Function at 0x1400096f0
Capabilities:
Check for time delay via queryperformancecounter
Parse pe header
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r12d, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r15, qword [0x1400f6380]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebp, 1
cmp qword [rdx + 0x20], 0
je 0x14000978f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x140009771
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140009771
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140009771
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x140009771
cmp dword [rax + rcx + 0x50], 0x147
ja 0x14000987b
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x800700c100000021
mov qword [rsi + 8], rax
jmp 0x140009804
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140009832
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x79
mov byte [rsi + 0x10], 1
lea rdx, str._var_tmp_build_firefox_cc4c8eaff833_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rax, qword [rsp + 0xa0]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140009b03
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140009849
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], rbp
mov eax, dword [rsp + 0x70]
cmp eax, 1
je 0x140009865
cmp eax, 2
jne 0x14000986c
mov ebp, 1
jmp 0x140009730
xor ebp, ebp
jmp 0x140009730
mov ecx, 0x80070507
mov eax, 0x88
jmp 0x1400097f0
mov r13d, dword [rax + rcx + 8]
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.140009b20
cmp byte [rsp + 0x98], 0
je 0x1400098a4
movups xmm0, xmmword [rsp + 0x88]
jmp 0x1400098d8
cmp byte [rsp + 0x8c], 0
je 0x1400098bc
cmp dword [rsp + 0x88], r13d
je 0x14000998d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.140009c60
cmp byte [rsp + 0x80], 0
je 0x1400098e4
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 1
jmp 0x140009804
movzx ecx, byte [rdi + 0x40]
mov eax, ecx
and al, 1
jne 0x1400098f3
shr rcx, 1
jmp 0x1400098f7
mov rcx, qword [rdi + 0x48]
lea r14, [rdi + 0x40]
test rcx, rcx
jne 0x140009926
lea rdx, [rdi + 0x28]
mov rcx, r14
call fcn.14007bb60
lea rdx, str.Image
mov r8d, 6
mov rcx, r14
call fcn.14007a800
mov al, byte [rdi + 0x40]
and al, 1
mov dword [rsp + 0x58], r13d
mov rcx, qword [rdi + 0x20]
test al, al
je 0x140009939
mov r14, qword [rdi + 0x50]
jmp 0x14000993d
add r14, 2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, r14
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000998d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
jmp 0x140009801
cmp ebx, 1
jne 0x1400099c2
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 1
jmp 0x140009804
cmp ebp, 1
je 0x1400099fa
test ebp, ebp
jne 0x140009a33
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov byte [rdi + 8], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], 0
jmp 0x140009804
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.140009ef0
cmp byte [rsp + 0x80], 0
jne 0x1400098d3
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.14000a030
cmp byte [rsp + 0x68], 0
je 0x140009a54
movups xmm0, xmmword [rsp + 0x58]
jmp 0x1400098d8
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x80070507000000ed
mov qword [rsi + 8], rax
jmp 0x140009804
mov cl, byte [rsp + 0x78]
test cl, cl
setne dl
mov r8b, byte [rsp + 0x60]
test r8b, r8b
setne al
xor al, dl
mov ebp, 1
jne 0x140009a96
mov ebp, ebx
test ebx, ebx
jne 0x140009a96
mov ebp, ebx
test cl, cl
je 0x140009a96
test r8b, r8b
je 0x140009b08
mov rax, qword [rsp + 0x70]
xor ebp, ebp
cmp rax, qword [rsp + 0x58]
setae bpl
cmp r12d, 1
cmove ebp, ebx
test ebp, ebp
je 0x140009ab4
cmp ebp, 1
jne 0x140009ae2
mov qword [rdi + 0x10], 0
add rdi, 0x18
jmp 0x140009ad4
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
add rdi, 8
mov byte [rdi], 1
mov byte [rsi + 0x10], 0
mov dword [rsi], ebp
jmp 0x140009804
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007050700000131
mov qword [rsi + 8], rax
jmp 0x140009804
call fcn.140072349
mov dword [0], 0x2ea
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3