Function at 0x140006020
Capabilities:
Check os version
Create process on windows
Query environment variable
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb38
movaps xmmword [rsp + 0xb20], xmm6
mov r14, r9
mov rdi, r8
mov rsi, rcx
mov r12, qword [0x1400f74a8]
mov rax, qword [r12]
xor rax, rsp
mov qword [rsp + 0xb18], rax
mov qword [rsp + 0x58], rdx
mov ecx, dword [rdx]
lea r8, [0x1400f8060]
lea r9, str.attempting_deelevation
mov rdx, rdi
call fcn.140016170
test al, al
je 0x14000800d
mov qword [0x140135490], r14
lea r13, [rdi + 8]
mov rax, qword [rdi + 8]
test rax, rax
je 0x140006280
lea rcx, [rdi + 0x10]
lea rdx, [0x1400f76d4]
mov r10, rax
mov r8, r13
jmp 0x1400060c5
mov r10, qword [r8 + 8]
add r8, 8
add rcx, 8
test r10, r10
je 0x14000619b
movzx r9d, word [r10]
cmp r9d, 0x2f
je 0x1400060f0
cmp r9d, 0x2d
jne 0x1400060b0
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
jmp 0x1400060f7
add r10, 2
mov r9, r10
mov r11b, 0x6c
xor r10d, r10d
nop dword [rax]
movzx ebx, word [r9 + r10*2]
test bx, bx
je 0x1400060b0
cmp r11b, 0x2d
je 0x140006124
lea ebp, [r11 - 0x30]
cmp bpl, 0xa
jb 0x140006124
lea ebp, [r11 - 0x61]
cmp bpl, 0x19
ja 0x1400060b0
movzx ebp, bx
cmp ebp, 0xff
mov r14d, 0xff
cmovb r14d, ebx
lea ebx, [r14 - 0x41]
mov ebp, r14d
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
cmovae ebx, r14d
cmp bl, r11b
jne 0x1400060b0
movzx r11d, byte [r10 + rdx + 1]
inc r10
cmp r10, 0x12
jne 0x140006100
cmp word [r9 + 0x24], 0
jne 0x1400060b0
nop word cs:[rax + rax]
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140006180
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov rax, qword [r13]
test rax, rax
je 0x140006280
lea rcx, str.contentproc
mov rdx, r13
jmp 0x1400061c1
mov rax, qword [rdx + 8]
add rdx, 8
test rax, rax
je 0x140006280
movzx r8d, word [rax]
cmp r8d, 0x2f
je 0x1400061f0
cmp r8d, 0x2d
jne 0x1400061b0
lea r8, [rax + 2]
lea r9, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r8, r9
jmp 0x1400061f7
add rax, 2
mov r8, rax
mov r9b, 0x63
xor eax, eax
nop dword [rax]
movzx r10d, word [r8 + rax*2]
test r10w, r10w
je 0x1400061b0
cmp r9b, 0x2d
je 0x140006225
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140006225
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x1400061b0
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x1400061b0
movzx r9d, byte [rax + rcx + 1]
inc rax
cmp rax, 0xb
jne 0x140006200
cmp word [r8 + 0x16], 0
jne 0x1400061b0
mov qword [rsi], 0
jmp 0x140007aeb
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xe8]
call fcn.140004930
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x6e0], xmm0
movdqa xmmword [rsp + 0x6d0], xmm0
movdqa xmmword [rsp + 0x6c0], xmm0
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x6c0]
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x140006372
mov rsi, r12
mov r8d, dword [rsp + 0x6e8]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14000638b
mov dword [rsp + 0x6c0], 0
mov byte [rsp + 0x6d8], 0
lea r12, [rsp + 0x6e0]
mov dword [rsp + 0x280], 0x209
lea r9, [rsp + 0x280]
mov rcx, r14
mov edx, 1
mov r8, r12
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400063b6
cmp byte [rsp + 0x6d8], 0
je 0x140007018
mov r12, qword [rsp + 0x6c8]
mov ebx, dword [rsp + 0x6d0]
mov r15b, 1
mov ebp, dword [rsp + 0x6d4]
jmp 0x1400063d9
mov ebp, eax
mov rsi, r12
or ebp, 0x10000000
lea r12, [0x1400f79ef]
mov ebx, 0x519
jmp 0x1400063ea
xor r12d, r12d
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400063d9
cmp eax, 0x57
je 0x1400063d9
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x5c
jmp 0x1400063cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x1e
mov r15b, 1
lea r12, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_SameBinary.h
mov rax, r14
inc rax
cmp rax, 2
jae 0x140006411
test r15b, r15b
je 0x14000641f
mov qword [rsp + 0x6c0], r12
mov dword [rsp + 0x6c8], ebx
mov dword [rsp + 0x6cc], ebp
lea rcx, [rsp + 0x6c0]
call fcn.140004800
xor ebp, ebp
jmp 0x140006426
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
jne 0x1400063ea
test r12b, r12b
sete bpl
lea rcx, [0x1400f7d55]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
mov r12, rsi
je 0x140006455
cmp byte [rax], 0
mov rsi, qword [rsp + 0x60]
je 0x14000645a
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov bpl, 1
jmp 0x14000645a
mov rsi, qword [rsp + 0x60]
mov rax, qword [r13]
test rax, rax
je 0x140006707
lea rcx, [rdi + 0x10]
mov r8, rax
jmp 0x140006480
mov r8, qword [rcx]
add rcx, 8
test r8, r8
je 0x140006707
movzx edx, word [r8]
cmp edx, 0x2f
je 0x1400064b0
cmp edx, 0x2d
jne 0x140006470
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x1400064b7
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x6c
jne 0x140006470
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x61
jne 0x140006470
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x75
jne 0x140006470
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x6e
jne 0x140006470
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x63
jne 0x140006470
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x68
jne 0x140006470
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x65
jne 0x140006470
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x140006470
movzx r9d, r8w
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, r8d
lea r8d, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp r8b, 0x1a
movzx r8d, r10b
cmovae r8d, r9d
cmp r8b, 0x72
jne 0x140006470
cmp word [rdx + 0x10], 0
jne 0x140006470
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400066e5
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov rax, qword [r13]
mov rsi, qword [rsp + 0x60]
jmp 0x140006710
test bpl, bpl
je 0x140006812
test rax, rax
je 0x14000681d
lea rcx, [rdi + 0x10]
lea rdx, str.force_launcher
mov r8, r13
jmp 0x140006745
mov rax, qword [r8 + 8]
add r8, 8
add rcx, 8
test rax, rax
je 0x14000681d
movzx r9d, word [rax]
cmp r9d, 0x2f
je 0x140006770
cmp r9d, 0x2d
jne 0x140006730
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
jmp 0x140006777
add rax, 2
mov r9, rax
mov r10b, 0x66
xor eax, eax
nop dword [rax]
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x140006730
cmp r10b, 0x2d
je 0x1400067a3
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x1400067a3
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x140006730
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov ebp, ebx
or bpl, 0x20
cmp r11b, 0x1a
movzx r11d, bpl
cmovae r11d, ebx
cmp r11b, r10b
jne 0x140006730
movzx r10d, byte [rax + rdx + 1]
inc rax
cmp rax, 0xe
jne 0x140006780
cmp word [r9 + 0x1c], 0
jne 0x140006730
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x1400067f0
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov r9d, 1
xor r8d, r8d
jmp 0x140006823
xor r9d, r9d
mov r8d, 1
jmp 0x140006823
xor r8d, r8d
xor r9d, r9d
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0xe8]
call fcn.14000cde0
movzx ebx, byte [rsp + 0x6d0]
test bl, bl
je 0x14000688e
lea rcx, [rsp + 0x6c0]
call fcn.140004800
xor r14d, r14d
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0xe8]
call fcn.140008190
cmp byte [rsp + 0x278], 0
je 0x1400068c2
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
jmp 0x140006942
cmp dword [rsp + 0x6c0], 0
je 0x140006c5b
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140006c01
cmp byte [rax], 0
je 0x140006c01
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x140006851
movzx eax, byte [rsp + 0x260]
mov rcx, qword [rsp + 0x261]
mov qword [rsp + 0x6c0], rcx
mov rcx, qword [rsp + 0x268]
mov qword [rsp + 0x6c7], rcx
mov rcx, qword [rsp + 0x270]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], 0
mov byte [rsp + 0xc0], al
mov rax, qword [rsp + 0x6c0]
mov rdx, qword [rsp + 0x6c7]
mov qword [rsp + 0xc1], rax
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], rcx
mov byte [rsp + 0xd8], 1
test bl, bl
sete al
test al, r14b
je 0x140006b90
mov eax, dword [0x1401376d8]
cmp eax, 0x3838
ja 0x140006a1e
mov eax, dword [0x140134014]
cmp eax, 0x383a
jb 0x140006a59
lea rcx, [rsp + 0x6c8]
mov r8d, 0x114
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x6c0], rax
mov dword [rsp + 0x6cc], 0x3839
mov rbx, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 1
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 4
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rbx
lea rcx, [rsp + 0x6c0]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, [0x140134014]
lea rdx, [0x1401376d8]
test eax, eax
cmove rdx, rcx
mov eax, 0x3839
xchg dword [rdx], eax
je 0x140006a59
movzx eax, byte [0x1401352e0]
test al, al
je 0x14000801c
mov rax, qword [0x1401376d0]
test rax, rax
je 0x140006a59
mov dword [rsp + 0x6c0], 4
lea rdx, [rsp + 0x6c0]
mov r8d, 4
mov ecx, 0xa
call rax
call fcn.140073be0
call fcn.1400088d0
test rdi, rdi
je 0x140006bb1
lea rcx, [rsp + 0x6c0]
xor edx, edx
call fcn.1400156d0
mov rax, qword [rsp + 0x6c0]
test rax, rax
je 0x140006bb1
mov qword [rdi], rax
mov r14, qword [rdi + 8]
test r14, r14
je 0x140007405
lea rax, [rdi + 0x10]
lea rcx, str.wait_for_browser
mov r9, r14
mov rdx, r13
jmp 0x140006ac5
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
je 0x140006c63
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x140006af0
cmp r8d, 0x2d
jne 0x140006ab0
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x140006af7
add r9, 2
mov r8, r9
mov r10b, 0x77
xor r9d, r9d
nop dword [rax]
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x140006ab0
cmp r10b, 0x2d
je 0x140006b23
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x140006b23
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x140006ab0
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov ebp, ebx
or bpl, 0x20
cmp r11b, 0x1a
movzx r11d, bpl
cmovae r11d, ebx
cmp r11b, r10b
jne 0x140006ab0
movzx r10d, byte [r9 + rcx + 1]
inc r9
cmp r9, 0x10
jne 0x140006b00
cmp word [r8 + 0x20], 0
jne 0x140006ab0
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140006b70
mov rax, qword [rsp + 0x58]
dec dword [rax]
mov r14, qword [r13]
jmp 0x140007433
lea rcx, [rsp + 0x6c0]
lea rdx, [rsp + 0xe8]
call fcn.1400085d0
cmp byte [rsp + 0x6d0], 0
jne 0x140006bda
jmp 0x140006be7
mov byte [rsp + 0x6d0], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6c0], rax
movabs rax, 0x8007050700000156
mov qword [rsp + 0x6c8], rax
lea rcx, [rsp + 0x6c0]
call fcn.140004800
mov qword [rsi], 0
cmp byte [rsp + 0xd8], 0
jne 0x140007aa6
jmp 0x140007abd
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
je 0x140006851
cmp word [rax], 0
je 0x140006851
xor r14d, r14d
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstoul
imul ebp, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov edx, eax
call fcn.140015c90
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006854
mov r14b, 1
jmp 0x140006854
lea rax, [rdi + 0x10]
mov rdx, r14
jmp 0x140006c80
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
je 0x140006f34
movzx ecx, word [rdx]
cmp ecx, 0x2f
je 0x140006ca0
cmp ecx, 0x2d
jne 0x140006c70
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
jmp 0x140006ca7
add rdx, 2
mov rcx, rdx
movzx edx, word [rcx]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6d
jne 0x140006c70
movzx edx, word [rcx + 2]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x61
jne 0x140006c70
movzx edx, word [rcx + 4]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x72
jne 0x140006c70
movzx edx, word [rcx + 6]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x69
jne 0x140006c70
movzx edx, word [rcx + 8]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6f
jne 0x140006c70
movzx edx, word [rcx + 0xa]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6e
jne 0x140006c70
movzx edx, word [rcx + 0xc]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140006c70
movzx edx, word [rcx + 0xe]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x74
jne 0x140006c70
movzx edx, word [rcx + 0x10]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x74
jne 0x140006c70
movzx edx, word [rcx + 0x12]
test dx, dx
je 0x140006c70
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x140006c70
cmp word [rcx + 0x14], 0
jne 0x140006c70
jmp 0x140007433
lea rax, str.backgroundtask
mov r8, r14
mov rcx, r13
jmp 0x140006f61
mov r8, qword [rcx + 8]
add rcx, 8
test r8, r8
je 0x1400070d4
movzx edx, word [r8]
cmp edx, 0x2f
je 0x140006f90
cmp edx, 0x2d
jne 0x140006f50
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x140006f97
add r8, 2
mov rdx, r8
mov r9b, 0x62
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x140006f50
cmp r9b, 0x2d
je 0x140006fc5
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x140006fc5
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x140006f50
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x140006f50
movzx r9d, byte [r8 + rax + 1]
inc r8
cmp r8, 0xe
jne 0x140006fa0
cmp word [rdx + 0x1c], 0
jne 0x140006f50
jmp 0x140007433
mov r8d, dword [rsp + 0x6c0]
lea rcx, [rsp + 0x1f0]
mov rdx, r12
call fcn.1400158b0
cmp byte [rsp + 0x208], 0
je 0x140007706
mov ebp, dword [rsp + 0x1fc]
cmp ebp, 0xd000003a
jne 0x14000775f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x280], 0
mov byte [rsp + 0x298], 0
lea rbp, [rsp + 0x2a0]
mov dword [rsp + 0x1f0], 0x209
lea r9, [rsp + 0x1f0]
mov qword [rsp + 0x68], rax
mov rcx, rax
mov edx, 1
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140007960
cmp byte [rsp + 0x298], 0
je 0x1400079c2
mov r12, qword [rsp + 0x288]
mov ebx, dword [rsp + 0x290]
mov r15b, 1
mov ebp, dword [rsp + 0x294]
mov rcx, qword [rsp + 0x68]
jmp 0x140007b41
lea rax, [rdi + 0x10]
mov rdx, r14
jmp 0x1400070f0
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
je 0x140007322
movzx ecx, word [rdx]
cmp ecx, 0x2f
je 0x140007110
cmp ecx, 0x2d
jne 0x1400070e0
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
jmp 0x140007117
add rdx, 2
mov rcx, rdx
movzx edx, word [rcx]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x68
jne 0x1400070e0
movzx edx, word [rcx + 2]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x1400070e0
movzx edx, word [rcx + 4]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x61
jne 0x1400070e0
movzx edx, word [rcx + 6]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x64
jne 0x1400070e0
movzx edx, word [rcx + 8]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x6c
jne 0x1400070e0
movzx edx, word [rcx + 0xa]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x65
jne 0x1400070e0
movzx edx, word [rcx + 0xc]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x73
jne 0x1400070e0
movzx edx, word [rcx + 0xe]
test dx, dx
je 0x1400070e0
movzx r8d, dx
cmp r8d, 0xff
mov r8d, 0xff
cmovb r8d, edx
lea edx, [r8 - 0x41]
mov r9d, r8d
or r9b, 0x20
cmp dl, 0x1a
movzx edx, r9b
cmovae edx, r8d
cmp dl, 0x73
jne 0x1400070e0
cmp word [rcx + 0x10], 0
jne 0x1400070e0
jmp 0x140007433
lea rax, str.remote_debugging_port
mov r8, r14
mov rcx, r13
jmp 0x140007351
mov r8, qword [rcx + 8]
add rcx, 8
test r8, r8
je 0x140007405
movzx edx, word [r8]
cmp edx, 0x2f
je 0x140007380
cmp edx, 0x2d
jne 0x140007340
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x140007387
add r8, 2
mov rdx, r8
mov r9b, 0x72
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x140007340
cmp r9b, 0x2d
je 0x1400073b5
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x1400073b5
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x140007340
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x140007340
movzx r9d, byte [r8 + rax + 1]
inc r8
cmp r8, 0x15
jne 0x140007390
cmp word [rdx + 0x2a], 0
jne 0x140007340
jmp 0x140007433
lea rcx, str.MOZ_AUTOMATION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14000741b
cmp byte [rax], 0
jne 0x140007433
lea rcx, str.MOZ_HEADLESS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor ebp, ebp
test rax, rax
je 0x140007438
cmp byte [rax], 0
je 0x140007438
mov ebp, 1
test r14, r14
je 0x14000765c
lea rax, [rdi + 0x10]
lea rcx, str.no_deelevate
mov r9, r14
mov rdx, r13
jmp 0x140007475
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
je 0x14000754e
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x1400074a0
cmp r8d, 0x2d
jne 0x140007460
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x1400074a7
add r9, 2
mov r8, r9
mov r10b, 0x6e
xor r9d, r9d
nop dword [rax]
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x140007460
cmp r10b, 0x2d
je 0x1400074d3
lea ebx, [r10 - 0x30]
cmp bl, 0xa
jb 0x1400074d3
lea ebx, [r10 - 0x61]
cmp bl, 0x19
ja 0x140007460
movzx ebx, r11w
cmp ebx, 0xff
mov ebx, 0xff
cmovb ebx, r11d
lea r11d, [rbx - 0x41]
mov r15d, ebx
or r15b, 0x20
cmp r11b, 0x1a
movzx r11d, r15b
cmovae r11d, ebx
cmp r11b, r10b
jne 0x140007460
movzx r10d, byte [r9 + rcx + 1]
inc r9
cmp r9, 0xc
jne 0x1400074b0
cmp word [r8 + 0x18], 0
jne 0x140007460
nop word cs:[rax + rax]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140007530
mov rax, qword [rsp + 0x58]
dec dword [rax]
or ebp, 2
mov r14, qword [r13]
test r14, r14
je 0x14000765c
lea rax, [rdi + 0x10]
lea rcx, str.attempting_deelevation
jmp 0x140007585
mov r14, qword [r13 + 8]
add r13, 8
add rax, 8
test r14, r14
je 0x14000765c
movzx edx, word [r14]
cmp edx, 0x2f
je 0x1400075b0
cmp edx, 0x2d
jne 0x140007570
lea rdx, [r14 + 2]
lea r8, [r14 + 4]
cmp word [r14 + 2], 0x2d
cmove rdx, r8
jmp 0x1400075b7
add r14, 2
mov rdx, r14
mov r9b, 0x61
xor r8d, r8d
nop dword [rax]
movzx r10d, word [rdx + r8*2]
test r10w, r10w
je 0x140007570
cmp r9b, 0x2d
je 0x1400075e5
lea r11d, [r9 - 0x30]
cmp r11b, 0xa
jb 0x1400075e5
lea r11d, [r9 - 0x61]
cmp r11b, 0x19
ja 0x140007570
movzx r11d, r10w
cmp r11d, 0xff
mov r11d, 0xff
cmovb r11d, r10d
lea r10d, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp r10b, 0x1a
movzx r10d, bl
cmovae r10d, r11d
cmp r10b, r9b
jne 0x140007570
movzx r9d, byte [r8 + rcx + 1]
inc r8
cmp r8, 0x16
jne 0x1400075c0
cmp word [rdx + 0x2c], 0
jne 0x140007570
nop word cs:[rax + rax]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140007640
mov rbx, qword [rsp + 0x58]
dec dword [rbx]
or ebp, 4
jmp 0x140007661
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x98], 0
mov rdx, qword [rdi]
lea rcx, [rsp + 0x248]
lea r9, [rsp + 0x98]
mov r8d, ebp
call fcn.140005940
cmp byte [rsp + 0x258], 0
je 0x1400076b3
lea rcx, [rsp + 0x248]
call fcn.140004800
mov qword [rsi], 0
mov r14, qword [rsp + 0x98]
jmp 0x140007a8e
mov r14, qword [rsp + 0x98]
mov r15d, 4
test r14, r14
je 0x140007776
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0xe8]
call fcn.1400085d0
cmp byte [rsp + 0x240], 0
je 0x1400077ed
lea rcx, [rsp + 0x230]
call fcn.140004800
mov qword [rsi], 0
jmp 0x140007a8e
mov dword [rsp + 0x280], 1
mov byte [rsp + 0x298], 0
lea r15, [rsp + 0x2a0]
xor ecx, ecx
mov rdx, r15
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x140007741
test eax, eax
jne 0x140007934
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ebx, 0x29
jmp 0x1400063cf
mov r12, qword [rsp + 0x1f0]
mov r15b, 1
mov ebx, dword [rsp + 0x1f8]
jmp 0x1400063d9
mov eax, dword [rsp + 0x248]
test eax, eax
je 0x1400079b3
xor r15d, r15d
cmp eax, 1
jne 0x1400076ca
mov r15d, 2
test bpl, 3
jne 0x1400076ca
mov r15d, 5
test bpl, 4
jne 0x1400076ca
mov edx, dword [rbx]
lea rcx, [rsp + 0x6c0]
mov r8, rdi
call fcn.140004c90
cmp byte [rsp + 0x6d0], 0
je 0x140007ece
lea rcx, [rsp + 0x6c0]
call fcn.140004800
mov qword [rsi], 0
xor r14d, r14d
jmp 0x140007a8e
mov edx, dword [rbx]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
mov r8, rdi
xor r9d, r9d
call fcn.140008a30
cmp qword [rsp + 0x90], 0
je 0x14000798d
lea rcx, [rsp + 0x88]
mov rdx, rbx
mov r8, rdi
mov r9d, 2
call fcn.140008ef0
cmp byte [rsp + 0x89], 0
je 0x140007a33
mov rsi, r12
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x208], 3
lea rax, [rsp + 0x210]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x228], 0
lea r13, [rsp + 0x1f0]
mov rcx, r13
call fcn.140009270
mov rbx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rbx
mov qword [rsp + 0x1d0], rax
mov ecx, 0xfffffff5
call rbx
mov qword [rsp + 0x1d8], rax
mov ecx, 0xfffffff4
call rbx
mov qword [rsp + 0x1e0], rax
lea rdx, [rsp + 0x1d0]
mov rcx, r13
call fcn.140009380
lea rcx, [rsp + 0x1b8]
lea r12, [rsp + 0x6c0]
mov rdx, r13
mov r8, r12
call fcn.1400094d0
cmp byte [rsp + 0x1c8], 0
je 0x140007b9a
lea rcx, [rsp + 0x1b8]
call fcn.140004800
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
lea rcx, [rsp + 0x1f0]
call fcn.140009c20
mov r12, rsi
mov rsi, qword [rsp + 0x60]
jmp 0x140007a70
cmp byte [rsp + 0x298], 0
je 0x140007b5a
mov r12, qword [rsp + 0x288]
mov ebx, dword [rsp + 0x290]
mov r15b, 1
mov ebp, dword [rsp + 0x294]
jmp 0x1400063d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r15b, 1
mov ebx, 0x1e
lea r12, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_SameBinary.h
mov rcx, qword [rsp + 0x68]
jmp 0x140007b41
mov byte [rsp + 0x6d0], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6c0], rax
movabs rax, 0x800705070000019e
jmp 0x140007a54
mov r15d, ebp
shr r15d, 1
or r15d, 1
jmp 0x1400076ca
cmp byte [rsp + 0x6d8], 0
mov rcx, qword [rsp + 0x68]
jne 0x140007b3b
mov eax, dword [rsp + 0x6c0]
or eax, dword [rsp + 0x280]
jne 0x140007b3b
lea rbx, [rsp + 0x1f0]
mov rcx, rbx
mov rdx, r12
call sub.ntdll.dll_RtlInitUnicodeString
lea r12, [rsp + 0x260]
mov rcx, r12
mov rdx, rbp
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
mov rdx, r12
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
mov rcx, qword [rsp + 0x68]
xor r12d, r12d
test al, al
setne r12b
xor r15d, r15d
jmp 0x140007b41
mov byte [rsp + 0x6d0], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0x6c0], rax
movabs rax, 0x80070057000001a5
mov qword [rsp + 0x6c8], rax
lea rcx, [rsp + 0x6c0]
call fcn.140004800
mov qword [rsi], 0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x140007a8e
call sub.mozglue.dll_free
lea rax, [r14 + 1]
cmp rax, 2
jae 0x140007b22
cmp byte [rsp + 0xd8], 0
je 0x140007abd
test byte [rsp + 0xc0], 1
je 0x140007abd
mov rcx, qword [rsp + 0xd0]
call sub.mozglue.dll_free
cmp byte [rsp + 0x278], 0
jne 0x140007ade
test byte [rsp + 0x260], 1
je 0x140007ade
mov rcx, qword [rsp + 0x270]
call sub.mozglue.dll_free
lea rcx, [rsp + 0xe8]
call fcn.140004b90
mov rax, qword [rsp + 0xb18]
xor rax, rsp
mov rcx, qword [r12]
cmp rcx, rax
jne 0x140008017
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb20]
add rsp, 0xb38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0xd8], 0
jne 0x140007aa6
jmp 0x140007abd
xor r12d, r12d
xor r15d, r15d
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400063d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400063d9
mov r8d, dword [rsp + 0x280]
lea rcx, [rsp + 0x260]
mov rdx, r15
call fcn.1400158b0
cmp byte [rsp + 0x278], 0
je 0x140007be8
mov r12, qword [rsp + 0x260]
mov ebx, dword [rsp + 0x268]
mov r15b, 1
mov ebp, dword [rsp + 0x26c]
jmp 0x1400063d9
xor ebx, ebx
cmp byte [rsp + 0x1b8], 0
je 0x140007bfe
mov r13d, 0x80404
cmp qword [rsp + 0x200], 0
je 0x140007c04
or byte [rsp + 0x6fd], 1
movdqa xmm0, xmmword [rsp + 0x1d0]
movdqu xmmword [rsp + 0x710], xmm0
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x720], rax
mov ebx, 1
jmp 0x140007c04
cmp byte [rsp + 0x208], 0
je 0x140007ee0
xor r12d, r12d
jmp 0x140007f1c
mov r13d, 0x404
xorps xmm6, xmm6
movaps xmmword [rsp + 0x280], xmm6
movaps xmmword [rsp + 0x2d0], xmm6
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2b0], xmm6
movaps xmmword [rsp + 0x2a0], xmm6
movaps xmmword [rsp + 0x290], xmm6
mov qword [rsp + 0x2e0], 0
mov dword [rsp + 0x280], 0x68
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x2bd], 8
je 0x140007c83
mov rax, qword [rsp + 0x298]
test rax, rax
je 0x140007c83
or byte [rsp + 0x6fd], 8
mov qword [rsp + 0x6d8], rax
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
mov rdx, qword [rdi]
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x70]
test r14, r14
je 0x140007cdd
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], 0
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140007d0c
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007d24
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
test bpl, 1
jne 0x140007d6e
xor eax, eax
jmp 0x140007d86
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0xb10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0xb00], rax
mov dword [rsp + 0xb08], 0x1e4
mov dword [rsp + 0xb0c], ecx
lea rcx, [rsp + 0xb00]
jmp 0x140007909
lea rcx, [rsp + 0xb00]
mov rdx, r12
call fcn.140009720
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x68], rax
cmp byte [rsp + 0x89], 0
je 0x140007ffd
cmp byte [rsp + 0x88], 0
setne bl
mov dword [rsp + 0x20], 0
lea r8, str.disabledynamicblocklist
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
xor r9d, r9d
call fcn.140008060
cmp eax, 1
sete al
cmp byte [rsp + 0x89], 0
je 0x140007ffd
or bl, al
mov rdi, qword [rdi]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xa9], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
cmp byte [rsp + 0xd8], 0
je 0x140007e19
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
call fcn.14007cf10
mov byte [rsp + 0xb8], 1
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea rcx, [rsp + 0x1a0]
mov rdx, rdi
mov r8, r12
mov r9d, r15d
call fcn.140009820
cmp byte [rsp + 0xb8], 0
je 0x140007e61
test byte [rsp + 0xa0], 1
je 0x140007e61
mov rcx, qword [rsp + 0xb0]
call sub.mozglue.dll_free
cmp byte [rsp + 0x1b0], 0
je 0x140007e97
lea rcx, [rsp + 0x1a0]
call fcn.140004800
mov rcx, r12
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
jmp 0x140007f8f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140007f24
test bpl, 1
jne 0x140007f6e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edx, edx
neg eax
sbb edx, edx
or edx, 0x2710
mov rcx, r12
call fcn.140009b70
jmp 0x140007f80
mov dword [rsi], 0
mov byte [rsi + 4], 1
xor r14d, r14d
jmp 0x140007a8e
movdqu xmm0, xmmword [rsp + 0x1f0]
movq xmm1, qword [rsp + 0x200]
movq xmm2, qword [rsp + 0x270]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x260]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor r12d, r12d
cmp eax, 0xffff
sete r12b
xor r15d, r15d
jmp 0x1400063d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0xb10], 1
lea rax, str._var_tmp_build_firefox_d8b47d80163d_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rsp + 0xb00], rax
mov dword [rsp + 0xb08], 0x1ff
mov dword [rsp + 0xb0c], ecx
lea rcx, [rsp + 0xb00]
jmp 0x140007e73
mov rcx, r12
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140007fd4
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov byte [rax + 4], 1
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140007fa4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r13 + 1]
cmp rax, 2
jb 0x140007fb7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 1]
cmp rax, 2
jb 0x14000791a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000791a
lea rdx, [rsp + 0xb00]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140007f80
mov eax, dword [rsp + 0xb00]
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rcx + 4], 1
jmp 0x140007f8f
mov dword [0], 0x2f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov ecx, 0x7f
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
call fcn.1400c8850
lea rcx, [0x1401352e0]
call fcn.1400c6e84
test eax, eax
je 0x140006a2d
lea rcx, [0x1401376c8]
lea rdx, [0x1400f76f4]
lea r8, [0x1400f770e]
call fcn.140008870
lea rcx, [0x1401352e0]
call fcn.1400c6f5f
jmp 0x140006a2d