Function at 0x1402b78e0
Capabilities:
Authenticate hmac
Create process on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x688
movaps xmmword [rsp + 0x670], xmm10
movaps xmmword [rsp + 0x660], xmm9
movaps xmmword [rsp + 0x650], xmm8
movaps xmmword [rsp + 0x640], xmm7
movaps xmmword [rsp + 0x630], xmm6
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x628], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], r13
movaps xmm6, xmmword [0x1403d4b30]
movaps xmmword [rsp + 0x70], xmm6
test r8, r8
je 0x1402b9973
mov rsi, r8
movabs rbp, 0x8000000000000000
mov rcx, r8
call fcn.14029c474
lea r12, [rbp - 9]
cmp rax, r12
ja 0x1402b997a
mov rdi, rax
cmp rax, 0xa
jbe 0x1402b8472
mov rax, rdi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov ebx, reloc.WS2_32.dll_listen
cmovne rbx, rcx
test rbx, rbx
js 0x1402b9975
lea rcx, [rbx + rbx]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x70], rax
or rbx, rbp
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rdi
lea rbx, [rcx + rdi*2]
cmp rsi, rcx
setb al
cmp rsi, rbx
setae dl
or dl, al
je 0x1402b9973
test rdi, rdi
je 0x1402b79f3
add rdi, rdi
mov rdx, rsi
mov r8, rdi
call fcn.1402b6370
mov word [rbx], 0
lea rdx, str.__uninstall
lea rcx, [rsp + 0x70]
call fcn.14020b000
test eax, eax
jne 0x1402b8491
call fcn.1400ddc40
test al, al
je 0x1402b7a1f
call fcn.1400ddc60
mov r15d, gethostname
call fcn.1400eb260
test al, al
je 0x1402b80fb
lea rsi, [rsp + 0x210]
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rcx, str.SetupMetrics
lea rdi, [rsp + 0x200]
mov qword [rdi], rcx
call fcn.14029c0d0
mov qword [rdi + 8], rax
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
call fcn.140106ce0
lea rcx, [rsp + 0x1d0]
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.140114d30
xor ecx, ecx
xor edx, edx
call fcn.140112560
lea rsi, [rsp + 0x1b0]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
call fcn.14021e3b0
mov rdi, rax
lea rcx, [0x1403db7e4]
lea rbx, [rsp + 0x1a0]
mov qword [rbx], rcx
call fcn.14029c0d0
mov qword [rbx + 8], rax
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.14021eb10
lea rcx, str.crashpad_handler
call fcn.14029c0d0
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x1402b7aef
mov rdx, qword [rsp + 0x1b8]
cmp rax, rdx
jne 0x1402b7b24
cmp rax, 0xffffffffffffffff
je 0x1402b9959
test cl, cl
jns 0x1402b7b0a
mov rsi, qword [rsp + 0x1b0]
lea rdx, str.crashpad_handler
mov rcx, rsi
mov r8, rax
call fcn.1402b6270
test eax, eax
je 0x1402b7fa4
call fcn.140115cb0
call fcn.14030b320
mov rdi, rax
mov rcx, rax
call fcn.14011dbb0
call fcn.14021e3b0
mov rsi, rax
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1402b7bd2
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rcx, [rsp + 0x420]
mov r8d, 0x5bf
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x430]
lea rdx, str.Command_Line:
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1401f8290
mov rbx, rax
lea r14, [rsp + 0x2f0]
mov rcx, rsi
mov rdx, r14
call fcn.140114350
mov rcx, rbx
mov rdx, r14
call fcn.14010a6f0
cmp byte [r14 + 0x17], 0
jns 0x1402b7bc5
mov rcx, qword [rsp + 0x2f0]
call fcn.1402776c8
lea rcx, [rsp + 0x420]
call fcn.14010e2d0
mov rcx, rsi
mov rdx, rdi
call fcn.1400edd10
mov byte [rsp + 0x19f], 0
lea r14, [0x1403dd852]
mov rcx, r14
call fcn.14029c0d0
cmp rax, r12
ja 0x1402b9984
mov rbx, rax
cmp rax, 0x16
ja 0x1402b7f60
lea rcx, [rsp + 0x420]
mov byte [rcx + 0x17], bl
lea r15, [rcx + rbx]
cmp rcx, r14
seta al
cmp r15, r14
setbe dl
or dl, al
je 0x1402b9973
test rbx, rbx
je 0x1402b7c41
lea rdx, [0x1403dd852]
mov r8, rbx
call fcn.1402b6370
mov byte [r15], 0
lea rbx, [rsp + 0x420]
lea r8, [rsp + 0x19f]
mov rcx, rdi
mov rdx, rbx
call fcn.14030b150
cmp byte [rbx + 0x17], 0
jns 0x1402b7c73
mov rcx, qword [rsp + 0x420]
call fcn.1402776c8
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1402b7cdc
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rbx, [rsp + 0x420]
mov rcx, rbx
mov r8d, 0x5c5
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x430]
lea rdx, str.system_install_is
mov r8d, reloc.WS2_32.dll_select
call fcn.1401f8290
mov dl, byte [rsp + 0x19f]
mov rcx, rax
call fcn.1400c2650
mov rcx, rbx
call fcn.14010e2d0
lea rbx, [rsp + 0x420]
mov r8d, 0x1d0
mov rcx, rbx
mov dl, 0xaa
call fcn.1402b6a10
mov rcx, rbx
call fcn.140308e10
mov rcx, rbx
call fcn.140308ee0
lea r12, [rsp + 0x130]
mov qword [r12 + 0x60], r13
movaps xmmword [r12 + 0x50], xmm6
movaps xmmword [r12 + 0x40], xmm6
movaps xmmword [r12 + 0x30], xmm6
movaps xmmword [r12 + 0x20], xmm6
movaps xmmword [r12 + 0x10], xmm6
movaps xmmword [r12], xmm6
mov rcx, r12
call fcn.1400ee790
mov rcx, r12
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.1400ee820
lea r14, [rsp + 0x138]
lea rcx, [rsp + 0x210]
mov rdx, r14
call fcn.14021c6d0
mov rcx, r12
call fcn.1400ef3d0
mov rcx, r12
call fcn.1400ef680
mov rcx, rsi
call fcn.1400efbf0
call fcn.140100b50
call fcn.140100b70
call fcn.14010dcb0
call fcn.1400fe790
mov rcx, rsi
call fcn.1400fe7b0
call fcn.1400fd2e0
lea rdx, [0x1403dde75]
mov rcx, rsi
call fcn.14021ea20
mov ebx, eax
test al, al
je 0x1402b7dbb
mov byte [rsp + 0x22c], 1
call fcn.140309620
test al, al
je 0x1402b802f
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x120], xmm6
xor eax, eax
mov byte [rsp + 0x110], al
mov byte [rsp + 0x128], al
lea rcx, [fcn.1400c2530]
call fcn.1400fd510
cmp byte [rsp + 0x128], 1
jne 0x1402b7e13
lea r15, [rsp + 0x110]
mov rcx, r15
call fcn.1400fd3f0
mov byte [r15 + 0x18], 0
lea r15, [rsp + 0x110]
mov rcx, r15
xor edx, edx
call fcn.1400fd310
mov byte [r15 + 0x18], 1
mov rcx, r15
call fcn.1400fd470
test al, al
je 0x1402b7fea
xor ecx, ecx
call fcn.1400fd510
call fcn.140116780
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
cmp byte [rax + 0xac], 0
jne 0x1402b7e99
mov r15d, 0x21
cmp byte [rsp + 0x19f], 0
jne 0x1402b8012
lea rdx, str.self_destruct
mov rcx, rsi
call fcn.14021ea20
test al, al
jne 0x1402b8012
lea rdx, str.remove_chrome_registration
mov rcx, rsi
call fcn.14021ea20
test al, al
jne 0x1402b8012
call fcn.1401161a0
test al, al
jne 0x1402b7ed6
lea rdx, str.make_chrome_default
mov rcx, rsi
call fcn.14021ea20
mov r15d, 0x21
test al, al
jne 0x1402b8012
lea rdx, str.register_chrome_browser
mov rcx, rsi
call fcn.14021ea20
test al, al
jne 0x1402b8012
mov rcx, rsi
call fcn.1400eb1a0
mov r15d, gethostname
test al, al
jne 0x1402b8012
mov byte [rsp + 0x58], bl
movabs r15, 0xfffffffc00000000
lea rbx, [rsp + 0xf0]
mov qword [rbx + 0x10], r13
movaps xmmword [rbx], xmm6
mov rcx, rbx
call fcn.14021c520
mov ecx, 1
mov rdx, rbx
call fcn.140105ef0
lea rdx, [rsp + 0xd0]
mov qword [rdx + 0x10], r13
movaps xmmword [rdx], xmm6
lea rbx, [rsp + 0x420]
mov rcx, r12
mov r8, rbx
call fcn.1400eee50
mov rcx, r12
and rcx, r15
mov rax, qword [0x140432948]
mov qword [rsp + 0x68], rcx
cmp rcx, rax
jne 0x1402b8240
jmp 0x1402b822c
mov rax, rbx
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov r15d, Ordinal_27
cmovne r15, rcx
mov rcx, r15
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x420], rax
or r15, rbp
mov qword [rsp + 0x430], r15
mov qword [rsp + 0x428], rbx
jmp 0x1402b7c15
mov byte [rsp + 0x22c], 1
lea rsi, [rsp + 0x420]
mov rcx, rsi
call fcn.14021c520
call fcn.14021e3b0
lea r8, [0x1403db7e4]
lea r9, str.user_data_dir
mov rcx, rax
mov rdx, rsi
call fcn.1401187c0
mov r15d, eax
mov rcx, rsi
call fcn.14021c6c0
jmp 0x1402b80ca
lea rcx, [rsp + 0x130]
mov r15d, 0xa
mov edx, 0xa
mov r8d, 0xc04
xor r9d, r9d
call fcn.1400ef0e0
xor ecx, ecx
call fcn.1400fd510
cmp byte [rsp + 0x128], 1
jne 0x1402b80a3
lea rcx, [rsp + 0x110]
call fcn.1400fd3f0
jmp 0x1402b80a3
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1402b8082
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rsi, [rsp + 0x2f0]
mov rcx, rsi
mov r8d, 0x5f4
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Chrome_only_supports_Windows_10_or_later.
mov r8d, reloc.WLDAP32.dll_Ordinal_41
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x130]
mov r15d, 9
mov edx, 9
mov r8d, 0xc56
xor r9d, r9d
call fcn.1400ef0e0
lea rcx, [rsp + 0x130]
call fcn.1400ee7e0
lea rcx, [rsp + 0x508]
call fcn.140307af0
lea rcx, [rsp + 0x420]
call fcn.140307af0
cmp byte [rsp + 0x1c7], 0
jns 0x1402b80e1
mov rcx, qword [rsp + 0x1b0]
call fcn.1402776c8
lea rcx, [rsp + 0x1d0]
call fcn.140114d90
lea rcx, [rsp + 0x210]
call fcn.140106dd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x420]
mov dword [rcx], 0xdeadbecf
mov dword [rcx + 4], r15d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], eax
mov dword [rcx + 0x10], 0xdeadbedf
call fcn.1401f7330
cmp byte [rsp + 0x87], 0
jns 0x1402b8155
mov rcx, qword [rsp + 0x70]
call fcn.1402776c8
mov rcx, qword [rsp + 0x628]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1402b816f
call fcn.140278ca0
int3
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x630]
movaps xmm7, xmmword [rsp + 0x640]
movaps xmm8, xmmword [rsp + 0x650]
movaps xmm9, xmmword [rsp + 0x660]
movaps xmm10, xmmword [rsp + 0x670]
add rsp, 0x688
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
mov byte [rsp + 0x1e7], cl
mov byte [rsp + 0x1d0], cl
test al, al
jns 0x1402b81d2
mov rcx, qword [rsp + 0x130]
call fcn.1402776c8
cmp byte [rsp + 0x307], 0
jns 0x1402b81e9
mov rcx, qword [rsp + 0x2f0]
call fcn.1402776c8
cmp byte [rsp + 0x1e7], 0
js 0x1402b81fd
lea rcx, [rsp + 0x1d0]
jmp 0x1402b8205
mov rcx, qword [rsp + 0x1d0]
call fcn.1400ddcf0
cmp byte [rsp + 0x1e7], 0
jns 0x1402b8221
mov rcx, qword [rsp + 0x1d0]
call fcn.1402776c8
mov r15d, 1
jmp 0x1402b8141
lea rcx, [rsp + 0x130]
call fcn.1400c3820
mov rax, qword [0x140432948]
mov qword [rsp + 0xb0], r12
mov rdx, rbx
movabs rcx, 0xfffffffc00000000
and rdx, rcx
mov qword [rsp + 0x60], rdx
cmp rdx, rax
jne 0x1402b8276
lea rcx, [rsp + 0x420]
call fcn.1400c3820
mov rax, qword [0x140432948]
mov qword [rsp + 0xb8], rbx
lea r15, [rsp + 0xf0]
mov rbx, r15
movabs rcx, 0xfffffffc00000000
and rbx, rcx
cmp rbx, rax
jne 0x1402b82af
lea rcx, [rsp + 0xf0]
call fcn.1400c3820
mov rax, qword [0x140432948]
mov qword [rsp + 0xc0], r15
lea r15, [rsp + 0xd0]
mov rcx, r15
movabs rdx, 0xfffffffc00000000
and rcx, rdx
cmp rcx, rax
jne 0x1402b82e1
lea rcx, [rsp + 0xd0]
call fcn.1400c3820
mov qword [rsp + 0xc8], r15
lea rdx, str.configure_browser_in_directory
mov rcx, rsi
call fcn.14021ea20
test al, al
je 0x1402b8304
mov byte [rsp + 0x22c], 1
lea r9, [rsp + 0xac]
mov dword [r9], 0
lea rcx, [rsp + 0xb0]
mov rdx, rsi
mov r8, rdi
call fcn.1400c6de0
test al, al
je 0x1402b83cc
mov r15d, dword [rsp + 0xac]
movabs rbx, 0xfffffffc00000000
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b835c
call fcn.1400c3960
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8378
call fcn.1400c3960
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8394
call fcn.1400c3960
mov rcx, qword [rsp + 0xb0]
and rbx, rcx
cmp rbx, qword [0x140432948]
jne 0x1402b83ad
call fcn.1400c3960
lea rcx, [rsp + 0xd0]
call fcn.140107800
lea rcx, [rsp + 0xf0]
call fcn.14021c6c0
jmp 0x1402b8012
cmp byte [rsp + 0x19f], 1
jne 0x1402b83e4
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1402b97f9
lea r15, [rsp + 0xa0]
mov qword [r15], r13
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x420]
mov rcx, r15
mov rdx, rsi
mov r8, rdi
call fcn.1400ed750
cmp qword [r15], 0
je 0x1402b953f
cmp byte [rsp + 0x58], 0
je 0x1402b90b4
lea rcx, [rsp + 0x280]
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.140111f60
lea rdx, str.self_destruct
mov rcx, rsi
call fcn.14021ea20
test al, al
je 0x1402b89d8
lea rcx, [rsp + 0x130]
call fcn.1400eee40
test al, al
jne 0x1402b89d8
jmp 0x1402b894d
lea rcx, [rsp + 0x70]
mov byte [rcx + 0x17], dil
jmp 0x1402b79c8
lea rcx, [rsp + 0x2f0]
mov byte [rcx + 0x17], dil
jmp 0x1402b8545
lea rdx, str.__adv_import
lea rcx, [rsp + 0x70]
call fcn.14020b000
test eax, eax
jne 0x1402b7a1f
lea rsi, [rsp + 0x420]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1402b6a10
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x300], r13
movaps xmmword [rsp + 0x2f0], xmm6
mov rcx, rsi
call fcn.14029c474
cmp rax, r12
ja 0x1402b9991
mov rdi, rax
cmp rax, 0xa
jbe 0x1402b8480
mov rax, rdi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov ebx, reloc.WS2_32.dll_listen
cmovne rbx, rcx
test rbx, rbx
js 0x1402b9975
lea rcx, [rbx + rbx]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x2f0], rax
or rbx, rbp
mov qword [rsp + 0x300], rbx
mov qword [rsp + 0x2f8], rdi
lea rbx, [rcx + rdi*2]
cmp rsi, rcx
setb al
cmp rsi, rbx
setae dl
or dl, al
je 0x1402b9973
test rdi, rdi
je 0x1402b8575
add rdi, rdi
lea rdx, [rsp + 0x420]
mov r8, rdi
call fcn.1402b6370
mov word [rbx], 0
mov ecx, 0x20
call fcn.14027768c
mov qword [rsp + 0x130], rax
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x138], reloc.WS2_32.dll_listen
lea rcx, [rax + 0x1a]
lea rdx, str.Application_
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x1402b9973
movups xmm0, xmmword [0x1403da13c]
movups xmmword [rax + 0xa], xmm0
movups xmm0, xmmword [str.Application_]
movups xmmword [rax], xmm0
mov word [rax + 0x1a], 0
movsx r10, byte [rsp + 0x307]
test r10, r10
js 0x1402b8629
lea rcx, [rsp + 0x2f0]
jmp 0x1402b8639
test r8, r8
je 0x1402b8673
xor r10d, r10d
movzx esi, word [r8 + r10*2]
cmp si, word [rax + r10*2]
jne 0x1402b8617
inc r10
cmp r10, 0xd
jne 0x1402b8600
jmp 0x1402b8676
add r8, 2
sar r11, 1
mov r10, r11
cmp r11, 0xc
jg 0x1402b8655
jmp 0x1402b8673
mov rcx, qword [rsp + 0x2f0]
mov r10, qword [rsp + 0x2f8]
lea rdx, [rcx + r10*2]
mov r8, rdx
cmp r10, 0xd
jl 0x1402b8676
lea r8, [r10 + r10]
lea r9, [rcx + r8]
add r9, 0xfffffffffffffffe
mov r8, rcx
add r10, 0xfffffffffffffff4
mov r11, r9
sub r11, r8
cmp word [r8], 0x5c
je 0x1402b85f8
add r8, 2
add r11, 0xfffffffffffffffe
dec r10
jne 0x1402b865f
mov r8, rdx
mov rax, r8
sub rax, rcx
sar rax, 1
add rax, 0xd
cmp r8, rdx
mov edi, recv
cmovne rdi, rax
lea rdx, str.Installer_
lea rsi, [rsp + 0x130]
mov r8d, recv
mov rcx, rsi
call fcn.1400e8820
movsx rax, byte [rsi + 0x17]
mov rdx, rax
test rax, rax
jns 0x1402b86c9
mov rdx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x130]
movsx rcx, byte [rsp + 0x307]
test rcx, rcx
js 0x1402b8720
lea rbx, [rsp + 0x2f0]
jmp 0x1402b8728
test r9, r9
je 0x1402b8791
xor r15d, r15d
movzx r14d, word [r9 + r15*2]
cmp r14w, word [rsi + r15*2]
jne 0x1402b8706
inc r15
cmp rdx, r15
jne 0x1402b86ed
jmp 0x1402b8794
add r9, 2
sar r10, 1
cmp r10, rdx
mov r14, qword [rsp + 0x58]
jge 0x1402b8760
jmp 0x1402b8791
xor esi, esi
jmp 0x1402b87ab
mov rbx, qword [rsp + 0x2f0]
test rdx, rdx
je 0x1402b8719
mov r10, rcx
test cl, cl
jns 0x1402b873c
mov r10, qword [rsp + 0x2f8]
lea r8, [rbx + r10*2]
mov r9, r8
cmp r10, rdx
jl 0x1402b8794
lea r9, [r10 + r10]
movzx r11d, word [rsi]
lea r14, [rbx + r9]
add r14, 0xfffffffffffffffe
mov r9, rbx
mov qword [rsp + 0x58], r14
mov r15, r10
sub r15, rdx
inc r15
je 0x1402b8791
sub r14, r9
inc r10
mov r15, r10
mov r10, r14
cmp word [r9], r11w
je 0x1402b86e1
add r9, 2
add r10, 0xfffffffffffffffe
dec r15
cmp rdx, r15
jne 0x1402b8777
mov r9, r8
mov rdx, r9
sub rdx, rbx
sar rdx, 1
cmp r9, r8
mov rsi, 0xffffffffffffffff
cmovne rsi, rdx
cmp rdi, 0xffffffffffffffff
je 0x1402b81b1
cmp rsi, 0xffffffffffffffff
je 0x1402b81b1
mov qword [rsp + 0x290], r13
movaps xmmword [rsp + 0x280], xmm6
test cl, cl
jns 0x1402b87db
mov rcx, qword [rsp + 0x2f8]
sub rcx, rdi
jb 0x1402b999e
sub rsi, rdi
cmp rcx, rsi
cmovb rsi, rcx
cmp rsi, r12
ja 0x1402b99ab
cmp rsi, 0xa
ja 0x1402b884c
lea rcx, [rsp + 0x280]
mov byte [rcx + 0x17], sil
lea rdx, [rbx + rdi*2]
lea rdi, [rcx + rsi*2]
cmp rdx, rcx
jb 0x1402b881f
cmp rdx, rdi
jb 0x1402b9973
test rsi, rsi
je 0x1402b882f
add rsi, rsi
mov r8, rsi
call fcn.1402b6370
mov word [rdi], 0
movsx rdi, byte [rsp + 0x297]
test rdi, rdi
js 0x1402b889a
lea rbx, [rsp + 0x280]
jmp 0x1402b88aa
mov rax, rsi
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r14d, reloc.WS2_32.dll_listen
cmovne r14, rcx
test r14, r14
js 0x1402b9975
lea rcx, [r14 + r14]
call fcn.14027768c
mov rcx, rax
mov qword [rsp + 0x280], rax
or r14, rbp
mov qword [rsp + 0x290], r14
mov qword [rsp + 0x288], rsi
jmp 0x1402b8809
mov rbx, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x288]
cmp rdi, r12
ja 0x1402b9966
cmp rdi, 0x17
jae 0x1402b88cc
lea rax, [rsp + 0x1d0]
mov byte [rax + 0x17], dil
test rdi, rdi
jne 0x1402b8907
jmp 0x1402b891d
mov rax, rdi
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov esi, Ordinal_27
cmovne rsi, rcx
mov rcx, rsi
call fcn.14027768c
mov qword [rsp + 0x1d0], rax
or rsi, rbp
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1d8], rdi
add rdi, rdi
xor ecx, ecx
mov dl, byte [rbx + rcx]
mov byte [rax], dl
inc rax
add rcx, 2
cmp rdi, rcx
jne 0x1402b890c
mov byte [rax], 0
cmp byte [rsp + 0x297], 0
jns 0x1402b8937
mov rcx, qword [rsp + 0x280]
call fcn.1402776c8
mov al, byte [rsp + 0x147]
jmp 0x1402b81c1
mov edx, 0x20
jmp 0x1402b8e66
lea rdi, [rsp + 0x2f0]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov dl, 1
call fcn.14030b410
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x1402b8978
mov rax, qword [rsp + 0x2f8]
test rax, rax
je 0x1402b89cb
lea rcx, str.onestart.exe
lea rdi, [rsp + 0x88]
mov qword [rdi], rcx
call fcn.14029c474
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x2f0]
lea r12, [rsp + 0x230]
mov rdx, r12
mov r8, rdi
call fcn.14021d0c0
lea rcx, [rsp + 0x280]
mov rdx, r12
call fcn.140112050
mov rcx, r12
call fcn.14021c6c0
lea rcx, [rsp + 0x2f0]
call fcn.14021c6c0
mov dword [rsp + 0x260], reloc.WS2_32.dll_send
lea rdx, str.force_uninstall
mov rcx, rsi
call fcn.14021ea20
mov byte [rsp + 0x57], al
lea rdx, str.do_not_remove_shared_items
mov rcx, rsi
call fcn.14021ea20
mov r12d, eax
lea r15, [rsp + 0x2d0]
mov qword [r15 + 0x10], r13
movaps xmmword [r15], xmm6
lea rdi, [rsp + 0x130]
lea r8, [rsp + 0x420]
mov rcx, rdi
mov rdx, r15
call fcn.1400eee50
mov rax, qword [0x140432948]
cmp qword [rsp + 0x68], rax
jne 0x1402b8a55
lea rcx, [rsp + 0x130]
call fcn.1400c3820
mov rax, qword [0x140432948]
mov qword [rsp + 0x230], rdi
cmp qword [rsp + 0x60], rax
jne 0x1402b8a78
lea rcx, [rsp + 0x420]
call fcn.1400c3820
mov rax, qword [0x140432948]
lea rcx, [rsp + 0x420]
mov qword [rsp + 0x238], rcx
cmp rbx, rax
jne 0x1402b8aa1
lea rcx, [rsp + 0xf0]
call fcn.1400c3820
mov rax, qword [0x140432948]
xor r12b, 1
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x240], rcx
mov rcx, r15
movabs rbx, 0xfffffffc00000000
and rcx, rbx
cmp rcx, rax
jne 0x1402b8ad7
lea rcx, [rsp + 0x2d0]
call fcn.1400c3820
lea rdi, [rsp + 0x230]
mov qword [rdi + 0x18], r15
mov rcx, rdi
mov edx, r12d
mov r8b, byte [rsp + 0x57]
mov r9, rsi
call fcn.1400cd760
lea r8, [rsp + 0x260]
mov dword [r8], eax
lea rdx, [rsp + 0xf0]
mov rcx, r14
call fcn.1400d0c20
mov rcx, r14
call fcn.1400ca0e0
lea rdx, str.trigger_active_setup
mov rcx, rsi
call fcn.14021ea20
test al, al
je 0x1402b8b31
call fcn.140308f30
lea rcx, [rsp + 0x280]
lea r14, [rsp + 0x2f0]
mov rdx, r14
call fcn.140112910
movsx rsi, byte [r14 + 0x17]
test rsi, rsi
jns 0x1402b8b5b
mov rsi, qword [rsp + 0x2f8]
mov rcx, r14
call fcn.14021c6c0
test rsi, rsi
je 0x1402b8ba3
lea r14, [rsp + 0x2f0]
mov rcx, r14
call fcn.140105de0
lea r15, [rsp + 0x270]
lea rdx, [rsp + 0x280]
mov rcx, r15
mov r8, r14
call fcn.140100b90
mov rcx, r15
call fcn.140100860
mov rcx, r14
call fcn.140105e50
cmp byte [rsp + 0x190], 0
jne 0x1402b8bc1
lea rcx, [rsp + 0x130]
call fcn.1400eee40
mov ecx, eax
call fcn.14030beb0
mov r12d, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8be5
call fcn.1400c3960
mov qword [rsp + 0x248], 0
mov rcx, qword [rsp + 0x240]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8c0d
call fcn.1400c3960
mov qword [rsp + 0x240], 0
mov rcx, qword [rsp + 0x238]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8c35
call fcn.1400c3960
mov qword [rsp + 0x238], 0
mov rcx, qword [rsp + 0x230]
mov rax, rcx
and rax, rbx
cmp rax, qword [0x140432948]
jne 0x1402b8c5d
call fcn.1400c3960
lea rcx, [rsp + 0x2d0]
call fcn.140107800
lea r14, [rsp + 0x280]
mov rcx, r14
call fcn.1401124e0
cmp r12d, 0x13
jne 0x1402b933c
mov ecx, 0x50
call fcn.14027768c
mov r15, rax
mov qword [rsp + 0x2d0], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2d8], Ordinal_41
lea rax, [r15 + 0x4c]
lea rcx, str.https:__www.surveymonkey.com_r_WTCWGRK
cmp r15, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x1402b9973
lea rdx, str.https:__www.surveymonkey.com_r_WTCWGRK
mov r8d, Ordinal_79
mov rcx, r15
call fcn.1402b6370
mov word [r15 + 0x4c], 0
lea rdx, str.start
lea r12, [rsp + 0x88]
lea r8, [rsp + 0x2d0]
mov rcx, r12
call fcn.1400c9e20
xor eax, eax
mov qword [rsp + 0x350], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x340], xmm0
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x320], xmm0
movaps xmmword [rsp + 0x310], xmm0
movaps xmmword [rsp + 0x300], xmm0
movaps xmmword [rsp + 0x2f0], xmm0
mov qword [rsp + 0x290], rax
movaps xmmword [rsp + 0x280], xmm0
mov ecx, Ordinal_73
call fcn.14027768c
mov r15, rax
mov qword [rsp + 0x230], rax
lea rbx, [rbp + 0x24]
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x238], Ordinal_41
lea rcx, [rax + 0x40]
lea rax, str.C:WindowsSystem32cmd.exe__c__
cmp r15, rax
seta dl
cmp rcx, rax
setbe al
or al, dl
je 0x1402b9973
movups xmm7, xmmword [0x1403d9ca2]
movups xmmword [r15 + 0x30], xmm7
movups xmm8, xmmword [0x1403d9c92]
movups xmmword [r15 + 0x20], xmm8
movups xmm9, xmmword [0x1403d9c82]
movups xmmword [r15 + 0x10], xmm9
movups xmm10, xmmword [str.C:WindowsSystem32cmd.exe__c__]
movups xmmword [r15], xmm10
mov word [r15 + 0x40], 0
movsx rsi, byte [rsp + 0x9f]
test rsi, rsi
cmovs rsi, qword [rsp + 0x90]
cmovs r12, qword [rsp + 0x88]
test rsi, rsi
sete al
test r12, r12
setne dl
or dl, al
je 0x1402b9973
cmp rsi, 3
ja 0x1402b8ff0
test rsi, rsi
je 0x1402b8943
lea rax, [rcx + rsi*2]
cmp r12, rcx
setb dl
cmp r12, rax
setae al
or al, dl
je 0x1402b9973
lea r8, [rsi + rsi]
mov rdx, r12
call fcn.1402b6370
lea rax, [r15 + rsi*2]
add rax, 0x40
or rsi, 0x20
mov qword [rsp + 0x238], rsi
lea rbx, [rbp + 0x24]
mov rdx, rsi
mov word [rax], 0
lea rsi, [rsp + 0x2f0]
dec rbp
and rbp, rbx
dec rbp
lea rax, [0x1403d9cb4]
cmp rbp, rdx
je 0x1402b8fa1
lea rcx, [r15 + rdx*2]
lea r8, [r15 + rdx*2]
add r8, 2
cmp rcx, rax
seta r9b
cmp r8, rax
setbe al
or al, r9b
movabs rbx, 0xfffffffc00000000
je 0x1402b9973
mov word [rcx], 0x22
lea rax, [rdx + 1]
cmp byte [rsp + 0x247], 0
jns 0x1402b8fe2
mov qword [rsp + 0x238], rax
mov word [r15 + rdx*2 + 2], 0
cmp byte [rsp + 0x247], 0
jns 0x1402b8eec
mov rdi, qword [rsp + 0x230]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000008
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1402b8f51
mov rcx, qword [rsp + 0x280]
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x288]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x280]
call rsi
cmp byte [rsp + 0x247], 0
jns 0x1402b8f68
mov rcx, qword [rsp + 0x230]
call fcn.1402776c8
cmp byte [rsp + 0x9f], 0
jns 0x1402b8f7f
mov rcx, qword [rsp + 0x88]
call fcn.1402776c8
cmp byte [rsp + 0x2e7], 0
jns 0x1402b8f96
mov rcx, qword [rsp + 0x2d0]
call fcn.1402776c8
mov r12d, reloc.WS2_32.dll_send
jmp 0x1402b933c
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x230]
mov r8d, 1
mov r9, rdx
call fcn.14020a830
movabs rbx, 0xfffffffc00000000
jmp 0x1402b8eda
and al, 0x7f
mov byte [rsp + 0x247], al
jmp 0x1402b8ed2
lea rax, [rsi + rbp]
add rax, 0x29
lea rcx, [rbp + 0x2c]
cmp rax, rcx
jb 0x1402b99b8
cmp rsi, 0x27
mov ebx, Ordinal_41
cmovae rbx, rsi
or rbx, 3
add rbx, 0x21
js 0x1402b9975
lea rcx, [rbx + rbx]
call fcn.14027768c
mov r14, rax
lea rcx, [rax + 0x40]
cmp r15, rax
setb al
cmp r15, rcx
setae dl
or dl, al
je 0x1402b9973
movups xmmword [r14 + 0x30], xmm7
movups xmmword [r14 + 0x20], xmm8
movups xmmword [r14 + 0x10], xmm9
movups xmmword [r14], xmm10
cmp r12, rcx
jb 0x1402b9069
lea rax, [rcx + rsi*2]
cmp r12, rax
jb 0x1402b9973
lea r8, [rsi + rsi]
mov rdx, r12
call fcn.1402b6370
mov rcx, r15
call fcn.1402776c8
mov qword [rsp + 0x230], r14
or rbx, rbp
mov qword [rsp + 0x240], rbx
lea rdx, [rsi + 0x20]
mov qword [rsp + 0x238], rdx
lea rax, [r14 + rsi*2]
add rax, 0x40
mov r15, r14
lea r14, [rsp + 0x280]
jmp 0x1402b8e61
mov dword [rsp + 0x25c], 0
lea rcx, [rsp + 0x130]
mov edx, 2
call fcn.1400ef0b0
xor ecx, ecx
mov edx, socket
call fcn.1400c2530
call fcn.1400eb070
mov ebp, eax
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test bpl, bpl
je 0x1402b9143
test eax, eax
jle 0x1402b9143
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea r15, [rsp + 0x2f0]
mov rcx, r15
mov r8d, 0x2a9
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Entered_background_processing_mode.
mov r8d, 0x23
call fcn.1401f8290
mov rcx, r15
call fcn.14010e2d0
lea r15, [rsp + 0x130]
mov rcx, r15
call fcn.1400eee40
test al, al
movabs rbx, 0xfffffffc00000000
jne 0x1402b9197
lea r12, [rsp + 0x420]
mov rcx, r12
xor edx, edx
call fcn.140308f10
mov rbp, rax
mov rcx, r12
mov dl, 1
call fcn.140308f10
mov r12, rax
test rbp, rbp
setne al
test r12, r12
sete cl
or cl, al
je 0x1402b956c
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1402b91fc
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea r12, [rsp + 0x2f0]
mov rcx, r12
mov r8d, 0x2ad
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Installing_to
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1401f8290
mov rcx, rax
mov rdx, r14
call fcn.14010a6f0
mov rcx, r12
call fcn.14010e2d0
lea rax, [rsp + 0x25c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x420]
lea rdx, [rsp + 0xf0]
mov r8, rsi
mov r9, rdi
call fcn.1400c4da0
mov r12d, eax
lea rdi, str.installerdata
mov rcx, rsi
mov rdx, rdi
call fcn.14021ea20
test al, al
je 0x1402b931d
lea r14, [rsp + 0x280]
mov qword [r14 + 0x10], r13
movaps xmmword [r14], xmm6
lea r15, [rsp + 0x230]
mov qword [r15], rdi
mov rcx, rdi
call fcn.14029c0d0
mov qword [r15 + 8], rax
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.140112a60
mov rcx, r14
call fcn.140102e10
test al, al
jne 0x1402b9310
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1402b9303
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rsi, [rsp + 0x2f0]
mov rcx, rsi
mov r8d, 0x2bd
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Failed_deleting_initial_preferences_file
mov r8d, reloc.WLDAP32.dll_Ordinal_41
call fcn.1401f8290
lea rdx, [rsp + 0x280]
mov rcx, rax
call fcn.14010a6f0
lea rdx, str.__scheduling_for_deletion_after_reboot.
mov r8d, Ordinal_41
mov rcx, rax
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x280]
call fcn.1402c6930
lea rcx, [rsp + 0x280]
call fcn.14021c6c0
mov ecx, dword [rsp + 0x25c]
mov edx, r12d
call fcn.1400c2530
lea rcx, [rsp + 0x130]
mov edx, r12d
call fcn.1400ece00
mov rcx, qword [0x140440d18]
test rcx, rcx
jne 0x1402b9377
mov dword [rsp + 0x20], 1
lea rcx, str.Setup.Install.Result
mov r9d, 0x51
mov edx, 1
mov r8d, 0x50
call fcn.14021a2b0
mov rcx, rax
mov qword [0x140440d18], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov edx, r12d
call qword [str._a_]
lea rsi, [rsp + 0x280]
mov qword [rsi + 0x40], r13
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
mov r8d, Ordinal_73
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x1402b948d
mov rcx, qword [0x140440d20]
test rcx, rcx
jne 0x1402b93fc
mov dword [rsp + 0x20], 1
lea rcx, str.Setup.Install.PeakPagefileUsage
mov r9d, 0x32
mov edx, 0x3e8
mov r8d, 0x7a120
call fcn.140219610
mov rcx, rax
mov qword [0x140440d20], rax
movabs rdi, 0x20000000000
mov rax, qword [rsp + 0x2c0]
mov rdx, rax
shr rdx, 0xa
shr rax, 0x29
mov esi, 0x7fffffff
cmovne edx, esi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [str._a_]
mov rcx, qword [0x140440d28]
test rcx, rcx
jne 0x1402b9469
mov dword [rsp + 0x20], 1
lea rcx, str.Setup.Install.PeakWorkingSetSize
mov r9d, 0x32
mov edx, 0x3e8
mov r8d, 0x7a120
call fcn.140219610
mov rcx, rax
mov qword [0x140440d28], rax
mov rax, qword [rsp + 0x288]
mov rdx, rax
shr rdx, 0xa
cmp rax, rdi
cmovb esi, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov edx, esi
call qword [str._a_]
xor r15d, r15d
mov al, byte [rsp + 0x58]
test byte [rsp + 0x190], al
jne 0x1402b94a8
mov ecx, r12d
call fcn.140309960
mov r15d, eax
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1402b950d
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rsi, [rsp + 0x2f0]
mov rcx, rsi
mov r8d, 0x694
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Installation_complete__returning:
mov r8d, 0x22
call fcn.1401f8290
mov rcx, rax
mov edx, r15d
call fcn.1400c2b00
mov rcx, rsi
call fcn.14010e2d0
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
test rsi, rsi
je 0x1402b8340
mov rcx, rsi
call fcn.1400edca0
mov rcx, rsi
call fcn.1402776c8
jmp 0x1402b8340
lea rcx, [rsp + 0x130]
mov r15d, 0x3c
mov edx, 0x3c
mov r8d, 0xca8
xor r9d, r9d
call fcn.1400ef0e0
movabs rbx, 0xfffffffc00000000
jmp 0x1402b950d
mov ecx, 2
call fcn.14021c050
test al, al
je 0x1402b9634
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rcx, [rsp + 0x2f0]
mov r8d, 0x220
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Already_installed_version
mov r8d, reloc.WLDAP32.dll_Ordinal_26
call fcn.1401f8290
mov rdi, rax
mov rcx, r12
call fcn.1402caa70
lea r14, [rsp + 0x280]
mov rcx, rax
mov rdx, r14
call fcn.140107c20
movsx r8, byte [r14 + 0x17]
test r8, r8
jns 0x1402b95f0
mov r8, qword [rsp + 0x288]
mov r14, qword [rsp + 0x280]
mov rcx, rdi
mov rdx, r14
call fcn.1401f8290
lea rdx, str._at_system_level_conflicts_with_this_one_at_user_level.
mov r8d, gethostname
mov rcx, rax
call fcn.1401f8290
cmp byte [rsp + 0x297], 0
jns 0x1402b9627
mov rcx, qword [rsp + 0x280]
call fcn.1402776c8
lea rcx, [rsp + 0x2f0]
call fcn.14010e2d0
lea rdi, [rsp + 0x230]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov dl, 1
call fcn.14030b410
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x1402b965f
mov rax, qword [rsp + 0x238]
test rax, rax
je 0x1402b97d6
lea rdi, [rsp + 0x2d0]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
lea rcx, str.onestart.exe
lea r14, [rsp + 0x88]
mov qword [r14], rcx
call fcn.14029c474
mov qword [r14 + 8], rax
lea rcx, [rsp + 0x230]
mov rdx, rdi
mov r8, r14
call fcn.14021d0c0
lea r14, [rsp + 0x280]
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
mov rcx, r14
mov rdx, rdi
call fcn.140111fd0
lea rcx, str.force_first_run
lea rdi, [rsp + 0x270]
mov qword [rdi], rcx
call fcn.14029c0d0
mov qword [rdi + 8], rax
mov rcx, r14
mov rdx, rdi
call fcn.140112bf0
lea rcx, [rsp + 0x130]
mov r12d, 3
mov edx, 3
mov r8d, 0xa6a
xor r9d, r9d
call fcn.1400ef0e0
lea rcx, str.....chromeinstaller_setup_setup_main.cc
mov edx, Ordinal_46
call fcn.14021c080
test eax, eax
jle 0x1402b9771
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rdi, [rsp + 0x2f0]
mov rcx, rdi
mov r8d, 0x233
mov r9d, 0xffffffff
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Launching_existing_system_level_chrome_instead.
mov r8d, 0x2f
call fcn.1401f8290
mov rcx, rdi
call fcn.14010e2d0
lea rdi, [rsp + 0x2f0]
mov rcx, rdi
call fcn.140105de0
lea r14, [rsp + 0x260]
lea r15, [rsp + 0x280]
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140100b90
mov rcx, r14
call fcn.140100860
mov rcx, rdi
call fcn.140105e50
mov rcx, r15
call fcn.1401124e0
lea rcx, [rsp + 0x2d0]
call fcn.14021c6c0
lea rcx, [rsp + 0x230]
call fcn.14021c6c0
jmp 0x1402b922c
lea rcx, [rsp + 0x130]
mov r12d, 0xa
mov edx, 0xa
mov r8d, 0xc04
xor r9d, r9d
call fcn.1400ef0e0
jmp 0x1402b97c4
lea rbx, str.run_as_admin
mov rcx, rsi
mov rdx, rbx
call fcn.14021ea20
test al, al
je 0x1402b9896
mov ecx, 2
call fcn.14021c050
test al, al
movabs rbx, 0xfffffffc00000000
je 0x1402b9870
lea rdx, str.....chromeinstaller_setup_setup_main.cc
lea rsi, [rsp + 0x2f0]
mov rcx, rsi
mov r8d, 0x655
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x300]
lea rdx, str.Non_admin_user_can_not_install_system_level_Chrome.
mov r8d, 0x33
call fcn.1401f8290
mov rcx, rsi
call fcn.14010e2d0
lea rcx, [rsp + 0x130]
mov r15d, reloc.WS2_32.dll_ntohl
mov edx, reloc.WS2_32.dll_ntohl
mov r8d, 0xb60
xor r9d, r9d
call fcn.1400ef0e0
jmp 0x1402b8340
lea rdi, [rsp + 0x2f0]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
xor edx, edx
call fcn.140111f60
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.1402f82d0
lea rsi, [rsp + 0x280]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14029c0d0
mov qword [rsi + 8], rax
mov rcx, rdi
mov rdx, rsi
call fcn.140112bf0
lea rsi, [0x1403dde47]
mov rcx, rdi
mov rdx, rsi
call fcn.14021ea20
test al, al
jne 0x1402b9928
lea rdi, [rsp + 0x230]
mov qword [rdi], rsi
mov rcx, rsi
call fcn.14029c0d0
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x2f0]
mov rdx, rdi
call fcn.140112bf0
lea rsi, [rsp + 0x2d0]
mov dword [rsi], Ordinal_27
lea rdi, [rsp + 0x2f0]
mov rcx, rdi
mov rdx, rsi
call fcn.140309240
mov r15d, dword [rsi]
mov rcx, rdi
call fcn.1401124e0
jmp 0x1402b8336
lea rcx, [rsp + 0x1b0]
call fcn.1402b9a50
lea rcx, [rsp + 0x1d0]
call fcn.1402b99d0
ud2
call fcn.1402b9a10
lea rcx, [rsp + 0x70]
call fcn.1402b99d0
lea rcx, [rsp + 0x420]
call fcn.1402b99d0
lea rcx, [rsp + 0x2f0]
call fcn.1402b99d0
lea rcx, [rsp + 0x280]
call fcn.1402b9a50
lea rcx, [rsp + 0x280]
call fcn.1402b99d0
lea rcx, [rsp + 0x230]
call fcn.1402b99d0
int3