Function at 0x140036da0
Capabilities:
Check os version
Create process on windows
Get common file path
Load assembly via iassembly
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7f8
movaps xmmword [rsp + 0x7e0], xmm6
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x7d8], rax
movsxd rax, dword [rcx]
cmp rax, 0xb
ja 0x140036e29
lea rcx, [0x14006b0a0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x360], 0
mov qword [rsp + 0x368], 0xf
mov byte [rsp + 0x350], 0
mov r9, qword [rax]
mov rdi, qword [rax + 8]
lea rcx, [rsp + 0x350]
cmp rdi, 0xf
jbe 0x140036e4b
mov rdx, rdi
call fcn.1400011a0
jmp 0x140036e62
mov qword [rsp + 0x368], 0xf
mov qword [rsp + 0x360], 0
mov byte [rsp + 0x350], 0
jmp 0x140036e62
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x350], 0
mov rbx, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140036e70
mov rsi, qword [rsi]
cmp rbx, 0xf
ja 0x140037724
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x330], xmm0
mov r12d, 0xf
mov qword [rsp + 0x340], rbx
mov qword [rsp + 0x348], r12
cmp dword [r14], 0
mov qword [rsp + 0x328], 0xf
je 0x140036ed7
mov qword [rsp + 0x320], 8
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x310], rax
mov byte [rsp + 0x318], 0
jmp 0x140036f01
mov qword [rsp + 0x320], 7
mov dword [rsp + 0x310], 0x74696e69
mov dword [rsp + 0x313], 0x6c616974
mov byte [rsp + 0x317], 0
mov eax, dword [r14 + 4]
cmp eax, 2
je 0x140036f3c
cmp eax, 1
jne 0x140036f6e
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 5
mov dword [rsp + 0x2f0], 0x776f6873
mov byte [rsp + 0x2f4], 0x6e
jmp 0x140036f67
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 5
mov dword [rsp + 0x2f0], 0x6f727265
mov byte [rsp + 0x2f4], 0x72
mov eax, 5
jmp 0x140036fa5
mov qword [rsp + 0x308], 0xf
mov qword [rsp + 0x300], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2f0], rax
mov byte [rsp + 0x2f8], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x2f0], 0
mov edx, dword [r14 + 8]
lea rcx, [rsp + 0x2d0]
call fcn.140031e30
lea rsi, [rsp + 0x4b4]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14003736d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSVersion
mov edx, edi
mov r9d, 0x59
call fcn.14002d220
test edi, edi
jne 0x140037244
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x68], rbx
xor ebx, ebx
xor r15d, r15d
xor edi, edi
xor r13d, r13d
mov qword [rsp + 0x2b0], r13
mov qword [rsp + 0x2b8], rdi
mov qword [rsp + 0x2c0], r15
mov qword [rsp + 0x2c8], rbx
lea rsi, [rsp + 0x4b0]
mov r8d, 0xaa
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x140037203
lea rsi, [rsp + 0x370]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.1400326c0
cmp dword [rsi + 0x20], 0
jne 0x140039f8b
mov rcx, qword [rsp + 0x370]
mov rax, qword [rsp + 0x378]
mov rdx, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x388]
mov byte [rsp + 0x370], 0
mov qword [rsp + 0x380], 0
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rax
mov r15, rdx
mov qword [rsp + 0x2a0], rdx
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x288], 0xf
mov byte [rsp + 0x270], 0
lea r8, str.PrevNotificationAction
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov edx, 1
xor r9d, r9d
call fcn.14002fb50
lea rdx, [rsp + 0x4d8]
mov edi, dword [rdx]
test edi, edi
je 0x140037792
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x186
call fcn.14002d330
cmp dword [rsp + 0x4d8], 0
jne 0x1400371bb
cmp byte [rsp + 0x4d0], 0
je 0x1400371bb
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
jae 0x14003776f
test edi, edi
jns 0x1400378a0
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
mov rbx, qword [rsp + 0xb8]
jae 0x140037701
cmp rsi, 0x10
jb 0x14003723a
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jae 0x14003be68
mov rcx, qword [rsp + 0xb0]
call fcn.140057960
jmp 0x14003723a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSLocale
mov edx, edi
mov r9d, 0x61
call fcn.14002d220
test edi, edi
je 0x1400376c6
cmp rbx, 0x10
jae 0x1400376e3
mov rax, qword [rsp + 0x2e8]
cmp rax, 0x10
jae 0x1400372bc
mov rax, qword [rsp + 0x308]
cmp rax, 0x10
jae 0x1400372df
mov rax, qword [rsp + 0x328]
cmp rax, 0x10
jae 0x140037302
cmp r12, 0x10
jae 0x140037325
mov rax, qword [rsp + 0x368]
cmp rax, 0x10
jae 0x14003734a
mov rcx, qword [rsp + 0x7d8]
xor rcx, rsp
call fcn.140058a80
mov eax, edi
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd2b
call fcn.140057960
jmp 0x140037252
mov rcx, qword [rsp + 0x2f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd4f
call fcn.140057960
jmp 0x140037260
mov rcx, qword [rsp + 0x310]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd73
call fcn.140057960
jmp 0x140037272
mov rcx, qword [rsp + 0x330]
cmp r12, 0xfff
jae 0x14003bd0a
inc r12
mov rdx, r12
call fcn.140057960
jmp 0x14003727c
mov rcx, qword [rsp + 0x350]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd97
call fcn.140057960
jmp 0x14003728e
mov qword [rsp + 0x60], r12
lea rax, [0x14006b080]
lea rsi, [rsp + 0x3f8]
mov qword [rsi - 0x88], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b088]
mov qword [rsi], rax
mov rax, qword [rsi - 0x88]
movsxd rax, dword [rax + 4]
lea r15, [0x14006b078]
mov qword [rsp + rax + 0x370], r15
mov rax, qword [rsi - 0x88]
movsxd rax, dword [rax + 4]
mov edi, 0xffffff78
lea ecx, [rax + rdi]
mov dword [rsp + rax + 0x36c], ecx
lea rsi, [rsp + 0x378]
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b098]
mov qword [rsp + rax + 0x370], rcx
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x36c], ecx
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x370
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x370], r15
mov rax, qword [rsi - 8]
movsxd rax, dword [rax + 4]
add edi, eax
mov dword [rsp + rax + 0x36c], edi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006b000]
mov qword [rsi], rax
mov qword [rsi + 0x68], 0
mov dword [rsi + 0x70], 4
mov edx, dword [rsp + 0x4b4]
mov r12, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x370]
call r12
lea rdi, [0x1400a1306]
mov rcx, rax
mov rdx, rdi
call fcn.14005b980
mov edx, dword [rsp + 0x4b8]
mov rcx, rax
call r12
mov rcx, rax
mov rdx, rdi
call fcn.14005b980
mov edx, dword [rsp + 0x4bc]
mov rcx, rax
call r12
cmp dword [rsp + 0x4b4], 0xa
jne 0x140037518
cmp dword [rsp + 0x4b8], 0
jne 0x140037518
lea rax, [rsp + 0x238]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x728]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a363c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140037d07
mov qword [rsp + 0x738], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov eax, dword [rsp + 0x3e8]
test al, 2
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0xa8], rbp
jne 0x14003938c
mov rcx, qword [rsp + 0x3b8]
mov rdi, qword [rcx]
test rdi, rdi
je 0x14003938c
mov rax, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x3e0]
mov r9, qword [rax]
cmp rdi, rcx
cmovb rdi, rcx
sub rdi, r9
cmp rdi, 0xf
mov r12, qword [rsp + 0x60]
lea rcx, [rsp + 0x728]
jbe 0x140037d30
mov rdx, rdi
call fcn.1400011a0
mov r13, qword [rsp + 0x728]
mov rdi, qword [rsp + 0x730]
mov r15, qword [rsp + 0x738]
mov rbx, qword [rsp + 0x740]
mov rax, qword [rsp + 0x370]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b078]
mov qword [rsp + rax + 0x370], rcx
mov rax, qword [rsp + 0x370]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x36c], ecx
lea rax, [0x14006b000]
mov qword [rsp + 0x378], rax
test byte [rsp + 0x3e8], 1
je 0x140037658
mov rax, qword [rsp + 0x3b8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003be2d
mov rcx, qword [rsp + rcx + 0x370]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x390]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003be42
call fcn.140057960
mov rax, qword [rsp + 0x390]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x398]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3d0]
mov dword [rax], ecx
mov qword [rsp + 0x3e0], rcx
and byte [rsp + 0x3e8], 0xfe
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x3f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x140037041
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xb8], rbx
xor esi, esi
xor edx, edx
xor eax, eax
xor ecx, ecx
jmp 0x1400370f5
lea rdx, [rbx + 1]
cmp rdx, 0x1000
jae 0x14003be09
mov rcx, r13
call fcn.140057960
jmp 0x140037244
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be99
call fcn.140057960
jmp 0x1400371dd
mov r12, rbx
or r12, 0xf
movabs rax, 0x7fffffffffffffff
cmp r12, rax
cmovae r12, rax
cmp r12, 0xfff
jae 0x140039323
lea rcx, [r12 + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x330], rcx
lea r8, [rbx + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140036e8d
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bebd
call fcn.140057960
jmp 0x1400371bb
mov qword [rsp + 0x58], rsi
lea rsi, [rsp + 0x398]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005bc20
cmp byte [rsi - 8], 0
je 0x140037b47
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0x370]
mov rcx, qword [rax]
mov rbx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
cmp rdx, 0x10
mov r12, rax
cmovae r12, rcx
cmp rbx, 0xf
ja 0x14003933e
cmp rdx, 0x10
mov rsi, qword [r12]
cmovae rax, rcx
mov rax, qword [rax + 8]
mov ecx, 0xf
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rcx
cmp rbx, 0x14
mov r12, qword [rsp + 0x60]
jne 0x14003bee1
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movd xmm1, dword [rax + 0x10]
pcmpeqb xmm1, xmmword [0x14006acf0]
pcmpeqb xmm0, xmmword [str.dismissed_by_tim]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140037b81
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovb rsi, rax
mov qword [rax + 0x10], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rsi], rax
mov word [rsi + 8], 0x6e
jmp 0x140037b81
cmp dword [r14 + 4], 1
jne 0x140037925
mov rdi, rsi
mov edx, dword [r14 + 8]
mov rcx, rbp
call fcn.140031e30
cmp qword [rsp + 0x4c8], 0x10
jb 0x1400378c9
mov rbp, qword [rsp + 0x4b0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x370]
mov rcx, rsi
mov r8, rbp
xor r9d, r9d
call fcn.14002f050
mov eax, dword [rsi]
test eax, eax
je 0x140037910
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x1a5
call fcn.14002d330
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
mov rsi, rdi
jae 0x140037d4c
mov qword [rsp + 0x58], rsi
lea rsi, [rsp + 0x238]
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.14005b880
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x140037cb8
lea rdx, [rax + 8]
mov qword [rsp + 0x248], rdx
cmp rcx, 8
jb 0x14003798d
mov rsi, qword [rsp + 0x238]
movdqu xmm0, xmmword [str._version]
movdqu xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4c8], 7
mov qword [rsp + 0x4c0], 1
mov dword [rsp + 0x4b0], 0x32
mov rax, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
cmp rcx, rax
mov rsi, qword [rsp + 0x58]
je 0x140037cdf
lea rdx, [rax + 1]
mov qword [rsp + 0x248], rdx
cmp rcx, 8
jb 0x1400379fe
mov rcx, qword [rsp + 0x238]
jmp 0x140037a06
lea rcx, [rsp + 0x238]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x140037a43
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a217
call fcn.140057960
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x260], 2
mov dword [rsp + 0x268], 0
lea rcx, [0x1400a02c5]
lea rdx, str.DisableTelemetry
call fcn.140031fb0
test al, al
je 0x140037abb
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
call fcn.140036040
mov edi, eax
jmp 0x140037b06
lea r8, str.LastPingSentAt
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov edx, 1
call fcn.140032c80
mov edi, dword [rbp + 0x10]
test edi, edi
je 0x140037bc9
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x108
call fcn.14002d330
mov rax, qword [rsp + 0x250]
cmp rax, 8
mov r13, qword [rsp + 0x98]
jb 0x1400371c3
mov rcx, qword [rsp + 0x238]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a243
call fcn.140057960
jmp 0x1400371c3
mov byte [rsp + 0x270], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x271], rax
mov byte [rsp + 0x279], 0
mov qword [rsp + 0x280], 9
mov qword [rsp + 0x288], 0xf
cmp byte [rsp + 0x390], 0
mov rsi, qword [rsp + 0x58]
je 0x140037195
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jb 0x140037195
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0a1
call fcn.140057960
jmp 0x140037195
mov rdi, qword [rsp + 0x4b0]
mov bl, byte [rsp + 0x4b8]
lea rsi, [rsp + 0x370]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rsi, qword [rsi]
test bl, bl
je 0x140037c25
mov rax, rsi
test rsi, rsi
jne 0x140037c0c
lea rbx, [rsp + 0x370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x140037d6f
shr rax, 9
cmp rax, 0x6388fc53
jb 0x140037d6f
lea rdx, str.LastPingSentAt
lea r13, [rsp + 0x370]
mov rcx, r13
mov r8, rsi
call fcn.140032e90
cmp dword [r13], 0
je 0x140037c6e
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x118
call fcn.14002d330
lea rcx, [rsp + 0x238]
lea rsi, [rsp + 0x480]
mov rdx, rsi
call fcn.14002d4e0
mov edi, dword [rsi]
test edi, edi
je 0x140037dad
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], edi
mov rsi, qword [rsp + 0x58]
jmp 0x1400394b4
mov qword [rsp + 0x20], 8
lea r9, str._version
lea rcx, [rsp + 0x238]
mov edx, 8
call fcn.14005b730
jmp 0x1400379a1
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
lea r9, [rsp + 0x4b0]
mov edx, 1
call fcn.14005b730
jmp 0x140037a13
lea rdx, [0x1400a1306]
lea rcx, [rsp + 0x370]
call fcn.14005b980
mov edx, dword [rsp + 0x728]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140037518
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x728], 0
jmp 0x1400375a4
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0ca
call fcn.140057960
jmp 0x140037925
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
call fcn.140036040
mov edi, eax
mov rsi, qword [rsp + 0x58]
jmp 0x140037b06
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x238]
mov r8d, dword [rcx + 0x2c]
lea rbx, [rsp + 0x7b8]
mov rdx, rbx
call fcn.14002ee30
mov eax, 0x90
lea rcx, [rax + r13]
mov qword [rsp + 0xa0], rcx
add rax, rbp
mov qword [rsp + 0x70], rax
xorps xmm6, xmm6
xor r12d, r12d
mov r14d, 0xf
xor esi, esi
cmp dword [rsp + 0x268], 0
je 0x1400393e8
mov qword [rsp + 0x740], r12
mov qword [rsp + 0x748], r14
mov byte [rsp + 0x730], r12b
mov qword [rsp + 0x760], r12
mov qword [rsp + 0x768], r14
mov byte [rsp + 0x750], r12b
mov qword [rsp + 0x780], r12
mov qword [rsp + 0x788], r14
mov byte [rsp + 0x770], r12b
mov byte [rsp + 0x7b0], r12b
cmp qword [rsp + 0x7d0], 8
mov r8, rbx
jb 0x140037e69
mov r8, qword [rsp + 0x7b8]
mov rcx, r13
lea rdx, str.CacheEntryVersion
call fcn.14002e0b0
mov edi, dword [rsp + 0x378]
test edi, edi
je 0x140037fc2
cmp qword [rsp + 0x7d0], 8
jb 0x140037e9a
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rbx
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b4
call fcn.14002d330
mov r8d, 0xa0
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], edi
mov ebx, 1
cmp byte [rsp + 0x7b0], 0
je 0x140037f27
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003835f
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003828d
mov qword [rsp + 0x780], 0
mov qword [rsp + 0x788], 0xf
mov byte [rsp + 0x770], 0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x1400382b0
mov qword [rsp + 0x760], 0
mov qword [rsp + 0x768], 0xf
mov byte [rsp + 0x750], 0
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x1400382d3
cmp ebx, 4
jne 0x14003946b
inc esi
cmp esi, dword [rsp + 0x260]
lea rbx, [rsp + 0x7b8]
jbe 0x140037df5
jmp 0x140039429
mov rax, qword [rsp + 0x370]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x140038228
mov dword [rsp + 0x728], eax
test eax, eax
je 0x1400382f6
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x6f0]
mov r8, rbx
lea r9, str.NotificationType
call fcn.14002f8e0
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x140037ecf
movaps xmmword [rsp + 0x6d0], xmm6
movaps xmmword [rsp + 0x6c0], xmm6
mov byte [rsp + 0x6e0], 0
lea rcx, [rsp + 0x6e8]
lea rdx, [rsp + 0x718]
call fcn.14005bc20
mov ebx, 4
cmp byte [rsp + 0x6e0], 0
je 0x1400381d7
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x140038c0f
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xd0], rax
mov eax, 0xf
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x140038382
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x730], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x738], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x748], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a217c]
call fcn.14002f8e0
cmp dword [rsp + 0x718], 0
jne 0x140038189
cmp byte [rsp + 0x710], 0
je 0x140038189
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x1400383c8
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
je 0x1400383eb
mov r8d, 0xa0
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x550], edi
mov ebx, 1
cmp byte [rsp + 0x6e0], 0
je 0x1400381d7
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
jae 0x1400383a5
cmp dword [rsp + 0x718], 0
jne 0x140037eeb
cmp byte [rsp + 0x710], 0
je 0x140037eeb
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jb 0x140037eeb
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038fb7
call fcn.140057960
jmp 0x140037eeb
cmp qword [rsp + 0x7d0], 8
jb 0x14003823b
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rbx
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1ba
call fcn.14002d330
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x6f0]
call fcn.14002f7c0
mov edi, dword [rsp + 0x6f0]
jmp 0x14003834d
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038eb9
call fcn.140057960
jmp 0x140037f39
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038edd
call fcn.140057960
jmp 0x140037f6b
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f01
call fcn.140057960
jmp 0x140037f9d
cmp qword [rsp + 0x7d0], 8
jb 0x140038309
mov rbx, qword [rsp + 0x7b8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x207
call fcn.14002d330
lea rcx, [rsp + 0x238]
mov rdx, r13
call fcn.14002f7c0
mov edi, dword [rsp + 0x370]
test edi, edi
jne 0x140037ecf
mov ebx, 4
jmp 0x140037eeb
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f25
call fcn.140057960
jmp 0x140037f07
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f93
call fcn.140057960
jmp 0x1400380e5
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038fdb
call fcn.140057960
jmp 0x1400381d7
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038fff
call fcn.140057960
jmp 0x140038169
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005bc20
cmp dword [rsp + 0x398], 0
jne 0x14003843e
cmp byte [rsp + 0x390], 0
je 0x14003843e
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038c70
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x14003819f
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005bc20
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005bc90
cmp byte [rsp + 0x390], 0
je 0x1400384a6
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038cb7
cmp byte [rsp + 0x6e0], 0
je 0x1400381d7
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x140038d20
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
mov eax, 0xf
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x140038cda
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x750], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x758], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x768], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, [0x1400a21f6]
call fcn.14002f8e0
cmp dword [rsp + 0x718], 0
jne 0x1400385e2
cmp byte [rsp + 0x710], 0
je 0x1400385e2
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x140038cfd
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
jne 0x14003819f
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005bc20
cmp dword [rsp + 0x398], 0
jne 0x14003864b
cmp byte [rsp + 0x390], 0
je 0x14003864b
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038d81
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x14003819f
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005bc20
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005bc90
cmp byte [rsp + 0x390], 0
je 0x1400386b3
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038dc8
cmp byte [rsp + 0x6e0], 0
je 0x1400381d7
mov rax, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6d8]
cmp rcx, 0x10
lea rdx, [rsp + 0x6c0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x50], rdi
cmp rdi, 0xf
ja 0x140038e31
cmp rcx, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x6c0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0], rax
mov eax, 0xf
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x140038deb
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x770], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x778], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x780], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x788], rax
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x50], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x238]
mov rdx, r13
lea r8, [rsp + 0x7b8]
lea r9, str.PrevNotificationAction
call fcn.14002f8e0
cmp dword [rsp + 0x718], 0
jne 0x1400387fd
cmp byte [rsp + 0x710], 0
je 0x1400387fd
mov rax, qword [rsp + 0x708]
cmp rax, 0x10
jae 0x140038e0e
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 0xf
mov byte [rsp + 0x6f0], 0
mov edi, dword [rsp + 0x398]
mov dword [rsp + 0x718], edi
test edi, edi
jne 0x14003819f
movaps xmmword [rsp + 0x700], xmm6
movaps xmmword [rsp + 0x6f0], xmm6
mov byte [rsp + 0x710], 0
lea rcx, [rsp + 0x718]
lea rdx, [rsp + 0x398]
call fcn.14005bc20
cmp dword [rsp + 0x398], 0
jne 0x140038866
cmp byte [rsp + 0x390], 0
je 0x140038866
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038e96
mov edi, dword [rsp + 0x718]
test edi, edi
jne 0x14003819f
movaps xmmword [rsp + 0x380], xmm6
movaps xmmword [rsp + 0x370], xmm6
mov byte [rsp + 0x390], 0
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0x718]
call fcn.14005bc20
lea rcx, [rsp + 0x6c0]
mov rdx, r13
call fcn.14005bc90
cmp byte [rsp + 0x390], 0
je 0x1400388ce
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x140038f70
cmp dword [rsp + 0x50], 2
jb 0x1400388e3
cmp byte [rsp + 0x6e0], 0
je 0x1400381d7
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x6c0]
call fcn.14005bd30
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0x460]
call fcn.14002f7c0
mov edi, dword [rsp + 0x460]
test edi, edi
jne 0x14003819f
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x370], eax
lea rax, [rsp + 0x398]
movups xmmword [rax - 0x10], xmm6
cmp qword [rsp + 0x748], 0x10
lea rax, [rsp + 0x730]
mov qword [rsp + 0x50], rax
jb 0x14003895b
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x740]
cmp rdi, 0xf
ja 0x140039023
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax - 0x20], xmm0
mov ebx, 0xf
mov qword [rsp + 0x388], rdi
mov qword [rsp + 0x390], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x10], xmm6
mov rdi, qword [rsp + 0x760]
cmp qword [rsp + 0x768], 0x10
lea rax, [rsp + 0x750]
mov qword [rsp + 0x50], rax
jb 0x1400389d1
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x50], rax
cmp rdi, 0xf
ja 0x14003906f
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3a8], rdi
mov qword [rsp + 0x3b0], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x30], xmm6
mov rdi, qword [rsp + 0x780]
cmp qword [rsp + 0x788], 0x10
lea rax, [rsp + 0x770]
mov qword [rsp + 0x50], rax
jb 0x140038a3e
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x50], rax
cmp rdi, 0xf
ja 0x1400390bb
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax + 0x20], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], rbx
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
mov byte [rax + 0x60], 0
cmp byte [rsp + 0x7b0], 0
je 0x140038b07
lea rax, [rsp + 0x398]
movups xmmword [rax + 0x50], xmm6
cmp qword [rsp + 0x7a8], 0x10
lea rax, [rsp + 0x790]
mov qword [rsp + 0x50], rax
jb 0x140038ac2
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x7a0]
cmp rdi, 0xf
ja 0x14003912b
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x398]
movdqu xmmword [rax + 0x40], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3e8], rdi
mov qword [rsp + 0x3f0], rbx
mov byte [rsp + 0x3f8], 1
mov bl, 1
mov byte [rsp + 0x400], bl
mov r8d, 0x91
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x370]
mov dword [rsp + 0x4b0], eax
lea rdx, [rsp + 0x398]
movups xmm0, xmmword [rdx - 0x20]
movups xmm1, xmmword [rdx - 0x10]
lea rcx, [rsp + 0x4b8]
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov qword [rsp + 0x388], r12
mov qword [rsp + 0x390], r14
mov byte [rsp + 0x378], r12b
lea rax, [rsp + 0x398]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x4d8]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x3a8], r12
mov qword [rsp + 0x3b0], r14
mov byte [rsp + 0x398], r12b
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
movdqu xmmword [rcx + 0x40], xmm0
movdqu xmmword [rcx + 0x50], xmm1
mov qword [rsp + 0x3c8], r12
mov qword [rsp + 0x3d0], r14
mov byte [rsp + 0x3b8], r12b
movups xmmword [rcx + 0x60], xmm6
movups xmmword [rcx + 0x70], xmm6
mov byte [rcx + 0x80], r12b
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xa0]
call fcn.14005bc20
mov byte [rsp + 0x540], bl
mov rcx, r13
call fcn.14003e6e0
mov dword [rsp + 0x550], 0
mov rcx, r13
call fcn.1400301b0
jmp 0x1400381b6
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jae 0x140038c93
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140057970
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400380d3
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140039107
call fcn.140057960
jmp 0x14003843e
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x78], rcx
mov qword [rcx - 8], rax
jmp 0x140038c50
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140039177
call fcn.140057960
jmp 0x1400384a6
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003919b
call fcn.140057960
jmp 0x14003853e
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400391bf
call fcn.140057960
jmp 0x1400385c2
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jae 0x140038da4
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140057970
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003852c
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003924b
call fcn.140057960
jmp 0x14003864b
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x78], rcx
mov qword [rcx - 8], rax
jmp 0x140038d61
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003926f
call fcn.140057960
jmp 0x1400386b3
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140039293
call fcn.140057960
jmp 0x14003874b
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400392b7
call fcn.140057960
jmp 0x1400387dd
mov rcx, qword [rsp + 0x50]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jae 0x140038f49
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140057970
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038739
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400392db
call fcn.140057960
jmp 0x140038866
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400382a6
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400382c9
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400382ec
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038378
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x78], rcx
mov qword [rcx - 8], rax
jmp 0x140038e76
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400392ff
call fcn.140057960
jmp 0x1400388ce
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003839b
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x14003821e
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400383be
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1400383e1
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x1400391e3
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x378], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038988
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x1400391fd
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x398], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400389f5
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140039217
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x3b8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038a63
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038c89
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x140039231
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x3d8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038aef
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038cd0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038cf3
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038d16
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039054
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400390a0
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400390ec
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003915c
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038d9a
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038de1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038e04
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038e27
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038eaf
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x140038f89
lea rcx, [r12 + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140037756
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0x70], rcx
jae 0x14003abec
inc rcx
call fcn.140057970
mov rsi, rax
lea r8, [rbx + 1]
mov rcx, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x70]
jmp 0x140037805
test al, 4
mov r12, qword [rsp + 0x60]
jne 0x1400375a4
mov rax, qword [rsp + 0x3b0]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400375a4
mov rax, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x3c8]
mov r9, qword [rax]
movsxd rax, dword [rcx]
add rdi, rax
sub rdi, r9
lea rcx, [rsp + 0x728]
cmp rdi, 0xf
jbe 0x14003c0f1
mov rdx, rdi
call fcn.1400011a0
jmp 0x14003c108
lea rsi, [rsp + 0x370]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x4b0]
mov dword [rcx + 0xa0], 0
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
call fcn.1400301b0
jmp 0x14003946b
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24b
call fcn.14002d330
lea rsi, [rsp + 0x4b0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jb 0x1400394a5
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003adc7
call fcn.140057960
mov edi, dword [rsp + 0x550]
test edi, edi
je 0x1400395d8
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x16b
call fcn.14002d330
cmp dword [rsp + 0x550], 0
jne 0x1400394ef
lea rcx, [rsp + 0x4b0]
call fcn.1400301b0
test edi, edi
js 0x140037b06
mov rax, qword [rsp + 0xa8]
movsxd rbx, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov edx, 1
xor r9d, r9d
call fcn.14002fb50
mov edi, dword [rsi + 0x28]
test edi, edi
je 0x140039fc7
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002d330
xor ecx, ecx
xor r13d, r13d
xor ebp, ebp
xor r14d, r14d
cmp dword [rsp + 0x4d8], 0
mov rsi, qword [rsp + 0x58]
jne 0x140039586
cmp byte [rsp + 0x4d0], 0
je 0x140039586
mov rax, qword [rsp + 0x4c8]
cmp rax, 0x10
jae 0x140039f99
test edi, edi
jne 0x140037b06
mov qword [rsp + 0x218], rcx
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], rbp
mov qword [rsp + 0x230], r14
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x200], xmm0
mov rdi, qword [rsp + 0x280]
cmp qword [rsp + 0x288], 0x10
jb 0x14003960f
mov rsi, qword [rsp + 0x270]
jmp 0x140039617
xor edi, edi
lea rcx, [rsp + 0x370]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x540], 0
jne 0x14003a2d1
lea rcx, [rsp + 0x370]
call fcn.1400301b0
jmp 0x1400394d8
lea rsi, [rsp + 0x270]
cmp rdi, 0xf
mov rax, qword [rsp + 0x98]
ja 0x14003a6fb
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x1f0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x208], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1e0], xmm0
mov rsi, qword [rsp + 0x2e0]
cmp qword [rsp + 0x2e8], 0x10
lea rbx, [rsp + 0x2d0]
jb 0x14003967b
mov rbx, qword [rsp + 0x2d0]
cmp rsi, 0xf
ja 0x14003a753
movdqu xmm0, xmmword [rbx]
movdqa xmmword [rsp + 0x1d0], xmm0
mov edi, 0xf
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c0], xmm0
mov rdi, qword [rsp + 0x300]
cmp qword [rsp + 0x308], 0x10
jb 0x1400396d1
mov rsi, qword [rsp + 0x2f0]
jmp 0x1400396d9
lea rsi, [rsp + 0x2f0]
cmp rdi, 0xf
ja 0x14003a7ab
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x1b0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1a0], xmm0
mov rdi, qword [rsp + 0x320]
cmp qword [rsp + 0x328], 0x10
jb 0x14003972f
mov rsi, qword [rsp + 0x310]
jmp 0x140039737
lea rsi, [rsp + 0x310]
cmp rdi, 0xf
ja 0x14003a803
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x190], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1a0], rdi
cmp qword [rsp + 0x58], 0x10
lea rsi, [rsp + 0x290]
cmovae rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x1a8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x180], xmm0
cmp r15, 0xf
ja 0x14003a85b
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x170], xmm0
mov edi, 0xf
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x180], r15
cmp qword [rsp + 0xb8], 0x10
lea rsi, [rsp + 0x2b0]
cmovae rsi, rax
mov qword [rsp + 0x188], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
cmp qword [rsp + 0x88], 0xf
ja 0x14003a8b8
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x150], xmm0
mov edi, 0xf
cmp r12, 0x10
jb 0x14003980b
mov rsi, qword [rsp + 0x330]
jmp 0x140039813
lea rsi, [rsp + 0x330]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x140], xmm0
cmp rbx, 0xf
ja 0x14003a915
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x130], xmm0
mov edi, 0xf
mov qword [rsp + 0x140], rbx
cmp r14, 0x10
lea rsi, [rsp + 0x218]
cmovae rsi, rcx
mov qword [rsp + 0x148], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
cmp rbp, 0xf
ja 0x14003a96b
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x110], xmm0
mov edi, 0xf
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x128], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x100], xmm0
mov rdi, qword [rsp + 0x360]
cmp qword [rsp + 0x368], 0x10
jb 0x1400398d7
mov rsi, qword [rsp + 0x350]
jmp 0x1400398df
lea rsi, [rsp + 0x350]
cmp rdi, 0xf
mov qword [rsp + 0xa8], rcx
ja 0x14003a9bb
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0xf0], xmm0
mov ebp, 0xf
mov r15, r12
lea rbx, [rsp + 0xf0]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rbp
lea rsi, [rsp + 0x728]
mov rcx, rsi
xor edx, edx
call fcn.140005b20
lea rdx, str.release
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
call fcn.1400015d0
lea rdx, str.build_channel
lea r8, [0x1400a08fb]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rdx, [0x1400a10ae]
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
call fcn.1400015d0
lea rdx, str.build_version
lea r8, [0x1400a084a]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rbp, [rsp + 0x4b0]
mov rcx, rbp
mov rdx, rbx
call fcn.1400601c0
lea rdx, [0x1400a05a4]
lea r8, [0x1400a05b3]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbp
mov rdx, rax
call fcn.140001500
mov rcx, rbp
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.previous_default_browser
lea r8, [0x1400a05b3]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a0379]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x150]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.os_version
lea r8, [0x1400a083c]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x170]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.os_locale
lea r8, [0x1400a0e2b]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x190]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.notification_type
lea r8, [0x1400a0d71]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1b0]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.notification_shown
lea r8, [0x1400a06e4]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1d0]
mov rcx, rbx
call fcn.1400601c0
lea rdx, [0x1400a076c]
lea r8, [0x1400a077f]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rbx, [rsp + 0x4b0]
lea rdx, [rsp + 0x1f0]
mov rcx, rbx
call fcn.1400601c0
lea rdx, str.previous_notification_action
lea r8, [0x1400a077f]
mov rcx, rsi
call fcn.1400016e0
mov rcx, rbx
mov rdx, rax
call fcn.140001500
mov rcx, rbx
call fcn.140001070
lea rax, [0x14006b150]
lea rbp, [rsp + 0x378]
mov r13, rax
mov qword [rbp - 8], rax
and dword [rbp + 8], 0xfffffe00
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 0
mov rcx, rbp
call fcn.1400012d0
lea rdx, [0x1400a142e]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
call fcn.1400015d0
lea rbx, [rsp + 0x6f0]
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0xb
movabs rax, 0x7461746e65646e69
mov qword [rbx], rax
mov dword [rbx + 7], 0x6e6f6974
mov byte [rbx + 0xb], 0
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.140005c90
mov rcx, rsi
mov rdx, rax
call fcn.140001500
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jae 0x14003a046
lea rcx, [rsp + 0x4b0]
call fcn.140001070
lea r12, [rsp + 0x6c0]
lea rdx, [rsp + 0x370]
lea r8, [rsp + 0x728]
mov rcx, r12
call fcn.140002b90
lea rcx, [rsp + 0x7b8]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
mov rsi, qword [rsp + 0x58]
je 0x140039cfb
mov edi, eax
or edi, 0x80010000
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov edx, edi
mov r9d, 0x2c
call fcn.14002d220
jmp 0x140039d67
pxor xmm0, xmm0
lea rdx, [rsp + 0x4b0]
movdqu xmmword [rdx + 0x3e], xmm0
movdqa xmmword [rdx + 0x30], xmm0
movdqa xmmword [rdx + 0x20], xmm0
movdqa xmmword [rdx + 0x10], xmm0
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x7b8]
mov rcx, rsi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
je 0x14003aa2a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x33
call fcn.14002d220
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
mov r12, r15
jae 0x14003a069
mov qword [rsp + 0x370], r13
mov rcx, rbp
call fcn.140001070
lea rcx, [rsp + 0x728]
call fcn.140001070
mov rax, qword [rsp + 0x108]
cmp rax, 0x10
jae 0x14003a094
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jae 0x14003a0bf
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0xf
mov byte [rsp + 0x110], 0
mov rax, qword [rsp + 0x148]
cmp rax, 0x10
jae 0x14003a0ea
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0xf
mov byte [rsp + 0x130], 0
mov rax, qword [rsp + 0x168]
cmp rax, 0x10
jae 0x14003a115
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0xf
mov byte [rsp + 0x150], 0
mov rax, qword [rsp + 0x188]
cmp rax, 0x10
jae 0x14003a140
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
mov rax, qword [rsp + 0x1a8]
cmp rax, 0x10
jae 0x14003a16b
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0xf
mov byte [rsp + 0x190], 0
mov rax, qword [rsp + 0x1c8]
cmp rax, 0x10
jae 0x14003a196
mov esi, 0xf
xor edx, edx
xor ecx, ecx
jmp 0x1400370e5
mov rbx, rcx
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c112
call fcn.140057960
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
jmp 0x140039586
mov qword [rsp + 0x60], r12
lea rdx, [rsp + 0x4d8]
lea rsi, [rsp + 0x398]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005bc20
cmp byte [rsi - 8], 0
je 0x14003a277
mov rax, qword [rsp + 0x370]
mov rbp, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x388]
cmp rcx, 0x10
mov rbx, r13
cmovae rbx, rax
cmp rbp, 0xf
ja 0x14003adf8
cmp rcx, 0x10
mov r12, qword [rbx]
cmovae r13, rax
mov r13, qword [r13 + 8]
mov esi, 0xf
jmp 0x14003ac3d
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c167
call fcn.140057960
jmp 0x140039c92
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c18b
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039d7c
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c1af
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039dab
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c1d3
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039ddd
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c1f7
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039e0f
mov rcx, qword [rsp + 0x150]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c21b
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039e41
mov rcx, qword [rsp + 0x170]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c23f
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039e73
mov rcx, qword [rsp + 0x190]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c263
call fcn.140057960
mov r12, r15
mov rsi, qword [rsp + 0x58]
jmp 0x140039ea5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov rsi, qword [rsp + 0x58]
jmp 0x140037a3e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov r13, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x58]
jmp 0x140037b3d
cmp ebx, 0xb
ja 0x14003aa05
lea rax, [0x14006b0a0]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x738], 0
mov qword [rsp + 0x740], 0xf
mov byte [rsp + 0x728], 0
mov r9, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rsp + 0x728]
cmp rsi, 0xf
jbe 0x14003ac06
mov rdx, rsi
call fcn.1400011a0
jmp 0x14003ac1d
lea rsi, [rsp + 0x400]
lea rbp, [rsp + 0x4b0]
mov eax, dword [rbp]
mov dword [rsi - 0x90], eax
lea rdx, [rsp + 0x4b8]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsi - 0x88], xmm0
movups xmmword [rsi - 0x78], xmm1
xor ebx, ebx
mov qword [rbp + 0x18], rbx
mov eax, 0xf
mov qword [rbp + 0x20], rax
mov byte [rbp + 8], bl
lea rcx, [rsp + 0x4d8]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi - 0x68], xmm0
movups xmmword [rsi - 0x58], xmm1
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x28], bl
movdqu xmm0, xmmword [rdx + 0x40]
movdqu xmm1, xmmword [rdx + 0x50]
movdqu xmmword [rsi - 0x48], xmm0
movdqu xmmword [rsi - 0x38], xmm1
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x48], bl
mov byte [rsi - 8], bl
pxor xmm0, xmm0
movdqu xmmword [rsi - 0x18], xmm0
movdqu xmmword [rsi - 0x28], xmm0
mov rcx, rsi
mov rdx, qword [rsp + 0x70]
call fcn.14005bc20
mov byte [rsi], 1
mov rcx, rbp
call fcn.14003e6e0
cmp byte [rsi], bl
mov rsi, qword [rsp + 0x58]
je 0x1400395fd
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x238]
lea rsi, [rsp + 0x310]
lea r8, [rsp + 0x2f0]
lea r9, [rsp + 0x2d0]
mov rdx, rsi
call fcn.140036040
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036ad0
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jae 0x14003ae60
lea rax, [rsp + 0x730]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x320], xmm1
movdqa xmmword [rsp + 0x310], xmm0
cmp byte [rax + 0x80], 0
je 0x14003a423
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003b027
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003ae83
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003aea6
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036ad0
mov rax, qword [rsp + 0x308]
cmp rax, 0x10
jae 0x14003aec9
lea rax, [rsp + 0x750]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x300], xmm1
movdqa xmmword [rsp + 0x2f0], xmm0
cmp byte [rax + 0x60], 0
je 0x14003a4b5
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003b04a
mov qword [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003aeec
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003af0f
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x728]
call fcn.140036ad0
mov rax, qword [rsp + 0x2e8]
cmp rax, 0x10
jae 0x14003af32
lea rax, [rsp + 0x770]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x2e0], xmm1
movdqa xmmword [rsp + 0x2d0], xmm0
mov qword [rax + 0x10], 0
cmp byte [rax + 0x40], 0
je 0x14003a54f
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003b06d
mov qword [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003af55
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003af78
lea rcx, [rsp + 0x370]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.140036ad0
mov sil, byte [rsi + 0x88]
test sil, sil
je 0x14003a5c1
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jae 0x14003b090
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jae 0x14003af9b
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003afbe
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jae 0x14003afe1
test sil, sil
je 0x14003ad27
lea rcx, [rsp + 0x370]
lea rsi, [rsp + 0x728]
mov rdx, rsi
call fcn.140036ad0
cmp byte [rsi + 0x88], 0
je 0x14003bcbe
mov bpl, byte [rsp + 0x790]
mov rsi, qword [rsp + 0x7a0]
mov rbx, qword [rsp + 0x7a8]
mov qword [rsp + 0x7a0], 0
mov qword [rsp + 0x7a8], 0xf
mov byte [rsp + 0x790], 0
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
jae 0x14003b0b3
lea rax, [rsp + 0x791]
mov byte [rsp + 0x270], bpl
mov rcx, qword [rax]
mov rdx, qword [rax + 7]
mov qword [rsp + 0x271], rcx
mov qword [rsp + 0x278], rdx
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], rbx
mov rax, qword [rax - 9]
cmp rax, 0x10
jae 0x14003b0d6
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jae 0x14003b0f9
mov rax, qword [rsp + 0x748]
cmp rax, 0x10
jb 0x14003ad73
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c57c
call fcn.140057960
jmp 0x14003ad73
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003b470
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x1f0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x14003963b
mov r13, rcx
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b48a
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x1d0], rcx
lea r8, [rsi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x140039697
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003b4a4
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x1b0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x1400396f5
mov r13, rcx
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003b4be
lea rcx, [rbx + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x190], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rcx, r13
jmp 0x140039753
mov r13, rcx
mov rdi, r15
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b4d8
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x170], rcx
lea r8, [r15 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x68]
mov rcx, r13
jmp 0x1400397a8
mov r15, rcx
mov rdi, qword [rsp + 0x88]
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b4f2
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x150], rcx
mov rax, qword [rsp + 0x88]
lea r8, [rax + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
jmp 0x1400397fb
mov r13, rcx
mov r15, rbx
mov rdi, rbx
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b50c
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x130], rcx
mov rbx, r15
lea r8, [r15 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r13
jmp 0x140039854
mov rbx, rcx
mov rdi, rbp
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b526
lea rcx, [rdi + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0x110], rcx
lea r8, [rbp + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
jmp 0x14003989d
mov rbp, rdi
or rbp, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
cmovae rbp, rax
cmp rbp, 0xfff
jae 0x14003b540
lea rcx, [rbp + 1]
call fcn.140057970
mov rcx, rax
mov qword [rsp + 0xf0], rcx
lea r8, [rdi + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140039903
mov qword [rsp + 0x740], 0xf
mov qword [rsp + 0x738], 0
mov byte [rsp + 0x728], 0
jmp 0x14003ac1d
lea rdi, [rsp + 0x6f0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [rsp + 0x4b2]
mov edx, 0x24
mov rcx, rdi
call fcn.14005b880
movzx eax, word [rdi]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x4a6], rcx
mov rcx, qword [rdi + 2]
mov qword [rsp + 0x4a0], rcx
mov qword [rsp + 0x60], rdi
movdqu xmm0, xmmword [rdi + 0x10]
mov word [rsp + 0x7b8], ax
mov rax, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x4a6]
mov qword [rsp + 0x7ba], rax
mov qword [rsp + 0x7c0], rcx
movdqu xmmword [rsp + 0x7c8], xmm0
lea rcx, section..rdata
lea r9, [rsp + 0x480]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x88], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14003ad82
mov rdi, qword [rsp + 0x480]
lea rbx, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a2df4]
mov rcx, rbx
mov qword [rsp + 0x68], rdi
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003ada4
lea rdx, [0x1400a1648]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ae3d
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003b004
cmp qword [rsp + 0x7d0], 8
jb 0x14003ab69
mov rsi, qword [rsp + 0x7b8]
lea rcx, [rsp + 0x4b0]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003b11c
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003b55a
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x6f0], 0
jmp 0x14003b56a
add rcx, 0x28
call fcn.140057970
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140039373
mov qword [rcx + 0x10], rsi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x728], 0
mov r12, qword [rsp + 0x728]
mov r13, qword [rsp + 0x730]
mov rbp, qword [rsp + 0x738]
mov rsi, qword [rsp + 0x740]
cmp qword [rsp + 0x368], 0x10
jb 0x14003ac52
mov r8, qword [rsp + 0x350]
jmp 0x14003ac5a
lea r8, [rsp + 0x350]
lea rdx, str.PingCurrentDefault
lea rbx, [rsp + 0x728]
mov rcx, rbx
xor r9d, r9d
call fcn.14002f050
mov edi, dword [rbx]
test edi, edi
je 0x14003acdc
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], edi
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x13d
call fcn.14002d330
xor ebx, ebx
mov r13d, 0
mov ebp, 0
mov r14d, 0
cmp rsi, 0x10
jb 0x14003ace2
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jae 0x14003c2f3
mov rcx, r12
call fcn.140057960
xor ebx, ebx
xor r13d, r13d
xor ebp, ebp
xor r14d, r14d
jmp 0x14003ace2
mov rbx, r12
mov r14, rsi
cmp byte [rsp + 0x390], 0
je 0x14003acfa
mov rax, qword [rsp + 0x388]
cmp rax, 0x10
jae 0x14003ad07
mov r12, qword [rsp + 0x60]
mov rcx, rbx
jmp 0x14003955b
mov rcx, qword [rsp + 0x370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c318
call fcn.140057960
jmp 0x14003acfa
mov rax, qword [rsp + 0x288]
cmp rax, 0x10
jae 0x14003b1ac
mov byte [rsp + 0x270], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x271], rax
mov byte [rsp + 0x279], 0
mov qword [rsp + 0x280], 9
mov qword [rsp + 0x288], 0xf
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x1400395fd
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edx, eax
mov r9d, 0x70
call fcn.14002d220
jmp 0x14003b173
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x7c
jmp 0x14003b13a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x1400394a0
mov rsi, rbp
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003b709
lea rcx, [rsi + 1]
call fcn.140057970
mov r12, rax
lea r8, [rbp + 1]
mov rcx, r12
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003ac3d
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x81
jmp 0x14003b13a
mov rcx, qword [rsp + 0x310]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c33c
call fcn.140057960
jmp 0x14003a3e5
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c360
call fcn.140057960
jmp 0x14003a435
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c384
call fcn.140057960
jmp 0x14003a447
mov rcx, qword [rsp + 0x2f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c3a8
call fcn.140057960
jmp 0x14003a46e
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c3cc
call fcn.140057960
jmp 0x14003a4c7
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c3f0
call fcn.140057960
jmp 0x14003a4d9
mov rcx, qword [rsp + 0x2d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c414
call fcn.140057960
jmp 0x14003a500
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c438
call fcn.140057960
jmp 0x14003a561
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c45c
call fcn.140057960
jmp 0x14003a573
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c480
call fcn.140057960
jmp 0x14003a5d3
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c4a4
call fcn.140057960
jmp 0x14003a5e5
mov rcx, qword [rsp + 0x730]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c4c8
call fcn.140057960
jmp 0x14003a5f7
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x86
jmp 0x14003b13a
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c4ec
call fcn.140057960
jmp 0x14003a423
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c510
call fcn.140057960
jmp 0x14003a4a9
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c534
call fcn.140057960
jmp 0x14003a543
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c558
call fcn.140057960
jmp 0x14003a5a9
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c5a0
call fcn.140057960
jmp 0x14003a66f
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c5c0
call fcn.140057960
jmp 0x14003a6b4
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c5e0
call fcn.140057960
jmp 0x14003a6c6
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x8b
call fcn.14002d220
xor eax, eax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0xa0], rax
xor esi, esi
xor eax, eax
mov qword [rsp + 0x50], rax
xor ebx, ebx
cmp qword [rsp + 0x68], 0
je 0x14003b16e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
jne 0x14003b1cf
mov rax, qword [rsp + 0x7d0]
cmp rax, 8
jb 0x140039d62
mov rcx, qword [rsp + 0x7b8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b724
call fcn.140057960
jmp 0x140039d62
mov rcx, qword [rsp + 0x270]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c600
call fcn.140057960
jmp 0x14003ad39
mov qword [rsp + 0x480], rbx
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x50]
cmp rcx, 8
lea rax, [rsp + 0x480]
cmovb rbx, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x498], rcx
lea rax, [0x14006afe8]
lea rsi, [rsp + 0x558]
mov qword [rsi - 0xa8], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b088]
mov qword [rsi], rax
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff58
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x4ac], ecx
lea rdi, [rsp + 0x4b8]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b098]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4ac], ecx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
xor esi, esi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x4ac], ebx
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006af70]
mov qword [rdi], rax
mov byte [rdi + 0x7c], sil
mov byte [rdi + 0x71], sil
lea rax, [rsp + 0x4c0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4c8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4e0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4e8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x500]
mov qword [rax + 8], rax
lea rax, [rsp + 0x504]
mov qword [rax + 0xc], rax
mov qword [rax - 4], rsi
mov qword [rax + 0x34], rsi
pxor xmm0, xmm0
movdqu xmmword [rax - 0x44], xmm0
movdqu xmmword [rax - 0x24], xmm0
mov rcx, qword [0x1400aa4d4]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x1c], rsi
mov rbx, rdi
mov rcx, rdi
mov rdx, qword [rsp + 0x68]
call fcn.14005d6e0
test rax, rax
jne 0x14003b3b0
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6d0]
cmp qword [rsp + 0x6d8], 0x10
jb 0x14003b3cb
mov r12, qword [rsp + 0x6c0]
lea rsi, [rsp + 0x4b0]
mov rcx, rsi
mov rdx, r12
call fcn.140004710
mov rax, qword [rsi]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4b0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003b5a6
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov edi, 0x8007045d
mov edx, 0x8007045d
mov r9d, 0xd6
call fcn.14002d220
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005ce40
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003b7a4
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a72f
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a787
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a7df
lea rcx, [rbx + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a837
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a88f
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a8f1
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a94c
lea rcx, [rdi + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a99f
lea rcx, [rbp + 0x28]
call fcn.140057970
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003a9ec
lea r9, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14005b880
mov rbx, qword [rsp + 0x6f0]
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x700]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x708]
mov qword [rsp + 0x50], rax
xor edi, edi
mov sil, 1
jmp 0x14003b15b
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4b0], rcx
mov rax, qword [rsp + 0x4b0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4ac], ecx
mov rcx, rbx
call fcn.14005ce40
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rsi, [rsp + 0x460]
mov rcx, rsi
xor edx, edx
call fcn.1400024f0
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003b6b6
lea rsi, [rsp + 0x4b0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x460]
lea r8, str.pingsender.exe
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003b6d6
mov qword [rsp + 0x700], 0
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], 0
lea rcx, [rsp + 0x4b0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x6f0]
cmp rax, 7
ja 0x14003b74b
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x6f0], 0
jmp 0x14003b75b
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x99
jmp 0x14003b6f4
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov edi, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0xa0
call fcn.14002d220
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x68], rax
xor esi, esi
xor r12d, r12d
jmp 0x14003b782
lea rcx, [rsi + 0x28]
call fcn.140057970
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14003ae29
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003b1a2
lea r9, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14005b880
mov rbx, qword [rsp + 0x6f0]
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x68], rax
mov rsi, qword [rsp + 0x700]
mov r12, qword [rsp + 0x708]
xor edi, edi
mov rcx, qword [rsp + 0x460]
mov qword [rsp + 0x460], 0
test rcx, rcx
je 0x14003b7a0
call fcn.140057960
test edi, edi
je 0x14003b7dd
mov rax, qword [rsp + 0x498]
cmp rax, 8
jb 0x14003b173
mov rcx, qword [rsp + 0x480]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003bce3
call fcn.140057960
jmp 0x14003b173
mov qword [rsp + 0x6f0], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x6f8], rax
mov qword [rsp + 0x700], rsi
mov qword [rsp + 0x708], r12
lea rsi, [rsp + 0x460]
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r9, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rsi
call fcn.14005b880
mov r8, qword [rsp + 0x7c8]
cmp qword [rsp + 0x7d0], 8
jb 0x14003b850
mov r9, qword [rsp + 0x7b8]
jmp 0x14003b858
lea r9, [rsp + 0x7b8]
mov rax, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x478]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x14003bcc9
lea rbx, [rax + r8]
mov qword [rsp + 0x470], rbx
cmp rcx, 8
jb 0x14003b891
mov rsi, qword [rsp + 0x460]
lea rcx, [rsi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbx*2], 0
cmp qword [rsp + 0x708], 8
jb 0x14003b8be
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x478], 8
jb 0x14003b8d3
mov rax, qword [rsp + 0x460]
jmp 0x14003b8db
lea rax, [rsp + 0x460]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x498], 8
jb 0x14003b8fb
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ecx, [rsi + 2]
test rax, rax
cmove ecx, esi
mov qword [rsp + 0x70], rcx
test rbx, rbx
jne 0x14003c626
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea r12d, [rsi + 2]
test rax, rax
cmove r12d, esi
test rbx, rbx
jne 0x14003c65d
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ecx, [rsi + 2]
test rax, rax
cmove ecx, esi
test rbx, rbx
jne 0x14003c68c
mov rax, qword [rsp + 0x70]
add eax, r12d
add eax, ecx
add eax, 3
test eax, eax
mov ecx, 1
cmovne ecx, eax
movsxd rax, ecx
add rax, rax
mov rsi, 0xffffffffffffffff
cmovae rsi, rax
mov rcx, rsi
call fcn.140057a8c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
mov qword [rsp + 0x70], rbx
test rax, rax
jne 0x14003c6bc
test rsi, rsi
jne 0x14003c6cf
mov rcx, rbx
mov rsi, qword [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c726
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
test rax, rax
jne 0x14003c734
add rbx, 2
test rsi, rsi
jne 0x14003c743
mov rcx, rbx
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c79a
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov r12, rax
test rax, rax
jne 0x14003c7a8
add rbx, 2
test rsi, rsi
jne 0x14003c7b7
mov rcx, rbx
mov rsi, qword [rsp + 0x88]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test r12, r12
jne 0x14003c817
mov word [rbx], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x4b0], xmm0
movdqa xmmword [rsp + 0x4e0], xmm0
movdqa xmmword [rsp + 0x500], xmm0
movdqa xmmword [rsp + 0x4f0], xmm0
movdqa xmmword [rsp + 0x4d0], xmm0
movdqa xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x510], 0
mov dword [rsp + 0x4b0], 0x68
mov dword [rsp + 0x4ec], 1
cmp qword [rsp + 0x708], 8
jb 0x14003bbb8
mov rcx, qword [rsp + 0x6f0]
jmp 0x14003bbc0
lea rcx, [rsp + 0x6f0]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
xor edi, edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003bc1c
mov rcx, qword [rsp + 0xe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xd8]
call rsi
jmp 0x14003bc4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov edx, edi
mov r9d, 0xf3
call fcn.14002d220
mov rcx, qword [rsp + 0x70]
call fcn.140057960
mov rax, qword [rsp + 0x478]
cmp rax, 8
jb 0x14003bc85
mov rcx, qword [rsp + 0x460]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003bdbb
call fcn.140057960
mov rax, qword [rsp + 0x708]
cmp rax, 8
jb 0x14003b7a4
mov rcx, qword [rsp + 0x6f0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003bde2
call fcn.140057960
jmp 0x14003b7a4
int3
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x460]
mov rdx, r8
call fcn.14005b730
jmp 0x14003b8a6
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003b7d3
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c620
add r12, 0x28
mov rcx, rax
jmp 0x14003733d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x1400372d5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x1400372f8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003731b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140037363
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003bc80
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14003bcb4
mov rax, qword [r13 - 8]
add r13, 0xfffffffffffffff8
sub r13, rax
cmp r13, 0x20
jae 0x14003c620
add rbx, 0x28
mov rdx, rbx
mov r13, rax
jmp 0x1400376f4
mov rax, qword [rsp + 0x3b0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x14003762a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c620
add rdx, 0x27
mov rcx, rax
mov r12, qword [rsp + 0x60]
jmp 0x140037653
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c620
mov rdx, rsi
add rdx, 0x28
mov qword [rsp + 0xb0], rax
jmp 0x1400371f4
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003771a
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x140037788
cmp rbx, 0x12
jg 0x14003bf1a
cmp rbx, 9
jne 0x14003bf55
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rdx, 0x6f697463612d6f6e
xor rdx, qword [rax]
movzx eax, byte [rax + 8]
xor rax, 0x6e
or rax, rdx
jmp 0x14003bfcf
cmp rbx, 0x1a
jg 0x14003bf8f
cmp rbx, 0x13
jne 0x14003bfdf
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 3]
pcmpeqb xmm1, xmmword [0x14006acb0]
pcmpeqb xmm0, xmmword [0x14006acc0]
jmp 0x14003bfc2
cmp rbx, 0xd
jne 0x14003c01c
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rbx, 0x6c632d7473616f74
xor rbx, qword [rax]
movabs rdx, 0x64656b63696c632d
xor rdx, qword [rax + 5]
or rdx, rbx
jmp 0x14003bfcf
cmp rbx, 0x1b
jne 0x14003c064
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xb]
pcmpeqb xmm1, xmmword [str.x_default_buttonmake_firefox_defplication_hiddendismissed_by_appmissed_by_buttondismissed_by_butto_action_centerdismissed_to_acteout]
pcmpeqb xmm0, xmmword [0x14006ac80]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
mov r12, qword [rsp + 0x60]
jne 0x140037870
jmp 0x140037b81
cmp rbx, 0x1a
mov r12, qword [rsp + 0x60]
jne 0x140037870
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xa]
pcmpeqb xmm1, xmmword [0x14006acd0]
pcmpeqb xmm0, xmmword [0x14006ace0]
jmp 0x14003785d
cmp rbx, 0xf
mov r12, qword [rsp + 0x60]
jne 0x140037870
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movabs rbx, 0x6d2d646e696d6572
xor rbx, qword [rax]
movabs rdx, 0x726574616c2d656d
xor rdx, qword [rax + 7]
or rdx, rbx
jne 0x140037870
jmp 0x140037b81
cmp rbx, 0x1f
mov r12, qword [rsp + 0x60]
jne 0x140037870
cmp rcx, 0x10
lea rax, [rsp + 0x270]
cmovae rax, rsi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xf]
pcmpeqb xmm1, xmmword [0x14006ac90]
pcmpeqb xmm0, xmmword [0x14006aca0]
jmp 0x14003785d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbx
mov rsi, qword [rsp + 0x58]
jmp 0x140037bbf
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
mov rsi, rdi
jmp 0x140037d65
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x728], 0
mov r12, qword [rsp + 0x60]
jmp 0x1400375a4
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x140039fb5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003a05f
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x14003a082
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a0ad
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a0d8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a103
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a12e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a159
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a184
mov rax, qword [r12 - 8]
add r12, 0xfffffffffffffff8
sub r12, rax
cmp r12, 0x20
jae 0x14003c620
add rsi, 0x28
mov rdx, rsi
mov r12, rax
jmp 0x14003acc8
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x14003ad20
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ae79
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ae9c
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aebf
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aee2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003af05
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003af28
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003af4b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003af6e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003af91
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003afb4
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003afd7
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003affa
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b040
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b063
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b086
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b0a9
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a6f1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003b0cc
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b0ef
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b112
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c620
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003b1c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ecx, ecx
mov rax, qword [rsp + 0x60]
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c643
cmp edx, 0x5c
je 0x14003c655
test edx, edx
jne 0x14003c651
jmp 0x14003b941
mov rdx, qword [rsp + 0x70]
add edx, ecx
inc edx
mov qword [rsp + 0x70], rdx
xor ecx, ecx
jmp 0x14003c657
inc ecx
add rax, 2
jmp 0x14003c62d
xor ecx, ecx
mov rax, qword [rsp + 0x68]
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c67a
cmp edx, 0x5c
je 0x14003c684
test edx, edx
jne 0x14003c680
jmp 0x14003b984
add r12d, ecx
inc r12d
xor ecx, ecx
jmp 0x14003c686
inc ecx
add rax, 2
jmp 0x14003c664
xor edx, edx
mov rax, qword [rsp + 0x88]
movzx ebx, word [rax]
cmp ebx, 0x22
je 0x14003c6ac
cmp ebx, 0x5c
je 0x14003c6b4
test ebx, ebx
jne 0x14003c6b0
jmp 0x14003b9c8
add ecx, edx
inc ecx
xor edx, edx
jmp 0x14003c6b6
inc edx
add rax, 2
jmp 0x14003c696
mov rbx, qword [rsp + 0x70]
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003ba3d
xor eax, eax
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c6ec
cmp ecx, 0x5c
je 0x14003c709
test ecx, ecx
jne 0x14003c715
jmp 0x14003ba63
test eax, eax
js 0x14003c711
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c6f2
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax]
jmp 0x14003c715
inc eax
mov cx, 0x5c
jmp 0x14003c717
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x60], 2
jmp 0x14003c6d1
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003ba6c
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003baa5
xor eax, eax
mov rcx, qword [rsp + 0x68]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c760
cmp ecx, 0x5c
je 0x14003c77d
test ecx, ecx
jne 0x14003c789
jmp 0x14003bacb
test eax, eax
js 0x14003c785
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c766
mov rax, qword [rsp + 0x68]
movzx ecx, word [rax]
jmp 0x14003c789
inc eax
mov cx, 0x5c
jmp 0x14003c78b
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x68], 2
jmp 0x14003c745
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003bad4
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003bb10
xor eax, eax
mov rcx, qword [rsp + 0x88]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c7d7
cmp ecx, 0x5c
je 0x14003c7f7
test ecx, ecx
jne 0x14003c803
jmp 0x14003bb39
test eax, eax
js 0x14003c7ff
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c7dd
mov rax, qword [rsp + 0x88]
movzx ecx, word [rax]
jmp 0x14003c803
inc eax
mov cx, 0x5c
jmp 0x14003c805
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x88], 2
jmp 0x14003c7b9
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003bb42