Function at 0x140005f5c
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create thread
Get common file path
Get file attributes
Move file
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe90]
sub rsp, 0xf90
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0xe80], rax
mov qword [rsp + 0x68], rdx
mov rbx, rdx
mov dword [rsp + 0x60], ecx
mov esi, ecx
cmp ecx, 4
jge 0x140005fc2
mov ecx, 2
call fcn.140014718
mov rcx, rax
lea rdx, str.Usage:_updater_patch_dir_install_dir_apply_to_dir__wait_pid__callback_working_dir_callback_path_args...___n
call fcn.140002430
mov eax, 1
jmp 0x140007518
lea rax, [rdx + 8]
mov r8d, 0x104
mov rdx, qword [rdx + 0x10]
lea rdi, [0x14003eea0]
mov qword [rsp + 0x78], rax
mov rcx, rdi
mov rax, qword [rax]
mov qword [0x14003ec88], rax
call fcn.140013fb8
xor r15d, r15d
mov rcx, rdi
mov word [0x14003f0a6], r15w
lea edx, [r15 + 0x5c]
call fcn.14001050c
test rax, rax
je 0x140006015
cmp word [rax + 2], r15w
jne 0x140006015
mov word [rax], r15w
lea rcx, [0x1400360b0]
call fcn.140019424
mov edi, 1
test rax, rax
je 0x140006035
mov byte [rsp + 0x50], dil
cmp byte [rax], r15b
jne 0x14000603a
mov byte [rsp + 0x50], r15b
lea rcx, str.MOZ_NO_SERVICE_FALLBACK
call fcn.140014b2c
call fcn.1400052bc
mov r12b, al
mov byte [rsp + 0x64], al
lea rax, [rsp + 0x58]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaMaintenanceService3932ecacee736d366d6436db0f55bce4
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140006082
mov eax, r15d
jmp 0x14000608f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov qword [rsp + 0x40], r15
lea rdx, str.SoftwareClassesApplications
test eax, eax
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x58]
mov r13d, 2
mov qword [rsp + 0x38], rax
setne byte [rsp + 0x51]
mov qword [rsp + 0x30], r15
mov r14, 0xffffffff80000001
mov dword [rsp + 0x28], r13d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareClassesApplicationsupdater.exe
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r13d
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000618f
mov rcx, qword [rsp + 0x58]
lea rdx, str.IsHostApp
mov dword [rsp + 0x28], r15d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rdx, str.NoOpenWith
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rdx, str.NoStartPage
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 4
jle 0x1400061d2
mov rcx, qword [rbx + 0x20]
call fcn.140018c80
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400061af
mov byte [0x14003e198], dil
jmp 0x1400061d2
mov rcx, qword [rbx + 0x20]
lea rdx, str._replace
call fcn.1400105f8
movzx ecx, byte [0x14003e199]
test rax, rax
cmovne ecx, edi
mov byte [0x14003e199], cl
mov rdx, qword [rbx + 0x18]
lea rsi, [0x14003ea80]
mov rcx, rsi
mov r8d, 0x104
call fcn.140013fb8
xor ebx, ebx
mov rcx, rsi
mov word [0x14003ec86], bx
lea edx, [rbx + 0x5c]
call fcn.14001050c
test rax, rax
je 0x14000620d
cmp word [rax + 2], bx
jne 0x14000620d
mov word [rax], bx
lea rcx, [0x1400361e8]
call fcn.140019424
test rax, rax
je 0x140006235
cmp byte [rax], bl
je 0x140006235
lea rcx, str.MOZ_OS_UPDATE
mov byte [0x14003e1a0], dil
call fcn.140014b2c
cmp byte [0x14003e199], bl
lea rsi, [0x14002aae0]
mov eax, dword [0x14003f0a8]
je 0x140006298
mov rbx, qword [0x14003ec88]
test dil, al
jne 0x14000626f
or eax, edi
xor edx, edx
mov rcx, rsi
mov dword [0x14003f0a8], eax
mov qword [0x14003f0c0], rdx
call fcn.14000fc8c
lea r14, [0x14003f0c0]
mov byte [rsp + 0x20], dil
mov rcx, r14
lea r9, str.update.log
lea r8, str.last_update.log
mov rdx, rbx
call fcn.14000b08c
xor ebx, ebx
jmp 0x1400062d8
test dil, al
jne 0x1400062b4
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rdx, qword [0x14003ec88]
lea r14, [0x14003f0c0]
mov rcx, r14
mov byte [rsp + 0x20], bl
xor r9d, r9d
lea r8, str.update.log
call fcn.14000b08c
lea rcx, str.applying
call fcn.140005134
test al, al
jne 0x140006320
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x14000630a
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.failed_setting_status_to_applying
mov rcx, r14
call fcn.14000b1bc
mov eax, edi
jmp 0x140007518
cmp byte [0x14003e198], bl
je 0x140006353
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x14000634a
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.Performing_a_staged_update
jmp 0x140006384
cmp byte [0x14003e199], bl
je 0x14000638c
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x14000637d
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.Performing_a_replace_request
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400063ae
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, qword [0x14003ec88]
lea rdx, str.PATCH_DIRECTORY__S
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400063e6
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea r8, [0x14003eea0]
mov rcx, r14
lea rdx, str.INSTALLATION_DIRECTORY__S
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x14000641e
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea r8, [0x14003ea80]
mov rcx, r14
lea rdx, str.WORKING_DIRECTORY__S
call fcn.14000b1bc
cmp byte [0x14003e199], bl
jne 0x140006448
cmp byte [0x14003e198], bl
je 0x140006546
lea r9, [0x14003ea80]
mov edx, 0x104
lea r8, [0x1400362f0]
lea rcx, [rbp + 0x230]
call fcn.1400024cc
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400064e9
lea ecx, [rax + 0x47]
call fcn.140005254
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400064a2
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_calling_PathRemoveFileSpecW:__d
mov rcx, r14
mov r8d, eax
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400064dc
mov qword [0x14003f0c0], rbx
or eax, edi
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
jmp 0x140006319
mov r8d, 0x104
lea rdx, [0x14003eea0]
lea rcx, [rbp + 0x230]
call fcn.140018f14
test eax, eax
je 0x140006546
mov ecx, 0x48
call fcn.140005254
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006532
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.Stage_and_Replace_requests_require_that_the_working_directory_is_a_sub_directory_of_the_installation_directory__Exiting
mov rcx, r14
call fcn.14000b1bc
jmp 0x1400064ba
test r15, r15
jle 0x140006586
mov r8d, r15d
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140006586
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140006319
xor ebx, ebx
cmp byte [0x14003e199], bl
je 0x1400065c4
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x20a
call fcn.140010e20
mov edx, 0x105
lea rcx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400065c4
lea rcx, [rbp + 0x440]
call fcn.1400190c8
lea rcx, [0x140036398]
call fcn.140019424
test rax, rax
je 0x1400065e0
mov byte [0x14003e19b], dil
cmp byte [rax], bl
jne 0x1400065e6
mov byte [0x14003e19b], bl
lea rcx, str.MOZ_USING_SERVICE
call fcn.140014b2c
xor edx, edx
mov dword [rsp + 0x70], 0x64
mov r8d, 0x208
lea rcx, [rbp + 0x20]
or r15, 0xffffffffffffffff
call fcn.140010e20
cmp byte [0x14003e19b], bl
jne 0x140006bad
cmp dword [rsp + 0x60], 6
mov al, byte [0x14003e198]
mov cl, byte [0x14003e199]
jg 0x14000663a
test al, al
jne 0x14000663e
test cl, cl
je 0x140006cb8
test al, al
je 0x14000665f
lea r9, [0x14003eea0]
mov edx, 0x104
lea r8, str._s_updated.update_in_progress.lock
lea rcx, [rbp + 0x230]
call fcn.1400024cc
jmp 0x1400066ba
test cl, cl
je 0x1400066c1
mov rcx, rbx
lea r12, [0x14003eea0]
movzx eax, word [rcx + r12]
mov word [rbp + rcx + 0x650], ax
add rcx, r13
test ax, ax
jne 0x14000666d
mov edx, 0x5c
lea rcx, [rbp + 0x650]
call fcn.14001050c
lea r9, [rbp + 0x650]
mov edx, 0x104
lea r8, str._smoz_update_in_progress.lock
lea rcx, [rbp + 0x230]
mov word [rax], bx
call fcn.1400024cc
mov r12b, byte [rsp + 0x64]
mov rbx, qword [rsp + 0x68]
jmp 0x1400066e2
mov rbx, qword [rsp + 0x68]
lea r8, str._s.update_in_progress.lock
mov edx, 0x104
lea rcx, [rbp + 0x230]
mov r9, qword [rbx + 0x30]
call fcn.1400024cc
xor edx, edx
lea rcx, [rbp + 0x230]
call fcn.140014000
xor r15d, r15d
test eax, eax
jne 0x140006753
lea rcx, [rbp + 0x230]
call fcn.1400147a0
test eax, eax
je 0x140006753
cmp byte [0x14003e198], r15b
jne 0x140006719
cmp byte [0x14003e199], r15b
je 0x140006725
lea rcx, str.pending
call fcn.140005134
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006747
or eax, edi
mov qword [0x14003f0c0], r15
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.Update_already_in_progress__Exiting
jmp 0x140006311
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x230]
mov dword [rsp + 0x28], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r9, qword [0x14003ec88]
lea r8, str._s_update_elevated.lock
mov edx, 0x104
lea rcx, [rbp + 0x20]
mov r15, rax
call fcn.1400024cc
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400067b3
call fcn.14000a620
cmp r15, 0xffffffffffffffff
je 0x1400067d8
xor eax, eax
test r12b, r12b
je 0x140006bb2
cmp byte [rsp + 0x51], al
je 0x140006bb2
cmp byte [rsp + 0x50], al
je 0x140006bb2
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140014000
xor ebx, ebx
test eax, eax
jne 0x140006812
lea rcx, [rbp + 0x20]
call fcn.1400147a0
test eax, eax
je 0x140006812
mov ecx, r13d
call fcn.140014718
mov rcx, rax
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting_n
call fcn.140002430
jmp 0x140006319
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x28], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x140006873
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006867
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting
jmp 0x140006311
mov ebx, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
lea ecx, [rbx - 1]
call fcn.1400048f4
xor ecx, ecx
mov rsi, rax
test rax, rax
jne 0x14000689c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006319
mov r14, qword [rsp + 0x68]
test r12b, r12b
je 0x140006a40
mov dword [rsp + 0x58], ecx
lea rdx, [rsp + 0x58]
mov rcx, qword [r14]
call fcn.14000ae94
xor ecx, ecx
test eax, eax
je 0x140006a3d
cmp dword [rsp + 0x58], ecx
je 0x140006a3d
lea rcx, [rsp + 0x58]
mov r12b, dil
call fcn.14000af44
xor ecx, ecx
test eax, eax
je 0x1400068f3
cmp dword [rsp + 0x58], ecx
sete r12b
test r12b, r12b
je 0x140006a40
lea rdx, [rbp + 0x440]
call fcn.140009cd4
xor ecx, ecx
test eax, eax
je 0x14000695b
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x68]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea rdx, [rbp + 0x440]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x140006946
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x140006966
mov al, byte [rsp + 0x51]
mov r12b, al
test al, al
jne 0x14000696f
mov dword [rsp + 0x70], 0x66
jmp 0x140006966
mov r12b, cl
mov dword [rsp + 0x70], 0x65
test r12b, r12b
je 0x140006a40
mov rdx, r14
mov ecx, ebx
call fcn.14000ab0c
xor ecx, ecx
test eax, eax
sete r12b
test r12b, r12b
je 0x140006a28
cmp byte [0x14003e198], cl
mov bl, cl
jne 0x14000699e
call fcn.1400020c0
test eax, eax
sete bl
mov edx, 5
call fcn.14000ac88
cmp eax, edi
je 0x140006a0e
xor ecx, ecx
lea rax, [0x1400059ac]
mov qword [rbp - 0x78], rax
lea r9, [rbp - 0x80]
lea rax, [rsp + 0x58]
mov qword [rbp - 0x70], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140002530]
xor edx, edx
mov dword [rsp + 0x20], ecx
call fcn.140014c80
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400069f8
test bl, bl
je 0x1400069f8
xor edx, edx
mov cl, dil
call fcn.1400021d4
mov rax, qword [rbp - 0x80]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
call fcn.14000ac88
xor ecx, ecx
cmp eax, edi
je 0x140006a30
mov dword [rsp + 0x70], 0x67
mov r12b, cl
jmp 0x140006a30
mov dword [rsp + 0x70], 0x68
test r12b, r12b
je 0x140006a40
mov al, byte [0x14003e198]
jmp 0x140006a71
mov r12b, cl
mov al, byte [0x14003e198]
test al, al
je 0x140006a6c
cmp r15, 0xffffffffffffffff
je 0x140006a59
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.pending
call fcn.140005134
xor eax, eax
jmp 0x140007518
test r12b, r12b
je 0x140006aba
test al, al
jne 0x140006ab1
mov byte [rsp + 0x51], cl
lea rcx, [rsp + 0x51]
call fcn.1400053d4
xor ecx, ecx
test al, al
je 0x140006ab1
cmp byte [rsp + 0x51], cl
je 0x140006ab1
call fcn.140004c84
test al, al
jne 0x140006ab1
mov ecx, 2
call fcn.140014718
mov rcx, rax
lea rdx, str.The_post_update_process_which_runs_as_the_user_for_service_update_could_not_be_launched.
call fcn.140002430
test r12b, r12b
jne 0x140006b45
mov bl, byte [rsp + 0x50]
test bl, bl
jne 0x140006b49
cmp r15, 0xffffffffffffffff
jne 0x140006b49
lea ebx, [r15 + 0x71]
xor edx, edx
mov r8d, ebx
lea rcx, [rbp - 0x50]
call fcn.140010e20
mov rax, qword [r14]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x38], rax
xor edx, edx
lea rax, str.runas
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x4c], 0x540
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x30], rsi
mov dword [rbp - 0x20], edi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
mov rcx, rsi
setne bl
call fcn.140013324
test bl, bl
je 0x140006b3b
mov rcx, qword [rbp + 0x18]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006b45
mov ecx, 9
call fcn.140005254
mov bl, byte [rsp + 0x50]
mov eax, dword [rsp + 0x60]
cmp eax, 6
jle 0x140006b62
mov rcx, qword [r14 + 0x28]
lea r8, [r14 + 0x30]
lea edx, [rax - 6]
call fcn.14000508c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12b, r12b
jne 0x140006b95
test bl, bl
jne 0x140006b7e
cmp r15, 0xffffffffffffffff
je 0x140006a65
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x70]
call fcn.140005254
jmp 0x140006a65
cmp r15, 0xffffffffffffffff
je 0x140006a65
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006a65
mov rbx, qword [rsp + 0x68]
xor r12d, r12d
cmp byte [0x14003e198], r12b
je 0x140006bcc
xor edx, edx
lea rcx, [0x14003ea80]
call fcn.140002890
cmp byte [0x14003e199], r12b
je 0x140006cc0
lea r9, [0x14003ea80]
mov r8d, 0x104
lea rdx, [rbp + 0x860]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x140006ddd
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006c20
or eax, edi
mov qword [0x14003f0c0], r12
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea r8, [0x14003ea80]
mov rcx, r14
lea rdx, str.NS_main:_unable_to_find_apply_to_dir:__S
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006c58
or eax, edi
mov qword [0x14003f0c0], r12
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
mov ecx, 0x41
call fcn.140005254
cmp r15, 0xffffffffffffffff
je 0x140006c79
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140014000
test eax, eax
jne 0x140006db6
lea rcx, [rbp + 0x20]
call fcn.1400147a0
test eax, eax
je 0x140006db6
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400064dc
mov qword [0x14003f0c0], r12
jmp 0x1400064cc
mov rbx, qword [rsp + 0x68]
xor r12d, r12d
lea rcx, [0x14003ea80]
call fcn.1400190c8
test eax, eax
je 0x140006d06
lea rcx, [0x14003ea80]
call fcn.1400140c0
test eax, eax
jne 0x140006319
call fcn.140018ec4
cmp dword [rax], 0x11
je 0x140006319
lea rcx, [0x14003ea80]
call fcn.1400190c8
test eax, eax
jne 0x140006319
cmp byte [0x14003e199], r12b
jne 0x140006bd9
or rcx, 0xffffffffffffffff
lea rax, [0x14003ea80]
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140006d1e
lea rcx, [rcx*2 + 4]
call fcn.140013358
mov r8, rax
test rax, rax
je 0x140006319
lea r9, [0x14003ea80]
mov rdx, rax
mov rcx, r9
sub rdx, r9
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r13
test ax, ax
jne 0x140006d51
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], r12w
jne 0x140006d64
mov ecx, 0x2f
lea rdx, [r8 + rax*2]
cmp word [r9 + rax*2 - 2], cx
je 0x140006da6
mov ecx, 0x5c
cmp word [r9 + rax*2 - 2], cx
je 0x140006da6
mov rcx, rdx
sub rcx, r13
add rcx, r13
cmp word [rcx], r12w
jne 0x140006d92
mov eax, dword [0x1400365bc]
add rdx, r13
mov dword [rcx], eax
mov word [rdx], r12w
mov qword [0x14003ea78], r8
jmp 0x140006be0
mov ecx, dword [rsp + 0x60]
cmp ecx, 6
jle 0x140006319
mov rax, qword [rsp + 0x68]
lea edx, [rcx - 6]
lea r8, [rax + 0x30]
mov rcx, qword [rax + 0x28]
call fcn.14000508c
jmp 0x140006319
mov r12d, dword [rsp + 0x60]
or r13, 0xffffffffffffffff
cmp r12d, 6
jle 0x140007328
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x208
call fcn.140010e20
add rbx, 0x30
lea rcx, [rbp + 0xa70]
xor edx, edx
mov r8d, 0x410
mov r12, qword [rbx]
mov qword [rsp + 0x58], r12
call fcn.140010e20
xor edx, edx
cmp byte [0x14003e199], dl
je 0x140006f2a
xor r8d, r8d
lea rdx, [0x14003eea0]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
mov rdx, qword [rbx]
lea rcx, [rbp + 0xa70]
movsxd r12, eax
mov r8, r12
mov qword [rsp + 0x70], r12
call fcn.140013fb8
lea rdx, [0x14003eea0]
mov ecx, 0x208
sub rcx, r12
lea rax, [rbp + 0xa70]
lea rax, [rax + r12*2]
mov qword [rsp + 0x58], rcx
lea r12, [rdx + r12*2]
mov qword [rsp + 0x78], rax
mov r8, rcx
mov rdx, r12
mov rcx, rax
call fcn.140013fb8
or r8, r13
mov rcx, r8
xor edx, edx
inc rcx
cmp word [r12 + rcx*2], dx
jne 0x140006e9d
mov rax, qword [rsp + 0x78]
lea rdi, [0x14003eea0]
lea r12, [rax + rcx*2]
mov rax, r8
sub rax, rcx
mov dword [r12], 0x5c
add qword [rsp + 0x58], rax
mov rcx, rdx
movzx eax, word [rcx + rdi]
mov word [rbp + rcx + 0x440], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140006ecd
mov rcx, qword [rbx]
lea rdx, [rbp + 0x440]
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
mov r8, qword [rsp + 0x58]
movsxd rcx, eax
cmp rcx, qword [rsp + 0x70]
mov rax, qword [rbx]
cmovb rcx, qword [rsp + 0x70]
lea rdx, [rax + rcx*2]
lea rcx, [r12 + 2]
call fcn.140013fb8
lea r12, [rbp + 0xa70]
mov edi, 1
mov qword [rsp + 0x58], r12
mov r8d, 0x104
lea rdx, [rbp + 0x650]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor ecx, ecx
test eax, eax
jne 0x14000700f
mov eax, dword [0x14003f0a8]
xor r13d, r13d
test dil, al
jne 0x140006f6f
or eax, edi
mov qword [0x14003f0c0], r13
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, r12
lea rdx, str.NS_main:_unable_to_find_callback_file:__S
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140006fa3
or eax, edi
mov qword [0x14003f0c0], r13
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
mov ecx, 0x42
call fcn.140005254
cmp r15, 0xffffffffffffffff
je 0x140006fc4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140014000
test eax, eax
jne 0x140006ffb
lea rcx, [rbp + 0x20]
call fcn.1400147a0
test eax, eax
je 0x140006ffb
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400064dc
mov qword [0x14003f0c0], r13
jmp 0x1400064cc
mov edx, dword [rsp + 0x60]
mov r8, rbx
mov rax, qword [rsp + 0x68]
add edx, 0xfffffffa
jmp 0x140006dcf
cmp byte [0x14003e199], cl
jne 0x140007323
or rax, 0xffffffffffffffff
lea rcx, [0x14003ec90]
xor r13d, r13d
lea rdx, [rbp + 0x860]
inc rax
cmp word [rdx + rax*2], r13w
jne 0x140007030
cdqe
lea rdx, [rbp + 0x650]
mov r8d, 0x5c
lea rdx, [rdx + rax*2]
cmp word [rdx], r8w
jne 0x140007057
add rdx, 2
sub rdx, rcx
mov edi, 0x2f
movzx eax, word [rdx + rcx]
cmp ax, r8w
jne 0x14000706e
mov word [rcx], di
jmp 0x140007071
mov word [rcx], ax
add rcx, 2
cmp word [rdx + rcx], r13w
jne 0x14000705f
mov word [rcx], r13w
lea r12, [0x14003e870]
mov r9, qword [rbx]
lea r8, str._s.moz_callback
mov rcx, r12
mov edx, 0x104
call fcn.1400024cc
mov rcx, r12
call fcn.1400147a0
mov rcx, qword [rbx]
mov edi, 1
mov r8d, edi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140007186
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14003f0a8]
mov r12d, eax
test dil, cl
jne 0x1400070ed
or ecx, edi
mov qword [0x14003f0c0], r13
mov dword [0x14003f0a8], ecx
mov rcx, rsi
call fcn.14000fc8c
mov r8, qword [rbx]
lea r9, [0x14003e870]
lea rdx, str.NS_main:_failed_to_copy_callback_file__S_into_place_at__S
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140007128
or eax, edi
mov qword [0x14003f0c0], r13
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
mov ecx, 0x23
cmp r12d, 5
je 0x140007140
mov ecx, 0x25
call fcn.140005254
cmp r15, 0xffffffffffffffff
je 0x140007154
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140014000
test eax, eax
jne 0x140007174
lea rcx, [rbp + 0x20]
call fcn.1400147a0
test eax, eax
jne 0x140006fe0
mov edx, dword [rsp + 0x60]
mov r8, rbx
mov rcx, qword [rbx]
add edx, 0xfffffffa
jmp 0x140006dd3
mov r12d, edi
jmp 0x14000718e
xor r13d, r13d
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov edx, 0x40010000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x140007323
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14003f0a8]
mov r13d, eax
test dil, cl
jne 0x1400071f6
or ecx, edi
xor edx, edx
mov dword [0x14003f0a8], ecx
mov rcx, rsi
mov qword [0x14003f0c0], rdx
call fcn.14000fc8c
mov r9, qword [rsp + 0x58]
lea rdx, str.NS_main:_callback_app_file_open_attempt__d_failed._File:__S._Last_error:__d
mov r8d, r12d
mov dword [rsp + 0x20], r13d
mov rcx, r14
call fcn.14000b1bc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
add r12d, edi
cmp r12d, 0xa
jle 0x14000718b
mov eax, dword [0x14003f0a8]
cmp r13d, 0x20
je 0x1400072ee
xor r12d, r12d
test dil, al
jne 0x140007259
or eax, edi
mov qword [0x14003f0c0], r12
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, qword [rbx]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file:__S
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x14000728d
or eax, edi
mov qword [0x14003f0c0], r12
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
mov ecx, 0x23
cmp r13d, 5
je 0x1400072a5
mov ecx, 0x25
call fcn.140005254
lea rcx, [0x14003e870]
call fcn.1400147a0
cmp r15, 0xffffffffffffffff
je 0x1400072c5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140014000
test eax, eax
jne 0x140006ffb
lea rcx, [rbp + 0x20]
call fcn.1400147a0
test eax, eax
je 0x140006ffb
jmp 0x140006c9d
test dil, al
jne 0x14000730c
or eax, edi
mov rcx, rsi
mov dword [0x14003f0a8], eax
xor eax, eax
mov qword [0x14003f0c0], rax
call fcn.14000fc8c
mov r8, qword [rbx]
lea rdx, str.NS_main:_callback_app_file_in_use__continuing_without_exclusive_access_for_executable_file:__S
mov rcx, r14
call fcn.14000b1bc
mov r13, qword [rsp + 0x78]
mov r12d, dword [rsp + 0x60]
xor ebx, ebx
cmp byte [0x14003e198], bl
jne 0x140007358
cmp byte [0x14003e199], bl
jne 0x140007358
xor edx, edx
lea rcx, str.tobedeleted
call fcn.140014000
test eax, eax
je 0x140007358
lea rcx, str.tobedeleted
call fcn.1400140c0
lea rax, [0x1400059cc]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], rax
lea r9, [rbp - 0x68]
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x140002530]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.140014c80
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1400073b0
cmp byte [0x14003e198], bl
jne 0x1400073b0
cmp byte [0x14003e199], bl
jne 0x1400073b0
mov dl, dil
xor ecx, ecx
call fcn.1400021d4
mov rax, qword [rbp - 0x68]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 6
jle 0x1400073ef
cmp byte [0x14003e199], bl
jne 0x1400073ef
cmp r13, 0xffffffffffffffff
je 0x1400073e3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14003e870]
call fcn.1400147a0
cmp byte [0x14003e198], bl
jne 0x1400074c6
cmp byte [0x14003e199], bl
jne 0x1400074c6
lea r13, str.tobedeleted
mov rcx, r13
call fcn.1400147c8
test eax, eax
je 0x1400074c6
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x140007440
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r8, r13
lea rdx, str.NS_main:_unable_to_remove_directory:__S__err:__d
mov rcx, r14
mov r9d, dword [rax]
call fcn.14000b1bc
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [0x14003f0a8]
je 0x140007498
test dil, al
jne 0x14000748f
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x1400074bb
test dil, al
jne 0x1400074b4
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
mov r8, r13
mov rcx, r14
call fcn.14000b1bc
mov eax, dword [0x14003f0a8]
test dil, al
jne 0x1400074e8
or eax, edi
mov qword [0x14003f0c0], rbx
mov rcx, rsi
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov rcx, r14
call fcn.14000b168
mov rdx, qword [rsp + 0x68]
lea r9, [rbp + 0x20]
mov ecx, r12d
mov qword [rsp + 0x20], r15
call fcn.140005e80
cmp byte [0x14003e19a], bl
mov ecx, eax
mov eax, ebx
sete al
test ecx, ecx
cmovne eax, ecx
mov rcx, qword [rbp + 0xe80]
xor rcx, rsp
call fcn.14000f700
mov rbx, qword [rsp + 0xfe0]
add rsp, 0xf90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret