Function at 0x140006020
Capabilities:
Check os version
Create process on windows
Query environment variable
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb28
movaps xmmword [rsp + 0xb10], xmm6
mov r14, r9
mov rdi, r8
mov rsi, rcx
mov r12, qword [0x1401054a8]
mov rax, qword [r12]
xor rax, rsp
mov qword [rsp + 0xb08], rax
mov qword [rsp + 0x58], rdx
mov ecx, dword [rdx]
lea r8, [0x1401060c0]
lea r9, str.attempting_deelevation
mov rdx, rdi
call fcn.140016700
test al, al
je 0x140008034
mov qword [0x140146490], r14
lea r13, [rdi + 8]
mov rax, qword [rdi + 8]
test rax, rax
je 0x140006280
lea rcx, [rdi + 0x10]
lea rdx, [0x1401056d4]
mov r10, rax
mov r8, r13
jmp 0x1400060c5
mov r10, qword [r8 + 8]
add r8, 8
add rcx, 8
test r10, r10
je 0x14000619b
movzx r9d, word [r10]
cmp r9d, 0x2f
je 0x1400060f0
cmp r9d, 0x2d
jne 0x1400060b0
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
jmp 0x1400060f7
add r10, 2
mov r9, r10
mov r11b, 0x6c
xor r10d, r10d
nop dword [rax]
movzx ebx, word [r9 + r10*2]
test bx, bx
je 0x1400060b0
cmp r11b, 0x2d
je 0x140006124
lea ebp, [r11 - 0x30]
cmp bpl, 0xa
jb 0x140006124
lea ebp, [r11 - 0x61]
cmp bpl, 0x19
ja 0x1400060b0
movzx ebp, bx
cmp ebp, 0xff
mov r14d, 0xff
cmovb r14d, ebx
lea ebx, [r14 - 0x41]
mov ebp, r14d
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
cmovae ebx, r14d
cmp bl, r11b
jne 0x1400060b0
movzx r11d, byte [r10 + rdx + 1]
inc r10
cmp r10, 0x12
jne 0x140006100
cmp word [r9 + 0x24], 0
jne 0x1400060b0
nop word cs:[rax + rax]
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140006180
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov rax, qword [r13]
test rax, rax
je 0x140006280
lea rcx, str.contentproc
mov rdx, r13
jmp 0x1400061c1
mov rax, qword [rdx + 8]
add rdx, 8
test rax, rax
je 0x140006280
movzx r8d, word [rax]
cmp r8d, 0x2f
je 0x1400061f0
cmp r8d, 0x2d
jne 0x1400061b0
lea r8, [rax + 2]
lea r9, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r8, r9
jmp 0x1400061f7
add rax, 2
mov r8, rax
mov r9b, 0x63
xor eax, eax
nop dword [rax]
movzx r10d, word [r8 + rax*2]
test r10w, r10w
je 0x1400061b0
cmp r9b, 0x2d
je 0x140006225
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140006225
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x1400061b0
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x1400061b0
movzx r9d, byte [rax + rcx + 1]
inc rax
cmp rax, 0xb
jne 0x140006200
cmp word [r8 + 0x16], 0
jne 0x1400061b0
mov qword [rsi], 0
jmp 0x140007b16
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xc8]
call fcn.140004930
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x6d0], xmm0
movdqa xmmword [rsp + 0x6c0], xmm0
movdqa xmmword [rsp + 0x6b0], xmm0
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x6b0]
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x140006372
mov rsi, r12
mov r8d, dword [rsp + 0x6d8]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14000638b
mov dword [rsp + 0x6b0], 0
mov byte [rsp + 0x6c8], 0
lea r12, [rsp + 0x6d0]
mov dword [rsp + 0x270], 0x209
lea r9, [rsp + 0x270]
mov rcx, r14
mov edx, 1
mov r8, r12
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400063b6
cmp byte [rsp + 0x6c8], 0
je 0x140007068
mov r12, qword [rsp + 0x6b8]
mov ebx, dword [rsp + 0x6c0]
mov r15b, 1
mov ebp, dword [rsp + 0x6c4]
jmp 0x1400063d9
mov ebp, eax
mov rsi, r12
or ebp, 0x10000000
lea r12, [0x140105a51]
mov ebx, 0x519
jmp 0x1400063ea
xor r12d, r12d
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400063d9
cmp eax, 0x57
je 0x1400063d9
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x5c
jmp 0x1400063cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x1e
mov r15b, 1
lea r12, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_SameBinary.h
mov rax, r14
inc rax
cmp rax, 2
jae 0x140006411
test r15b, r15b
je 0x14000641f
mov qword [rsp + 0x6b0], r12
mov dword [rsp + 0x6b8], ebx
mov dword [rsp + 0x6bc], ebp
lea rcx, [rsp + 0x6b0]
call fcn.140004800
xor ebp, ebp
jmp 0x140006426
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
jne 0x1400063ea
test r12b, r12b
sete bpl
lea rcx, [0x140105db5]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
mov r12, rsi
je 0x140006455
cmp byte [rax], 0
mov rsi, qword [rsp + 0x60]
je 0x14000645a
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov bpl, 1
jmp 0x14000645a
mov rsi, qword [rsp + 0x60]
mov rax, qword [r13]
test rax, rax
je 0x140006707
lea rcx, [rdi + 0x10]
mov r8, rax
jmp 0x140006480
mov r8, qword [rcx]
add rcx, 8
test r8, r8
je 0x140006707
movzx edx, word [r8]
cmp edx, 0x2f
je 0x1400064b0
cmp edx, 0x2d
jne 0x140006470
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x1400064b7
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x6c
jne 0x140006470
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x61
jne 0x140006470
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x75
jne 0x140006470
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x6e
jne 0x140006470
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x63
jne 0x140006470
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x68
jne 0x140006470
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x65
jne 0x140006470
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x72
jne 0x140006470
cmp word [rdx + 0x10], 0
jne 0x140006470
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400066e5
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov rax, qword [r13]
mov rsi, qword [rsp + 0x60]
jmp 0x140006710
test bpl, bpl
je 0x140006812
test rax, rax
je 0x14000681d
lea rcx, [rdi + 0x10]
lea rdx, str.force_launcher
mov r8, r13
jmp 0x140006745
mov rax, qword [r8 + 8]
add r8, 8
add rcx, 8
test rax, rax
je 0x14000681d
movzx r9d, word [rax]
cmp r9d, 0x2f
je 0x140006770
cmp r9d, 0x2d
jne 0x140006730
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
jmp 0x140006777
add rax, 2
mov r9, rax
mov r10b, 0x66
xor eax, eax
nop dword [rax]
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x140006730
cmp r10b, 0x2d
je 0x1400067a3
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x1400067a3
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x140006730
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov ebp, ebx
or bpl, 0x20
cmp r11b, 0x1a
movzx r11d, bpl
cmovae r11d, ebx
cmp r11b, r10b
jne 0x140006730
movzx r10d, byte [rax + rdx + 1]
inc rax
cmp rax, 0xe
jne 0x140006780
cmp word [r9 + 0x1c], 0
jne 0x140006730
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400067f0
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov r9d, 1
xor r8d, r8d
jmp 0x140006823
xor r9d, r9d
mov r8d, 1
jmp 0x140006823
xor r8d, r8d
xor r9d, r9d
lea rcx, [rsp + 0x6b0]
lea rdx, [rsp + 0xc8]
call fcn.14000ca40
movzx ebx, byte [rsp + 0x6c0]
test bl, bl
je 0x1400068ae
lea rcx, [rsp + 0x6b0]
call fcn.140004800
xor r14d, r14d
lea rcx, [rsp + 0x6b0]
lea rdx, [rsp + 0xc8]
call fcn.14000d980
cmp byte [rsp + 0x6c8], 0
je 0x1400068e5
mov rax, qword [rsp + 0x6b1]
mov rcx, qword [rsp + 0x6b8]
mov qword [rsp + 0x247], rcx
mov qword [rsp + 0x240], rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x260], xmm0
movdqa xmmword [rsp + 0x250], xmm0
jmp 0x140006984
cmp dword [rsp + 0x6b0], 0
je 0x140006cab
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140006c51
cmp byte [rax], 0
je 0x140006c51
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140006851
movzx eax, byte [rsp + 0x6b0]
mov rcx, qword [rsp + 0x6b1]
mov qword [rsp + 0x240], rcx
mov rcx, qword [rsp + 0x6b8]
mov qword [rsp + 0x247], rcx
mov rcx, qword [rsp + 0x6c0]
mov rdx, qword [rsp + 0x240]
mov r8, qword [rsp + 0x247]
mov qword [rsp + 0x6b7], r8
mov qword [rsp + 0x6b0], rdx
mov qword [rsp + 0x247], 0
mov qword [rsp + 0x240], 0
mov byte [rsp + 0x250], al
mov rax, qword [rsp + 0x6b0]
mov rdx, qword [rsp + 0x6b7]
mov qword [rsp + 0x251], rax
mov qword [rsp + 0x258], rdx
mov qword [rsp + 0x260], rcx
mov byte [rsp + 0x268], 1
test bl, bl
sete al
test al, r14b
je 0x140006be0
mov eax, dword [0x1401486d8]
cmp eax, 0x3838
ja 0x140006a60
mov eax, dword [0x140145014]
cmp eax, 0x383a
jb 0x140006a9b
lea rcx, [rsp + 0x6b8]
mov r8d, 0x114
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x6b0], rax
mov dword [rsp + 0x6bc], 0x3839
mov rbx, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 1
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 4
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rbx
lea rcx, [rsp + 0x6b0]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, [0x140145014]
lea rdx, [0x1401486d8]
test eax, eax
cmove rdx, rcx
mov eax, 0x3839
xchg dword [rdx], eax
je 0x140006a9b
movzx eax, byte [0x1401462e0]
test al, al
je 0x140008043
mov rax, qword [0x1401486d0]
test rax, rax
je 0x140006a9b
mov dword [rsp + 0x6b0], 4
lea rdx, [rsp + 0x6b0]
mov r8d, 4
mov ecx, 0xa
call rax
call fcn.1400743e0
call fcn.140008530
test rdi, rdi
je 0x140006c01
lea rcx, [rsp + 0x6b0]
xor edx, edx
call fcn.1400161d0
mov rax, qword [rsp + 0x6b0]
test rax, rax
je 0x140006c01
mov qword [rdi], rax
mov r14, qword [rdi + 8]
test r14, r14
je 0x140007455
lea rax, [rdi + 0x10]
lea rcx, str.wait_for_browser
mov r9, r14
mov rdx, r13
jmp 0x140006b15
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
je 0x140006cb3
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x140006b40
cmp r8d, 0x2d
jne 0x140006b00
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x140006b47
add r9, 2
mov r8, r9
mov r10b, 0x77
xor r9d, r9d
nop dword [rax]
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x140006b00
cmp r10b, 0x2d
je 0x140006b73
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x140006b73
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x140006b00
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov ebp, ebx
or bpl, 0x20
cmp r11b, 0x1a
movzx r11d, bpl
cmovae r11d, ebx
cmp r11b, r10b
jne 0x140006b00
movzx r10d, byte [r9 + rcx + 1]
inc r9
cmp r9, 0x10
jne 0x140006b50
cmp word [r8 + 0x20], 0
jne 0x140006b00
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140006bc0
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov r14, qword [r13]
jmp 0x140007483
lea rcx, [rsp + 0x6b0]
lea rdx, [rsp + 0xc8]
call fcn.140008230
cmp byte [rsp + 0x6c0], 0
jne 0x140006c2a
jmp 0x140006c37
mov byte [rsp + 0x6c0], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6b0], rax
movabs rax, 0x8007050700000156
mov qword [rsp + 0x6b8], rax
lea rcx, [rsp + 0x6b0]
call fcn.140004800
mov qword [rsi], 0
cmp byte [rsp + 0x268], 0
jne 0x140007af2
jmp 0x140007b09
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
je 0x140006851
cmp word [rax], 0
je 0x140006851
xor r14d, r14d
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstoul
imul ebp, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov edx, eax
call fcn.140015cf0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006854
mov r14b, 1
jmp 0x140006854
lea rax, [rdi + 0x10]
mov rdx, r14
jmp 0x140006cd0
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
je 0x140006f84
movzx ecx, word [rdx]
cmp ecx, 0x2f
je 0x140006cf0
cmp ecx, 0x2d
jne 0x140006cc0
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
jmp 0x140006cf7
add rdx, 2
mov rcx, rdx
movzx edx, word [rcx]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6d
jne 0x140006cc0
movzx edx, word [rcx + 2]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x61
jne 0x140006cc0
movzx edx, word [rcx + 4]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x72
jne 0x140006cc0
movzx edx, word [rcx + 6]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x69
jne 0x140006cc0
movzx edx, word [rcx + 8]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6f
jne 0x140006cc0
movzx edx, word [rcx + 0xa]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6e
jne 0x140006cc0
movzx edx, word [rcx + 0xc]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140006cc0
movzx edx, word [rcx + 0xe]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x74
jne 0x140006cc0
movzx edx, word [rcx + 0x10]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x74
jne 0x140006cc0
movzx edx, word [rcx + 0x12]
test dx, dx
je 0x140006cc0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140006cc0
cmp word [rcx + 0x14], 0
jne 0x140006cc0
jmp 0x140007483
lea rax, str.backgroundtask
mov r8, r14
mov rcx, r13
jmp 0x140006fb1
mov r8, qword [rcx + 8]
add rcx, 8
test r8, r8
je 0x140007124
movzx edx, word [r8]
cmp edx, 0x2f
je 0x140006fe0
cmp edx, 0x2d
jne 0x140006fa0
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x140006fe7
add r8, 2
mov rdx, r8
mov r9b, 0x62
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x140006fa0
cmp r9b, 0x2d
je 0x140007015
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140007015
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x140006fa0
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x140006fa0
movzx r9d, byte [r8 + rax + 1]
inc r8
cmp r8, 0xe
jne 0x140006ff0
cmp word [rdx + 0x1c], 0
jne 0x140006fa0
jmp 0x140007483
mov r8d, dword [rsp + 0x6b0]
lea rcx, [rsp + 0x1d0]
mov rdx, r12
call fcn.140015910
cmp byte [rsp + 0x1e8], 0
je 0x140007756
mov ebp, dword [rsp + 0x1dc]
cmp ebp, 0xd000003a
jne 0x1400077af
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x270], 0
mov byte [rsp + 0x288], 0
lea rbp, [rsp + 0x290]
mov dword [rsp + 0x1d0], 0x209
lea r9, [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
mov rcx, rax
mov edx, 1
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400079b0
cmp byte [rsp + 0x288], 0
je 0x140007a12
mov r12, qword [rsp + 0x278]
mov ebx, dword [rsp + 0x280]
mov r15b, 1
mov ebp, dword [rsp + 0x284]
mov rcx, qword [rsp + 0x68]
jmp 0x140007b68
lea rax, [rdi + 0x10]
mov rdx, r14
jmp 0x140007140
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
je 0x140007372
movzx ecx, word [rdx]
cmp ecx, 0x2f
je 0x140007160
cmp ecx, 0x2d
jne 0x140007130
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
jmp 0x140007167
add rdx, 2
mov rcx, rdx
movzx edx, word [rcx]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x68
jne 0x140007130
movzx edx, word [rcx + 2]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140007130
movzx edx, word [rcx + 4]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x61
jne 0x140007130
movzx edx, word [rcx + 6]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x64
jne 0x140007130
movzx edx, word [rcx + 8]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6c
jne 0x140007130
movzx edx, word [rcx + 0xa]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140007130
movzx edx, word [rcx + 0xc]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x73
jne 0x140007130
movzx edx, word [rcx + 0xe]
test dx, dx
je 0x140007130
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x73
jne 0x140007130
cmp word [rcx + 0x10], 0
jne 0x140007130
jmp 0x140007483
lea rax, str.remote_debugging_port
mov r8, r14
mov rcx, r13
jmp 0x1400073a1
mov r8, qword [rcx + 8]
add rcx, 8
test r8, r8
je 0x140007455
movzx edx, word [r8]
cmp edx, 0x2f
je 0x1400073d0
cmp edx, 0x2d
jne 0x140007390
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x1400073d7
add r8, 2
mov rdx, r8
mov r9b, 0x72
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x140007390
cmp r9b, 0x2d
je 0x140007405
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140007405
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x140007390
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x140007390
movzx r9d, byte [r8 + rax + 1]
inc r8
cmp r8, 0x15
jne 0x1400073e0
cmp word [rdx + 0x2a], 0
jne 0x140007390
jmp 0x140007483
lea rcx, str.MOZ_AUTOMATION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14000746b
cmp byte [rax], 0
jne 0x140007483
lea rcx, str.MOZ_HEADLESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor ebp, ebp
test rax, rax
je 0x140007488
cmp byte [rax], 0
je 0x140007488
mov ebp, 1
test r14, r14
je 0x1400076ac
lea rax, [rdi + 0x10]
lea rcx, str.no_deelevate
mov r9, r14
mov rdx, r13
jmp 0x1400074c5
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
je 0x14000759e
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x1400074f0
cmp r8d, 0x2d
jne 0x1400074b0
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x1400074f7
add r9, 2
mov r8, r9
mov r10b, 0x6e
xor r9d, r9d
nop dword [rax]
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x1400074b0
cmp r10b, 0x2d
je 0x140007523
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x140007523
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x1400074b0
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov r15d, ebx
or r15b, 0x20
cmp r11b, 0x1a
movzx r11d, r15b
cmovae r11d, ebx
cmp r11b, r10b
jne 0x1400074b0
movzx r10d, byte [r9 + rcx + 1]
inc r9
cmp r9, 0xc
jne 0x140007500
cmp word [r8 + 0x18], 0
jne 0x1400074b0
nop word cs:[rax + rax]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140007580
mov rax, qword [rsp + 0x58]
dec dword [rax]
or ebp, 2
mov r14, qword [r13]
test r14, r14
je 0x1400076ac
lea rax, [rdi + 0x10]
lea rcx, str.attempting_deelevation
jmp 0x1400075d5
mov r14, qword [r13 + 8]
add r13, 8
add rax, 8
test r14, r14
je 0x1400076ac
movzx edx, word [r14]
cmp edx, 0x2f
je 0x140007600
cmp edx, 0x2d
jne 0x1400075c0
lea rdx, [r14 + 2]
lea r8, [r14 + 4]
cmp word [r14 + 2], 0x2d
cmove rdx, r8
jmp 0x140007607
add r14, 2
mov rdx, r14
mov r9b, 0x61
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x1400075c0
cmp r9b, 0x2d
je 0x140007635
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140007635
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x1400075c0
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x1400075c0
movzx r9d, byte [r8 + rcx + 1]
inc r8
cmp r8, 0x16
jne 0x140007610
cmp word [rdx + 0x2c], 0
jne 0x1400075c0
nop word cs:[rax + rax]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140007690
mov rbx, qword [rsp + 0x58]
dec dword [rbx]
or ebp, 4
jmp 0x1400076b1
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x98], 0
mov rdx, qword [rdi]
lea rcx, [rsp + 0x228]
lea r9, [rsp + 0x98]
mov r8d, ebp
call fcn.140005940
cmp byte [rsp + 0x238], 0
je 0x140007703
lea rcx, [rsp + 0x228]
call fcn.140004800
mov qword [rsi], 0
mov r14, qword [rsp + 0x98]
jmp 0x140007ade
mov r14, qword [rsp + 0x98]
mov r15d, 4
test r14, r14
je 0x1400077c6
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0xc8]
call fcn.140008230
cmp byte [rsp + 0x220], 0
je 0x14000783d
lea rcx, [rsp + 0x210]
call fcn.140004800
mov qword [rsi], 0
jmp 0x140007ade
mov dword [rsp + 0x270], 1
mov byte [rsp + 0x288], 0
lea r15, [rsp + 0x290]
xor ecx, ecx
mov rdx, r15
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x140007791
test eax, eax
jne 0x140007984
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x29
jmp 0x1400063cf
mov r12, qword [rsp + 0x1d0]
mov r15b, 1
mov ebx, dword [rsp + 0x1d8]
jmp 0x1400063d9
mov eax, dword [rsp + 0x228]
test eax, eax
je 0x140007a03
xor r15d, r15d
cmp eax, 1
jne 0x14000771a
mov r15d, 2
test bpl, 3
jne 0x14000771a
mov r15d, 5
test bpl, 4
jne 0x14000771a
mov edx, dword [rbx]
lea rcx, [rsp + 0x6b0]
mov r8, rdi
call fcn.140004c90
cmp byte [rsp + 0x6c0], 0
je 0x140007ef5
lea rcx, [rsp + 0x6b0]
call fcn.140004800
mov qword [rsi], 0
xor r14d, r14d
jmp 0x140007ade
mov edx, dword [rbx]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
mov r8, rdi
xor r9d, r9d
call fcn.140008690
cmp qword [rsp + 0x90], 0
je 0x1400079dd
lea rcx, [rsp + 0x88]
mov rdx, rbx
mov r8, rdi
mov r9d, 2
call fcn.140008b50
cmp byte [rsp + 0x89], 0
je 0x140007a83
mov rsi, r12
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1e0], 0
mov qword [rsp + 0x1e8], 3
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x208], 0
lea r13, [rsp + 0x1d0]
mov rcx, r13
call fcn.140008ed0
mov rbx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rbx
mov qword [rsp + 0x1b0], rax
mov ecx, 0xfffffff5
call rbx
mov qword [rsp + 0x1b8], rax
mov ecx, 0xfffffff4
call rbx
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x1b0]
mov rcx, r13
call fcn.140008fe0
lea rcx, [rsp + 0x198]
lea r12, [rsp + 0x6b0]
mov rdx, r13
mov r8, r12
call fcn.140009130
cmp byte [rsp + 0x1a8], 0
je 0x140007bc1
lea rcx, [rsp + 0x198]
call fcn.140004800
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
lea rcx, [rsp + 0x1d0]
call fcn.140009880
mov r12, rsi
mov rsi, qword [rsp + 0x60]
jmp 0x140007ac0
cmp byte [rsp + 0x288], 0
je 0x140007b81
mov r12, qword [rsp + 0x278]
mov ebx, dword [rsp + 0x280]
mov r15b, 1
mov ebp, dword [rsp + 0x284]
jmp 0x1400063d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r15b, 1
mov ebx, 0x1e
lea r12, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_SameBinary.h
mov rcx, qword [rsp + 0x68]
jmp 0x140007b68
mov byte [rsp + 0x6c0], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6b0], rax
movabs rax, 0x800705070000019e
jmp 0x140007aa4
mov r15d, ebp
shr r15d, 1
or r15d, 1
jmp 0x14000771a
cmp byte [rsp + 0x6c8], 0
mov rcx, qword [rsp + 0x68]
jne 0x140007b62
mov eax, dword [rsp + 0x6b0]
or eax, dword [rsp + 0x270]
jne 0x140007b62
lea rbx, [rsp + 0x1d0]
mov rcx, rbx
mov rdx, r12
call sub.ntdll.dll_RtlInitUnicodeString
lea r12, [rsp + 0x250]
mov rcx, r12
mov rdx, rbp
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
mov rdx, r12
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
mov rcx, qword [rsp + 0x68]
xor r12d, r12d
test al, al
setne r12b
xor r15d, r15d
jmp 0x140007b68
mov byte [rsp + 0x6c0], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6b0], rax
movabs rax, 0x80070057000001a5
mov qword [rsp + 0x6b8], rax
lea rcx, [rsp + 0x6b0]
call fcn.140004800
mov qword [rsi], 0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x140007ade
call sub.mozglue.dll_free
lea rax, [r14 + 1]
cmp rax, 2
jae 0x140007b4d
cmp byte [rsp + 0x268], 0
je 0x140007b09
test byte [rsp + 0x250], 1
je 0x140007b09
mov rcx, qword [rsp + 0x260]
call sub.mozglue.dll_free
lea rcx, [rsp + 0xc8]
call fcn.140004b90
mov rax, qword [rsp + 0xb08]
xor rax, rsp
mov rcx, qword [r12]
cmp rcx, rax
jne 0x14000803e
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb10]
add rsp, 0xb28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x268], 0
jne 0x140007af2
jmp 0x140007b09
xor r12d, r12d
xor r15d, r15d
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400063d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400063d9
mov r8d, dword [rsp + 0x270]
lea rcx, [rsp + 0x250]
mov rdx, r15
call fcn.140015910
cmp byte [rsp + 0x268], 0
je 0x140007c0f
mov r12, qword [rsp + 0x250]
mov ebx, dword [rsp + 0x258]
mov r15b, 1
mov ebp, dword [rsp + 0x25c]
jmp 0x1400063d9
xor ebx, ebx
cmp byte [rsp + 0x198], 0
je 0x140007c25
mov r13d, 0x80404
cmp qword [rsp + 0x1e0], 0
je 0x140007c2b
or byte [rsp + 0x6ed], 1
movdqa xmm0, xmmword [rsp + 0x1b0]
movdqu xmmword [rsp + 0x700], xmm0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x710], rax
mov ebx, 1
jmp 0x140007c2b
cmp byte [rsp + 0x1e8], 0
je 0x140007f07
xor r12d, r12d
jmp 0x140007f43
mov r13d, 0x404
xorps xmm6, xmm6
movaps xmmword [rsp + 0x270], xmm6
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2b0], xmm6
movaps xmmword [rsp + 0x2a0], xmm6
movaps xmmword [rsp + 0x290], xmm6
movaps xmmword [rsp + 0x280], xmm6
mov qword [rsp + 0x2d0], 0
mov dword [rsp + 0x270], 0x68
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x2ad], 8
je 0x140007caa
mov rax, qword [rsp + 0x288]
test rax, rax
je 0x140007caa
or byte [rsp + 0x6ed], 8
mov qword [rsp + 0x6c8], rax
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
mov rdx, qword [rdi]
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x70]
test r14, r14
je 0x140007d04
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], 0
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140007d33
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007d4b
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
test bpl, 1
jne 0x140007d95
xor eax, eax
jmp 0x140007dad
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0xb00], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0xaf0], rax
mov dword [rsp + 0xaf8], 0x1e4
mov dword [rsp + 0xafc], ecx
lea rcx, [rsp + 0xaf0]
jmp 0x140007959
lea rcx, [rsp + 0xaf0]
mov rdx, r12
call fcn.140009380
mov rax, qword [rsp + 0xaf0]
mov qword [rsp + 0x68], rax
cmp byte [rsp + 0x89], 0
je 0x140008024
cmp byte [rsp + 0x88], 0
setne bl
mov dword [rsp + 0x20], 0
lea r8, str.disabledynamicblocklist
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
xor r9d, r9d
call fcn.140008090
cmp eax, 1
sete al
cmp byte [rsp + 0x89], 0
je 0x140008024
or bl, al
mov rdi, qword [rdi]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xa9], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
cmp byte [rsp + 0x268], 0
je 0x140007e40
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x250]
call fcn.14007d710
mov byte [rsp + 0xb8], 1
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea rcx, [rsp + 0x180]
mov rdx, rdi
mov r8, r12
mov r9d, r15d
call fcn.140009480
cmp byte [rsp + 0xb8], 0
je 0x140007e88
test byte [rsp + 0xa0], 1
je 0x140007e88
mov rcx, qword [rsp + 0xb0]
call sub.mozglue.dll_free
cmp byte [rsp + 0x190], 0
je 0x140007ebe
lea rcx, [rsp + 0x180]
call fcn.140004800
mov rcx, r12
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x140007fb6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140007f4b
test bpl, 1
jne 0x140007f95
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edx, edx
neg eax
sbb edx, edx
or edx, 0x2710
mov rcx, r12
call fcn.1400097d0
jmp 0x140007fa7
mov dword [rsi], 0
mov byte [rsi + 4], 1
xor r14d, r14d
jmp 0x140007ade
movdqu xmm0, xmmword [rsp + 0x1d0]
movq xmm1, qword [rsp + 0x1e0]
movq xmm2, qword [rsp + 0x260]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x250]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor r12d, r12d
cmp eax, 0xffff
sete r12b
xor r15d, r15d
jmp 0x1400063d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0xb00], 1
lea rax, str._var_tmp_build_firefox_1d8abcb1f7a7_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0xaf0], rax
mov dword [rsp + 0xaf8], 0x1ff
mov dword [rsp + 0xafc], ecx
lea rcx, [rsp + 0xaf0]
jmp 0x140007e9a
mov rcx, r12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140007ffb
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov byte [rax + 4], 1
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140007fcb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
jb 0x140007fde
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 1]
cmp rax, 2
jb 0x14000796a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000796a
lea rdx, [rsp + 0xaf0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140007fa7
mov eax, dword [rsp + 0xaf0]
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rcx + 4], 1
jmp 0x140007fb6
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov ecx, 0x7f
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
call fcn.1400d58e0
lea rcx, [0x1401462e0]
call fcn.1400d3f14
test eax, eax
je 0x140006a6f
lea rcx, [0x1401486c8]
lea rdx, [0x1401056f4]
lea r8, [0x14010570e]
call fcn.1400084d0
lea rcx, [0x1401462e0]
call fcn.1400d3fef
jmp 0x140006a6f