Function at 0x140005ff0
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Query or enumerate registry value
Read file on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1418
call fcn.14001bf20
sub rsp, rax
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x1410], rax
cmp ecx, 2
jg 0x140006079
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000668e
lea rdx, str.Not_enough_command_line_arguments_to_execute_a_service_command
call fcn.140009d30
xor edi, edi
mov rcx, qword [rsp + 0x1410]
xor rcx, rsp
call fcn.140018440
mov eax, edi
add rsp, 0x1418
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rdx
mov edi, ecx
lea rbx, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.14000baa0
mov rcx, rbx
call fcn.140025ce0
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400060e3
cmp ecx, edx
jg 0x140006710
mov r8, qword [rsi + 0x10]
lea rdx, str.Executing_service_command__ls__ID:__ls
lea r9, [rsp + 0xb50]
call fcn.140009c20
jmp 0x1400060fb
cmp ecx, edx
jg 0x140006792
mov r8, qword [rsi + 0x10]
lea rdx, str.Executing_service_command__ls
call fcn.140009c20
mov rcx, qword [rsi + 0x10]
lea rdx, str.software_update
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140006199
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006751
mov r8, qword [rsi + 0x10]
lea rdx, str.Service_command_not_recognized:__ls.
call fcn.140009d30
xor edi, edi
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400066cf
test edi, edi
lea rax, str.Failure
lea r9, str.Success
cmove r9, rax
mov r8, qword [rsi + 8]
lea rdx, str.service_command__ls_complete_with_result:__ls.
call fcn.140009c20
jmp 0x140006053
cmp edi, 5
jb 0x1400061f2
mov rcx, qword [rsi + 0x20]
call fcn.140009e60
test al, al
je 0x1400061f2
lea r13, [rsi + 0x20]
mov rbx, qword [r13]
mov rcx, rbx
call fcn.14000a544
cmp rax, 9
ja 0x140006223
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006814
lea rdx, str.The_patch_directory_path_length_is_not_valid_for_this_application.
jmp 0x14000604c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400067d3
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application.
jmp 0x14000604c
lea rcx, [rbx + rax*2]
add rcx, 0xffffffffffffffec
lea rdx, str.updates0
mov r8d, 0xa
call fcn.140011f64
test eax, eax
je 0x140006272
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006855
lea rdx, str.The_patch_directory_path_subdirectory_is_not_valid_for_this_application.
jmp 0x14000604c
mov rbx, qword [r13]
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
mov rcx, r14
call fcn.14000a170
test eax, eax
je 0x1400062ee
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, [0x14002fa5c]
mov rcx, rbx
mov r8, r14
call fcn.14000a270
test eax, eax
je 0x1400062ee
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x1400062ee
lea rcx, [rsp + 0xff0]
call fcn.140012220
lea rcx, [rsp + 0xff0]
call fcn.14000a170
test eax, eax
je 0x140006353
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, str..status
mov rcx, rbx
mov r8, r14
call fcn.14000a270
test eax, eax
je 0x140006353
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x140006353
lea rcx, [rsp + 0xff0]
call fcn.140012220
lea rcx, [rsp + 0xff0]
call fcn.14000a170
test eax, eax
je 0x1400063b8
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, [0x14002f85a]
mov rcx, rbx
mov r8, r14
call fcn.14000a270
test eax, eax
je 0x1400063b8
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x1400063b8
lea rcx, [rsp + 0xff0]
call fcn.140012220
mov rbx, qword [r13]
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
mov rcx, r14
call fcn.140025ce0
test eax, eax
je 0x140006432
lea r14, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
mov rcx, r14
call fcn.14000a170
test eax, eax
je 0x140006432
lea r14, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, [0x14002fa5c]
mov rcx, rbx
mov r8, r14
call fcn.14000a270
test eax, eax
jne 0x140006463
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140006c6e
lea rdx, str.Unable_to_write_to_secure_ID_file.
jmp 0x14000604c
lea rcx, [rsp + 0xd60]
lea rdx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x140006432
lea rdx, [0x14002fb84]
lea rcx, [rsp + 0xd60]
call fcn.140012148
test rax, rax
je 0x140006432
mov rbx, rax
lea rdx, str._ls_n
lea r14, [rsp + 0xff0]
mov rcx, rax
mov r8, r14
call fcn.140025bb0
mov ebp, eax
mov rcx, rbx
call fcn.140012248
cmp ebp, 0xffffffff
je 0x140006432
cmp edi, 6
jb 0x1400068ac
mov rcx, qword [rsi + 0x28]
call fcn.140009e60
test al, al
je 0x1400068ac
mov r15, qword [rsi + 0x28]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400068ac
mov ebp, eax
mov r12d, eax
add r12, r12
mov rcx, r12
call fcn.14000a484
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14000baa0
mov rcx, r15
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400068a4
lea r9, [rsp + 0x1200]
mov qword [r9], 0
lea rcx, [0x140027010]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400068a4
mov r12, qword [rsp + 0x1200]
mov rcx, r12
call fcn.14000a544
test rax, rax
je 0x140006896
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x14000692b
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.140011f64
test eax, eax
je 0x14000699c
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [rsp + 0x1200], 0
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea r8, [0x14002f69c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400068a4
mov ebp, dword [rsp + 0x1200]
cmp rbp, 4
jb 0x1400068a4
mov r15d, ebp
and r15d, 0xfffffffe
mov rcx, r15
call fcn.14000a484
mov r12, rax
mov dword [rsp + 0x50], 0
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000baa0
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea r8, [0x14002f69c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r15b, 1
test eax, eax
je 0x140006caf
mov rcx, r12
call fcn.14000a48c
mov rcx, rbx
call fcn.14000a48c
test r15b, r15b
je 0x1400068ac
cmp byte [rsp + 0x50], 0
jne 0x1400069ad
jmp 0x1400068ac
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006045
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006045
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006170
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006170
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400060c9
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400060c9
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006139
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006139
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400060eb
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400060eb
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006217
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006217
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400061e6
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400061e6
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006266
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006266
test r12, r12
je 0x1400068a4
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.14000a48c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400070d9
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application.
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x37
call fcn.14000a330
xor edi, edi
test eax, eax
jne 0x140006053
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000739d
lea rdx, str.Could_not_write_update.status_for_previous_failure.
call fcn.140009d30
jmp 0x140006053
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rcx
mov rcx, rax
add rcx, 2
mov qword [rsp + 0x58], rcx
lea rax, [rax + rax + 4]
mov r15, 0xffffffffffffffff
cmovns r15, rax
mov rcx, r15
call fcn.14000a484
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000baa0
mov rcx, rbp
mov rdx, qword [rsp + 0x58]
mov r9, r12
call fcn.140009de0
mov rcx, rbx
mov rdx, rbp
mov r8, qword [rsp + 0x50]
call fcn.140011f64
mov r15d, eax
mov rcx, rbp
call fcn.14000a48c
test r15d, r15d
jne 0x140006594
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call fcn.14000a48c
lea ebp, [rdi - 3]
cmp ebp, 4
jne 0x1400069cb
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14002fb68]
call fcn.140013c18
test eax, eax
jne 0x1400069d1
jmp 0x1400069ea
jb 0x140006be8
mov rcx, qword [rsi + 0x30]
lea rdx, str._replace
call fcn.14000bd5c
test rax, rax
je 0x140006b56
lea rbx, [rsi + 0x18]
lea r15, [rsp + 0x940]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.14000baa0
mov ecx, ebp
mov rdx, rbx
mov r8, r15
call fcn.1400051e0
test eax, eax
je 0x140006b17
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaMaintenanceService3932ecacee736d366d6436db0f55bce4
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140006d79
lea rcx, [rsp + 0x940]
lea rdx, [rsp + 0x1200]
call fcn.140001100
test eax, eax
je 0x140006c27
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007d59
lea rdx, str.Checking_for_Maintenance_Service_registry._key:__ls
lea r15, [rsp + 0x1200]
mov r8, r15
call fcn.140009c20
mov qword [rsp + 0xff0], 0
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20119
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140006d83
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007ddb
lea rdx, str.The_maintenance_service_registry_key_does_not_exist.
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x39
jmp 0x140006c30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007d18
lea rdx, str.Could_not_get_the_installation_directory
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x21
jmp 0x140006c30
mov rbx, qword [rsi + 0x30]
movzx ecx, word [rbx]
test cx, cx
je 0x1400069ea
add rbx, 2
call fcn.1400134dc
test eax, eax
jne 0x140006b5a
cmp edi, 7
jl 0x140006be8
mov rcx, qword [rsi + 0x30]
call fcn.140009e60
test al, al
je 0x140006be8
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, 0x104
call fcn.140011f64
test eax, eax
je 0x1400069ea
cmp edi, 8
jae 0x140006ea2
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000834d
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x36
jmp 0x1400068e6
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007cd7
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application.
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x38
jmp 0x1400068e6
mov rcx, qword [r13]
mov edx, 0x35
call fcn.14000a330
test eax, eax
jne 0x140006051
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007d9a
lea rdx, str.Could_not_write_update.status_for_previous_failure.
jmp 0x14000604c
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006457
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006457
shr rbp, 1
mov rcx, r12
mov rdx, rbp
call fcn.140013c6c
test rax, rax
je 0x140006cef
cmp word [r12 + rax*2 - 2], 0x5c
jne 0x140006cfc
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.140011f64
test eax, eax
jne 0x140006d6b
mov r15b, 1
mov al, 1
mov dword [rsp + 0x50], eax
jmp 0x140006665
mov dword [rsp + 0x50], 0
jmp 0x140006665
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rcx
mov rcx, rax
add rcx, 2
mov qword [rsp + 0x58], rcx
lea rax, [rax + rax + 4]
mov rbp, 0xffffffffffffffff
cmovns rbp, rax
mov rcx, rbp
call fcn.14000a484
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.14000baa0
mov rcx, r15
mov rdx, qword [rsp + 0x58]
mov r9, r12
call fcn.140009de0
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x50]
call fcn.140011f64
mov ebp, eax
mov rcx, r15
call fcn.14000a48c
test ebp, ebp
je 0x140006ce1
mov al, 1
mov dword [rsp + 0x50], eax
xor r15d, r15d
jmp 0x140006665
mov rcx, qword [rsp + 0x1200]
jmp 0x140006d8b
mov rcx, qword [rsp + 0xff0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, [rsp + 0x730]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, [rsp + 0x940]
mov r8d, 0x104
mov rcx, r14
call fcn.14000a494
lea rdx, str.updater.exe
mov rcx, r14
call int.140025c90
test eax, eax
jne 0x140006e03
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000823d
lea rdx, str.Install_directory_updater_could_not_be_determined.
call fcn.140009d30
mov r8, qword [r13]
lea rcx, [rsp + 0x730]
lea rdx, [rsp + 0x940]
call fcn.140005300
mov r14d, eax
lea rcx, [rsp + 0x520]
mov r8d, 0x20a
xor edx, edx
call fcn.14000baa0
test r14b, r14b
je 0x140006f8f
lea rdx, [rsp + 0x520]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140006f52
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140007090
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008338
lea rdi, str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x140006f7e
mov rcx, qword [rsi + 0x38]
lea rdx, [0x14002fb68]
call fcn.140013c18
test eax, eax
je 0x140006ecf
mov rcx, qword [rsi + 0x38]
lea rdx, str._replace
call fcn.14000bd5c
test rax, rax
je 0x140006ba9
mov r9, qword [rsi + 0x30]
lea rbx, [rsp + 0x1200]
mov rcx, rbx
call fcn.140008a90
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140007048
mov rdx, qword [rsi + 0x28]
lea rcx, [rsp + 0x1200]
mov r8d, 0x104
call fcn.140011f64
test eax, eax
je 0x1400069ea
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400083d6
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x34
jmp 0x140006c30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000838e
lea rdi, str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____lu_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov r8d, eax
call fcn.140009d30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007ee8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_copy_path_to_secure_location.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x31
call fcn.14000a330
xor edi, edi
test eax, eax
jne 0x14000700e
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000827e
lea rdx, str.Could_not_write_update.status_could_not_copy_updater_error
call fcn.140009d30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007f29
mov r8, qword [rsi + 0x10]
lea rdx, str.Service_command__ls_complete.
call fcn.140009c20
jmp 0x14000614b
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008417
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_remove_file_spec_when_attempting_to_verify_the_working_directory_path.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x47
jmp 0x140006c30
lea rdx, [0x14002f8f2]
lea rcx, [rsp + 0x520]
call int.140025c90
test eax, eax
jne 0x14000711a
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400073e6
lea rdi, str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x140006f7e
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400068d1
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400068d1
lea r14, [rsp + 0x520]
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.updater.exe
mov rcx, r14
call int.140025c90
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400073de
cmp ecx, edx
jg 0x14000846b
mov r8, qword [rbx]
mov qword [rsp + 0x20], r14
lea rdx, str.Passed_in_path:__ls__ignored___Install_dir_has:__ls__Using_this_path_for_updating:__ls.
lea r15, [rsp + 0x730]
mov r9, r15
call fcn.140009c20
mov rcx, r14
call fcn.140005e20
mov rcx, r15
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140006f8f
mov qword [rbx], r14
lea rcx, [rsp + 0x310]
mov r8d, 0x20a
xor edx, edx
call fcn.14000baa0
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.14000baa0
mov rcx, r14
call fcn.14000a544
cmp rax, 0x104
ja 0x140007215
lea r14, [rsp + 0x100]
lea rdx, [rsp + 0x520]
mov r8d, 0x105
mov rcx, r14
call fcn.14000a494
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140007be6
lea r14, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
mov ecx, ebp
mov rdx, rbx
mov r8, r14
call fcn.1400051e0
test eax, eax
je 0x1400073fe
mov r8, qword [r13]
mov rcx, qword [rbx]
lea rdx, [rsp + 0xd60]
call fcn.140005300
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test al, al
je 0x14000747d
cmp ecx, edx
jg 0x1400084ac
lea rdx, str.Starting_update_process_as_the_service_in_session_0.
call fcn.140009c20
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf70], xmm0
movaps xmmword [rsp + 0xf80], xmm0
movaps xmmword [rsp + 0xf90], xmm0
movaps xmmword [rsp + 0xfa0], xmm0
movaps xmmword [rsp + 0xfb0], xmm0
movaps xmmword [rsp + 0xfc0], xmm0
xor r15d, r15d
mov qword [rsp + 0xfd0], r15
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xf70], 0x68
lea rax, str.winsta0Default
mov qword [rsp + 0xf80], rax
mov eax, ebp
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov r14, qword [rbx + r15*8]
mov rcx, r14
call fcn.14000a544
mov r12, rax
mov rcx, r14
mov dx, 0x22
call fcn.14000bc30
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r14
mov rcx, r14
lea rdx, [0x14002ce90]
call fcn.140014008
lea ecx, [r12 + 2]
test rax, rax
cmove ecx, r12d
cmp qword [rsp + 0x60], 0
jne 0x14000736c
mov rax, qword [rsp + 0x50]
add eax, ecx
inc eax
mov qword [rsp + 0x50], rax
inc r15
cmp r15, qword [rsp + 0x58]
jne 0x140007307
jmp 0x1400074f1
xor eax, eax
mov rdx, qword [rsp + 0x68]
movzx edx, word [rdx]
cmp edx, 0x22
je 0x14000738b
cmp edx, 0x5c
je 0x140007393
mov eax, 0
test edx, edx
jne 0x140007395
jmp 0x14000734f
add ecx, eax
inc ecx
xor eax, eax
jmp 0x140007395
inc eax
add qword [rsp + 0x68], 2
jmp 0x14000736e
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000691a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000691a
cmp ecx, edx
jle 0x1400070cd
lea rcx, [0x140038330]
call fcn.14000a740
lea rdi, str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x1400083a1
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400084ed
lea rdx, str.Could_not_get_the_installation_directory
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x21
call fcn.14000a330
xor edi, edi
test eax, eax
jne 0x140007bd4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000852e
lea rdx, str.Could_not_write_update.status_for_GetInstallationDir_failure.
call fcn.140009d30
jmp 0x140007bd4
cmp ecx, edx
jg 0x14000856f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_start_process_due_to_certificate_check_error_on_updater.exe._Updating_update.status.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, qword [r13]
mov edx, 0x1a
call fcn.14000a330
xor edi, edi
test eax, eax
jne 0x140007bd4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400085b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_write_pending_state_to_update.status.____lu_
mov r8d, eax
call fcn.140009d30
jmp 0x140007bd4
mov rcx, qword [rsp + 0x50]
test ecx, ecx
mov eax, 1
cmovne eax, ecx
lea rcx, [rax + rax]
test eax, eax
mov r14, 0xffffffffffffffff
cmovns r14, rcx
mov rcx, r14
call fcn.14000a484
mov r12, rax
xor r15d, r15d
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.14000baa0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x50], r12
mov r14, qword [rbx + r15*8]
mov rcx, r14
mov dx, 0x22
call fcn.14000bc30
mov r12, rax
mov rcx, r14
lea rdx, [0x14002ce90]
call fcn.140014008
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400075ba
test r12, r12
jne 0x1400075cf
mov r12, qword [rsp + 0x50]
mov rcx, r12
mov rdx, r14
call fcn.140013c50
mov rcx, r14
call fcn.14000a544
lea r12, [r12 + rax*2]
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x60], 0
jne 0x140007632
inc r15
cmp r15, qword [rsp + 0x58]
je 0x14000764a
mov rax, qword [rsp + 0x50]
mov word [rax], 0x20
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007536
mov rax, qword [rsp + 0x50]
mov word [rax], 0x22
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007562
xor eax, eax
movzx ecx, word [r14]
cmp ecx, 0x22
je 0x1400075ea
cmp ecx, 0x5c
je 0x14000760d
mov eax, 0
test ecx, ecx
jne 0x14000761b
jmp 0x140007588
test eax, eax
js 0x140007615
inc eax
mov rcx, qword [rsp + 0x50]
mov word [rcx], 0x5c
add rcx, 2
mov qword [rsp + 0x50], rcx
dec eax
jne 0x1400075f0
movzx ecx, word [r14]
jmp 0x140007619
inc eax
mov cx, 0x5c
jmp 0x14000761b
mov cx, 0x22
xor eax, eax
mov rdx, qword [rsp + 0x50]
mov word [rdx], cx
add rdx, 2
mov qword [rsp + 0x50], rdx
add r14, 2
jmp 0x1400075d1
mov rax, qword [rsp + 0x50]
mov word [rax], 0x22
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140007594
mov rax, qword [rsp + 0x50]
mov word [rax], 0
cmp ebp, 4
jne 0x14000766f
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14002fb68]
call fcn.140013c18
test eax, eax
jne 0x140007674
jmp 0x1400076a3
cmp edi, 7
jl 0x1400076a3
mov rcx, qword [rsi + 0x30]
lea rdx, str._replace
call fcn.14000bd5c
test rax, rax
jne 0x1400076a3
mov r14, qword [rsi + 0x30]
movzx ecx, word [r14]
test cx, cx
je 0x1400076a3
add r14, 2
call fcn.1400134dc
test eax, eax
jne 0x14000768d
lea rax, [0x14002fb8a]
mov qword [rsp + 0xf80], rax
or byte [rsp + 0xfac], 1
mov word [rsp + 0xfb0], 0
lea rcx, str.MOZ_USING_SERVICE1
call fcn.140011494
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400085f1
lea rdx, str.Starting_service_with_cmdline:__ls
mov r14, qword [rsp + 0x68]
mov r8, r14
call fcn.140009c20
mov rcx, qword [rbx]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x1400077c5
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008632
lea rdx, str.Process_was_started..._waiting_on_result.
call fcn.140009c20
mov rcx, qword [rsp + 0x90]
mov edx, 0xdbba0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15d, eax
cmp eax, 0x102
jne 0x140007813
mov rcx, qword [rsp + 0x90]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x58], 0
xor ebp, ebp
jmp 0x14000789e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008673
mov r8, qword [rbx]
mov dword [rsp + 0x20], r14d
lea rdx, str.Could_not_create_process_as_current_user__updaterPath:__ls__cmdLine:__ls.____lu_
mov r9, qword [rsp + 0x68]
call fcn.140009d30
xor ebp, ebp
jmp 0x140007946
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x1200]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140007880
cmp ecx, edx
jg 0x1400086b4
mov r8d, dword [rsp + 0x1200]
lea rdx, str.Process_finished_with_return_code__lu.
call fcn.140009c20
xor ebp, ebp
cmp dword [rsp + 0x1200], 0
sete bpl
mov dword [rsp + 0x58], 0
jmp 0x14000789e
cmp ecx, edx
jg 0x1400086f5
lea rdx, str.Process_finished_but_could_not_obtain_return_code.
call fcn.140009d30
xor ebp, ebp
mov dword [rsp + 0x58], 1
mov rcx, qword [rsp + 0x90]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rcx, qword [rsp + 0x98]
call r14
mov r14, qword [r13]
lea r12, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r12
xor edx, edx
call fcn.14000baa0
mov rcx, r12
call fcn.14000a170
test eax, eax
je 0x140007915
lea r12, [rsp + 0x1200]
mov r8d, 0x20a
mov rcx, r12
xor edx, edx
call fcn.14000baa0
lea rdx, str..status
mov rcx, r14
mov r8, r12
call fcn.14000a270
test eax, eax
jne 0x140007e2a
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008736
lea rdx, str.Could_not_get_path_for_the_secure_update_status_file
call fcn.140009d30
lea rcx, str.MOZ_USING_SERVICE
call fcn.140011494
mov rcx, qword [rsp + 0x68]
call fcn.14000a48c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test ebp, ebp
je 0x1400079e5
cmp eax, ecx
jg 0x140008777
lea rdx, str.updater.exe_was_launched_and_run_successfully_
call fcn.140009c20
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400087b8
mov rcx, qword [0x140038120]
test rcx, rcx
je 0x1400079c9
call fcn.140012330
cmp edi, 7
je 0x140007a92
cmp edi, 8
jne 0x140007aaf
mov eax, 4
jmp 0x140007a97
cmp eax, ecx
jg 0x1400087f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_running_update_process._Updating_update.status____lu_
mov r8d, eax
call fcn.140009d30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000883a
mov rcx, qword [0x140038120]
test rcx, rcx
je 0x140007a38
call fcn.140012330
xor edi, edi
cmp dword [rsp + 0x50], 0
jne 0x140007bd4
mov rcx, qword [r13]
mov edx, 0x18
call fcn.14000a330
test eax, eax
jne 0x140007bd4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000887b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_write_update.status_service_update_failure.____lu_
jmp 0x1400074e4
mov eax, 3
mov rcx, qword [rbx + rax*8]
lea rdx, [0x14002fb68]
call fcn.140013c18
test eax, eax
je 0x140007bcf
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, 1
test rax, rax
je 0x140007bd4
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
je 0x140007bd4
lea r9, [rsp + 0xfc]
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140007b24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140007e1c
lea r15, [rsp + 0xfc]
mov r12d, dword [r15]
mov rcx, r12
call fcn.14000a484
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14000baa0
mov rcx, r14
mov rdx, rbx
mov r8d, r12d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebp, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
je 0x140007bc5
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea rcx, [rsp + 0x1200]
mov r8d, 0x20a
xor edx, edx
call fcn.14000baa0
mov r14, qword [rbx + 0x10]
mov rcx, r14
call fcn.14000a544
cmp rax, 0x104
ja 0x140007bc5
lea r15, [rsp + 0x1200]
mov r8d, 0x105
mov rcx, r15
mov rdx, r14
call fcn.14000a494
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000807e
mov rcx, rbx
call fcn.14000a48c
jmp 0x140007bd4
mov edi, 1
lea rcx, [rsp + 0x520]
call fcn.140005e20
jmp 0x14000700e
lea rdx, str.updater.ini
lea rcx, [rsp + 0x100]
call int.140025c90
test eax, eax
je 0x140007215
lea rcx, [rsp + 0x730]
call fcn.14000a544
cmp rax, 0x104
ja 0x140007215
lea r14, [rsp + 0x310]
lea rdx, [rsp + 0x730]
mov r8d, 0x105
mov rcx, r14
call fcn.14000a494
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140007215
lea rdx, str.updater.ini
lea rcx, [rsp + 0x310]
call int.140025c90
test eax, eax
je 0x140007215
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x100]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140007215
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400088bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.Could_not_copy_updater.ini_from:__ls_to__ls.____lu_
lea r8, [rsp + 0x310]
lea r9, [rsp + 0x100]
call fcn.140009d30
jmp 0x140007215
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006c0d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006c0d
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006b3c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006b3c
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006a8f
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006a8f
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006c62
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006c62
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006afd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006afd
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140007bd4
lea rcx, [rsp + 0xff0]
lea rdx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x140007915
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xff0]
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140007f6a
xorps xmm0, xmm0
lea rdx, [rsp + 0x1200]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007f98
movabs rax, 0x676e69796c707061
xor r14d, r14d
cmp qword [rsp + 0x1200], rax
sete r14b
mov r12d, 1
jmp 0x140007fcf
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006fb4
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006fb4
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007033
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007033
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400088fd
lea rdx, str.Could_not_open_update.status_file
jmp 0x140007fc4
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000893e
lea rdx, str.Could_not_read_from_update.status_file
call fcn.140009d30
xor r14d, r14d
xor r12d, r12d
mov rax, qword [rsp + 0x60]
inc rax
cmp rax, 2
jb 0x140007fe8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x140007946
test r14d, r14d
je 0x140007946
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test ebp, ebp
je 0x1400082bf
cmp eax, ecx
jg 0x14000897f
lea rdx, str.update.status_is_still_applying_even_though_update_was_successful.
call fcn.140009c20
mov rcx, qword [r13]
mov edx, 0x1d
call fcn.14000a330
xor ebp, ebp
test eax, eax
jne 0x140007946
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400089c0
lea rdx, str.Could_not_write_update.status_still_applying_on_success_error.
jmp 0x140007941
lea rdx, str.maintenanceservice_tmp.exe
lea rcx, [rsp + 0x1200]
call int.140025c90
test eax, eax
je 0x140007bc5
lea rcx, [rsp + 0xd60]
call fcn.14000a544
cmp rax, 0x104
ja 0x140007bc5
lea r14, [rsp + 0xff0]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000baa0
lea rdx, [rsp + 0xd60]
mov r8d, 0x104
mov rcx, r14
call fcn.14000a494
lea rdx, [0x14002f8b2]
mov rcx, r14
call int.140025c90
lea rdx, [rsp + 0x1200]
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007bc5
lea r14, [rsp + 0xd60]
lea rdx, [rsp + 0x1200]
mov rcx, r14
mov r8d, 1
call fcn.140008b10
test eax, eax
je 0x140008458
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
xor r12d, r12d
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0x90], 0x68
lea rax, [0x14002fb8a]
mov qword [rsp + 0xa0], rax
lea r13, [rsp + 0x70]
mov qword [r13 + 0x10], r12
movaps xmmword [r13], xmm0
lea r15, [rsp + 0xf70]
movaps xmmword [r15 + 0x70], xmm0
movaps xmmword [r15 + 0x60], xmm0
movaps xmmword [r15 + 0x50], xmm0
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.dummyparam.exe_upgrade
mov r8d, 0x3f
mov rcx, r15
call fcn.14000a494
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x1200]
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007bc5
mov rcx, qword [rsp + 0x70]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rcx, qword [rsp + 0x78]
call r14
jmp 0x140007bc5
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006df7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006df7
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007002
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007002
cmp eax, ecx
jg 0x140008a01
lea rdx, str.update.status_is_still_applying_and_update_was_not_successful.
call fcn.140009d30
cmp r15d, 0x102
mov eax, 0x32
mov ecx, 0x1e
cmove ecx, eax
cmp dword [rsp + 0x58], 0
mov edx, 0x33
cmove edx, ecx
mov rcx, qword [r13]
call fcn.14000a330
xor ebp, ebp
test eax, eax
jne 0x140007946
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008a42
lea rdx, str.Could_not_write_update.status_still_applying_on_failure_error.
jmp 0x140007941
lea rcx, [0x140038330]
call fcn.14000a740
lea rdi, str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x1400083a1
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006bce
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006bce
lea rcx, [0x140038330]
call fcn.14000a740
lea rdi, str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____lu_
cmp dword [0x140038330], 0xffffffff
jne 0x140006f7e
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006f7e
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140006f38
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140006f38
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000706d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000706d
lea rcx, [rsp + 0x1200]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140007bc5
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000716b
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000716b
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007285
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007285
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007423
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007423
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000746c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000746c
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007485
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007485
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400074d7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400074d7
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400076f5
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400076f5
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000777a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000777a
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400077f3
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400077f3
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007854
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007854
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007888
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007888
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000793a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000793a
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007987
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007987
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400079b8
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400079b8
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400079ed
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400079ed
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007a27
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007a27
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007a80
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007a80
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007cac
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007cac
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007f8f
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007f8f
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140007fbd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140007fbd
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140008029
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140008029
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140008072
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140008072
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400082c7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400082c7
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000832c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000832c