Function at 0x140005d50
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create thread
Get common file path
Get file attributes
Move file
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf08
movaps xmmword [rsp + 0xef0], xmm6
mov r13, rdx
mov r12d, ecx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0xee8], rax
lea rcx, [0x14003e33a]
call fcn.140021a44
test rax, rax
je 0x140005d9c
cmp byte [rax], 0
setne al
jmp 0x140005d9e
xor eax, eax
mov byte [0x140049a68], al
lea rcx, str.MOZ_USING_SERVICE
call fcn.14001e974
cmp r12d, 3
jg 0x140005ddf
mov ecx, 2
call fcn.1400163f8
lea rcx, str.Usage:_updater_patch_dir_install_dir_apply_to_dir__wait_pid__callback_working_dir_callback_path_args...___n
mov edx, 0x6a
mov r8d, 1
mov r9, rax
call fcn.14002176c
jmp 0x140006336
lea r15, [r13 + 8]
mov rdx, qword [r13 + 8]
lea rsi, [0x140049230]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400138f0
mov word [0x140049436], 0
lea rdi, [rsp + 0xce0]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.140015c00
lea r8, str._supdate_elevated.lock
mov edx, 0x104
mov rcx, rdi
mov r9, rsi
call fcn.140004870
mov al, 1
cmp byte [0x140049a68], 0
jne 0x140005e5f
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x140005e5d
call fcn.14001b454
cmp dword [rax], 2
setne al
jmp 0x140005e5f
xor eax, eax
mov byte [0x140049c78], al
mov rcx, qword [r15]
call fcn.140011be0
test al, al
je 0x140005f44
mov rcx, qword [r13 + 0x10]
call fcn.140011be0
test al, al
je 0x140005f5d
mov rdx, qword [r13 + 0x10]
lea rsi, [0x140049a70]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400138f0
mov word [0x140049c76], 0
mov rcx, rsi
mov dx, 0x5c
call fcn.140015f68
test rax, rax
je 0x140005ec5
cmp word [rax + 2], 0
jne 0x140005ec5
mov word [rax], 0
lea r8, str._s_update.status
lea r9, [0x140049230]
lea rsi, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call fcn.140004870
lea rdx, [0x14003f9d6]
mov rcx, rsi
call fcn.14001fa44
test rax, rax
je 0x140005fa1
mov rbp, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0xad0]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.1400214a8
mov rdi, rax
mov rcx, rbp
call fcn.140020ffc
test eax, eax
je 0x140005fae
mov dword [rsp + 0x48], 0
jmp 0x1400060a8
mov rsi, qword [r15]
mov ecx, 2
call fcn.1400163f8
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application___S__n
jmp 0x14000632b
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4b
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov rsi, qword [r13 + 0x10]
mov ecx, 2
call fcn.1400163f8
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application___S__n
jmp 0x14000632b
mov dword [rsp + 0x48], 0
jmp 0x1400060b0
mov byte [rsp + rdi + 0xad0], 0
lea r14, [rsp + 0xad0]
mov rcx, r14
mov edx, 0x3a
call fcn.140015d90
mov rdi, rax
test rax, rax
jne 0x140006000
lea rcx, [rsp + 0xad0]
mov edx, 0xa
call fcn.140015d90
test rax, rax
jne 0x140006000
lea rcx, [rsp + 0xad0]
call fcn.140022150
add rax, rsp
add rax, 0xad0
sub rax, r14
cmp rax, 0xf
jne 0x140006032
movabs rax, 0x2d676e69646e6570
xor rax, qword [rsp + 0xad0]
movabs rcx, 0x656369767265732d
xor rcx, qword [rsp + 0xad7]
or rcx, rax
je 0x1400060a2
test rdi, rdi
jne 0x140006069
lea rcx, [rsp + 0xad0]
mov edx, 0xa
call fcn.140015d90
mov rdi, rax
test rax, rax
jne 0x140006069
lea rcx, [rsp + 0xad0]
call fcn.140022150
lea rdi, [rsp + rax]
add rdi, 0xad0
sub rdi, r14
cmp rdi, 0xf
jne 0x140005f37
movabs rax, 0x2d6465696c707061
xor rax, qword [rsp + 0xad0]
movabs rcx, 0x656369767265732d
xor rcx, qword [rsp + 0xad7]
or rcx, rax
sete al
jmp 0x1400060a4
mov al, 1
mov dword [rsp + 0x48], eax
mov rcx, rbp
call fcn.140020ee8
xor edi, edi
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebp, 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareClassesApplications
mov rbx, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbx
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
lea rdx, str.SoftwareClassesApplicationsupdater.exe
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400061af
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.IsHostApp
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoOpenWith
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoStartPage
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12d, 5
jb 0x1400061e5
mov rcx, qword [r13 + 0x20]
call fcn.14001fd08
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400061ea
mov rcx, qword [r13 + 0x20]
lea rdx, str._replace
call fcn.14001601c
test rax, rax
je 0x1400061f4
lea rax, [0x140049c79]
jmp 0x1400061f1
xor r14d, r14d
jmp 0x1400061f4
lea rax, [0x140049438]
mov byte [rax], 1
mov rcx, qword [r13 + 0x18]
call fcn.140011be0
test al, al
je 0x1400062ec
mov rdx, qword [r13 + 0x18]
lea rsi, [0x140049440]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400138f0
mov word [0x140049646], 0
mov rcx, rsi
mov dx, 0x5c
call fcn.140015f68
test rax, rax
je 0x140006244
cmp word [rax + 2], 0
jne 0x140006244
mov word [rax], 0
cmp r12d, 7
jb 0x140006422
mov rcx, qword [r13 + 0x30]
call fcn.140011be0
test al, al
je 0x140006369
lea rsi, [0x140049a70]
mov rcx, rsi
call fcn.140013730
mov rdi, rax
lea rbp, [rsp + 0x270]
mov r8d, 0x208
mov rcx, rbp
xor edx, edx
call fcn.140015c00
mov rdx, qword [r13 + 0x30]
mov rcx, rbp
mov r8, rdi
call fcn.1400138f0
mov rcx, rsi
mov rdx, rbp
call fcn.140022964
test eax, eax
je 0x1400063aa
lea r8, str.failed:__d_n
lea rsi, [rsp + 0xad0]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4e
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov rsi, qword [r13 + 0x30]
mov ecx, 2
call fcn.1400163f8
lea rdx, str.The_callback_file_must_be_located_in_the_installation_directory___S__n
jmp 0x14000632b
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4c
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov rsi, qword [r13 + 0x18]
mov ecx, 2
call fcn.1400163f8
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application___S__n
mov rcx, rax
mov r8, rsi
call fcn.140001260
mov esi, 1
mov rcx, qword [rsp + 0xee8]
xor rcx, rsp
call fcn.1400246e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xef0]
add rsp, 0xf08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4d
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov rsi, qword [r13 + 0x30]
mov ecx, 2
call fcn.1400163f8
lea rdx, str.The_callback_file_path_is_not_valid_for_this_application___S__n
jmp 0x14000632b
cmp r12d, 8
jb 0x1400063fd
lea edi, [r12 - 6]
dec rdi
xor ebp, ebp
lea rsi, str.backgroundtask
mov rcx, qword [r13 + rbp*8 + 0x38]
test rcx, rcx
je 0x1400063f5
movzx eax, word [rcx]
cmp eax, 0x2f
je 0x1400063df
cmp eax, 0x2d
jne 0x1400063f5
cmp word [rcx + 2], 0x2d
je 0x1400063e5
add rcx, 2
jmp 0x1400063e9
add rcx, 4
mov rdx, rsi
call fcn.140022964
test eax, eax
je 0x14000641a
inc rbp
cmp rdi, rbp
jne 0x1400063c1
lea rcx, str.MOZ_APP_SILENT_START
call fcn.140021a44
test rax, rax
je 0x140006416
cmp byte [rax], 0
setne al
jmp 0x14000641c
xor eax, eax
jmp 0x14000641c
mov al, 1
mov byte [0x140049c7a], al
lea rcx, [rsp + 0xad0]
mov r8d, 0x20a
xor edx, edx
call fcn.140015c00
cmp byte [0x140049c78], 0
je 0x140006468
lea rsi, [0x140049230]
mov rcx, rsi
call fcn.1400122b0
lea rdx, [0x14003f750]
lea r8, [rsp + 0xad0]
mov rcx, rsi
call fcn.140012110
jmp 0x140006488
lea r8, str._supdate.log
lea r9, [0x140049230]
lea rcx, [rsp + 0xad0]
mov edx, 0x105
call fcn.140004870
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007e89
lea rcx, [0x140049e88]
lea rdx, [rsp + 0xad0]
call fcn.140011640
lea rcx, str.applying
call fcn.1400085a0
test al, al
je 0x140006508
cmp byte [0x140049438], 1
jne 0x14000654a
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007fce
lea rsi, str.Performing_a_staged_update
jmp 0x14000657f
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007eca
lea rcx, [0x140049e88]
lea rdx, str.failed_setting_status_to_applying
call fcn.1400116a0
call fcn.1400086b0
jmp 0x140006336
cmp byte [0x140049c79], 1
jne 0x14000658e
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007fe3
lea rsi, str.Performing_a_replace_request
lea rcx, [0x140049e88]
mov rdx, rsi
call fcn.1400116a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f0b
lea rcx, [0x140049e88]
lea rdx, str.PATCH_DIRECTORY__S
lea r8, [0x140049230]
call fcn.1400116a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f4c
lea rcx, [0x140049e88]
lea rdx, str.INSTALLATION_DIRECTORY__S
lea r8, [0x140049a70]
call fcn.1400116a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f8d
lea rcx, [0x140049e88]
lea rdx, str.WORKING_DIRECTORY__S
lea rsi, [0x140049440]
mov r8, rsi
call fcn.1400116a0
lea rbx, [0x140049a70]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.14001f870
test eax, eax
je 0x140006738
cmp byte [0x140049438], 0
jne 0x140006684
cmp byte [0x140049c79], 0
je 0x140006a14
lea r8, [0x14003f262]
lea r9, [0x140049440]
lea rsi, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call fcn.140004870
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1400069a4
lea rdx, [0x140049a70]
lea rcx, [rsp + 0x270]
mov r8d, 0x104
call fcn.14001f870
test eax, eax
je 0x140006738
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x8c0]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x48
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000802b
lea rcx, [0x140049e88]
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
jmp 0x14000653b
test r14, r14
jle 0x1400067aa
mov ecx, 0x100000
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400067aa
mov rsi, rax
mov rcx, rax
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400067aa
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000812f
lea rcx, [0x140049e88]
lea rdx, str.The_parent_process_didnt_exit__Continuing_with_update.
call fcn.1400116a0
cmp byte [0x140049c79], 0
jne 0x1400067bc
cmp byte [0x140049438], 1
jne 0x1400067f3
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
mov rcx, rsi
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400067f3
lea rcx, [rsp + 0x270]
call fcn.14001f1e4
mov r14, 0xffffffffffffffff
cmp byte [0x140049a68], 0
je 0x14000696f
cmp byte [0x140049438], 1
jne 0x14000681e
lea rcx, [0x140049440]
xor edx, edx
call fcn.1400088a0
cmp byte [0x140049c79], 0
jne 0x140006845
lea rcx, [0x140049440]
call fcn.14001fb70
test eax, eax
je 0x140006845
call fcn.14001b454
cmp dword [rax], 0x11
jne 0x140006540
lea rcx, [0x140049440]
lea rdx, [rsp + 0x8c0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x140006a76
mov rbp, 0xffffffffffffffff
cmp r12d, 7
jb 0x140006b83
lea rcx, [rsp + 0x680]
mov ebp, 0x208
mov r8d, 0x208
xor edx, edx
call fcn.140015c00
lea r15, [r13 + 0x30]
mov rsi, qword [r13 + 0x30]
lea rdi, [rsp + 0x270]
mov r8d, 0x410
mov rcx, rdi
xor edx, edx
call fcn.140015c00
cmp byte [0x140049c79], 1
jne 0x140006b4d
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
movsxd rsi, eax
mov rdx, qword [r15]
mov rcx, rdi
mov r8, rsi
call fcn.1400138f0
lea rdi, [rsp + rsi*2]
add rdi, 0x270
sub rbp, rsi
mov rax, rbx
mov rbx, r14
lea r14, [rax + rsi*2]
mov rcx, rdi
mov rdx, r14
mov r8, rbp
call fcn.1400138f0
mov rcx, r14
mov r14, rbx
call fcn.140013730
lea rdi, [rdi + rax*2]
add rdi, 2
mov dword [rdi - 2], 0x5c
not rax
add rbp, rax
lea rbx, [rsp + 0x60]
mov rcx, rbx
lea rdx, [0x140049a70]
call fcn.140013680
mov rcx, qword [r15]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
cmp eax, esi
cmova esi, eax
movsxd rdx, esi
add rdx, rdx
add rdx, qword [r15]
mov rcx, rdi
lea rdi, [rsp + 0x270]
mov r8, rbp
call fcn.1400138f0
jmp 0x140006b50
mov al, byte [0x140049438]
cmp r12d, 6
jbe 0x140006b25
test al, 1
jne 0x140006b2d
cmp byte [0x140049c79], 1
je 0x140006de9
mov r9, qword [r13 + 0x30]
lea r8, str._s.update_in_progress.lock
jmp 0x140006b3b
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x8c0]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x47
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000806c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140049e88]
lea rdx, str.Error_calling_PathRemoveFileSpecW:__lu
mov r8d, eax
call fcn.1400116a0
jmp 0x140006540
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4a
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400080ad
lea rcx, [0x140049e88]
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
jmp 0x14000653b
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x41
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400080ee
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_unable_to_find_apply_to_dir:__S
lea r8, [0x140049440]
call fcn.1400116a0
call fcn.1400086b0
cmp r14, 0xffffffffffffffff
je 0x140006af3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x140006dad
call fcn.14001b454
cmp r12d, 7
jb 0x140006336
cmp dword [rax], 2
je 0x140006db7
jmp 0x140006336
test al, 1
je 0x140006dd5
lea r8, str._s_updated.update_in_progress.lock
lea r9, [0x140049a70]
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
jmp 0x140006e28
mov rdi, rsi
lea rdx, [rsp + 0x680]
mov rcx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400070c6
mov rbp, 0xffffffffffffffff
cmp byte [0x140049c79], 0
je 0x140007175
cmp byte [0x140049438], 0
jne 0x140006bdd
cmp byte [0x140049c79], 0
jne 0x140006bdd
lea rax, str.tobedeleted
mov qword [rsp + 0x20], rax
lea rsi, [0x140049c80]
lea r8, str._s__s
lea r9, [0x140049440]
mov edx, 0x104
mov rcx, rsi
call fcn.140004870
mov rcx, rsi
xor edx, edx
call fcn.14001f124
test eax, eax
je 0x140006bdd
lea rcx, [0x140049c80]
call fcn.14001fb70
lea rax, [0x140008b20]
lea rsi, [rsp + 0x270]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
lea rax, [rsp + 0x680]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b1d0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.14001a5b8
mov qword [rsi], rax
test rax, rax
je 0x140006c54
cmp byte [0x140049438], 0
jne 0x140006c54
cmp byte [0x140049c79], 1
je 0x140006c54
cmp byte [0x140049c7a], 0
jne 0x140006c54
xor ecx, ecx
mov dl, 1
call fcn.140001fc0
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 7
jb 0x140006ce7
cmp byte [0x140049c79], 0
jne 0x140006ce7
cmp rbp, 0xffffffffffffffff
je 0x140006c8e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140049860]
call fcn.14001fc88
test eax, eax
je 0x140006ce7
call fcn.14001b454
cmp dword [rax], 2
je 0x140006ce7
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400082ca
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_non_fatal_error_removing_backup_of_callback_app_file__path:__S
lea r8, [0x140049860]
call fcn.1400116a0
cmp byte [0x140049438], 0
jne 0x140007466
cmp byte [0x140049c79], 0
jne 0x140007466
lea rcx, [0x140049c80]
call fcn.14001fce0
test eax, eax
je 0x140007466
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008233
call fcn.14001b454
mov r9d, dword [rax]
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_unable_to_remove_directory:__S__err:__d
lea r8, str.tobedeleted
call fcn.1400116a0
lea rcx, [0x140049c80]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [0x14004a098]
mov edx, dword [0x140047e4c]
mov rbp, qword gs:[0x58]
mov rdx, qword [rbp + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140007441
cmp ecx, edx
jg 0x1400082b5
lea rsi, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x140007450
cmp r12d, 7
jb 0x140006336
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
jmp 0x140007797
mov r14, 0xffffffffffffffff
cmp byte [0x140049c79], 1
jne 0x140006827
lea rdx, [0x140049a70]
lea rsi, [rsp + 0x270]
mov rcx, rsi
call fcn.140013680
mov rcx, rsi
mov dx, 0x5c
call fcn.140015f68
mov word [rax], 0
lea r8, str._smoz_update_in_progress.lock
lea rcx, [rsp + 0x8c0]
mov edx, 0x104
mov r9, rsi
call fcn.140004870
lea rcx, [rsp + 0x8c0]
call fcn.14001fc88
test eax, eax
je 0x140006e4c
call fcn.14001b454
cmp dword [rax], 2
jne 0x1400070ad
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0x8c0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
lea rcx, [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006ea8
lea rdx, str.SeAssignPrimaryTokenPrivilege
mov r8d, 0x22
xor ecx, ecx
call fcn.140011310
cmp r14, 0xffffffffffffffff
jne 0x140006807
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x140006ed1
call fcn.14001b454
cmp dword [rax], 2
jne 0x1400072fd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
lea rcx, [rsp + 0xce0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400072fd
mov r14, rax
lea edx, [r12 - 1]
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov r8, r15
call fcn.140001090
mov rbx, qword [rsi]
test rbx, rbx
je 0x140007517
cmp byte [rsp + 0x48], 0
je 0x140007a65
lea rcx, [0x140049a70]
call fcn.140011870
test al, al
je 0x140007a65
lea rdx, [rsp + 0x270]
mov dword [rdx], 0
mov rcx, qword [r13]
call fcn.140012aa0
test eax, eax
je 0x140007a65
cmp dword [rsp + 0x270], 0
je 0x140007a65
lea rcx, [rsp + 0x270]
call fcn.140012b40
test eax, eax
je 0x140006f9c
cmp dword [rsp + 0x270], 0
jne 0x140007a65
lea rcx, [0x140049a70]
lea rdx, [rsp + 0x270]
call fcn.1400012d0
test eax, eax
je 0x140007a65
lea rax, [rsp + 0x680]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x270]
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006ffc
mov rcx, qword [rsp + 0x680]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x690], xmm0
movaps xmmword [rsp + 0x680], xmm0
mov qword [rsp + 0x69d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f97c]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x1400077d7
lea rdx, [0x14003f9d6]
lea rcx, [rsp + 0x270]
call fcn.14001fa44
test rax, rax
je 0x1400077d5
mov rsi, rax
lea rcx, [rsp + 0x680]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400214a8
cmp rax, 1
sete dil
jne 0x1400070a0
mov byte [rsp + 0x6a4], 0
mov rcx, rsi
call fcn.140020ee8
jmp 0x1400077d7
cmp byte [0x140049c79], 1
jne 0x140007292
lea rcx, str.pending
jmp 0x1400072c0
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x60]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x42
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400081b1
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_unable_to_find_callback_file:__S
mov r8, rdi
call fcn.1400116a0
call fcn.1400086b0
cmp r14, 0xffffffffffffffff
je 0x14000713c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x14000715b
call fcn.14001b454
cmp dword [rax], 2
jne 0x140006336
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
mov edx, r12d
mov r8, r15
jmp 0x140007797
lea rcx, [rsp + 0x8c0]
call fcn.140013730
movsxd rcx, eax
lea rax, [rsp + rcx*2]
add rax, 0x680
xor edx, edx
cmp word [rax], 0x5c
sete dl
movzx eax, word [rax + rdx*2]
add rdx, rdx
lea rcx, [rdx + rcx*2]
lea rdx, [rsp + rcx]
add rdx, 0x682
xor ecx, ecx
lea rbp, [0x140049650]
mov ebx, 0x2f
cmp ax, 0x5c
cmove eax, ebx
mov word [rcx + rbp], ax
movzx eax, word [rdx + rcx]
add rcx, 2
test ax, ax
jne 0x1400071bc
mov word [rcx + rbp], 0
mov r9, qword [r15]
lea rcx, [0x140049860]
lea r8, str._s.moz_callback
mov edx, 0x104
call fcn.140004870
cmp eax, 0x104
jb 0x140007335
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x60]
mov edx, 0x20
mov rcx, rsi
mov r9d, 3
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008274
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_callback_backup_path_truncated
call fcn.1400116a0
call fcn.1400086b0
cmp r14, 0xffffffffffffffff
je 0x140007273
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x140006336
call fcn.14001b454
jmp 0x140006336
cmp byte [0x140049438], 1
jne 0x1400072c5
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x2c
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008170
lea rcx, [0x140049e88]
lea rdx, str.Update_already_in_progress__Exiting
jmp 0x14000653b
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400081f2
lea rcx, [0x140049e88]
lea rdx, str.Unable_to_create_elevated_lock_file__Exiting
jmp 0x14000653b
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov rcx, qword [r15]
lea rdx, [0x140049860]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007525
mov esi, 1
lea r15, str.NS_main:_callback_app_file_open_attempt__d_failed._File:__S._Last_error:__lu
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x40010000
mov r8d, 6
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140007553
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007407
mov dword [rsp + 0x20], ebp
lea rcx, [0x140049e88]
mov rdx, r15
mov r8d, esi
mov rbx, rdi
mov r9, rdi
call fcn.1400116a0
mov ecx, 0x64
call r14
inc esi
cmp esi, 0xb
jne 0x140007370
jmp 0x140007560
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400073d3
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400073d3
cmp ecx, edx
jg 0x14000830b
lea rsi, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
lea rcx, [0x140049e88]
lea r8, str.tobedeleted
mov rdx, rsi
call fcn.1400116a0
call fcn.1400086b0
cmp r12d, 7
jb 0x140007508
cmp byte [0x140049a6a], 1
jne 0x1400074c0
call fcn.1400057b0
test al, al
jne 0x1400074ab
mov ecx, 2
call fcn.1400163f8
lea rcx, str.The_post_update_process_was_not_launched
mov edx, 0x28
mov r8d, 1
mov r9, rax
call fcn.14002176c
cmp byte [0x140049a68], 0
jne 0x1400074c0
lea rcx, [0x140049a70]
call fcn.140012440
cmp r14, 0xffffffffffffffff
je 0x1400074cf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x1400074ea
call fcn.14001b454
cmp dword [rax], 2
jne 0x140007508
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
call fcn.140005bd0
movzx esi, byte [0x140049a6a]
xor esi, 1
jmp 0x14000633b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006540
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x60]
mov edx, 0x20
mov rcx, rsi
cmp eax, 5
jne 0x1400075d7
mov r9d, 0x23
jmp 0x1400075dd
mov rbp, rax
mov r14, qword [rsp + 0x48]
jmp 0x140006b83
cmp ebp, 0x20
jne 0x140007679
cmp byte [0x140049c7a], 0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
je 0x1400077a1
cmp eax, ecx
jg 0x140008457
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file_from_background_task:__S
call fcn.1400116a0
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x60]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x6a
jmp 0x1400076e0
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008353
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsi]
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_failed_to_copy_callback_file__S_into_place_at__S
lea r9, [0x140049860]
call fcn.1400116a0
call fcn.1400086b0
mov rcx, qword [rsp + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x140007647
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
je 0x140007666
call fcn.14001b454
cmp dword [rax], 2
jne 0x140006336
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [rsi]
jmp 0x140007791
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008416
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_callback_app_file_in_use__failed_to_exclusively_open_executable_file:__S
call fcn.1400116a0
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x60]
mov edx, 0x20
mov rcx, rsi
cmp ebp, 5
jne 0x1400076da
mov r9d, 0x23
jmp 0x1400076e0
mov r9d, 0x25
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
lea rcx, [0x140049860]
call fcn.14001fc88
test eax, eax
je 0x140007746
call fcn.14001b454
cmp dword [rax], 2
je 0x140007746
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008498
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_unable_to_remove_backup_of_callback_app_file__path:__S
lea r8, [0x140049860]
call fcn.1400116a0
call fcn.1400086b0
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x14000775e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xce0]
call fcn.14001fc88
test eax, eax
mov rsi, qword [rsp + 0x50]
je 0x140007782
call fcn.14001b454
cmp dword [rax], 2
jne 0x140006336
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
mov edx, r12d
mov r8, rsi
call fcn.140005bd0
jmp 0x140006336
cmp eax, ecx
jg 0x1400084d9
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
lea rcx, [0x140049e88]
lea rdx, str.NS_main:_callback_app_file_in_use__continuing_without_exclusive_access_for_executable_file:__S
call fcn.1400116a0
mov r14, qword [rsp + 0x48]
mov rbp, 0xffffffffffffffff
jmp 0x140006b83
xor edi, edi
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x3a
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov ecx, r12d
mov rdx, r13
call fcn.140012950
test eax, eax
jne 0x140007a65
xor ebp, ebp
cmp byte [0x140049438], 1
je 0x140007833
cmp byte [0x140049c7a], 0
jne 0x140007833
call fcn.140001f00
test eax, eax
sete bpl
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.140012740
cmp eax, 1
je 0x1400078c8
lea rax, [0x140008870]
lea rsi, [rsp + 0x270]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b1d0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call fcn.14001a5b8
mov qword [rsi], rax
test rax, rax
sete cl
xor bpl, 1
or bpl, cl
jne 0x1400078ac
mov cl, 1
xor edx, edx
call fcn.140001fc0
mov rax, qword [rsp + 0x270]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.MozillaMaintenance
mov edx, 1
call fcn.140012740
cmp eax, 1
jne 0x140007a65
mov byte [0x140049a69], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x7d], 0
test dil, dil
je 0x1400079f4
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f97c]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x1400079e7
lea rdx, [0x14003f9d6]
lea rcx, [rsp + 0x270]
call fcn.14001fa44
test rax, rax
je 0x1400079e7
mov rsi, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400214a8
cmp rax, 1
jne 0x1400079df
lea rdi, [rsp + 0x60]
mov byte [rdi + 0x24], 0
mov rcx, rsi
call fcn.140020ee8
lea rcx, [rsp + 0x680]
mov r8d, 0x25
mov rdx, rdi
call fcn.140022210
test eax, eax
jne 0x1400079e7
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000855b
lea rcx, [0x140049e88]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_the_service
jmp 0x140007d99
mov rcx, rsi
call fcn.140020ee8
cmp byte [0x140049a69], 1
jne 0x140007dd8
cmp byte [0x140049438], 0
jne 0x140007dd8
xor eax, eax
lea r8, [rsp + 0x270]
mov byte [r8], al
mov byte [r8 + 4], al
lea rcx, [0x14003d483]
lea rdx, [rsp + 0x890]
call fcn.14000b1f0
test al, al
je 0x140007dd8
cmp byte [rsp + 0x890], 0
je 0x140007dd8
cmp byte [rsp + 0x274], 0
je 0x140007dd8
mov eax, dword [rsp + 0x270]
lea ecx, [rax - 0x18]
cmp ecx, 0xa
jb 0x140007a65
add eax, 0xffffffcf
cmp eax, 9
ja 0x140007dd8
cmp byte [0x140049438], 1
jne 0x140007ada
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x2b
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008394
lea rcx, [0x140049e88]
lea rdx, str.Non_critical_update_staging_error__Falling_back_to_non_staged_updates_and_exiting
call fcn.1400116a0
call fcn.1400086b0
jmp 0x140007e13
cmp byte [0x140049c7a], 0
je 0x140007b4f
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x69
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400083d5
lea rcx, [0x140049e88]
lea rdx, str.Skipping_update_to_avoid_UAC_prompt_from_background_task.
call fcn.1400116a0
call fcn.1400086b0
jmp 0x140007df5
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x7d], 0
xor edi, edi
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f97c]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x140007beb
lea rdx, [0x14003f9d6]
lea rcx, [rsp + 0x270]
call fcn.14001fa44
test rax, rax
je 0x140007be9
mov rsi, rax
lea rcx, [rsp + 0x60]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400214a8
cmp rax, 1
sete dil
jne 0x140007bdf
mov byte [rsp + 0x84], 0
mov rcx, rsi
call fcn.140020ee8
jmp 0x140007beb
xor edi, edi
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 0x4f
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
xor eax, eax
lea rcx, [rsp + 0x680]
mov qword [rcx + 0x68], rax
movups xmmword [rcx + 0x58], xmm6
movups xmmword [rcx + 0x48], xmm6
movups xmmword [rcx + 0x38], xmm6
movups xmmword [rcx + 0x28], xmm6
movabs rdx, 0x54000000070
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov rax, qword [r13]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rbx
lea rax, str.runas
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140007da7
mov rcx, qword [rsp + 0x6e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x140049a69], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x8a0], xmm0
movaps xmmword [rsp + 0x890], xmm0
mov qword [rsp + 0x8ad], 0
test dil, dil
je 0x140007dd8
lea rsi, [rsp + 0x270]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f97c]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x140007dd8
lea rdx, [0x14003f9d6]
lea rcx, [rsp + 0x270]
call fcn.14001fa44
test rax, rax
je 0x140007dd8
mov rsi, rax
lea rcx, [rsp + 0x890]
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.1400214a8
cmp rax, 1
jne 0x140007e7c
lea rdi, [rsp + 0x890]
mov byte [rdi + 0x24], 0
mov rcx, rsi
call fcn.140020ee8
lea rcx, [rsp + 0x60]
mov r8d, 0x25
mov rdx, rdi
call fcn.140022210
test eax, eax
jne 0x140007dd8
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000851a
lea rcx, [0x140049e88]
lea rdx, str.The_secure_ID_hasnt_changed_after_launching_the_updater_using_runas
call fcn.1400116a0
mov byte [0x140049a69], 0
jmp 0x140007dd8
mov byte [0x140049a69], 0
lea r8, str.failed:__d_n
lea rsi, [rsp + 0x270]
mov edx, 0x20
mov rcx, rsi
mov r9d, 9
call fcn.140001000
mov rcx, rsi
call fcn.1400085a0
cmp byte [0x140049438], 0
je 0x140007e22
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400086b0
cmp r12d, 7
jb 0x140007e13
mov r9b, byte [0x140049a68]
add r12d, 0xfffffffa
mov rcx, qword [r13 + 0x28]
add r13, 0x30
mov edx, r12d
mov r8, r13
call fcn.140005bd0
mov rcx, rbx
call fcn.1400138e8
xor esi, esi
jmp 0x14000633b
lea rdx, [rsp + 0x270]
mov byte [rdx], 0
lea rcx, str.succeeded
xor r8d, r8d
call fcn.14000b1f0
test al, al
je 0x140007de1
cmp byte [rsp + 0x270], 0
je 0x140007de1
call fcn.1400057b0
test al, al
jne 0x140007de1
mov ecx, 2
call fcn.1400163f8
lea rcx, str.The_post_update_process_which_runs_as_the_user_for_service_update_could_not_be_launched.
mov edx, 0x58
mov r8d, 1
mov r9, rax
call fcn.14002176c
jmp 0x140007de1
mov rcx, rsi
call fcn.140020ee8
jmp 0x140007dd8
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400064ad
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400064ad
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000652d
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000652d
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400065b3
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400065b3
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400065f2
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400065f2
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006631
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006631
lea rcx, [0x14004a098]
call fcn.140013b60
lea rsi, str.Performing_a_staged_update
jmp 0x140007ff6
lea rcx, [0x14004a098]
call fcn.140013b60
lea rsi, str.Performing_a_replace_request
cmp dword [0x14004a098], 0xffffffff
jne 0x14000657f
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000657f
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006725
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006725
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400069f3
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400069f3
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006a63
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006a63
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006ac5
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006ac5
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006797
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006797
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400072ea
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400072ea
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140007112
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007112
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140007322
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007322
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006d3a
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006d3a
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000724c
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000724c
lea rcx, [0x14004a098]
call fcn.140013b60
lea rsi, str.NS_main:_directory_will_be_removed_on_OS_reboot:__S
jmp 0x14000831e
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140006ccd
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140006ccd
lea rcx, [0x14004a098]
call fcn.140013b60
lea rsi, str.NS_main:_failed_to_schedule_OS_reboot_removal_of_directory:__S
cmp dword [0x14004a098], 0xffffffff
jne 0x140007450
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007450
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000760f
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000760f
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140007abd
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007abd
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140007b32
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007b32
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000769e
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000769e
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000759d
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000759d
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x14000772c
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x14000772c
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400077a9
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400077a9
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140007d8b
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140007d8b
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400079cc
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400079cc