0
movzx ecx, word [rbp + 0xe]
test cx, cx
je 0x1400060b0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400060b0
cmp word [rbp + 0x10], 0
jne 0x1400060b0
mov rax, qword [rbx]
mov qword [rbx - 8], rax
add rbx, 8
test rax, rax
jne 0x1400061b2
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
mov rdi, qword [rsp + 0x68]
jmp 0x1400061da
test sil, sil
je 0x1400063c4
mov rax, qword [rdi]
xor ebp, ebp
test rax, rax
je 0x1400063bf
lea rsi, [r13 + 0x10]
jmp 0x140006200
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x1400063bf
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400061f0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x1400061f0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400061f0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400061f0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x1400061f0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400061f0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x1400061f0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x1400061f0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400061f0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x1400061f0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400061f0
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x1400061f0
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x1400061f0
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400061f0
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x1400061f0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400061f0
cmp word [rbx + 0x1c], 0
jne 0x1400061f0
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x14000639a
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
mov r9d, 1
mov rdi, qword [rsp + 0x68]
jmp 0x1400063cc
xor r9d, r9d
jmp 0x1400063cc
xor r9d, r9d
mov ebp, 1
lea rcx, [rsp + 0x670]
lea rdx, [rsp + 0xa0]
mov r8d, ebp
call fcn.1400096f0
cmp byte [rsp + 0x680], 0
je 0x140006479
lea rcx, [rsp + 0x670]
call fcn.140004250
lea rcx, [rsp + 0x670]
lea rdx, [rsp + 0xa0]
call fcn.1400079a0
cmp byte [rsp + 0x680], 0
je 0x14000642b
lea rcx, [rsp + 0x670]
call fcn.140004250
mov rsi, qword [rsp + 0x58]
mov qword [rsi], 0
mov rdi, qword [0x1400f6380]
lea rcx, [rsp + 0xa0]
call fcn.140004660
mov rax, qword [rsp + 0xab0]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x1400076e5
mov rax, rsi
add rsp, 0xab8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rsp + 0x670], 0
je 0x1400064fb
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400064a4
cmp byte [rax], 0
je 0x1400064a4
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x1400063ff
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
je 0x1400063ff
cmp word [rax], 0
je 0x1400063ff
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstoul
imul esi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov edx, eax
call fcn.140011fb0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400063ff
mov eax, dword [0x140130150]
cmp eax, 0x3838
ja 0x1400065bf
mov eax, dword [0x14012c00c]
cmp eax, 0x383a
jb 0x1400065f9
lea rcx, [rsp + 0x678]
mov r8d, 0x114
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x670], rax
mov dword [rsp + 0x67c], 0x3839
mov rsi, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 4
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rsi
lea rcx, [rsp + 0x670]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140007087
mov eax, 0x3839
xchg dword [0x140130150], eax
mov al, byte [0x14012e1a8]
test al, al
je 0x1400076fa
mov rax, qword [0x140130148]
test rax, rax
je 0x1400065f9
mov dword [rsp + 0x670], 4
lea rdx, [rsp + 0x670]
mov r8d, 4
mov ecx, 0xa
call rax
call fcn.140007c50
test r13, r13
je 0x1400068f7
lea rcx, [rsp + 0x670]
xor edx, edx
call fcn.140011aa0
mov rax, qword [rsp + 0x670]
test rax, rax
je 0x1400068f7
mov qword [r13], rax
mov rax, qword [r13 + 8]
test rax, rax
je 0x140006de4
lea rsi, [r13 + 0x10]
jmp 0x140006650
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x14000697f
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006640
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x77
jne 0x140006640
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006640
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x69
jne 0x140006640
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006640
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x140006640
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x140006640
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006640
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006640
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x140006640
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x62
jne 0x140006640
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006640
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006640
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x77
jne 0x140006640
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140006640
movzx ecx, word [rbx + 0x1c]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006640
movzx ecx, word [rbx + 0x1e]
test cx, cx
je 0x140006640
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006640
cmp word [rbx + 0x20], 0
jne 0x140006640
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x140006822
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
mov rdi, qword [rsp + 0x68]
jmp 0x140006e12
mov r8d, dword [rsp + 0x670]
lea rcx, [rsp + 0x190]
mov rdx, rsi
call fcn.140011bc0
cmp byte [rsp + 0x1a8], 0
je 0x140006925
mov ebx, dword [rsp + 0x19c]
cmp ebx, 0xd000003a
jne 0x140006adf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
mov dword [rsp + 0x238], 0
mov byte [rsp + 0x250], 0
mov dword [rsp + 0x190], 0x209
lea r8, [rsp + 0x258]
lea r9, [rsp + 0x190]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400070c4
cmp byte [rsp + 0x250], 0
je 0x14000711d
mov r15, qword [rsp + 0x240]
mov r12d, dword [rsp + 0x248]
mov r14b, 1
mov ebx, dword [rsp + 0x24c]
jmp 0x140007185
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x800705070000010e
mov qword [rsp + 0x678], rax
jmp 0x14000641e
mov dword [rsp + 0x238], 1
mov byte [rsp + 0x250], 0
lea rsi, [rsp + 0x258]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x140006960
test eax, eax
jne 0x140007097
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r12d, 0x29
jmp 0x14000601b
mov rax, qword [rdi]
test rax, rax
je 0x140006de4
lea rsi, [r13 + 0x10]
jmp 0x1400069b0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006af7
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400069a0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6d
jne 0x1400069a0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400069a0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x1400069a0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x69
jne 0x1400069a0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400069a0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x1400069a0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400069a0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400069a0
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x1400069a0
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x1400069a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400069a0
cmp word [rbx + 0x14], 0
jne 0x1400069a0
jmp 0x140006e12
mov r15, qword [rsp + 0x190]
mov r12d, dword [rsp + 0x198]
mov r14b, 1
jmp 0x140006025
mov rax, qword [rdi]
test rax, rax
je 0x140006de4
lea rsi, [r13 + 0x10]
jmp 0x140006b20
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006cbf
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006b10
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x62
jne 0x140006b10
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006b10
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x63
jne 0x140006b10
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6b
jne 0x140006b10
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x67
jne 0x140006b10
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x72
jne 0x140006b10
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006b10
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x75
jne 0x140006b10
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006b10
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140006b10
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006b10
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006b10
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140006b10
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x140006b10
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6b
jne 0x140006b10
cmp word [rbx + 0x1c], 0
jne 0x140006b10
jmp 0x140006e12
mov rax, qword [rdi]
test rax, rax
je 0x140006de4
lea rsi, [r13 + 0x10]
jmp 0x140006cf0
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006de4
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006ce0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x68
jne 0x140006ce0
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006ce0
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006ce0
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140006ce0
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x140006ce0
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006ce0
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140006ce0
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006ce0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140006ce0
cmp word [rbx + 0x10], 0
jne 0x140006ce0
jmp 0x140006e12
lea rcx, str.MOZ_AUTOMATION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140006dfa
cmp byte [rax], 0
jne 0x140006e12
lea rcx, str.MOZ_HEADLESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor ebp, ebp
test rax, rax
je 0x140006e17
cmp byte [rax], 0
je 0x140006e17
mov ebp, 1
mov rax, qword [rdi]
test rax, rax
je 0x140006fbd
lea rsi, [r13 + 0x10]
jmp 0x140006e40
mov rax, qword [rsi]
add rsi, 8
test rax, rax
je 0x140006fbd
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140006e30
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6e
jne 0x140006e30
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140006e30
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x140006e30
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140006e30
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006e30
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006e30
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6c
jne 0x140006e30
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006e30
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x76
jne 0x140006e30
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140006e30
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x74
jne 0x140006e30
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x140006e30
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140006e30
cmp word [rbx + 0x18], 0
jne 0x140006e30
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x140006fa2
mov rax, qword [rsp + 0x60]
add dword [rax], 0xffffffff
or ebp, 2
mov qword [rsp + 0x98], 0
mov rdx, qword [r13]
lea rcx, [rsp + 0x1e8]
lea r9, [rsp + 0x98]
mov r8d, ebp
call fcn.140005540
cmp byte [rsp + 0x1f8], 0
mov rsi, qword [rsp + 0x60]
je 0x140007035
lea rcx, [rsp + 0x1e8]
call fcn.140004250
mov rsi, qword [rsp + 0x58]
mov qword [rsi], 0
mov rdi, qword [0x1400f6380]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000643e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000643e
test ebp, ebp
jne 0x1400070ed
cmp dword [rsp + 0x1e8], 1
jne 0x1400070ed
cmp qword [rsp + 0x98], 0
jne 0x1400070ed
mov edx, dword [rsi]
lea rcx, [rsp + 0x670]
mov r8, r13
call fcn.140004730
cmp byte [rsp + 0x680], 0
je 0x1400071e6
lea rcx, [rsp + 0x670]
jmp 0x140006ffc
mov eax, 0x3839
xchg dword [0x14012c00c], eax
jmp 0x1400065f9
cmp byte [rsp + 0x250], 0
je 0x1400071a1
mov r15, qword [rsp + 0x240]
mov r12d, dword [rsp + 0x248]
mov r14b, 1
mov ebx, dword [rsp + 0x24c]
jmp 0x140006025
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r14b, 1
mov r12d, 0x1e
lea r15, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_SameBinary.h
jmp 0x140007185
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0xa0]
call fcn.1400079a0
cmp byte [rsp + 0x1e0], 0
je 0x1400071fa
lea rcx, [rsp + 0x1d0]
jmp 0x140006ffc
xor r15d, r15d
cmp byte [rsp + 0x688], 0
mov r14d, 0
jne 0x140007185
mov eax, dword [rsp + 0x238]
or eax, dword [rsp + 0x670]
jne 0x140007185
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov rdx, rsi
call sub.ntdll.dll_RtlInitUnicodeString
lea rsi, [rsp + 0x218]
mov rcx, rsi
lea rdx, [rsp + 0x258]
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
mov rdx, rsi
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
xor r15d, r15d
test al, al
setne r15b
xor r14d, r14d
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140006025
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006025
mov r8d, dword [rsp + 0x238]
lea rcx, [rsp + 0x218]
mov rdx, rsi
call fcn.140011bc0
cmp byte [rsp + 0x230], 0
je 0x140007336
mov r15, qword [rsp + 0x218]
mov r12d, dword [rsp + 0x220]
mov r14b, 1
mov ebx, dword [rsp + 0x224]
jmp 0x140006025
mov rsi, qword [rsp + 0x58]
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x14000700d
mov edx, dword [rsi]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
mov r8, r13
xor r9d, r9d
call fcn.1400049c0
cmp qword [rsp + 0x90], 0
je 0x14000734c
lea rcx, [rsp + 0x88]
mov rdx, rsi
mov r8, r13
mov r9d, 2
call fcn.140007db0
cmp byte [rsp + 0x89], 0
je 0x14000736f
mov qword [rsp + 0x190], 0
movdqa xmm0, xmmword [0x1400f6430]
movdqu xmmword [rsp + 0x1a0], xmm0
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1c8], 0
lea rbx, [rsp + 0x190]
mov rcx, rbx
call fcn.1400080c0
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov qword [rsp + 0x170], rax
mov ecx, 0xfffffff5
call rsi
mov qword [rsp + 0x178], rax
mov ecx, 0xfffffff4
call rsi
mov qword [rsp + 0x180], rax
lea rdx, [rsp + 0x170]
mov rcx, rbx
call fcn.1400081d0
lea rcx, [rsp + 0x158]
lea rsi, [rsp + 0x670]
mov rdx, rbx
mov r8, rsi
call fcn.140008210
cmp byte [rsp + 0x168], 0
je 0x140007427
lea rcx, [rsp + 0x158]
call fcn.140004250
mov rsi, qword [rsp + 0x58]
mov qword [rsi], 0
mov rdi, qword [0x1400f6380]
lea rcx, [rsp + 0x190]
call fcn.140008520
jmp 0x1400073b8
cmp byte [rsp + 0x1a8], 0
je 0x1400073df
xor r15d, r15d
jmp 0x14000741f
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x8007050700000139
jmp 0x140007390
mov byte [rsp + 0x680], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x670], rax
movabs rax, 0x8007005700000140
mov qword [rsp + 0x678], rax
lea rcx, [rsp + 0x670]
call fcn.140004250
mov rsi, qword [rsp + 0x58]
mov qword [rsi], 0
mov rdi, qword [0x1400f6380]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x140007014
call sub.mozglue.dll_free
jmp 0x140007014
movdqu xmm0, xmmword [rsp + 0x190]
movdqu xmm1, xmmword [rsp + 0x218]
pcmpeqb xmm1, xmm0
movq xmm0, qword [rsp + 0x1a0]
movq xmm2, qword [rsp + 0x228]
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb eax, xmm2
xor r15d, r15d
cmp eax, 0xffff
sete r15b
xor r14d, r14d
jmp 0x140006025
xor ebx, ebx
cmp byte [rsp + 0x158], 0
je 0x140007475
mov r14d, 0x80404
cmp qword [rsp + 0x1a0], 0
je 0x14000747b
or byte [rsp + 0x6ad], 1
movdqa xmm0, xmmword [rsp + 0x170]
movdqu xmmword [rsp + 0x6c0], xmm0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x6d0], rax
mov ebx, 1
jmp 0x14000747b
mov r14d, 0x404
lea rcx, [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x275], 8
je 0x1400074b0
mov rax, qword [rsp + 0x250]
test rax, rax
je 0x1400074b0
or byte [rsp + 0x6ad], 8
mov qword [rsp + 0x688], rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [r13]
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x70]
test rcx, rcx
je 0x140007511
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000753c
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400075a2
cmp byte [rsp + 0x89], 0
je 0x1400076ea
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rdx, qword [r13]
lea rcx, [rsp + 0x140]
mov r8, rbx
call fcn.1400040d0
cmp byte [rsp + 0x150], 0
je 0x1400075ec
lea rcx, [rsp + 0x140]
call fcn.140004250
mov rcx, rbx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rsi, qword [rsp + 0x58]
mov qword [rsi], 0
jmp 0x14000768a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x228], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x218], rax
mov dword [rsp + 0x220], 0x17f
mov dword [rsp + 0x224], ecx
lea rcx, [rsp + 0x218]
jmp 0x14000730c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14000761f
test bpl, 1
jne 0x140007669
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edx, edx
cmp eax, 1
sbb edx, edx
not edx
or edx, 0x2710
mov rcx, rbx
call fcn.140008470
jmp 0x14000767b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x228], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x218], rax
mov dword [rsp + 0x220], 0x18f
mov dword [rsp + 0x224], ecx
lea rcx, [rsp + 0x218]
jmp 0x14000757e
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400076c0
mov rsi, qword [rsp + 0x58]
mov dword [rsi], 0
mov byte [rsi + 4], 1
mov rdi, qword [0x1400f6380]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400076a4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140007324
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007324
lea rdx, [rsp + 0x218]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000767b
mov eax, dword [rsp + 0x218]
mov rsi, qword [rsp + 0x58]
mov dword [rsi], eax
jmp 0x140007686
call fcn.140072349
mov dword [0], 0x2ea
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea rcx, [0x14012e1a8]
call fcn.1400c0194
test eax, eax
je 0x1400065cd
lea rcx, [0x140130140]
lea rdx, [0x1400f6626]
lea r8, [0x1400f6640]
call fcn.1400120f0
lea rcx, [0x14012e1a8]
call fcn.1400c0265
jmp 0x1400065cd