Function at 0x140004c90
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rbx, r8
mov r14d, edx
mov rsi, rcx
mov rdi, qword [0x1401054a8]
mov rax, qword [rdi]
xor rax, rbp
mov qword [rbp], rax
mov eax, 0x800401f0
mov qword [rbp - 0x28], rax
lea r13, [rbp - 0x20]
mov dword [rbp - 0x20], 0x800401f0
sub rsp, 0x20
mov rcx, r13
mov edx, 2
call fcn.14000a080
add rsp, 0x20
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x140005216
mov dword [rbp - 0x28], eax
test eax, eax
js 0x140005232
sub rsp, 0x20
lea r8, [0x1401060c0]
lea r9, str.attempting_deelevation
mov ecx, r14d
mov rdx, rbx
call fcn.140016700
add rsp, 0x20
test al, al
je 0x140005389
lea r15, [rbx + 8]
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140004f4f
lea rax, [rbx + 0x10]
jmp 0x140004d60
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
je 0x140004f4f
movzx ecx, word [rdx]
cmp ecx, 0x2f
je 0x140004d80
cmp ecx, 0x2d
jne 0x140004d50
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
jmp 0x140004d87
add rdx, 2
mov rcx, rdx
movzx edx, word [rcx]
test dx, dx
je 0x140004d50
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6f
jne 0x140004d50
movzx edx, word [rcx + 2]
test dx, dx
je 0x140004d50
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x73
jne 0x140004d50
movzx edx, word [rcx + 4]
test dx, dx
je 0x140004d50
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x69
jne 0x140004d50
movzx edx, word [rcx + 6]
test dx, dx
je 0x140004d50
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6e
jne 0x140004d50
movzx edx, word [rcx + 8]
test dx, dx
je 0x140004d50
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x74
jne 0x140004d50
cmp word [rcx + 0xa], 0
jne 0x140004d50
lea eax, [r14 + 1]
shl rax, 3
cmp r14d, 0xffffffff
mov r13, 0xffffffffffffffff
cmovge r13, rax
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r12, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.ntdll.dll_memset
add rsp, 0x20
mov rax, qword [r15]
mov qword [r12], rax
lea rax, str.__attempting_deelevation
mov qword [r12 + 8], rax
cmp r14d, 2
jle 0x1400052e8
mov r15d, r14d
mov rcx, r12
add rcx, 0x10
lea rdx, [rbx + 0x10]
lea r8, [r15*8 - 0x10]
sub rsp, 0x20
call sub.ntdll.dll_memcpy
add rsp, 0x20
jmp 0x1400052eb
lea rax, str.__attempting_deelevation
mov qword [rbp - 0x18], rax
dec r14d
sub rsp, 0x30
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x30]
mov edx, r14d
mov r8, r15
mov r9d, 1
call fcn.140008690
add rsp, 0x30
cmp qword [rbp - 0x30], 0
je 0x140005331
sub rsp, 0x20
lea rcx, [0x140105bfc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x20
test rax, rax
je 0x14000503a
sub rsp, 0x20
lea rdx, str.GetCurrentPackageFamilyName
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x14000503a
mov r15, rax
mov dword [rbp - 0x18], 0
sub rsp, 0x20
lea rcx, [rbp - 0x18]
xor edx, edx
call rax
add rsp, 0x20
cmp eax, 0x7a
jne 0x14000503a
mov r12d, dword [rbp - 0x18]
add r12, r12
sub rsp, 0x20
mov rcx, r12
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov r14, rax
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.ntdll.dll_memset
lea rcx, [rbp - 0x18]
mov rdx, r14
call r15
add rsp, 0x20
sub rsp, 0x20
test eax, eax
je 0x14000524f
mov rcx, r14
call sub.mozglue.dll_free
add rsp, 0x20
mov r14, qword [rbx]
sub rsp, 0x20
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rbx, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysAllocString]
add rsp, 0x20
mov qword [rbx], rax
test r14, r14
je 0x140005095
test rax, rax
jne 0x140005095
sub rsp, 0x20
mov ecx, 0x8007000e
xor edx, edx
call qword [0x140145008]
add rsp, 0x20
mov qword [rbp - 0x38], rbx
xor r14d, r14d
mov rbx, qword [rbp - 0x30]
mov word [rbp - 0x18], 8
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysAllocString]
add rsp, 0x20
mov qword [rbp - 0x10], rax
test rbx, rbx
je 0x1400050da
test rax, rax
jne 0x1400050da
sub rsp, 0x20
mov ecx, 0x8007000e
xor edx, edx
call qword [0x140145008]
add rsp, 0x20
mov word [rbp - 0x50], 8
sub rsp, 0x20
lea rcx, str.open
call qword [sym.imp.OLEAUT32.dll_SysAllocString]
add rsp, 0x20
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x140005113
sub rsp, 0x20
mov ecx, 0x8007000e
xor edx, edx
call qword [0x140145008]
add rsp, 0x20
sub rsp, 0x20
lea rbx, [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
add rsp, 0x20
mov word [rbp - 0x80], 0x16
mov dword [rbp - 0x78], 1
sub rsp, 0x30
lea r15, [rbp - 0x80]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x38]
lea r12, [rbp - 0x18]
lea r13, [rbp - 0x50]
mov rcx, rsi
mov r8, r12
mov r9, r13
call fcn.140005410
add rsp, 0x10
mov rdi, qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, r15
call rdi
mov rcx, rbx
call rdi
mov rcx, r13
call rdi
mov rcx, r12
call rdi
add rsp, 0x20
test r14, r14
je 0x140005199
sub rsp, 0x20
mov rcx, r14
call sub.mozglue.dll_free
add rsp, 0x20
mov rbx, qword [rbp - 0x38]
test rbx, rbx
mov rdi, qword [0x1401054a8]
lea r13, [rbp - 0x20]
je 0x1400051ef
lock dec dword [rbx + 0x10]
jne 0x1400051ef
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400051c9
sub rsp, 0x20
call qword [sym.imp.OLEAUT32.dll_SysFreeString]
add rsp, 0x20
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400051df
sub rsp, 0x20
call sub.mozglue.dll_free
add rsp, 0x20
sub rsp, 0x20
mov rcx, rbx
call sub.mozglue.dll_free
add rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x30], 0
test rcx, rcx
je 0x14000534d
sub rsp, 0x20
call sub.mozglue.dll_free
add rsp, 0x20
jmp 0x14000534d
sub rsp, 0x20
lea rcx, [rbp - 0x28]
call fcn.14000a170
add rsp, 0x20
mov eax, dword [rbp - 0x28]
test eax, eax
jns 0x140004d04
mov byte [rsi + 0x10], 1
lea rcx, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rcx
mov dword [rsi + 8], 0x89
mov dword [rsi + 0xc], eax
jmp 0x14000534d
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add rsp, 0x20
mov rcx, rax
mov r12, rsp
add ecx, 0x16
lea rax, [rcx + rcx]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.1400d514c
sub rsp, rax
mov r15, rsp
movsxd rdx, ecx
sub rsp, 0x20
mov rcx, r15
mov r9, r14
call fcn.1400053a0
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
add rsp, 0x20
mov rbx, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysAllocString]
add rsp, 0x20
mov qword [rbx], rax
test rax, rax
jne 0x1400052dc
sub rsp, 0x20
mov ecx, 0x8007000e
xor edx, edx
call qword [0x140145008]
add rsp, 0x20
mov qword [rbp - 0x38], rbx
mov rsp, r12
jmp 0x14000509c
movsxd r15, r14d
lea r13, [rbp - 0x20]
mov qword [r12 + r15*8], 0
sub rsp, 0x30
mov qword [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
mov edx, r14d
mov r8, r12
xor r9d, r9d
call fcn.140008690
add rsp, 0x10
mov rcx, r12
call sub.mozglue.dll_free
add rsp, 0x20
cmp qword [rbp - 0x30], 0
jne 0x140004f8e
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
movabs rax, 0x80070507000000ac
mov qword [rsi + 8], rax
sub rsp, 0x20
mov rcx, r13
call fcn.140015840
add rsp, 0x20
mov rax, qword [rbp]
xor rax, rbp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140005380
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
call fcn.1400d58e0
sub rsp, 0x20
mov ecx, 0x7f
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3