Function at 0x14003bd60
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x438
movaps xmmword [rsp + 0x420], xmm6
mov rax, qword [0x1400a9028]
xor rax, rsp
mov qword [rsp + 0x418], rax
mov edi, 0x80070057
cmp ecx, 2
jl 0x14003bffa
mov rsi, rdx
cmp qword [rdx + 8], 0
je 0x14003bffa
mov ebx, ecx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003bec6
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003becd
mov rcx, qword [rsi + 8]
lea rdx, str.unregister_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003bf71
mov rcx, qword [rsi + 8]
lea rdx, str.debug_remote_disabled
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c301
lea rcx, [0x14009ee93]
lea rdx, str.DisableDefaultBrowserAgent
call fcn.140031580
mov edi, 0x800704ec
test al, al
jne 0x14003bf8d
mov rcx, qword [rsi + 8]
lea rdx, [0x1400a1068]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c028
mov rcx, qword [rsi + 8]
lea rdx, str.update_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c098
mov rcx, qword [rsi + 8]
lea rdx, str.do_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c2a4
mov rcx, qword [rsi + 8]
lea rdx, str.set_default_browser_user_choice
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
test eax, eax
jne 0x14003bf8d
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003bf8d
add rsi, 0x18
mov rdx, rsi
call fcn.1400349f0
jmp 0x14003bf8b
mov edi, eax
jmp 0x14003bffa
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
cmp qword [rsi + 0x10], 0
je 0x14003bf8d
lea rcx, [rsp + 0x68]
call fcn.14003d790
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
xor edx, edx
call fcn.140002650
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003bf48
lea rax, [rsp + 0xb0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20107
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003c23e
mov rcx, qword [rsp + 0x1a0]
mov qword [rsp + 0x1a0], 0
test rcx, rcx
je 0x14003bf66
call fcn.140058840
mov rcx, qword [rsi + 0x10]
mov edx, 1
jmp 0x14003bf86
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003bf8d
xor edx, edx
call fcn.140034410
mov edi, eax
cmp byte [rsp + 0x70], 0
mov rsi, qword [rsp + 0x68]
je 0x14003bfe1
test rsi, rsi
je 0x14003bfc6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14003bfe1
lea rcx, str.Failed_to_release_registry_mutex
lea rdx, str.Release
mov r8d, 0xc8
call fcn.14002d890
jmp 0x14003bfe1
lea rcx, str.Unexpectedly_missing_registry_mutex
lea rdx, str.Release
mov r8d, 0xc3
call fcn.14002d890
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003bff4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x418]
xor rcx, rsp
call fcn.140059960
mov eax, edi
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x438
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
cmp qword [rsi + 0x10], 0
je 0x14003bf8d
lea rcx, [rsp + 0x68]
call fcn.14003d790
lea r8, str.Installed
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032060
mov r9d, dword [rdi]
test r9d, r9d
je 0x14003c088
lea rcx, str.Failed_to_write_installation_registry_entry:__X
lea rdx, str.WriteInstallationRegistryEntry
mov r8d, 0x82
call fcn.14002d890
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.140032dc0
jmp 0x14003bf8b
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
cmp qword [rsi + 0x10], 0
je 0x14003bf8d
lea rcx, [rsp + 0x68]
call fcn.14003d790
lea r8, str.Installed
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032060
mov r9d, dword [rdi]
test r9d, r9d
je 0x14003c0f8
lea rcx, str.Failed_to_write_installation_registry_entry:__X
lea rdx, str.WriteInstallationRegistryEntry
mov r8d, 0x82
call fcn.14002d890
mov rbx, qword [rsi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140065030]
lea r9, [0x140065020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003c479
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
lea rbp, [rsp + 0xb0]
movaps xmmword [rbp], xmm0
xor eax, eax
mov qword [rbp + 0x10], rax
lea r9, [rsp + 0x3a0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x3f0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x3d0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], rbp
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c48c
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
lea rcx, [0x1400a1996]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
test rcx, rcx
je 0x14003c1de
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x140058b3e.0]
test eax, eax
jns 0x14003c761
mov rcx, rbx
xor edx, edx
call fcn.140032dc0
mov edi, eax
test rsi, rsi
je 0x14003c21b
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14003c4a2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
jmp 0x14003c4a2
mov r15, qword [rsp + 0xb0]
lea rax, [rsp + 0x3a0]
mov dword [rax], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x58], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14003c357
test r15, r15
je 0x14003bf48
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003bf48
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003bf8d
cmp qword [rsi + 0x10], 0
je 0x14003bf8d
lea rcx, [rsp + 0x68]
call fcn.14003d790
mov edi, 0x80070020
test al, al
je 0x14003bf8d
lea r8, str.AppLastRunTime
lea rbp, [rsp + 0x1a0]
mov rcx, rbp
xor edx, edx
call fcn.140032240
cmp dword [rbp + 0x10], 0
je 0x14003c4c5
mov edi, 0x80041324
jmp 0x14003bf8d
call fcn.140032670
movzx esi, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_IsAgentRemoteDisabled:
call fcn.14005c300
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor edi, edi
jmp 0x14003bf8d
mov edi, dword [rsp + 0x3a0]
inc edi
mov dword [rsp + 0x3a0], edi
lea r14, [rdi + rdi]
mov rcx, r14
call fcn.14005896c
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x3f0]
mov dword [r9], edi
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
xor edx, edx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0
test eax, eax
jne 0x14003c444
xorps xmm6, xmm6
lea r14, [rsp + 0x3f0]
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
mov rdi, qword [rsp + 0x1a0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003c40d
inc r12d
mov rcx, rbx
mov dx, 0x7c
call sub.VCRUNTIME140.dll_wcschr
test rax, rax
movzx ebp, bpl
mov eax, 1
cmovne ebp, eax
jmp 0x14003c419
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x3f0], eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov edx, r12d
mov r8, rbx
mov r9, r14
call r13
test eax, eax
je 0x14003c3ca
test r15, r15
je 0x14003c452
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, 1
jne 0x14003c46c
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, rbx
call fcn.140058840
jmp 0x14003bf48
mov edi, eax
lea rdx, str.UpdateTask
mov ecx, eax
mov r8d, 0xfc
jmp 0x14003c49d
mov edi, eax
lea rdx, str.UpdateTask
mov ecx, eax
mov r8d, 0xfe
call fcn.14002fad0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14003bf8d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
jmp 0x14003bf8d
cmp byte [rsp + 0x1a8], 0
je 0x14003c2f7
mov rdi, qword [rsp + 0x1a0]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x14003c50c
mov edi, 0x80041324
movabs rcx, 0x46b8e92d7fff
cmp rax, rcx
ja 0x14003bf8d
xor edi, edi
call fcn.140032670
test al, al
jne 0x14003bf8d
lea r15, [rsp + 0x3a0]
mov qword [r15], 0
mov qword [rsp + 0x20], r15
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor r12d, r12d
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003c921
mov rcx, qword [rsp + 0x3a0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rbp
lea rdx, str.http
mov r8d, 1
mov r9d, 1
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c94f
mov r14, qword [rsp + 0x1a0]
xor r12d, r12d
mov r8d, 0x200
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3f0]
mov dword [rax], 0x100
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov edx, 4
mov r8, r14
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003ca51
lea rdx, [0x14006a7d0]
mov r8d, 0xf0
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x1400a0148]
lea rcx, [rsp + 0x1a0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cae3
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x1a0]
mov r8d, 0xd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003ca6e
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0x1a0]
mov r8d, 0xe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003ca78
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x1a0]
mov r8d, 0x11
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003ca82
lea rdx, str.Opera
lea rcx, [rsp + 0x1a0]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003ca8c
lea rdx, str.Brave
lea rcx, [rsp + 0x1a0]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003ca96
lea rdx, str.Yandex
lea rcx, [rsp + 0x1a0]
mov r8d, 6
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003caa0
lea rdx, str.QQBrowser
lea rcx, [rsp + 0x1a0]
mov r8d, 9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003caaa
lea rdx, str.360
lea rcx, [rsp + 0x1a0]
mov r8d, 8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cadb
lea rdx, [0x14009ff30]
lea rcx, [rsp + 0x1a0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
xor ebp, ebp
mov r12d, 0
test eax, eax
jne 0x14003cb0f
lea rbx, [rsp + 0x188]
jmp 0x14003cae3
lea rdi, [rsp + 0x1a0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [0x1400a2526]
mov edx, 0x1e
mov rcx, rdi
call fcn.14005c1a0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rdi + 0x10]
mov rbp, qword [rdi + 0x18]
mov rdx, rbp
sub rdx, rcx
cmp rdx, rax
jb 0x14003c96f
lea r14, [rcx + rax]
mov qword [rsp + 0x1b0], r14
cmp rbp, 8
jb 0x14003c7cb
mov rdi, qword [rsp + 0x1a0]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rbx
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], 0
cmp qword [rsp + 0x1b8], 8
jb 0x14003c7f9
mov rcx, qword [rsp + 0x1a0]
jmp 0x14003c801
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x98]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov rdx, r14
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c910
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c93e
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c9b4
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov edx, 1
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c98c
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x78]
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003c98c
mov rbp, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, rbp
call fcn.140032dc0
mov edi, eax
test rbp, rbp
je 0x14003c998
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003c998
mov rcx, rbx
xor edx, edx
call fcn.140032dc0
mov edi, eax
jmp 0x14003c9f4
mov edi, eax
lea rdx, str.GetDefaultBrowser
mov ecx, eax
mov r8d, 0x41
call fcn.14002fad0
xor ebp, ebp
jmp 0x14003cb1f
mov rcx, rbx
xor edx, edx
call fcn.140032dc0
mov edi, eax
jmp 0x14003c9da
mov edi, eax
lea rdx, str.GetDefaultBrowser
mov ecx, eax
mov r8d, 0x4c
call fcn.14002fad0
xor ebp, ebp
xor r12d, r12d
jmp 0x14003cb1f
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1a0]
mov rdx, rax
mov r9, rbx
call fcn.14005c050
jmp 0x14003c7e4
mov rcx, rbx
xor edx, edx
call fcn.140032dc0
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14003c9c0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
jmp 0x14003c9c0
mov rcx, rbx
xor edx, edx
call fcn.140032dc0
mov edi, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14003c9da
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14003c9f4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14003ca0e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
test r14, r14
je 0x14003ca1c
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x1b8]
cmp rax, 8
jb 0x14003c20d
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003cab4
call fcn.140058840
jmp 0x14003c20d
mov edi, eax
lea rdx, str.GetDefaultBrowser
mov ecx, eax
mov r8d, 0x5c
call fcn.14002fad0
xor ebp, ebp
jmp 0x14003cb11
lea rbx, [rsp + 0xc8]
jmp 0x14003cae3
lea rbx, [rsp + 0xe0]
jmp 0x14003cae3
lea rbx, [rsp + 0xf8]
jmp 0x14003cae3
lea rbx, [rsp + 0x110]
jmp 0x14003cae3
lea rbx, [rsp + 0x128]
jmp 0x14003cae3
lea rbx, [rsp + 0x140]
jmp 0x14003cae3
lea rbx, [rsp + 0x158]
jmp 0x14003cae3
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14003d755
add rax, rax
add rax, 0x29
mov rdx, rax
jmp 0x14003ca47
lea rbx, [rsp + 0x170]
mov ebp, dword [rbx + 0x10]
cmp ebp, 4
jne 0x14003cb08
lea rdx, str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
mov r8d, 0x24
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cb6f
mov ebp, dword [rbx + 0x10]
mov r12d, ebp
shr r12d, 8
xor edi, edi
test r14, r14
je 0x14003cb1f
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x3a0]
test rcx, rcx
je 0x14003cb39
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
test edi, edi
jne 0x14003bf8d
shl r12d, 8
movzx r14d, bpl
or r14d, r12d
cmp r14d, 0xc
jae 0x14003cb77
movsxd rax, r14d
lea rcx, [0x14006aa30]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x3f0]
call fcn.14005c2a0
jmp 0x14003cb97
xor r12d, r12d
mov bpl, 3
jmp 0x14003cb0f
mov qword [rsp + 0x408], 0xf
mov qword [rsp + 0x400], 0
mov byte [rsp + 0x3f0], 0
lea r8, [0x1400a055e]
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov edx, 1
xor r9d, r9d
call fcn.14002f150
xorps xmm0, xmm0
movups xmmword [rsp + 0x3b0], xmm0
mov rbp, qword [rsp + 0x400]
cmp qword [rsp + 0x408], 0x10
jb 0x14003cbde
mov r12, qword [rsp + 0x3f0]
jmp 0x14003cbe6
lea r12, [rsp + 0x3f0]
cmp rbp, 0xf
ja 0x14003d52e
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x3a0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x3b0], rbp
mov qword [rsp + 0x3b8], rbx
mov byte [rsp + 0x3c0], 1
cmp dword [rsp + 0x1c8], 0
lea rcx, [rsp + 0xd8]
cmovne rdi, r15
add rdi, 0x28
xorps xmm0, xmm0
movaps xmmword [rcx - 0x28], xmm0
movaps xmmword [rcx - 0x18], xmm0
mov byte [rcx - 8], 0
mov rdx, rdi
call fcn.14005c5b0
cmp byte [rsp + 0x3c0], 0
je 0x14003cc85
mov rax, qword [rsp + 0x3b8]
cmp rax, 0x10
jae 0x14003cf1a
mov qword [rsp + 0x3b0], 0
mov qword [rsp + 0x3b8], 0xf
mov byte [rsp + 0x3a0], 0
cmp byte [rsp + 0xd0], 0
je 0x14003ccac
mov rdi, qword [rsp + 0xc0]
cmp qword [rsp + 0xc8], 0x10
jb 0x14003ccc9
mov rbx, qword [rsp + 0xb0]
jmp 0x14003ccdb
mov rdi, qword [rsp + 0x400]
cmp qword [rsp + 0x408], 0x10
jb 0x14003ccd3
mov rbx, qword [rsp + 0x3f0]
jmp 0x14003ccdb
lea rbx, [rsp + 0xb0]
jmp 0x14003ccdb
lea rbx, [rsp + 0x3f0]
cmp rdi, 0xf
ja 0x14003d578
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x3d0], xmm0
mov r12d, 0xf
cmp byte [rsp + 0xd0], 0
je 0x14003cd32
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x14003cf3d
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
cmp dword [rsp + 0x1c8], 0
jne 0x14003cd58
cmp byte [rsp + 0x1c0], 0
je 0x14003cd58
mov rax, qword [rsp + 0x1b8]
cmp rax, 0x10
jae 0x14003cf60
cmp qword [rsp + 0x408], 0x10
jb 0x14003cd6d
mov r8, qword [rsp + 0x3f0]
jmp 0x14003cd75
lea r8, [rsp + 0x3f0]
lea rdx, [0x1400a055e]
xor ebx, ebx
lea rcx, [rsp + 0x1a0]
xor r9d, r9d
call fcn.14002e680
cmp r12, 0x10
lea rax, [rsp + 0x3d0]
mov rcx, qword [rax]
cmovae rax, rcx
cmp rdi, 0xb
ja case.0x14003cdc1.1
lea rdx, [0x14006a6b0]
lea rbp, [0x14003d75c]
movsxd rdi, dword [rbp + rdi*4]
add rdi, rbp
jmp rdi
movzx eax, word [rax]
cmp eax, 0x6569
jne 0x14003cf13
lea rdx, [0x14006a728]
jmp case.0x14003cdc1.0
mov edx, 0x65726966
xor edx, dword [rax]
mov ebp, 0x786f6665
xor ebp, dword [rax + 3]
or ebp, edx
jne 0x14003cf13
lea rdx, str.firefox
jmp case.0x14003cdc1.0
movabs rdx, 0x73776f72622d7171
xor rdx, qword [rax]
movzx eax, word [rax + 8]
xor rax, 0x7265
or rax, rdx
jne 0x14003cf13
lea rdx, str.qq_browser
jmp case.0x14003cdc1.0
movabs rdx, 0x7268632d65676465
xor rdx, qword [rax]
movabs rbp, 0x656d6f7268632d65
xor rbp, qword [rax + 3]
or rbp, rdx
je 0x14003cf83
movabs rdx, 0x776f72622d303633
xor rdx, qword [rax]
movabs rbp, 0x726573776f72622d
xor rbp, qword [rax + 3]
or rbp, rdx
jne 0x14003cf13
lea rdx, str.360_browser
jmp case.0x14003cdc1.0
cmp dword [rax], 0x65676465
jne 0x14003cf13
lea rdx, str.edge
jmp case.0x14003cdc1.0
mov edx, 0x7265706f
xor edx, dword [rax]
movzx ebp, byte [rax + 4]
xor ebp, 0x61
or ebp, edx
je 0x14003cf8c
mov edx, 0x76617262
xor edx, dword [rax]
movzx ebp, byte [rax + 4]
xor ebp, 0x65
or ebp, edx
je 0x14003cf9e
mov edx, 0x6f676f73
xor edx, dword [rax]
movzx eax, byte [rax + 4]
xor eax, 0x75
or eax, edx
jne 0x14003cf13
lea rdx, str.sogou
jmp case.0x14003cdc1.0
mov edx, 0x6f726863
xor edx, dword [rax]
movzx ebp, word [rax + 4]
xor ebp, 0x656d
or ebp, edx
je 0x14003cf95
mov edx, 0x646e6179
xor edx, dword [rax]
movzx eax, word [rax + 4]
xor eax, 0x7865
or eax, edx
je 0x14003cfa7
xor ebx, ebx
jmp case.0x14003cdc1.1
mov rcx, qword [rsp + 0x3a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003d6f5
call fcn.140058840
jmp 0x14003cc65
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003d715
call fcn.140058840
jmp 0x14003cd12
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003d735
call fcn.140058840
jmp 0x14003cd58
lea rdx, str.edge_chrome
jmp case.0x14003cdc1.0
lea rdx, str.opera
jmp case.0x14003cdc1.0
lea rdx, [0x14006a6e0]
jmp case.0x14003cdc1.0
lea rdx, str.brave
jmp case.0x14003cdc1.0
lea rdx, str.yandex
mov ebx, dword [rdx + 0x10]
shl rbx, 0x20
cmp r12, 0x10
jae 0x14003d15b
mov rax, qword [rsp + 0x408]
cmp rax, 0x10
jae 0x14003d178
mov eax, r14d
or rbx, rax
mov qword [rsp + 0x3f0], rbx
lea rax, [rsp + 0xb0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003d0e1
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], r15
lea rdx, str..pdf
xor r8d, r8d
mov r9d, 1
call qword [case.0x140058b3e.0]
test eax, eax
js 0x14003d0f4
mov rdi, qword [rsp + 0x3a0]
mov dword [rsp + 0x3a0], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003d129
mov ebp, dword [rsp + 0x3a0]
add rbp, rbp
mov rcx, rbp
call fcn.14005896c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003d19b
lea rcx, [rsp + 0x1a0]
mov rdx, rbx
call fcn.140031ca0
jmp 0x14003d1cb
mov edi, eax
lea rdx, str.GetDefaultPdf
mov ecx, eax
mov r8d, 0x1d
jmp 0x14003d105
mov edi, eax
lea rdx, str.GetDefaultPdf
mov ecx, eax
mov r8d, 0x27
call fcn.14002fad0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x1c0], edi
jmp 0x14003d1e1
mov ebx, eax
lea rdx, str.GetDefaultPdf
mov ecx, eax
mov r8d, 0x36
call fcn.14002fad0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x1c0], ebx
jmp 0x14003d1d3
cmp r12, 0xfff
jae 0x14003d690
inc r12
mov rdx, r12
call fcn.140058840
jmp 0x14003cfbf
mov rcx, qword [rsp + 0x3f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003d6b1
call fcn.140058840
jmp 0x14003cfd1
mov ebp, eax
lea rdx, str.GetDefaultPdf
mov ecx, eax
mov r8d, 0x3f
call fcn.14002fad0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x1c0], ebp
mov rcx, rbx
call fcn.140058840
test rdi, rdi
je 0x14003d1e1
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14003d1fb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140058b3e.0]
mov edi, dword [rsp + 0x1c0]
test edi, edi
jne 0x14003bf8d
movaps xmm0, xmmword [rsp + 0x1a0]
movaps xmm1, xmmword [rsp + 0x1b0]
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm1
mov r14, qword [rsi + 0x10]
mov eax, dword [0x1400a9440]
cmp eax, 0x9ffffff
ja 0x14003d2e0
mov eax, dword [0x1400a9068]
cmp eax, 0xa000001
jb 0x14003d4d4
lea rdi, [rsp + 0x1ac]
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0xa0000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov rsi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rsi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rsi
lea rcx, [rsp + 0x1a0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14003d4c9
mov eax, 0xa000000
xchg dword [0x1400a9440], eax
lea r8, str.NeverShowNotificationAgain
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov edx, 1
call fcn.140031e60
cmp dword [rdi + 4], 0
jne 0x14003d315
movzx eax, word [rsp + 0x1a0]
cmp eax, 0x100
jb 0x14003d342
test al, al
je 0x14003d342
mov dword [rsp + 0x1a0], 0
movabs rax, 0x700000000
mov qword [rsp + 0x1a4], rax
mov dword [rsp + 0x1ac], 3
jmp 0x14003d608
lea r8, str.InitialNotificationShown
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov edx, 1
call fcn.140031e60
cmp dword [rdi + 4], 0
jne 0x14003d49e
movzx eax, word [rsp + 0x1a0]
cmp eax, 0x100
jb 0x14003d49e
test al, al
je 0x14003d49e
lea r8, str.FollowupRequestTime
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov edx, 1
call fcn.140032240
xor esi, esi
cmp byte [rdi + 8], 0
mov ebx, 0
je 0x14003d3b4
mov rbx, qword [rsp + 0x1a0]
lea rdi, [rsp + 0x1a0]
cmp dword [rdi + 0x10], 0
cmovne rbx, rsi
lea r8, str.FollowupNotificationShown
mov rcx, rdi
mov edx, 1
call fcn.140031e60
cmp dword [rdi + 4], 0
jne 0x14003d3ff
movzx eax, word [rsp + 0x1a0]
mov byte [rsp + 0x1a1], 0
cmp eax, 0x100
setae cl
test al, al
setne sil
and sil, cl
mov ebp, 7
test rbx, rbx
je 0x14003d5e4
test sil, sil
jne 0x14003d5e4
lea r8, str.FollowupNotificationSuppressed
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
mov edx, 1
call fcn.140031e60
cmp dword [rdi + 4], 0
jne 0x14003d44f
movzx eax, word [rsp + 0x1a0]
cmp eax, 0x100
jb 0x14003d44f
test al, al
jne 0x14003d5e4
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rdi]
mov ebp, 6
sub rax, rbx
jbe 0x14003d5e4
shr rax, 0xe
cmp rax, 0x1600a391
jb 0x14003d5e4
cmp dword [rsp + 0x3f0], 4
jne 0x14003d5c3
lea rcx, [rsp + 0x1a0]
mov edx, 1
jmp 0x14003d4bc
cmp dword [rsp + 0x3f0], 4
jne 0x14003d501
cmp dword [rsp + 0x3f4], 1
jne 0x14003d501
lea rcx, [rsp + 0x1a0]
xor edx, edx
mov r8, r14
call fcn.14002fbe0
jmp 0x14003d608
mov eax, 0xa000000
xchg dword [0x1400a9068], eax
mov dword [rsp + 0x1a0], 0
movabs rax, 0x700000000
mov qword [rsp + 0x1a4], rax
mov dword [rsp + 0x1ac], 2
jmp 0x14003d608
mov dword [rsp + 0x1a0], 0
movabs rax, 0x700000000
mov qword [rsp + 0x1a4], rax
mov dword [rsp + 0x1ac], 4
jmp 0x14003d608
mov rbx, rbp
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003d65b
lea rcx, [rbx + 1]
call fcn.140058850
mov rcx, rax
mov qword [rsp + 0x3a0], rcx
lea r8, [rbp + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003cc02
mov r12, rdi
or r12, 0xf
movabs rax, 0x7fffffffffffffff
cmp r12, rax
cmovae r12, rax
cmp r12, 0xfff
jae 0x14003d675
lea rcx, [r12 + 1]
call fcn.140058850
mov rcx, rax
mov qword [rsp + 0x3d0], rcx
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003ccf6
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0x1a0]
mov edx, 1
mov r9b, 1
call fcn.140032060
mov ebp, 5
mov dword [rsp + 0x1a0], 1
movabs rax, 0x700000000
mov qword [rsp + 0x1a4], rax
mov dword [rsp + 0x1ac], ebp
lea rcx, [rsp + 0x3f0]
lea rsi, [rsp + 0xb0]
lea r8, [rsp + 0x1a0]
mov rdx, rsi
call fcn.140036190
mov edi, eax
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14003bf8d
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003d6d5
call fcn.140058840
jmp 0x14003bf8d
lea rcx, [rbx + 0x28]
call fcn.140058850
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003d55f
lea rcx, [r12 + 0x28]
call fcn.140058850
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003d5aa
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003d755
add r12, 0x28
mov rcx, rax
jmp 0x14003d16b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003d755
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003d191
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003d755
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003d651
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003d755
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003cf33
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003d755
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003cf56
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003d755
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003cf79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3