Function at 0x140010f00
Capabilities:
Check for software breakpoints
Parse credit card information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov r13, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov qword [rcx], 0
cmp qword [r9], 0
je 0x140010f72
cmp qword [r13 + 0x10], 0
je 0x1400119e6
cmp qword [r13 + 0x18], 0
je 0x1400119e6
cmp dword [r13 + 8], 0
je 0x1400119e6
cmp byte [r13 + 0x2c], 0
je 0x1400119e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [r13 + 0x20]
lea edx, [rcx + 8]
cmp qword [r13], 0
je 0x140011f3f
cmp edx, dword [r13 + 0x28]
ja 0x140011f48
mov rdx, qword [r13 + 0x10]
mov qword [rdx + rcx], rax
add dword [r13 + 0x20], 8
cmp qword [r13], 0
je 0x140010fd7
cmp qword [r13 + 0x10], 0
je 0x1400119e6
cmp qword [r13 + 0x18], 0
je 0x1400119e6
cmp dword [r13 + 8], 0
je 0x1400119e6
cmp byte [r13 + 0x2c], 0
je 0x1400119e6
mov rax, qword [rdi]
mov ecx, dword [rdi + 0x10]
add rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [r13 + 0x20]
lea edx, [rcx + 8]
cmp qword [r13], 0
mov qword [rsp + 0x50], rsi
je 0x140011f52
cmp edx, dword [r13 + 0x28]
ja 0x140011f5b
mov rdx, qword [r13 + 0x10]
mov qword [rdx + rcx], rax
add dword [r13 + 0x20], 8
cmp qword [r13], 0
je 0x140011048
cmp qword [r13 + 0x10], 0
je 0x1400119d4
cmp qword [r13 + 0x18], 0
je 0x1400119d4
cmp dword [r13 + 8], 0
je 0x1400119d4
cmp byte [r13 + 0x2c], 0
je 0x1400119d4
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x10]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x48
mov qword [rsp + 0x28], r13
jne 0x140011084
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0xb8
je 0x1400123fa
lea rsi, [rdi + 0x10]
mov eax, dword [r13 + 0x20]
mov dword [r13 + 0x24], eax
mov eax, dword [rbx + 0x30]
and eax, 2
mov ecx, eax
shr ecx, 1
mov dword [rsp + 0x4c], ecx
xor ecx, ecx
test eax, eax
sete cl
lea r14d, [rcx + rcx*2]
add r14d, 0xa
mov edx, dword [rsi]
xor eax, eax
cmp edx, r14d
jae 0x1400116e1
mov qword [rsp + 0x40], rax
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x34], r14d
mov rcx, qword [rdi]
test byte [rsp + 0x40], 1
jne 0x140011a0b
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xf
je 0x140011464
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x88
jae 0x140011446
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x40
je 0x140011a66
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x41
je 0x140011a66
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x44
je 0x140011adf
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x45
je 0x140011b5b
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xfa
cmp al, 0x48
jne 0x14001155c
mov rax, qword [r13]
mov r8d, dword [r13 + 0x20]
lea ebp, [r8 + 1]
test rax, rax
je 0x140011c01
cmp ebp, dword [r13 + 0x28]
ja 0x140011a52
cmp qword [rax], 0
je 0x140011a52
add rdx, qword [rcx + 0x40]
add r8, qword [r13 + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 1
call r12
test eax, eax
je 0x140011a52
cmp qword [rsp + 0x60], 1
jne 0x140011a52
inc dword [r13 + 0x20]
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x81
je 0x140011c0a
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
je 0x140011c53
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
je 0x140011c89
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
je 0x140011cd2
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x2b
je 0x140011d1b
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x85
je 0x140011d61
call fcn.1400133c0
mov rbp, qword [rdi]
mov rax, qword [rbp + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xfd
cmp al, 0x89
jne 0x140011d87
lea esi, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
movabs rax, 0x100000001
mov qword [rbx + 8], rax
lea rax, [0x14004e380]
mov qword [rbx], rax
lea r13, [rbx + 0x10]
mov rax, qword [rbp]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0x20
lea rax, [rbx + 0x30]
mov qword [rbx + 0x18], rax
mov rcx, qword [rbp + 0x40]
add rcx, rsi
mov qword [rbx + 0x50], rcx
mov r14, qword [rbp + 0x10]
cmp r14, rsi
jbe 0x140011356
mov r15, qword [rbp + 8]
lea rbp, [r15 + r14]
add r15, rsi
mov r12, rbp
sub r12, r15
cmp r12, 0x21
jae 0x140011dca
xor ecx, ecx
cmp r14, rsi
jle 0x14001134f
add rax, rcx
mov cl, byte [r15]
mov byte [rax], cl
inc r15
inc rax
cmp r15, rbp
jb 0x14001133b
mov rcx, qword [rbx + 0x20]
add rcx, r12
mov qword [rbx + 0x20], rcx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], 0
lea r15, [rsp + 0x60]
mov rcx, r15
lea rdx, [rsp + 0x58]
call fcn.140013720
mov ebp, eax
lock dec dword [rbx + 8]
jne 0x1400113a7
mov rax, qword [rbx]
mov rax, qword [rax]
mov rcx, rbx
call qword [case.0x14001b2ee.0]
lock dec dword [rbx + 0xc]
jne 0x1400113a7
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [case.0x14001b2ee.0]
test ebp, ebp
mov r13, qword [rsp + 0x28]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
js 0x140011dee
lea esi, [rbp + 1]
mov rax, qword [r13]
mov r8d, dword [r13 + 0x20]
lea ecx, [r8 + rbp]
inc ecx
test rax, rax
je 0x140011e60
cmp ecx, dword [r13 + 0x28]
ja 0x140011a5c
cmp qword [rax], 0
je 0x140011a5c
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rcx + 0x40]
mov ebx, esi
add r8, qword [r13 + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9, rbx
call r12
test eax, eax
je 0x140011a5c
cmp qword [rsp + 0x60], rbx
jne 0x140011a5c
add dword [r13 + 0x20], esi
mov rax, qword [rsp + 0x38]
add dword [rax], esi
mov rsi, rax
mov edx, dword [rsi]
cmp edx, r14d
jb 0x1400110d5
jmp 0x1400116e6
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x8b
ja 0x140011115
jmp 0x140011f65
mov rax, qword [r13]
mov r8d, dword [r13 + 0x20]
lea ebp, [r8 + 1]
test rax, rax
je 0x140011f77
cmp ebp, dword [r13 + 0x28]
ja 0x140011ad5
cmp qword [rax], 0
je 0x140011ad5
add rdx, qword [rcx + 0x40]
add r8, qword [r13 + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], r15
mov r9d, 1
call r12
test eax, eax
je 0x140011ad5
cmp qword [rsp + 0x60], 1
jne 0x140011ad5
inc dword [r13 + 0x20]
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x1f
jne 0x14001160e
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xc0
cmp al, 0x40
jne 0x1400119d4
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
mov cl, byte [rcx + rdx]
and cl, 7
cmp cl, 4
jne 0x1400119d4
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 3
call fcn.140013590
add dword [rsi], 3
jmp 0x140011436
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x66
je 0x140011f80
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xf0
cmp al, 0x50
je 0x1400116c8
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x65
je 0x140012051
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x80
je 0x1400120c2
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x90
je 0x1400116c8
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xf8
cmp al, 0xb8
jne 0x14001162c
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 5
call fcn.140013590
add dword [rsi], 5
jmp 0x140011436
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 5
je 0x1400116c8
jmp 0x1400125cb
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x33
je 0x140012640
call fcn.1400133c0
mov rbx, qword [rdi]
mov rax, qword [rbx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xf6
je 0x140012649
mov rcx, rbx
call fcn.1400133c0
mov rbx, qword [rdi]
mov rax, qword [rbx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x85
je 0x140012713
mov rcx, rbx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xd1
je 0x1400127c3
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
je 0x1400127ff
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xc3
jne 0x14001283b
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
inc dword [rsi]
jmp 0x140011436
mov qword [rsp + 0x40], rax
cmp edx, 0x64
ja 0x1400119d4
test byte [rsp + 0x40], 1
jne 0x140011715
mov rax, qword [rdi]
mov edx, edx
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 3
call fcn.1400138b0
test al, al
je 0x1400119d4
cmp byte [r13 + 0x2c], 0
je 0x1400119d4
cmp qword [r13], 0
je 0x1400119d4
mov r15d, dword [r13 + 0x24]
add r15, qword [r13 + 0x18]
je 0x1400119d4
lea rbp, [rsp + 0x60]
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
xor r9d, r9d
call fcn.140013b90
cmp qword [rbp + 0x70], 0
je 0x14001199a
cmp byte [rsp + 0xb8], 0
je 0x14001199a
cmp byte [rsp + 0x4c], 0
jne 0x1400120fe
lea r14, [rsp + 0x80]
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
je 0x140012125
mov rcx, qword [rsp + 0x80]
mov byte [rcx + rax], 0x49
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
inc dword [rsp + 0x78]
cmp rax, qword [rsp + 0x90]
je 0x14001214c
mov rcx, qword [rsp + 0x80]
mov byte [rcx + rax], 0xbb
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
inc dword [rsp + 0x78]
lea rcx, [rax + 8]
cmp rcx, qword [rsp + 0x90]
ja 0x140012173
mov rbp, qword [rsp + 0x170]
mov r8, rbp
shr r8, 8
mov r9, rbp
shr r9, 0x10
mov r10, rbp
shr r10, 0x18
mov rsi, rbp
shr rsi, 0x20
mov rdi, rbp
shr rdi, 0x28
mov rbx, rbp
shr rbx, 0x30
mov rcx, rbp
shr rcx, 0x38
mov rdx, qword [rsp + 0x80]
mov byte [rdx + rax], bpl
mov byte [rdx + rax + 1], r8b
mov byte [rdx + rax + 2], r9b
mov byte [rdx + rax + 3], r10b
mov byte [rdx + rax + 4], sil
mov byte [rdx + rax + 5], dil
mov byte [rdx + rax + 6], bl
mov byte [rdx + rax + 7], cl
mov rax, qword [rsp + 0x88]
add rax, 8
mov qword [rsp + 0x88], rax
add dword [rsp + 0x78], 8
cmp rax, qword [rsp + 0x90]
je 0x14001219a
mov rcx, qword [rsp + 0x80]
mov byte [rcx + rax], 0x41
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
inc dword [rsp + 0x78]
cmp rax, qword [rsp + 0x90]
je 0x1400121c1
mov rcx, qword [rsp + 0x80]
mov byte [rcx + rax], 0xff
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
inc dword [rsp + 0x78]
cmp rax, qword [rsp + 0x90]
je 0x1400121e8
mov rcx, qword [rsp + 0x80]
mov byte [rcx + rax], 0xe3
inc qword [rsp + 0x88]
inc dword [rsp + 0x78]
cmp qword [rsp + 0xd0], 0
je 0x14001199a
cmp byte [rsp + 0xb8], 0
je 0x14001199a
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x14001198f
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001199a
mov edx, dword [rsp + 0x7c]
add rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x80]
lea rbp, [rsp + 0x58]
mov qword [rbp], 0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbp
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001199a
cmp qword [rsp + 0x58], rdi
jne 0x14001199a
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x88]
add dword [rsp + 0x7c], eax
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x178]
mov qword [rax], r15
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.140013620
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0xe0]
cmp rcx, rax
jne 0x14001220f
lea rax, [rsp + 0x98]
mov rcx, qword [rax - 0x18]
cmp rcx, rax
jne 0x14001221a
mov rax, qword [rsp + 0x178]
cmp qword [rax], 0
je 0x140012225
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14001bc70
nop
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x90
je 0x140011a39
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xcc
jne 0x14001294d
inc edx
mov rax, qword [rsp + 0x38]
mov dword [rax], edx
cmp edx, dword [rsp + 0x34]
jb 0x140011a0b
mov r13, qword [rsp + 0x28]
jmp 0x1400116e6
mov byte [r13 + 0x2c], 0
jmp 0x1400111f8
mov byte [r13 + 0x2c], 0
jmp 0x14001142c
add rdx, qword [rcx + 0x40]
mov rcx, qword [rsp + 0x28]
mov r8d, 1
call fcn.140013590
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xf0
cmp al, 0x50
jne 0x140011bab
add rdx, qword [rcx + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, 1
call fcn.140013590
mov rsi, qword [rsp + 0x38]
inc dword [rsi]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140011436
mov byte [r13 + 0x2c], 0
jmp 0x1400114c7
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx], 0x89
jne 0x1400119d4
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
inc dword [rdi + 0x10]
mov rcx, rdi
xor edx, edx
call fcn.140013720
test eax, eax
js 0x1400119d4
mov ebx, eax
mov rax, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, ebx
call fcn.140013590
add dword [rdi + 0x10], ebx
jmp 0x140011436
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx], 0x33
jne 0x1400119d4
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 2
call fcn.140013590
add dword [rsi], 2
jmp 0x140011436
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xb8
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jb 0x1400119d4
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx], 0xbf
ja 0x1400119d4
add rdx, qword [rax + 0x40]
jmp 0x1400115f8
mov dword [r13 + 0x20], ebp
jmp 0x1400111f8
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0xe8
jne 0x140011e69
mov rax, qword [rcx + 0x40]
add rax, rdx
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 6
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 6
jmp 0x140011abf
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0xe8
je 0x140011ca8
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140011235
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0xc0
jne 0x140011e84
mov rax, qword [rcx + 0x40]
add rax, rdx
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 3
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 3
jmp 0x140011abf
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0x60
jne 0x140011e9f
mov rax, qword [rcx + 0x40]
add rax, rdx
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 5
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 5
jmp 0x140011abf
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jb 0x140011eba
mov rax, qword [rcx + 0x40]
add rax, rdx
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 2
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 2
jmp 0x140011abf
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx + 1], 0xc0
lea r15, [rsp + 0x60]
jae 0x140011b91
jmp 0x1400119d4
mov rcx, rbp
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx]
and al, 0xf8
cmp al, 0xb8
jne 0x140011ed5
add rdx, qword [rcx + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, 9
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 9
jmp 0x140011abf
mov rcx, rbx
add rcx, 0x18
mov rdx, r12
call fcn.140010910
test al, al
je 0x140011356
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x20]
jmp 0x140011333
cmp ebp, 0xfffffffe
jne 0x140012709
add dword [rdi + 0x10], 2
mov rcx, rdi
call fcn.140021400
mov bl, byte [rsp + 0x58]
test bl, bl
je 0x1400123a1
mov rcx, qword [rsp + 0x28]
cmp qword [rcx], 0
mov ecx, dword [rcx + 0x20]
je 0x14001292f
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
cmp ecx, edx
jae 0x14001298f
add bl, 0xb8
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov byte [rdx + rcx], bl
mov ecx, dword [rbp + 0x20]
inc ecx
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x140012931
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
jmp 0x140012998
mov dword [r13 + 0x20], ecx
jmp 0x14001142c
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001121c
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001124e
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140011267
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140011280
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xc7
jne 0x14001228f
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx + 1], 0x44
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x1400119d4
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 8
call fcn.140013590
add dword [rsi], 8
jmp 0x140011436
mov dword [r13 + 0x20], edx
jmp 0x140010fd7
mov byte [r13 + 0x2c], 0
jmp 0x140010fab
mov dword [r13 + 0x20], edx
jmp 0x140011048
mov byte [r13 + 0x2c], 0
jmp 0x14001101c
mov rax, qword [rcx + 0x40]
add rax, rdx
mov rcx, r13
mov rdx, rax
jmp 0x140011b1c
mov dword [r13 + 0x20], ebp
jmp 0x1400114c7
add rdx, qword [rcx + 0x40]
mov rcx, r13
mov r8d, 1
call fcn.140013590
mov edx, dword [rdi + 0x10]
inc edx
mov dword [rdi + 0x10], edx
mov rcx, qword [rdi]
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x88
jb 0x14001223a
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x8b
ja 0x14001223a
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
movzx ebx, byte [rcx + rdx + 1]
mov ecx, ebx
and ecx, 0xffffffc0
cmp cl, 0xc0
je 0x140012d4a
cmp cl, 0x40
mov r13, qword [rsp + 0x28]
je 0x140012021
test cl, cl
jne 0x1400119d4
mov ebp, ebx
and ebp, 6
cmp ebp, 4
jne 0x140012d4a
cmp ecx, 0x40
mov r13, qword [rsp + 0x28]
jne 0x1400119d4
and ebx, 7
add rdx, qword [rax + 0x40]
cmp ebx, 4
jne 0x140012dde
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, 4
call fcn.140013590
mov rsi, qword [rsp + 0x38]
add dword [rsi], 4
jmp 0x140011abf
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0x48
jne 0x1400119d4
add edx, 2
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 2], 0x88
jb 0x1400119d4
add edx, 2
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx + 2], 0x8b
ja 0x1400119d4
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, 3
call fcn.140013590
add dword [rdi + 0x10], 3
jmp 0x140011b2a
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0x3d
je 0x140012deb
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x1400115c3
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r9, qword [rsp + 0x170]
call fcn.140021510
test al, al
jne 0x1400118f6
jmp 0x14001199a
mov edx, 1
mov rcx, r14
call fcn.140010910
test al, al
je 0x140013322
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x140011789
mov edx, 1
mov rcx, r14
call fcn.140010910
test al, al
je 0x14001333c
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400117ba
mov edx, 8
mov rcx, r14
call fcn.140010910
test al, al
je 0x140013356
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400117ef
mov edx, 1
mov rcx, r14
call fcn.140010910
test al, al
je 0x140013370
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x14001187c
mov edx, 1
mov rcx, r14
call fcn.140010910
test al, al
je 0x14001338a
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400118ad
mov edx, 1
mov rcx, r14
call fcn.140010910
test al, al
je 0x1400133a4
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400118de
call qword [sym.imp.mozglue.dll_free]
jmp 0x1400119bf
call qword [sym.imp.mozglue.dll_free]
jmp 0x1400119d4
mov dword [r13 + 0x20], 0
mov rcx, r13
call fcn.1400218a0
jmp 0x1400119e6
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x44
jne 0x1400123f0
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx + 1], 0x89
jne 0x1400123f0
add rdx, qword [rax + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, 2
call fcn.140013590
add dword [rdi + 0x10], 2
jmp 0x140012613
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xff
je 0x140012a0b
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x8d
jne 0x140012ae6
inc edx
call fcn.1400133c0
mov r14, qword [rdi]
mov rax, qword [r14 + 8]
mov ebp, dword [rdi + 0x10]
cmp byte [rax + rbp + 1], 0x3f
ja 0x1400122fc
lea edx, [rbp + 1]
mov rcx, r14
call fcn.1400133c0
mov r14, qword [rdi]
mov rax, qword [r14 + 8]
mov ebp, dword [rdi + 0x10]
mov al, byte [rax + rbp + 1]
and al, 7
cmp al, 5
je 0x140013230
inc ebp
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
movabs rax, 0x100000001
mov qword [rbx + 8], rax
lea rax, [0x14004e380]
mov qword [rbx], rax
lea rsi, [rbx + 0x10]
mov rcx, rsi
mov rdx, r14
mov r8d, ebp
call fcn.140021120
lea rcx, [rsp + 0x60]
mov qword [rcx], rsi
mov qword [rcx + 8], rbx
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.140013720
mov ebp, eax
lock dec dword [rbx + 8]
jne 0x14001237d
mov rax, qword [rbx]
mov rax, qword [rax]
mov rcx, rbx
call qword [case.0x14001b2ee.0]
lock dec dword [rbx + 0xc]
jne 0x14001237d
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [case.0x14001b2ee.0]
inc ebp
mov rax, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rax + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, ebp
call fcn.140013590
add dword [rdi + 0x10], ebp
jmp 0x140012943
mov rcx, qword [rsp + 0x28]
cmp qword [rcx], 0
mov ecx, dword [rcx + 0x20]
je 0x140013288
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
cmp ecx, edx
jae 0x140013292
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov byte [rdx + rcx], 0xa1
mov ecx, dword [rbp + 0x20]
inc ecx
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x14001328a
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
jmp 0x14001329b
mov r13, qword [rsp + 0x28]
jmp 0x140012943
add edx, 0xa
call fcn.1400133c0
mov r12, qword [rdi]
mov rax, qword [r12 + 8]
mov ebp, dword [rdi + 0x10]
cmp byte [rax + rbp + 0xa], 0xff
je 0x140012b3b
mov r13, qword [rsp + 0x28]
add ebp, 0xa
mov rcx, r12
mov edx, ebp
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 0xa], 0x50
jne 0x140011084
add edx, 0xb
call fcn.1400133c0
mov r12, qword [rdi]
mov rax, qword [r12 + 8]
mov ebp, dword [rdi + 0x10]
cmp byte [rax + rbp + 0xb], 0xc3
jne 0x140011084
add ebp, 2
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
movabs rax, 0x100000001
mov qword [r13 + 8], rax
lea rax, [0x14004e380]
mov qword [r13], rax
lea rsi, [r13 + 0x10]
mov rcx, rsi
mov rdx, r12
mov r8d, ebp
call fcn.140021120
mov rcx, rsi
mov edx, 8
call fcn.1400133c0
mov rax, qword [r13 + 0x18]
mov r15, qword [rax]
lock dec dword [r13 + 8]
jne 0x1400124dc
mov rax, qword [r13]
mov rax, qword [rax]
mov rcx, r13
call qword [case.0x14001b2ee.0]
lock dec dword [r13 + 0xc]
jne 0x1400124dc
mov rax, qword [r13]
mov rax, qword [rax + 8]
mov rcx, r13
call qword [case.0x14001b2ee.0]
lea rbp, [rsp + 0x60]
mov rcx, rdi
mov rdx, rbp
mov r8d, 8
mov r9b, 2
call fcn.140013b90
xor esi, esi
cmp qword [rbp + 0x70], 0
je 0x140012591
cmp byte [rsp + 0xb8], 0
je 0x140012591
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, qword [rsp + 0x170]
call fcn.140021260
mov rcx, rbp
call fcn.140021310
test al, al
je 0x14001258f
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx + 0x20]
lea ecx, [rax + 8]
cmp qword [rdx], 0
je 0x1400130d3
mov rdx, qword [rsp + 0x28]
cmp ecx, dword [rdx + 0x28]
jbe 0x1400130ee
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x10], 0
je 0x14001258f
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x18], 0
je 0x14001258f
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
je 0x14001258f
mov rax, qword [rsp + 0x28]
cmp byte [rax + 0x2c], 0
jne 0x1400130db
xor esi, esi
lea rbp, [rsp + 0xc0]
mov rcx, rbp
call fcn.1400213d0
mov rcx, qword [rbp - 0x40]
lea rax, [rsp + 0x98]
cmp rcx, rax
je 0x1400125b8
call qword [sym.imp.mozglue.dll_free]
test sil, sil
mov r13, qword [rsp + 0x28]
je 0x140011084
jmp 0x1400119d4
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x10
je 0x1400125f9
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x11
jne 0x140012cb7
add rdx, qword [rcx + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, 1
call fcn.140013590
inc dword [rdi + 0x10]
mov rcx, rdi
xor edx, edx
call fcn.140013720
test eax, eax
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jns 0x140011b3c
jmp 0x1400119d4
add rdx, qword [rcx + 0x40]
jmp 0x140011b95
lea r14, [rsp + 0x58]
mov byte [r14], 0
lea r15d, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbp, rax
movabs rax, 0x100000001
mov qword [rbp + 8], rax
lea rax, [0x14004e380]
mov qword [rbp], rax
lea rsi, [rbp + 0x10]
mov rcx, rsi
mov rdx, rbx
mov r8d, r15d
call fcn.140021120
lea rcx, [rsp + 0x60]
mov qword [rcx], rsi
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], 0
mov rdx, r14
call fcn.140013720
mov ebx, eax
lock dec dword [rbp + 8]
jne 0x1400126d9
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
lock dec dword [rbp + 0xc]
jne 0x1400126d9
mov rax, qword [rbp]
mov rax, qword [rax + 8]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
test ebx, ebx
js 0x140012709
cmp byte [rsp + 0x58], 0
jne 0x140012709
add ebx, 2
mov rax, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rax + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, ebx
call fcn.140013590
add dword [rdi + 0x10], ebx
jmp 0x140012943
mov r13, qword [rsp + 0x28]
jmp 0x1400119d4
lea r14d, [rdx + 1]
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbp, rax
movabs rax, 0x100000001
mov qword [rbp + 8], rax
lea rax, [0x14004e380]
mov qword [rbp], rax
lea rsi, [rbp + 0x10]
mov rcx, rsi
mov rdx, rbx
mov r8d, r14d
call fcn.140021120
lea rcx, [rsp + 0x60]
mov qword [rcx], rsi
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.140013720
mov ebx, eax
lock dec dword [rbp + 8]
jne 0x140012799
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
lock dec dword [rbp + 0xc]
jne 0x140012799
mov rax, qword [rbp]
mov rax, qword [rax + 8]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
test ebx, ebx
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
js 0x1400119d4
inc ebx
jmp 0x140011b3e
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jae 0x140011d37
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140011696
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0xc0
jae 0x140011ca8
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x1400116af
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xcc
je 0x140011aa1
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xe8
je 0x140012fae
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xe9
je 0x140012fae
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x73
jb 0x140012b9d
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x75
ja 0x140012b9d
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
movzx eax, byte [rax + rdx]
lea rbp, [0x14004e3a0]
mov ebx, dword [rbp + rax*4 - 0x1cc]
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
movzx ecx, byte [rcx + rdx + 1]
add edx, 2
mov dword [rdi + 0x10], edx
add rdx, rcx
add rdx, qword [rax + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov r8d, ebx
call fcn.1400138b0
test al, al
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x140011436
jmp 0x1400119d4
inc ecx
add ecx, 8
inc ecx
inc ecx
inc ecx
mov r13, qword [rsp + 0x28]
mov dword [r13 + 0x20], ecx
mov rsi, qword [rsp + 0x38]
jmp 0x140011abf
cmp qword [rsp + 0x50], 0
mov r13, qword [rsp + 0x28]
je 0x1400119d4
cmp edx, 0xa
jb 0x1400119d4
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov ecx, dword [rax + 0x20]
add rcx, qword [rax + 0x18]
mov al, 1
mov dword [rsp + 0x4c], eax
mov eax, 0x80000001
cmp rcx, rax
jb 0x1400116e6
jmp 0x1400119d4
mov rbp, qword [rsp + 0x28]
mov byte [rbp + 0x2c], 0
lea ebp, [rcx + 8]
cmp ebp, edx
jbe 0x1400129de
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
cmp ecx, edx
jae 0x140012a9a
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x48
mov ecx, dword [rdx + 0x20]
inc ecx
mov dword [rdx + 0x20], ecx
cmp qword [rdx], 0
je 0x140012936
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x28]
jmp 0x140012aa3
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
mov ecx, dword [rbp + 0x20]
add ecx, 8
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x140012934
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x28]
jmp 0x1400129a8
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx + 1], 0x3f
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
ja 0x1400119d4
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0x10]
mov cl, byte [rcx + rax + 1]
and cl, 7
cmp cl, 5
jne 0x1400119d4
add eax, 2
mov dword [rdi + 0x10], eax
dec dword [r13 + 0x20]
mov rcx, rdi
call fcn.140021440
mov rcx, r13
mov rdx, rax
mov r8d, 3
call fcn.1400138b0
mov cl, 1
mov qword [rsp + 0x40], rcx
test al, al
jne 0x140011436
jmp 0x1400119d4
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
cmp ecx, edx
jae 0x140012b66
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x8b
mov ecx, dword [rdx + 0x20]
inc ecx
mov dword [rdx + 0x20], ecx
cmp qword [rdx], 0
je 0x140012938
mov dl, byte [rsp + 0x58]
lea eax, [rdx*8]
or al, dl
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
jmp 0x140012b7e
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x63
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x1400119d4
inc edx
call fcn.1400133c0
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rcx + rdx + 1], 0xc0
jae 0x140011b91
jmp 0x1400119d4
lea edx, [rbp + 0xb]
mov rcx, r12
call fcn.1400133c0
mov r12, qword [rdi]
mov rax, qword [r12 + 8]
mov ebp, dword [rdi + 0x10]
cmp byte [rax + rbp + 0xb], 0xe0
mov r13, qword [rsp + 0x28]
jne 0x14001241d
jmp 0x14001245d
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
mov bpl, byte [rsp + 0x58]
lea eax, [rbp*8]
or al, bpl
cmp ecx, edx
jae 0x1400132a2
mov r13, qword [rsp + 0x28]
mov rdx, qword [r13 + 0x10]
mov ecx, ecx
mov byte [rdx + rcx], al
inc dword [r13 + 0x20]
jmp 0x140012943
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0xff
je 0x140012d5b
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
jne 0x140012bea
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov al, byte [rax + rdx + 1]
and al, 0xf8
cmp al, 0x60
je 0x140011cf1
call fcn.1400133c0
mov rsi, qword [rdi]
mov rax, qword [rsi + 8]
mov ebx, dword [rdi + 0x10]
cmp byte [rax + rbx], 0xc6
mov r13, qword [rsp + 0x28]
jne 0x1400119d4
inc ebx
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbp, rax
movabs rax, 0x100000001
mov qword [rbp + 8], rax
lea rax, [0x14004e380]
mov qword [rbp], rax
lea r14, [rbp + 0x10]
mov rcx, r14
mov rdx, rsi
mov r8d, ebx
call fcn.140021120
lea rcx, [rsp + 0x60]
mov qword [rcx], r14
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.140013720
mov ebx, eax
lock dec dword [rbp + 8]
jne 0x140012c8c
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
lock dec dword [rbp + 0xc]
jne 0x140012c8c
mov rax, qword [rbp]
mov rax, qword [rax + 8]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
test ebx, ebx
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
js 0x1400119d4
add ebx, 2
jmp 0x140011b3e
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x83
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jb 0x1400119d4
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
cmp byte [rax + rdx], 0x85
ja 0x1400119d4
call fcn.1400133c0
mov rax, qword [rdi]
mov rax, qword [rax + 8]
mov ecx, dword [rdi + 0x10]
movzx eax, byte [rax + rcx]
lea rdx, [0x14004e3a0]
mov ebx, dword [rdx + rax*4 - 0x20c]
lea eax, [rcx + 1]
mov dword [rdi + 0x10], eax
dec dword [r13 + 0x20]
mov rcx, rdi
call fcn.140021400
mov rcx, r13
mov rdx, rax
mov r8d, ebx
call fcn.1400138b0
jmp 0x140012a8d
add rdx, qword [rax + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
jmp 0x140011d49
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov sil, byte [rax + rdx + 1]
inc edx
call fcn.1400133c0
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov edx, dword [rdi + 0x10]
mov bl, byte [rax + rdx + 1]
shr bl, 3
and bl, 7
inc edx
call fcn.1400133c0
mov r15, qword [rdi]
mov rax, qword [r15 + 8]
mov r14d, dword [rdi + 0x10]
mov dl, byte [rax + r14 + 1]
and dl, 7
cmp sil, 0xc0
jb 0x140012e6a
cmp bl, 6
ja 0x140013223
movzx eax, bl
mov ecx, 0x47
bt ecx, eax
jae 0x140013223
add r14, qword [r15 + 0x40]
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, r14
jmp 0x140011d49
mov r13, qword [rsp + 0x28]
mov rcx, r13
jmp 0x140011cba
lea eax, [rdx + 2]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
mov eax, dword [rax + 0x20]
jne 0x140012f72
inc eax
inc eax
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0x20], eax
mov rcx, rdi
call fcn.140021400
mov rcx, qword [rsp + 0x28]
cmp qword [rcx], 0
mov ecx, dword [rcx + 0x20]
je 0x140012ff0
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
cmp ecx, edx
jae 0x140013071
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov byte [rdx + rcx], 0x49
mov ecx, dword [rbp + 0x20]
inc ecx
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x140012ff2
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
jmp 0x14001307a
cmp sil, 0x40
setb al
cmp dl, 5
sete cl
cmp sil, 0x3f
ja 0x140012e8b
cmp bl, 2
jne 0x140012e8b
cmp dl, 5
je 0x1400132fc
cmp bl, 4
mov r13, qword [rsp + 0x28]
jne 0x1400119d4
and cl, al
cmp cl, 1
je 0x1400132ca
inc r14d
mov ecx, 0x58
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbp, rax
movabs rax, 0x100000001
mov qword [rbp + 8], rax
lea rax, [0x14004e380]
mov qword [rbp], rax
lea rbx, [rbp + 0x10]
mov rcx, rbx
mov rdx, r15
mov r8d, r14d
call fcn.140021120
lea rcx, [rsp + 0x60]
mov qword [rcx], rbx
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], 0
xor edx, edx
call fcn.140013720
mov ebx, eax
lock dec dword [rbp + 8]
jne 0x140012f29
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
lock dec dword [rbp + 0xc]
jne 0x140012f29
mov rax, qword [rbp]
mov rax, qword [rax + 8]
mov rcx, rbp
call qword [case.0x14001b2ee.0]
test ebx, ebx
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea r15, [rsp + 0x60]
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
js 0x1400119d4
inc ebx
mov rax, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rax + 0x40]
mov rcx, r13
mov r8d, ebx
call fcn.140013590
add dword [rdi + 0x10], ebx
mov al, 1
mov qword [rsp + 0x40], rax
jmp 0x140011436
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x28]
cmp eax, ecx
jae 0x140013157
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x10]
mov byte [rcx + rax], 0x49
mov eax, dword [rdx + 0x20]
inc eax
mov dword [rdx + 0x20], eax
cmp qword [rdx], 0
je 0x140012e09
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x28]
jmp 0x140013160
call fcn.1400133c0
mov rax, qword [rdi]
mov rax, qword [rax + 8]
mov ecx, dword [rdi + 0x10]
xor edx, edx
cmp byte [rax + rcx], 0xe9
sete dl
lea eax, [rcx + 1]
mov dword [rdi + 0x10], eax
mov ebx, 4
mov qword [rsp + 0x40], rdx
sub ebx, edx
mov rcx, rdi
call fcn.140021400
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
jmp 0x140012904
inc ecx
inc ecx
add ecx, 8
inc ecx
inc ecx
inc ecx
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x20], ecx
mov rax, qword [rdi]
mov edx, dword [rdi + 0x10]
add rdx, qword [rax + 0x40]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
mov r8d, 1
call fcn.140013590
inc dword [rdi + 0x10]
cmp qword [rsi], 0
mov eax, dword [rsi + 0x20]
je 0x14001305f
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x28]
cmp eax, ecx
jae 0x1400130ae
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x10]
mov byte [rcx + rax], 0x49
mov eax, dword [rdx + 0x20]
inc eax
mov dword [rdx + 0x20], eax
cmp qword [rdx], 0
je 0x140013061
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x28]
jmp 0x1400130b7
inc eax
inc eax
mov r13, qword [rsp + 0x28]
mov dword [r13 + 0x20], eax
jmp 0x140012943
mov rbp, qword [rsp + 0x28]
mov byte [rbp + 0x2c], 0
cmp ecx, edx
jae 0x14001310b
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov ecx, ecx
mov byte [rdx + rcx], 0xbb
mov ecx, dword [rbp + 0x20]
inc ecx
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x140012ff4
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
jmp 0x140013114
mov rdx, qword [rsp + 0x28]
mov byte [rdx + 0x2c], 0
cmp eax, ecx
jae 0x1400132a2
mov r13, qword [rsp + 0x28]
mov rcx, qword [r13 + 0x10]
mov eax, eax
mov byte [rcx + rax], 0x5b
jmp 0x140012b94
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x20], ecx
mov rax, qword [rsp + 0x178]
mov qword [rax], r15
mov sil, 1
jmp 0x140012591
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x10]
mov qword [rcx + rax], r15
add dword [rdx + 0x20], 8
cmp qword [rdx], 0
jne 0x14001255d
jmp 0x1400130db
mov rbp, qword [rsp + 0x28]
mov byte [rbp + 0x2c], 0
lea ebp, [rcx + 8]
cmp ebp, edx
jbe 0x14001317b
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
cmp ecx, edx
jae 0x1400131b9
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x41
mov ecx, dword [rdx + 0x20]
inc ecx
mov dword [rdx + 0x20], ecx
cmp qword [rdx], 0
je 0x140012ff9
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x28]
jmp 0x1400131c2
mov rdx, qword [rsp + 0x28]
mov byte [rdx + 0x2c], 0
cmp eax, ecx
jae 0x1400131ab
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x10]
mov eax, eax
mov byte [rcx + rax], 0x53
inc dword [rdx + 0x20]
jmp 0x140012e13
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
mov ecx, dword [rbp + 0x20]
add ecx, 8
mov dword [rbp + 0x20], ecx
cmp qword [rbp], 0
je 0x140012ff7
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x28]
jmp 0x140013124
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
jmp 0x140012e13
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
cmp ecx, edx
jae 0x1400131f1
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x80
mov ecx, dword [rdx + 0x20]
inc ecx
mov dword [rdx + 0x20], ecx
cmp qword [rdx], 0
je 0x140012ffb
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x28]
jmp 0x1400131fa
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
cmp ecx, edx
jae 0x140013215
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x10]
mov ecx, ecx
mov byte [rax + rcx], 0x3b
inc dword [rdx + 0x20]
jmp 0x140013005
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x2c], 0
jmp 0x140013005
cmp dl, 5
sete cl
xor eax, eax
jmp 0x140012e8b
lea edx, [rbp + 1]
mov rcx, r14
call fcn.1400133c0
mov rax, qword [rdi]
mov rax, qword [rax + 8]
mov ecx, dword [rdi + 0x10]
mov bl, byte [rax + rcx + 1]
lea eax, [rcx + 2]
mov dword [rdi + 0x10], eax
mov rcx, rdi
call fcn.140021400
mov rcx, qword [rsp + 0x28]
cmp qword [rcx], 0
mov ecx, dword [rcx + 0x20]
je 0x140013288
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0x28]
cmp ecx, edx
jae 0x140013292
shr bl, 3
or bl, 0xb8
mov rbp, qword [rsp + 0x28]
mov rdx, qword [rbp + 0x10]
mov byte [rdx + rcx], bl
jmp 0x1400123d0
inc ecx
add ecx, 8
jmp 0x14001293a
mov rbp, qword [rsp + 0x28]
mov byte [rbp + 0x2c], 0
lea ebp, [rcx + 8]
cmp ebp, edx
jbe 0x1400132b1
mov r13, qword [rsp + 0x28]
mov byte [r13 + 0x2c], 0
jmp 0x140012943
mov r13, qword [rsp + 0x28]
mov rdx, qword [r13 + 0x10]
mov ecx, ecx
mov qword [rdx + rcx], rax
add dword [r13 + 0x20], 8
jmp 0x140012943
add r14d, 2
mov dword [rdi + 0x10], r14d
mov rcx, rdi
call fcn.140021440
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 3
call fcn.1400138b0
mov cl, 1
mov qword [rsp + 0x40], rcx
jmp 0x14001290c
add r14d, 2
mov dword [rdi + 0x10], r14d
mov rcx, rdi
call fcn.140021440
mov r13, qword [rsp + 0x28]
mov rcx, r13
mov rdx, rax
mov r8d, 4
jmp 0x140012907
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400117ac
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400117dd
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x14001186e
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x14001189f
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x28]
jmp 0x1400118d0
mov byte [rsp + 0xb8], 0
mov r13, qword [rsp + 0x28]
jmp 0x1400118f6