Function at 0x1400062f0
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Query or enumerate registry value
Read file on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1418
call fcn.14001c210
sub rsp, rax
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x1410], rax
cmp ecx, 2
jg 0x140006379
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000698e
lea rdx, str.Not_enough_command_line_arguments_to_execute_a_service_command
call fcn.14000a020
xor edi, edi
mov rcx, qword [rsp + 0x1410]
xor rcx, rsp
call fcn.140018730
mov eax, edi
add rsp, 0x1418
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rdx
mov edi, ecx
lea rbx, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.14000bd90
mov rcx, rbx
call fcn.140025c90
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400063e3
cmp ecx, edx
jg 0x140006a10
mov r8, qword [rsi + 0x10]
lea rdx, str.Executing_service_command__ls__ID:__ls
lea r9, [rsp + 0xb50]
call fcn.140009f10
jmp 0x1400063fb
cmp ecx, edx
jg 0x140006a92
mov r8, qword [rsi + 0x10]
lea rdx, str.Executing_service_command__ls
call fcn.140009f10
mov rcx, qword [rsi + 0x10]
lea rdx, str.software_update
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140006499
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006a51
mov r8, qword [rsi + 0x10]
lea rdx, str.Service_command_not_recognized:__ls.
call fcn.14000a020
xor edi, edi
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400069cf
test edi, edi
lea rax, str.Failure
lea r9, str.Success
cmove r9, rax
mov r8, qword [rsi + 8]
lea rdx, str.service_command__ls_complete_with_result:__ls.
call fcn.140009f10
jmp 0x140006353
cmp edi, 5
jb 0x1400064f2
mov rcx, qword [rsi + 0x20]
call fcn.14000a150
test al, al
je 0x1400064f2
lea r13, [rsi + 0x20]
mov rbx, qword [r13]
mov rcx, rbx
call fcn.14000a834
cmp rax, 9
ja 0x140006523
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006b14
lea rdx, str.The_patch_directory_path_length_is_not_valid_for_this_application.
jmp 0x14000634c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006ad3
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application.
jmp 0x14000634c
lea rcx, [rbx + rax*2]
add rcx, 0xffffffffffffffec
lea rdx, str.updates0
mov r8d, 0xa
call fcn.140012254
test eax, eax
je 0x140006572
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006b55
lea rdx, str.The_patch_directory_path_subdirectory_is_not_valid_for_this_application.
jmp 0x14000634c
mov rbx, qword [r13]
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
mov rcx, r14
call fcn.14000a460
test eax, eax
je 0x1400065ee
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, [0x14002fa5c]
mov rcx, rbx
mov r8, r14
call fcn.14000a560
test eax, eax
je 0x1400065ee
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x1400065ee
lea rcx, [rsp + 0xff0]
call fcn.140012510
lea rcx, [rsp + 0xff0]
call fcn.14000a460
test eax, eax
je 0x140006653
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, str..status
mov rcx, rbx
mov r8, r14
call fcn.14000a560
test eax, eax
je 0x140006653
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x140006653
lea rcx, [rsp + 0xff0]
call fcn.140012510
lea rcx, [rsp + 0xff0]
call fcn.14000a460
test eax, eax
je 0x1400066b8
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, [0x14002f85a]
mov rcx, rbx
mov r8, r14
call fcn.14000a560
test eax, eax
je 0x1400066b8
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x1400066b8
lea rcx, [rsp + 0xff0]
call fcn.140012510
mov rbx, qword [r13]
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
mov rcx, r14
call fcn.140025c90
test eax, eax
je 0x140006732
lea r14, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
mov rcx, r14
call fcn.14000a460
test eax, eax
je 0x140006732
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, [0x14002fa5c]
mov rcx, rbx
mov r8, r14
call fcn.14000a560
test eax, eax
jne 0x140006763
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006f6e
lea rdx, str.Unable_to_write_to_secure_ID_file.
jmp 0x14000634c
lea rcx, [rsp + 0xd60]
lea rdx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x140006732
lea rdx, [0x14002fb84]
lea rcx, [rsp + 0xd60]
call fcn.140012438
test rax, rax
je 0x140006732
mov rbx, rax
lea rdx, str._ls_n
lea r14, [rsp + 0xff0]
mov rcx, rax
mov r8, r14
call fcn.140025b60
mov ebp, eax
mov rcx, rbx
call fcn.140012538
cmp ebp, 0xffffffff
je 0x140006732
cmp edi, 6
jb 0x140006bac
mov rcx, qword [rsi + 0x28]
call fcn.14000a150
test al, al
je 0x140006bac
mov r15, qword [rsi + 0x28]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140006bac
mov ebp, eax
mov r12d, eax
add r12, r12
mov rcx, r12
call fcn.14000a774
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14000bd90
mov rcx, r15
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140006ba4
lea r9, [rsp + 0x1200]
mov qword [r9], 0
lea rcx, [0x140027010]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140006ba4
mov r12, qword [rsp + 0x1200]
mov rcx, r12
call fcn.14000a834
test rax, rax
je 0x140006b96
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x140006c2b
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.140012254
test eax, eax
je 0x140006c9c
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [rsp + 0x1200], 0
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea r8, [0x14002f69c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140006ba4
mov ebp, dword [rsp + 0x1200]
cmp rbp, 4
jb 0x140006ba4
mov r15d, ebp
and r15d, 0xfffffffe
mov rcx, r15
call fcn.14000a774
mov r12, rax
mov dword [rsp + 0x50], 0
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bd90
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea r8, [0x14002f69c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r15b, 1
test eax, eax
je 0x140006faf
mov rcx, r12
call fcn.14000a77c
mov rcx, rbx
call fcn.14000a77c
test r15b, r15b
je 0x140006bac
cmp byte [rsp + 0x50], 0
jne 0x140006cad
jmp 0x140006bac
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006345
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006345
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006470
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006470
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400063c9
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400063c9
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006439
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006439
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400063eb
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400063eb
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006517
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006517
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400064e6
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400064e6
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006566
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006566
test r12, r12
je 0x140006ba4
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.14000a77c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400073d9
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application.
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x37
call fcn.14000a620
xor edi, edi
test eax, eax
jne 0x140006353
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000769d
lea rdx, str.Could_not_write_update.status_for_previous_failure.
call fcn.14000a020
jmp 0x140006353
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rcx
mov rcx, rax
add rcx, 2
mov qword [rsp + 0x58], rcx
lea rax, [rax + rax + 4]
mov r15, 0xffffffffffffffff
cmovns r15, rax
mov rcx, r15
call fcn.14000a774
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bd90
mov rcx, rbp
mov rdx, qword [rsp + 0x58]
mov r9, r12
call fcn.14000a0d0
mov rcx, rbx
mov rdx, rbp
mov r8, qword [rsp + 0x50]
call fcn.140012254
mov r15d, eax
mov rcx, rbp
call fcn.14000a77c
test r15d, r15d
jne 0x140006894
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.14000a77c
lea ebp, [rdi - 3]
cmp ebp, 4
jne 0x140006ccb
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14002fb68]
call fcn.140013f08
test eax, eax
jne 0x140006cd1
jmp 0x140006cea
jb 0x140006ee8
mov rcx, qword [rsi + 0x30]
lea rdx, str._replace
call fcn.14000c04c
test rax, rax
je 0x140006e56
lea rbx, [rsi + 0x18]
lea r15, [rsp + 0x940]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.14000bd90
mov ecx, ebp
mov rdx, rbx
mov r8, r15
call fcn.1400054e0
test eax, eax
je 0x140006e17
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaMaintenanceService3932ecacee736d366d6436db0f55bce4
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140007079
lea rcx, [rsp + 0x940]
lea rdx, [rsp + 0x1200]
call fcn.140001100
test eax, eax
je 0x140006f27
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008059
lea rdx, str.Checking_for_Maintenance_Service_registry._key:__ls
lea r15, [rsp + 0x1200]
mov r8, r15
call fcn.140009f10
mov qword [rsp + 0xff0], 0
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140007083
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400080db
lea rdx, str.The_maintenance_service_registry_key_does_not_exist.
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x39
jmp 0x140006f30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008018
lea rdx, str.Could_not_get_the_installation_directory
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x21
jmp 0x140006f30
mov rbx, qword [rsi + 0x30]
movzx ecx, word [rbx]
test cx, cx
je 0x140006cea
add rbx, 2
call fcn.1400137cc
test eax, eax
jne 0x140006e5a
cmp edi, 7
jl 0x140006ee8
mov rcx, qword [rsi + 0x30]
call fcn.14000a150
test al, al
je 0x140006ee8
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, 0x104
call fcn.140012254
test eax, eax
je 0x140006cea
cmp edi, 8
jae 0x1400071a2
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000864d
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x36
jmp 0x140006be6
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007fd7
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application.
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x38
jmp 0x140006be6
mov rcx, qword [r13]
mov edx, 0x35
call fcn.14000a620
test eax, eax
jne 0x140006351
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000809a
lea rdx, str.Could_not_write_update.status_for_previous_failure.
jmp 0x14000634c
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006757
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006757
shr rbp, 1
mov rcx, r12
mov rdx, rbp
call fcn.140013f5c
test rax, rax
je 0x140006fef
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x140006ffc
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.140012254
test eax, eax
jne 0x14000706b
mov r15b, 1
mov al, 1
mov dword [rsp + 0x50], eax
jmp 0x140006965
mov dword [rsp + 0x50], 0
jmp 0x140006965
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rcx
mov rcx, rax
add rcx, 2
mov qword [rsp + 0x58], rcx
lea rax, [rax + rax + 4]
mov rbp, 0xffffffffffffffff
cmovns rbp, rax
mov rcx, rbp
call fcn.14000a774
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.14000bd90
mov rcx, r15
mov rdx, qword [rsp + 0x58]
mov r9, r12
call fcn.14000a0d0
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x50]
call fcn.140012254
mov ebp, eax
mov rcx, r15
call fcn.14000a77c
test ebp, ebp
je 0x140006fe1
mov al, 1
mov dword [rsp + 0x50], eax
xor r15d, r15d
jmp 0x140006965
mov rcx, qword [rsp + 0x1200]
jmp 0x14000708b
mov rcx, qword [rsp + 0xff0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, [rsp + 0x730]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, [rsp + 0x940]
mov r8d, 0x104
mov rcx, r14
call fcn.14000a784
lea rdx, str.updater.exe
mov rcx, r14
call int.140025c40
test eax, eax
jne 0x140007103
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000853d
lea rdx, str.Install_directory_updater_could_not_be_determined.
call fcn.14000a020
mov r8, qword [r13]
lea rcx, [rsp + 0x730]
lea rdx, [rsp + 0x940]
call fcn.140005600
mov r14d, eax
lea rcx, [rsp + 0x520]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bd90
test r14b, r14b
je 0x14000728f
lea rdx, [rsp + 0x520]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140007252
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140007390
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008638
lea rdi, str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x14000727e
mov rcx, qword [rsi + 0x38]
lea rdx, [0x14002fb68]
call fcn.140013f08
test eax, eax
je 0x1400071cf
mov rcx, qword [rsi + 0x38]
lea rdx, str._replace
call fcn.14000c04c
test rax, rax
je 0x140006ea9
mov r9, qword [rsi + 0x30]
lea rbx, [rsp + 0x1200]
mov rcx, rbx
call fcn.140008d90
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140007348
mov rdx, qword [rsi + 0x28]
lea rcx, [rsp + 0x1200]
mov r8d, 0x104
call fcn.140012254
test eax, eax
je 0x140006cea
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400086d6
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x34
jmp 0x140006f30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000868e
lea rdi, str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____lu_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov r8d, eax
call fcn.14000a020
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400081e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_copy_path_to_secure_location.____lu_
mov r8d, eax
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x31
call fcn.14000a620
xor edi, edi
test eax, eax
jne 0x14000730e
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000857e
lea rdx, str.Could_not_write_update.status_could_not_copy_updater_error
call fcn.14000a020
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008229
mov r8, qword [rsi + 0x10]
lea rdx, str.Service_command__ls_complete.
call fcn.140009f10
jmp 0x14000644b
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008717
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_remove_file_spec_when_attempting_to_verify_the_working_directory_path.____lu_
mov r8d, eax
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x47
jmp 0x140006f30
lea rdx, [0x14002f8f2]
lea rcx, [rsp + 0x520]
call int.140025c40
test eax, eax
jne 0x14000741a
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400076e6
lea rdi, str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x14000727e
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006bd1
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006bd1
lea r14, [rsp + 0x520]
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.updater.exe
mov rcx, r14
call int.140025c40
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400076de
cmp ecx, edx
jg 0x14000876b
mov r8, qword [rbx]
mov qword [rsp + 0x20], r14
lea rdx, str.Passed_in_path:__ls__ignored___Install_dir_has:__ls__Using_this_path_for_updating:__ls.
lea r15, [rsp + 0x730]
mov r9, r15
call fcn.140009f10
mov rcx, r14
call fcn.140006120
mov rcx, r15
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000728f
mov qword [rbx], r14
lea rcx, [rsp + 0x310]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bd90
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bd90
mov rcx, r14
call fcn.14000a834
cmp rax, 0x104
ja 0x140007515
lea r14, [rsp + 0x100]
lea rdx, [rsp + 0x520]
mov r8d, 0x105
mov rcx, r14
call fcn.14000a784
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140007ee6
lea r14, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
mov ecx, ebp
mov rdx, rbx
mov r8, r14
call fcn.1400054e0
test eax, eax
je 0x1400076fe
mov r8, qword [r13]
mov rcx, qword [rbx]
lea rdx, [rsp + 0xd60]
call fcn.140005600
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test al, al
je 0x14000777d
cmp ecx, edx
jg 0x1400087ac
lea rdx, str.Starting_update_process_as_the_service_in_session_0.
call fcn.140009f10
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf70], xmm0
movaps xmmword [rsp + 0xf80], xmm0
movaps xmmword [rsp + 0xf90], xmm0
movaps xmmword [rsp + 0xfa0], xmm0
movaps xmmword [rsp + 0xfb0], xmm0
movaps xmmword [rsp + 0xfc0], xmm0
xor r15d, r15d
mov qword [rsp + 0xfd0], r15
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xf70], 0x68
lea rax, str.winsta0Default
mov qword [rsp + 0xf80], rax
mov eax, ebp
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov r14, qword [rbx + r15*8]
mov rcx, r14
call fcn.14000a834
mov r12, rax
mov rcx, r14
mov dx, 0x22
call fcn.14000bf20
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r14
mov rcx, r14
lea rdx, [0x14002ce90]
call fcn.1400142f8
lea ecx, [r12 + 2]
test rax, rax
cmove ecx, r12d
cmp qword [rsp + 0x60], 0
jne 0x14000766c
mov rax, qword [rsp + 0x50]
add eax, ecx
inc eax
mov qword [rsp + 0x50], rax
inc r15
cmp r15, qword [rsp + 0x58]
jne 0x140007607
jmp 0x1400077f1
xor eax, eax
mov rdx, qword [rsp + 0x68]
movzx edx, word [rdx]
cmp edx, 0x22
je 0x14000768b
cmp edx, 0x5c
je 0x140007693
mov eax, 0
test edx, edx
jne 0x140007695
jmp 0x14000764f
add ecx, eax
inc ecx
xor eax, eax
jmp 0x140007695
inc eax
add qword [rsp + 0x68], 2
jmp 0x14000766e
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006c1a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006c1a
cmp ecx, edx
jle 0x1400073cd
lea rcx, [0x140038330]
call fcn.14000aa30
lea rdi, str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x1400086a1
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400087ed
lea rdx, str.Could_not_get_the_installation_directory
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x21
call fcn.14000a620
xor edi, edi
test eax, eax
jne 0x140007ed4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000882e
lea rdx, str.Could_not_write_update.status_for_GetInstallationDir_failure.
call fcn.14000a020
jmp 0x140007ed4
cmp ecx, edx
jg 0x14000886f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_start_process_due_to_certificate_check_error_on_updater.exe._Updating_update.status.____lu_
mov r8d, eax
call fcn.14000a020
mov rcx, qword [r13]
mov edx, 0x1a
call fcn.14000a620
xor edi, edi
test eax, eax
jne 0x140007ed4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400088b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_write_pending_state_to_update.status.____lu_
mov r8d, eax
call fcn.14000a020
jmp 0x140007ed4
mov rcx, qword [rsp + 0x50]
test ecx, ecx
mov eax, 1
cmovne eax, ecx
lea rcx, [rax + rax]
test eax, eax
mov r14, 0xffffffffffffffff
cmovns r14, rcx
mov rcx, r14
call fcn.14000a774
mov r12, rax
xor r15d, r15d
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.14000bd90
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x50], r12
mov r14, qword [rbx + r15*8]
mov rcx, r14
mov dx, 0x22
call fcn.14000bf20
mov r12, rax
mov rcx, r14
lea rdx, [0x14002ce90]
call fcn.1400142f8
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400078ba
test r12, r12
jne 0x1400078cf
mov r12, qword [rsp + 0x50]
mov rcx, r12
mov rdx, r14
call fcn.140013f40
mov rcx, r14
call fcn.14000a834
lea r12, [r12 + rax*2]
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x60], 0
jne 0x140007932
inc r15
cmp r15, qword [rsp + 0x58]
je 0x14000794a
mov rax, qword [rsp + 0x50]
mov word [rax], 0x20
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007836
mov rax, qword [rsp + 0x50]
mov word [rax], 0x22
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007862
xor eax, eax
movzx ecx, word [r14]
cmp ecx, 0x22
je 0x1400078ea
cmp ecx, 0x5c
je 0x14000790d
mov eax, 0
test ecx, ecx
jne 0x14000791b
jmp 0x140007888
test eax, eax
js 0x140007915
inc eax
mov rcx, qword [rsp + 0x50]
mov word [rcx], 0x5c
add rcx, 2
mov qword [rsp + 0x50], rcx
dec eax
jne 0x1400078f0
movzx ecx, word [r14]
jmp 0x140007919
inc eax
mov cx, 0x5c
jmp 0x14000791b
mov cx, 0x22
xor eax, eax
mov rdx, qword [rsp + 0x50]
mov word [rdx], cx
add rdx, 2
mov qword [rsp + 0x50], rdx
add r14, 2
jmp 0x1400078d1
mov rax, qword [rsp + 0x50]
mov word [rax], 0x22
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007894
mov rax, qword [rsp + 0x50]
mov word [rax], 0
cmp ebp, 4
jne 0x14000796f
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14002fb68]
call fcn.140013f08
test eax, eax
jne 0x140007974
jmp 0x1400079a3
cmp edi, 7
jl 0x1400079a3
mov rcx, qword [rsi + 0x30]
lea rdx, str._replace
call fcn.14000c04c
test rax, rax
jne 0x1400079a3
mov r14, qword [rsi + 0x30]
movzx ecx, word [r14]
test cx, cx
je 0x1400079a3
add r14, 2
call fcn.1400137cc
test eax, eax
jne 0x14000798d
lea rax, [0x14002fb8a]
mov qword [rsp + 0xf80], rax
or byte [rsp + 0xfac], 1
mov word [rsp + 0xfb0], 0
lea rcx, str.MOZ_USING_SERVICE1
call fcn.140011784
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400088f1
lea rdx, str.Starting_service_with_cmdline:__ls
mov r14, qword [rsp + 0x68]
mov r8, r14
call fcn.140009f10
mov rcx, qword [rbx]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x140007ac5
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008932
lea rdx, str.Process_was_started..._waiting_on_result.
call fcn.140009f10
mov rcx, qword [rsp + 0x90]
mov edx, 0xdbba0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15d, eax
cmp eax, 0x102
jne 0x140007b13
mov rcx, qword [rsp + 0x90]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x58], 0
xor ebp, ebp
jmp 0x140007b9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008973
mov r8, qword [rbx]
mov dword [rsp + 0x20], r14d
lea rdx, str.Could_not_create_process_as_current_user__updaterPath:__ls__cmdLine:__ls.____lu_
mov r9, qword [rsp + 0x68]
call fcn.14000a020
xor ebp, ebp
jmp 0x140007c46
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x1200]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140007b80
cmp ecx, edx
jg 0x1400089b4
mov r8d, dword [rsp + 0x1200]
lea rdx, str.Process_finished_with_return_code__lu.
call fcn.140009f10
xor ebp, ebp
cmp dword [rsp + 0x1200], 0
sete bpl
mov dword [rsp + 0x58], 0
jmp 0x140007b9e
cmp ecx, edx
jg 0x1400089f5
lea rdx, str.Process_finished_but_could_not_obtain_return_code.
call fcn.14000a020
xor ebp, ebp
mov dword [rsp + 0x58], 1
mov rcx, qword [rsp + 0x90]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rcx, qword [rsp + 0x98]
call r14
mov r14, qword [r13]
lea r12, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r12
xor edx, edx
call fcn.14000bd90
mov rcx, r12
call fcn.14000a460
test eax, eax
je 0x140007c15
lea r12, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r12
xor edx, edx
call fcn.14000bd90
lea rdx, str..status
mov rcx, r14
mov r8, r12
call fcn.14000a560
test eax, eax
jne 0x14000812a
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008a36
lea rdx, str.Could_not_get_path_for_the_secure_update_status_file
call fcn.14000a020
lea rcx, str.MOZ_USING_SERVICE
call fcn.140011784
mov rcx, qword [rsp + 0x68]
call fcn.14000a77c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test ebp, ebp
je 0x140007ce5
cmp eax, ecx
jg 0x140008a77
lea rdx, str.updater.exe_was_launched_and_run_successfully_
call fcn.140009f10
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008ab8
mov rcx, qword [0x140038120]
test rcx, rcx
je 0x140007cc9
call fcn.140012620
cmp edi, 7
je 0x140007d92
cmp edi, 8
jne 0x140007daf
mov eax, 4
jmp 0x140007d97
cmp eax, ecx
jg 0x140008af9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_running_update_process._Updating_update.status____lu_
mov r8d, eax
call fcn.14000a020
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008b3a
mov rcx, qword [0x140038120]
test rcx, rcx
je 0x140007d38
call fcn.140012620
xor edi, edi
cmp dword [rsp + 0x50], 0
jne 0x140007ed4
mov rcx, qword [r13]
mov edx, 0x18
call fcn.14000a620
test eax, eax
jne 0x140007ed4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008b7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_write_update.status_service_update_failure.____lu_
jmp 0x1400077e4
mov eax, 3
mov rcx, qword [rbx + rax*8]
lea rdx, [0x14002fb68]
call fcn.140013f08
test eax, eax
je 0x140007ecf
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, 1
test rax, rax
je 0x140007ed4
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
je 0x140007ed4
lea r9, [rsp + 0xfc]
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140007e24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000811c
lea r15, [rsp + 0xfc]
mov r12d, dword [r15]
mov rcx, r12
call fcn.14000a774
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14000bd90
mov rcx, r14
mov rdx, rbx
mov r8d, r12d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebp, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
je 0x140007ec5
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea rcx, [rsp + 0x1200]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bd90
mov r14, qword [rbx + 0x10]
mov rcx, r14
call fcn.14000a834
cmp rax, 0x104
ja 0x140007ec5
lea r15, [rsp + 0x1200]
mov r8d, 0x105
mov rcx, r15
mov rdx, r14
call fcn.14000a784
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000837e
mov rcx, rbx
call fcn.14000a77c
jmp 0x140007ed4
mov edi, 1
lea rcx, [rsp + 0x520]
call fcn.140006120
jmp 0x14000730e
lea rdx, str.updater.ini
lea rcx, [rsp + 0x100]
call int.140025c40
test eax, eax
je 0x140007515
lea rcx, [rsp + 0x730]
call fcn.14000a834
cmp rax, 0x104
ja 0x140007515
lea r14, [rsp + 0x310]
lea rdx, [rsp + 0x730]
mov r8d, 0x105
mov rcx, r14
call fcn.14000a784
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140007515
lea rdx, str.updater.ini
lea rcx, [rsp + 0x310]
call int.140025c40
test eax, eax
je 0x140007515
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x100]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140007515
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008bbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.Could_not_copy_updater.ini_from:__ls_to__ls.____lu_
lea r8, [rsp + 0x310]
lea r9, [rsp + 0x100]
call fcn.14000a020
jmp 0x140007515
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006f0d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006f0d
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006e3c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006e3c
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006d8f
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006d8f
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006f62
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006f62
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006dfd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006dfd
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140007ed4
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x140007c15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xff0]
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x14000826a
xorps xmm0, xmm0
lea rdx, [rsp + 0x1200]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008298
movabs rax, 0x676e69796c707061
xor r14d, r14d
cmp qword [rsp + 0x1200], rax
sete r14b
mov r12d, 1
jmp 0x1400082cf
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400072b4
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400072b4
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007333
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007333
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008bfd
lea rdx, str.Could_not_open_update.status_file
jmp 0x1400082c4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008c3e
lea rdx, str.Could_not_read_from_update.status_file
call fcn.14000a020
xor r14d, r14d
xor r12d, r12d
mov rax, qword [rsp + 0x60]
inc rax
cmp rax, 2
jb 0x1400082e8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x140007c46
test r14d, r14d
je 0x140007c46
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test ebp, ebp
je 0x1400085bf
cmp eax, ecx
jg 0x140008c7f
lea rdx, str.update.status_is_still_applying_even_though_update_was_successful.
call fcn.140009f10
mov rcx, qword [r13]
mov edx, 0x1d
call fcn.14000a620
xor ebp, ebp
test eax, eax
jne 0x140007c46
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008cc0
lea rdx, str.Could_not_write_update.status_still_applying_on_success_error.
jmp 0x140007c41
lea rdx, str.maintenanceservice_tmp.exe
lea rcx, [rsp + 0x1200]
call int.140025c40
test eax, eax
je 0x140007ec5
lea rcx, [rsp + 0xd60]
call fcn.14000a834
cmp rax, 0x104
ja 0x140007ec5
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000bd90
lea rdx, [rsp + 0xd60]
mov r8d, 0x104
mov rcx, r14
call fcn.14000a784
lea rdx, [0x14002f8b2]
mov rcx, r14
call int.140025c40
lea rdx, [rsp + 0x1200]
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007ec5
lea r14, [rsp + 0xd60]
lea rdx, [rsp + 0x1200]
mov rcx, r14
mov r8d, 1
call fcn.140008e10
test eax, eax
je 0x140008758
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
xor r12d, r12d
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0x90], 0x68
lea rax, [0x14002fb8a]
mov qword [rsp + 0xa0], rax
lea r13, [rsp + 0x70]
mov qword [r13 + 0x10], r12
movaps xmmword [r13], xmm0
lea r15, [rsp + 0xf70]
movaps xmmword [r15 + 0x70], xmm0
movaps xmmword [r15 + 0x60], xmm0
movaps xmmword [r15 + 0x50], xmm0
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.dummyparam.exe_upgrade
mov r8d, 0x3f
mov rcx, r15
call fcn.14000a784
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x1200]
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007ec5
mov rcx, qword [rsp + 0x70]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rcx, qword [rsp + 0x78]
call r14
jmp 0x140007ec5
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400070f7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400070f7
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007302
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007302
cmp eax, ecx
jg 0x140008d01
lea rdx, str.update.status_is_still_applying_and_update_was_not_successful.
call fcn.14000a020
cmp r15d, 0x102
mov eax, 0x32
mov ecx, 0x1e
cmove ecx, eax
cmp dword [rsp + 0x58], 0
mov edx, 0x33
cmove edx, ecx
mov rcx, qword [r13]
call fcn.14000a620
xor ebp, ebp
test eax, eax
jne 0x140007c46
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008d42
lea rdx, str.Could_not_write_update.status_still_applying_on_failure_error.
jmp 0x140007c41
lea rcx, [0x140038330]
call fcn.14000aa30
lea rdi, str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x1400086a1
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140006ece
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140006ece
lea rcx, [0x140038330]
call fcn.14000aa30
lea rdi, str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____lu_
cmp dword [0x140038330], 0xffffffff
jne 0x14000727e
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000727e
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007238
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007238
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x14000736d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000736d
lea rcx, [rsp + 0x1200]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140007ec5
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x14000746b
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000746b
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007585
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007585
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007723
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007723
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x14000776c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000776c
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007785
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007785
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400077d7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400077d7
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400079f5
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400079f5
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007a7a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007a7a
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007af3
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007af3
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007b54
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007b54
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007b88
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007b88
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007c3a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007c3a
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007c87
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007c87
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007cb8
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007cb8
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007ced
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007ced
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007d27
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007d27
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007d80
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007d80
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140007fac
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140007fac
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x14000828f
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000828f
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400082bd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400082bd
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140008329
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140008329
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x140008372
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x140008372
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x1400085c7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x1400085c7
lea rcx, [0x140038330]
call fcn.14000aa30
cmp dword [0x140038330], 0xffffffff
jne 0x14000862c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abc8
lea rcx, [0x140038330]
call fcn.14000aa98
jmp 0x14000862c