Function at 0x140030dc0
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov r12, r8
mov r13d, edx
mov r15, rcx
mov rax, qword [0x14005e018]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov eax, 0x800401f0
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140024e50
add rsp, 0x20
mov dword [rbp - 0x10], eax
test eax, eax
je 0x140030fe3
mov dword [rbp - 0x18], eax
test eax, eax
js 0x140030ffe
sub rsp, 0x20
mov ecx, r13d
mov rdx, r12
call fcn.1400227d0
add rsp, 0x20
test al, al
je 0x140031402
lea r14, [r12 + 8]
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x140030f4b
lea rax, [r12 + 0x10]
mov r8d, 0xff
movzx edi, word [rdx]
cmp edi, 0x2f
je 0x140030e7b
cmp edi, 0x2d
jne 0x140030f3b
lea rdi, [rdx + 2]
lea rsi, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rdi, rsi
jmp 0x140030e82
add rdx, 2
mov rdi, rdx
movzx edx, word [rdi]
test dx, dx
je 0x140030f3b
movzx esi, dx
cmp esi, r8d
cmovae edx, r8d
lea esi, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp sil, 0x1a
movzx ebx, bl
cmovae ebx, edx
cmp bl, 0x6f
jne 0x140030f3b
movzx edx, word [rdi + 2]
test dx, dx
je 0x140030f3b
movzx ebx, dx
cmp ebx, r8d
cmovae edx, r8d
lea ebx, [rdx - 0x41]
mov ecx, edx
or cl, 0x20
cmp bl, 0x1a
movzx ecx, cl
cmovae ecx, edx
cmp cl, 0x73
jne 0x140030f3b
movzx edx, word [rdi + 4]
test dx, dx
je 0x140030f3b
movzx ecx, dx
cmp ecx, r8d
cmovae edx, r8d
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x69
jne 0x140030f3b
movzx edx, word [rdi + 6]
test dx, dx
je 0x140030f3b
movzx ecx, dx
cmp ecx, r8d
cmovae edx, r8d
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x6e
jne 0x140030f3b
movzx edx, word [rdi + 8]
test dx, dx
jne 0x14003101b
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x140030e57
lea rax, str.__attempting_deelevation
lea rcx, [rbp - 8]
mov qword [rcx], rax
dec r13d
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov edx, r13d
mov r8, r14
mov r9d, 1
call fcn.140023db0
add rsp, 0x30
mov rbx, qword [rbp - 0x20]
test rbx, rbx
jne 0x1400310fe
mov byte [r15 + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [r15], rax
movabs rax, 0x80070507000000aa
mov qword [r15 + 8], rax
cmp dword [rbp - 0x10], 0
js 0x140030fbb
sub rsp, 0x20
call fcn.140024f30
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
sub rsp, 0x20
call fcn.14002c730
add rsp, 0x20
mov rax, r15
lea rsp, [rbp + 0x18]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
lea rdi, [rbp - 0x18]
mov rcx, rdi
call fcn.140025000
add rsp, 0x20
mov eax, dword [rdi]
jmp 0x140030e16
mov byte [r15 + 0x10], 1
lea rcx, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [r15], rcx
mov dword [r15 + 8], 0x87
mov dword [r15 + 0xc], eax
jmp 0x140030fa8
movzx ecx, dx
cmp ecx, r8d
cmovae edx, r8d
lea ecx, [rdx - 0x41]
mov ebx, edx
or bl, 0x20
cmp cl, 0x1a
movzx ecx, bl
cmovae ecx, edx
cmp cl, 0x74
jne 0x140030f3b
cmp word [rdi + 0xa], 0
jne 0x140030f3b
lea eax, [r13 + 1]
cdqe
mov ecx, 8
mul rcx
mov rdi, 0xffffffffffffffff
cmovno rdi, rax
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rsi, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_memset
add rsp, 0x20
mov rax, qword [r14]
mov qword [rsi], rax
lea rax, str.__attempting_deelevation
mov qword [rsi + 8], rax
cmp r13d, 3
jl 0x1400310c4
mov rcx, rsi
add rcx, 0x10
lea rdx, [r12 + 0x10]
lea r8d, [r13 - 2]
shl r8, 3
sub rsp, 0x20
call sub.ntdll.dll_memcpy
add rsp, 0x20
movsxd rax, r13d
xor ecx, ecx
mov qword [rsi + rax*8], rcx
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov edx, r13d
mov r8, rsi
xor r9d, r9d
call fcn.140023db0
add rsp, 0x10
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
jmp 0x140030f7e
sub rsp, 0x20
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x20
test rax, rax
je 0x140031247
sub rsp, 0x20
lea rdx, str.GetCurrentPackageFamilyName
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x140031247
mov rsi, rax
lea rcx, [rbp - 8]
mov dword [rcx], 0
sub rsp, 0x20
xor edx, edx
call qword [case.0x14002bdde.0]
add rsp, 0x20
cmp eax, 0x7a
jne 0x140031247
lea r13, [rbp - 8]
mov r14d, dword [r13]
add r14, r14
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.ntdll.dll_memset
mov rcx, r13
mov rdx, rdi
mov rax, rsi
call qword [case.0x14002bdde.0]
add rsp, 0x20
sub rsp, 0x20
test eax, eax
jne 0x14003123a
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add rsp, 0x20
mov rcx, rax
mov r14, rsp
add ecx, 0x16
lea rax, [rcx + rcx]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14002c6c0
sub rsp, rax
mov rsi, rsp
movsxd rdx, ecx
sub rsp, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.14002e270
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r12, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [r12], rax
test rax, rax
je 0x1400313f4
mov rsp, r14
mov qword [rbp - 0x28], r12
xor esi, esi
jmp 0x14003129c
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
mov rdi, qword [r12]
sub rsp, 0x20
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r12, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [r12], rax
test rdi, rdi
je 0x140031293
test rax, rax
je 0x1400313f4
mov qword [rbp - 0x28], r12
mov sil, 1
xor edi, edi
mov word [rbp - 8], 8
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rbp], rax
test rax, rax
je 0x1400313f4
mov dword [rbp - 0x74], esi
mov qword [rbp - 0x80], rdi
mov word [rbp - 0x40], 8
sub rsp, 0x20
lea rcx, str.open
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
add rsp, 0x20
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1400313f4
sub rsp, 0x20
lea rdi, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantClear]
add rsp, 0x20
lea rbx, [rbp - 0x70]
mov word [rbx], 0x16
mov dword [rbx + 8], 1
sub rsp, 0x30
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea rdx, [rbp - 0x28]
lea rsi, [rbp - 8]
lea r13, [rbp - 0x40]
mov rcx, r15
mov r8, rsi
mov r9, r13
call fcn.140031420
add rsp, 0x10
mov r14, qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, rbx
call r14
mov rcx, rdi
call r14
mov rcx, r13
call r14
mov rcx, rsi
call r14
add rsp, 0x20
cmp byte [rbp - 0x74], 0
jne 0x14003137b
sub rsp, 0x20
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
lock dec dword [r12 + 0x10]
jne 0x1400313d4
mov rcx, qword [r12]
test rcx, rcx
je 0x1400313a2
sub rsp, 0x20
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
add rsp, 0x20
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x1400313c3
sub rsp, 0x20
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
mov qword [r12 + 8], 0
sub rsp, 0x20
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140030fa8
sub rsp, 0x20
call qword [sym.imp.mozglue.dll_free]
add rsp, 0x20
jmp 0x140030fa8
sub rsp, 0x20
mov ecx, 0x8007000e
call fcn.14002c150
sub rsp, 0x20
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3