Function at 0x14003c300
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov edi, 0x80070057
cmp ecx, 2
jl 0x14003c697
mov rsi, rdx
cmp qword [rdx + 8], 0
je 0x14003c697
mov ebx, ecx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003c555
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c55c
mov rcx, qword [rsi + 8]
lea rdx, str.unregister_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c600
mov rcx, qword [rsi + 8]
lea rdx, str.debug_remote_disabled
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cc36
lea rcx, [0x1400a0413]
lea rdx, str.DisableDefaultBrowserAgent
call fcn.140031b70
mov edi, 0x800704ec
test al, al
jne 0x14003c61c
mov rcx, qword [rsi + 8]
lea rdx, [0x1400a2486]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c6c5
mov rcx, qword [rsi + 8]
lea rdx, str.update_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c73e
mov rcx, qword [rsi + 8]
lea rdx, str.do_task
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003c953
mov rcx, qword [rsi + 8]
lea rdx, str.set_default_browser_user_choice
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x14003cc8c
mov rcx, qword [rsi + 8]
lea rdx, str.set_default_extension_handlers_user_choice
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
test eax, eax
jne 0x14003c61c
mov r12, qword [rsi + 0x10]
test r12, r12
je 0x14003c61c
lea rdi, [rsp + 0x2e0]
mov rcx, rdi
call fcn.140059140
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003ce0e
lea rbp, [rsi + 0x18]
add rsi, 0x20
lea r14, [rsp + 0xb0]
cmp qword [rbp], 0
je 0x14003cdf4
mov rdx, qword [rsi]
test rdx, rdx
je 0x14003cdf4
mov rcx, r14
mov r8, r12
call fcn.14005b280
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rbp]
mov rdx, rdi
call fcn.1400353e0
test al, al
je 0x14003c4f5
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rbp]
call fcn.140035840
test al, al
je 0x14003c4fd
add rbp, 0x10
add rsi, 0x10
mov bl, 1
jmp 0x14003c505
mov r15d, 0x80004005
jmp 0x14003c503
mov r15d, 0xa0000003
xor ebx, ebx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
test rcx, rcx
je 0x14003c523
call fcn.1400574f0
test bl, bl
jne 0x14003c49a
cmp r15d, 0xa0000003
jne 0x14003ce62
mov ecx, 0x8000000
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 0xa0000003
jmp 0x14003ce85
mov edi, eax
jmp 0x14003c697
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
cmp qword [rsi + 0x10], 0
je 0x14003c61c
lea rcx, [rsp + 0x68]
call fcn.14003dfd0
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400019f0
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003c5d7
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20107
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003c8ed
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
test rcx, rcx
je 0x14003c5f5
call fcn.1400574f0
mov rcx, qword [rsi + 0x10]
mov edx, 1
jmp 0x14003c615
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003c61c
xor edx, edx
call fcn.1400348f0
mov edi, eax
cmp byte [rsp + 0x70], 0
mov rsi, qword [rsp + 0x68]
je 0x14003c67e
test rsi, rsi
je 0x14003c65c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14003c67e
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_release_registry_mutex
lea r8, str.Release
mov r9d, 0xc8
call fcn.14002cf00
jmp 0x14003c67e
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpectedly_missing_registry_mutex
lea r8, str.Release
mov r9d, 0xc3
call fcn.14002cf00
xor esi, esi
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003c691
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.140058610
mov eax, edi
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
cmp qword [rsi + 0x10], 0
je 0x14003c61c
lea rcx, [rsp + 0x68]
call fcn.14003dfd0
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032660
mov eax, dword [rdi]
test eax, eax
je 0x14003c72e
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002cf00
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.1400331b0
jmp 0x14003c61a
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
cmp qword [rsi + 0x10], 0
je 0x14003c61c
lea rcx, [rsp + 0x68]
call fcn.14003dfd0
lea r8, str.Installed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
mov r9b, 1
call fcn.140032660
mov eax, dword [rdi]
test eax, eax
je 0x14003c7a7
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_write_installation_registry_entry:__X
lea r8, str.WriteInstallationRegistryEntry
mov r9d, 0x82
call fcn.14002cf00
mov rbx, qword [rsi + 0x10]
lea rax, [rsp + 0xa8]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140065030]
lea r9, [0x140065020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003cdda
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
lea rbp, [rsp + 0x2e0]
movaps xmmword [rbp], xmm0
xor eax, eax
mov qword [rbp + 0x10], rax
lea r9, [rsp + 0x2b0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x330]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x310]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], rbp
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003ce18
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
lea rcx, [0x1400a2de6]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], rbp
test rcx, rcx
je 0x14003c88d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x1400577ee.0]
test eax, eax
jns 0x14003ced3
mov rcx, rbx
xor edx, edx
call fcn.1400331b0
mov edi, eax
test rsi, rsi
je 0x14003c8ca
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14003ce35
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
jmp 0x14003ce35
mov r15, qword [rsp + 0x2e0]
lea rax, [rsp + 0x2b0]
mov dword [rax], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x58], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14003ccb8
test r15, r15
je 0x14003c5d7
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003c5d7
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
cmp qword [rsi + 0x10], 0
je 0x14003c61c
lea rcx, [rsp + 0x68]
call fcn.14003dfd0
mov edi, 0x80070020
test al, al
je 0x14003c61c
lea r8, str.AppLastRunTime
lea rbp, [rsp + 0xb0]
mov rcx, rbp
xor edx, edx
call fcn.140032840
cmp dword [rbp + 0x10], 0
jne 0x14003ce58
cmp byte [rsp + 0xb8], 0
je 0x14003ce58
mov rdi, qword [rsp + 0xb0]
lea rbx, [rsp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbx]
sub rax, rdi
jbe 0x14003c9ed
mov edi, 0x80041324
movabs rcx, 0x46b8e92d7fff
cmp rax, rcx
ja 0x14003c61c
xor edi, edi
call fcn.140032a50
test al, al
jne 0x14003c61c
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x20], rbx
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor r15d, r15d
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003cf6b
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rbp
lea rdx, str.http
mov r8d, 1
mov r9d, 1
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d0a1
mov r14, qword [rsp + 0xb0]
xor r15d, r15d
mov r8d, 0x200
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x2b0]
mov dword [rax], 0x100
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov edx, 4
mov r8, r14
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003d0d7
lea rdx, [0x1400a1636]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d107
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0xb0]
mov r8d, 0xd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d1f4
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0xb0]
mov r8d, 0xe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d1fb
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0xb0]
mov r8d, 0x11
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d202
lea rdx, str.Opera
lea rcx, [rsp + 0xb0]
mov edi, 5
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d209
lea rdx, str.Brave
lea rcx, [rsp + 0xb0]
mov r8d, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d20e
lea rdx, str.Yandex
lea rcx, [rsp + 0xb0]
mov edi, 6
mov r8d, 6
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d20e
lea rdx, str.QQBrowser
lea rcx, [rsp + 0xb0]
mov r8d, 9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d7ba
lea rdx, str.360
lea rcx, [rsp + 0xb0]
mov edi, 8
mov r8d, 8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d20e
lea rdx, [0x1400a141e]
lea rcx, [rsp + 0xb0]
mov r8d, 7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
xor r15d, r15d
mov edi, 0
test eax, eax
jne 0x14003d244
mov edi, 9
jmp 0x14003d20e
call fcn.140032a50
movzx esi, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_IsAgentRemoteDisabled:
call fcn.14005b7e0
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor edi, edi
jmp 0x14003c61c
mov edi, 0x80070057
cmp ebx, 3
jb 0x14003c61c
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14003c61c
add rsi, 0x18
mov rdx, rsi
call fcn.140034f00
jmp 0x14003c61a
mov edi, dword [rsp + 0x2b0]
inc edi
mov dword [rsp + 0x2b0], edi
lea r14, [rdi + rdi]
mov rcx, r14
call fcn.14005753c
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x330]
mov dword [r9], edi
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
xor edx, edx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, 0
test eax, eax
jne 0x14003cda5
xorps xmm6, xmm6
lea r14, [rsp + 0x330]
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebp, ebp
mov rdi, qword [rsp + 0xb0]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003cd6e
inc r12d
mov rcx, rbx
mov dx, 0x7c
call sub.VCRUNTIME140.dll_wcschr
test rax, rax
movzx ebp, bpl
mov eax, 1
cmovne ebp, eax
jmp 0x14003cd7a
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsp + 0x2b0]
mov dword [rsp + 0x330], eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov edx, r12d
mov r8, rbx
mov r9, r14
call r13
test eax, eax
je 0x14003cd2b
test r15, r15
je 0x14003cdb3
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, 1
jne 0x14003cdcd
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, rbx
call fcn.1400574f0
jmp 0x14003c5d7
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfc
jmp 0x14003ce30
xor edi, edi
mov ecx, 0x8000000
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x14003ceac
mov edi, 0x80004005
jmp 0x14003c61c
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.UpdateTask
mov edx, eax
mov r9d, 0xfe
call fcn.14002cdf0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14003c61c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
jmp 0x14003c61c
mov edi, 0x80041324
jmp 0x14003c61c
xor edi, edi
mov ecx, 0x8000000
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 0x80004005
cmp r15d, 0x80004005
jne 0x14003ceac
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x20], r12
lea rdx, str.Failed_setting_default_with__s
lea r8, str.SetDefaultExtensionHandlersUserChoice
mov r9d, 0x14b
call fcn.14002cf00
mov edi, esi
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0x2e0], 0
test rcx, rcx
je 0x14003c61c
call fcn.1400574f0
jmp 0x14003c61c
lea rdi, [rsp + 0xb0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, [0x1400a3976]
mov edx, 0x1e
mov rcx, rdi
call fcn.14005b6e0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rdi + 0x10]
mov rbp, qword [rdi + 0x18]
mov rdx, rbp
sub rdx, rcx
cmp rdx, rax
jb 0x14003d1d7
lea r14, [rcx + rax]
mov qword [rsp + 0xc0], r14
cmp rbp, 8
jb 0x14003cf3d
mov rdi, qword [rsp + 0xb0]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rbx
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], 0
cmp qword [rsp + 0xc8], 8
jb 0x14003cf8d
mov rcx, qword [rsp + 0xb0]
jmp 0x14003cf95
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x41
call fcn.14002cdf0
jmp 0x14003d252
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x98]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov rdx, r14
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d0c6
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d0f9
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d136
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov edx, 1
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d10e
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x78]
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003d10e
mov rbp, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, rbp
call fcn.1400331b0
mov edi, eax
test rbp, rbp
je 0x14003d11a
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003d11a
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x4c
call fcn.14002cdf0
xor r15d, r15d
jmp 0x14003d252
mov rcx, rbx
xor edx, edx
call fcn.1400331b0
mov edi, eax
jmp 0x14003d176
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultBrowser
mov edx, eax
mov r9d, 0x5c
call fcn.14002cdf0
jmp 0x14003d244
mov rcx, rbx
xor edx, edx
call fcn.1400331b0
mov edi, eax
jmp 0x14003d15c
xor edi, edi
jmp 0x14003d20e
mov rcx, rbx
xor edx, edx
call fcn.1400331b0
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14003d142
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
jmp 0x14003d142
mov rcx, rbx
xor edx, edx
call fcn.1400331b0
mov edi, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14003d15c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14003d176
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14003d190
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
test r14, r14
je 0x14003d19e
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x14003c8bc
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003d8a8
call fcn.1400574f0
jmp 0x14003c8bc
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
mov rdx, rax
mov r9, rbx
call fcn.14005b590
jmp 0x14003cf56
mov edi, 1
jmp 0x14003d20e
mov edi, 2
jmp 0x14003d20e
mov edi, 3
jmp 0x14003d20e
mov edi, 4
lea rax, [rdi + rdi*2]
lea rcx, [0x14006ae40]
mov r15d, dword [rcx + rax*8 + 0x10]
cmp r15d, 4
jne 0x14003d242
lea rdx, str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
mov r8d, 0x24
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14003d2c7
xor edi, edi
test r14, r14
je 0x14003d252
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003d26c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
test edi, edi
jne 0x14003c61c
cmp r15d, 0xb
ja 0x14003d2d4
movsxd rax, r15d
lea rcx, [0x14006b0a0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov r9, qword [rax]
mov rdi, qword [rax + 8]
lea rcx, [rsp + 0x330]
cmp rdi, 0xf
jbe 0x14003d2f6
mov rdx, rdi
call fcn.140001070
jmp 0x14003d30d
xor edi, edi
mov r15d, 3
jmp 0x14003d244
mov qword [rsp + 0x348], 0xf
mov qword [rsp + 0x340], 0
mov byte [rsp + 0x330], 0
jmp 0x14003d30d
mov qword [rcx + 0x10], rdi
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x330], 0
lea r8, [0x1400a1a2e]
lea rcx, [rsp + 0xb0]
mov edx, 1
xor r9d, r9d
call fcn.14002f720
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov rbp, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d351
mov r14, qword [rsp + 0x330]
jmp 0x14003d359
lea r14, [rsp + 0x330]
cmp rbp, 0xf
ja 0x14003d7f2
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x2b0], xmm0
mov edi, 0xf
mov qword [rsp + 0x2c0], rbp
mov qword [rsp + 0x2c8], rdi
mov byte [rsp + 0x2d0], 1
cmp dword [rsp + 0xd8], 0
lea rcx, [rsp + 0x308]
jne 0x14003debf
lea rdx, [rsp + 0xd8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2f0], xmm0
movaps xmmword [rsp + 0x2e0], xmm0
mov byte [rsp + 0x300], 0
call fcn.14005ba80
cmp byte [rsp + 0x2d0], 0
je 0x14003d406
mov rax, qword [rsp + 0x2c8]
cmp rax, 0x10
jae 0x14003d751
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2c8], 0xf
mov byte [rsp + 0x2b0], 0
cmp byte [rsp + 0x300], 0
je 0x14003d42d
mov rdi, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x14003d452
mov rbx, qword [rsp + 0x2e0]
jmp 0x14003d452
mov rdi, qword [rsp + 0x340]
cmp qword [rsp + 0x348], 0x10
jb 0x14003d44a
mov rbx, qword [rsp + 0x330]
jmp 0x14003d452
lea rbx, [rsp + 0x330]
cmp rdi, 0xf
ja 0x14003d828
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x310], xmm0
mov ebp, 0xf
cmp byte [rsp + 0x300], 0
je 0x14003d4a8
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jae 0x14003d774
mov qword [rsp + 0x2f0], 0
mov qword [rsp + 0x2f8], 0xf
mov byte [rsp + 0x2e0], 0
cmp dword [rsp + 0xd8], 0
jne 0x14003d4ce
cmp byte [rsp + 0xd0], 0
je 0x14003d4ce
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x14003d797
cmp qword [rsp + 0x348], 0x10
jb 0x14003d4e3
mov r8, qword [rsp + 0x330]
jmp 0x14003d4eb
lea r8, [rsp + 0x330]
lea rdx, [0x1400a1a2e]
lea rcx, [rsp + 0xb0]
xor r9d, r9d
call fcn.14002ec20
cmp rbp, 0x10
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
cmovae rax, rcx
cmp rdi, 0xb
ja case.0x14003d52d.1
lea rdx, [0x14003df98]
movsxd rbx, dword [rdx + rdi*4]
add rbx, rdx
jmp rbx
movzx eax, word [rax]
rol ax, 8
movzx eax, ax
cmp eax, 0x6965
jne case.0x14003d52d.1
movabs rdi, 0x500000000
jmp case.0x14003d52d.0
mov edx, dword [rax]
bswap edx
mov ebx, 0x66697265
cmp edx, 0x66697265
jne 0x14003d578
mov edx, dword [rax + 3]
bswap edx
mov ebx, 0x65666f78
xor eax, eax
cmp edx, 0x65666f78
je 0x14003d583
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d52d.1
movabs rdi, 0x100000000
jmp case.0x14003d52d.0
movabs rbx, 0x71712d62726f7773
mov rdx, qword [rax]
bswap rdx
cmp rdx, rbx
jne 0x14003d5c9
movzx eax, word [rax + 8]
rol ax, 8
movzx edx, ax
xor eax, eax
cmp edx, 0x6572
je 0x14003d5d5
mov ebx, 0x6572
xor eax, eax
cmp rdx, rbx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d52d.1
movabs rdi, 0x900000000
jmp case.0x14003d52d.0
movabs rdx, 0x656467652d636872
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d619
movabs rdx, 0x652d6368726f6d65
mov rbx, qword [rax + 3]
bswap rbx
xor edi, edi
cmp rbx, rdx
je 0x14003d626
xor edi, edi
cmp rbx, rdx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003d85e
movabs rdx, 0x3336302d62726f77
mov rbx, qword [rax]
bswap rbx
cmp rbx, rdx
jne 0x14003d65b
movabs rdx, 0x2d62726f77736572
mov rbx, qword [rax + 3]
bswap rbx
xor eax, eax
cmp rbx, rdx
je 0x14003d667
xor eax, eax
cmp rbx, rdx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d52d.1
movabs rdi, 0xa00000000
jmp case.0x14003d52d.0
mov eax, dword [rax]
bswap eax
xor edx, edx
cmp eax, 0x65646766
setae dl
cmp eax, 0x65646765
sbb edx, 0
jne case.0x14003d52d.1
movabs rdi, 0x300000000
jmp case.0x14003d52d.0
mov edx, dword [rax]
bswap edx
cmp edx, 0x6f706572
jne 0x14003d7c4
movzx edx, byte [rax + 4]
add edx, 0xffffff9f
jmp 0x14003d7ce
mov edx, dword [rax]
bswap edx
mov ebx, 0x6368726f
cmp edx, 0x6368726f
jne 0x14003d6f0
movzx edx, word [rax + 4]
rol dx, 8
movzx edx, dx
mov ebx, 0x6d65
xor edi, edi
cmp edx, 0x6d65
je 0x14003d6fc
xor edi, edi
cmp edx, ebx
setae dil
add edi, edi
dec edi
test edi, edi
je 0x14003d879
mov edx, dword [rax]
bswap edx
mov ebx, 0x79616e64
cmp edx, 0x79616e64
jne 0x14003d72f
movzx eax, word [rax + 4]
rol ax, 8
movzx edx, ax
mov ebx, 0x6578
xor eax, eax
cmp edx, 0x6578
je 0x14003d73a
xor eax, eax
cmp edx, ebx
setae al
add eax, eax
dec eax
test eax, eax
jne case.0x14003d52d.1
movabs rdi, 0x800000000
jmp case.0x14003d52d.0
mov rcx, qword [rsp + 0x2b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003df31
call fcn.1400574f0
jmp 0x14003d3e6
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003df51
call fcn.1400574f0
jmp 0x14003d488
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003df71
call fcn.1400574f0
jmp 0x14003d4ce
mov edi, 7
jmp 0x14003d20e
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003d86d
mov edx, dword [rax]
bswap edx
cmp edx, 0x62726176
jne 0x14003d885
movzx edx, byte [rax + 4]
add edx, 0xffffff9b
jmp 0x14003d88f
mov rdi, rbp
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003de54
lea rcx, [rdi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003de69
mov rbp, rdi
or rbp, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
cmovae rbp, rax
cmp rbp, 0xfff
jae 0x14003de82
lea rcx, [rbp + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003de97
movabs rdi, 0x400000000
jmp case.0x14003d52d.0
movabs rdi, 0x600000000
jmp case.0x14003d52d.0
movabs rdi, 0x200000000
jmp case.0x14003d52d.0
setae dl
movzx edx, dl
add edx, edx
dec edx
test edx, edx
je 0x14003d8cf
mov edx, dword [rax]
bswap edx
cmp edx, 0x736f676f
jne 0x14003d8db
movzx eax, byte [rax + 4]
add eax, 0xffffff8b
jmp 0x14003d8e5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003df91
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003d1cd
movabs rdi, 0x700000000
jmp case.0x14003d52d.0
setae al
movzx eax, al
add eax, eax
dec eax
test eax, eax
je 0x14003deb0
xor edi, edi
cmp rbp, 0x10
jae 0x14003dab2
mov rax, qword [rsp + 0x348]
cmp rax, 0x10
jae 0x14003dacf
mov eax, r15d
or rdi, rax
mov qword [rsp + 0x330], rdi
lea rax, [rsp + 0x2e0]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400650f0]
lea r9, [0x140065110]
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003da23
mov rcx, qword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea r14, [rsp + 0x2b0]
mov qword [rsp + 0x20], r14
lea rdx, str..pdf
xor r8d, r8d
mov r9d, 1
call qword [case.0x1400577ee.0]
test eax, eax
js 0x14003da3d
mov rdi, qword [rsp + 0x2b0]
mov dword [rsp + 0x2b0], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003da79
mov ebp, dword [rsp + 0x2b0]
add rbp, rbp
mov rcx, rbp
call fcn.14005753c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 4
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x14003daf2
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140032280
jmp 0x14003db29
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x1d
jmp 0x14003da55
mov edi, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x27
call fcn.14002cdf0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], edi
jmp 0x14003db3f
mov ebx, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x36
call fcn.14002cdf0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebx
jmp 0x14003db31
cmp rbp, 0xfff
jae 0x14003decc
inc rbp
mov rdx, rbp
call fcn.1400574f0
jmp 0x14003d8f9
mov rcx, qword [rsp + 0x330]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003deed
call fcn.1400574f0
jmp 0x14003d90b
mov ebp, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetDefaultPdf
mov edx, eax
mov r9d, 0x3f
call fcn.14002cdf0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xd0], ebp
mov rcx, rbx
call fcn.1400574f0
test rdi, rdi
je 0x14003db3f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x14003db59
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400577ee.0]
mov edi, dword [rsp + 0xd0]
test edi, edi
jne 0x14003c61c
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x2e0], xmm0
movups xmmword [rsp + 0x2f0], xmm1
mov rsi, qword [rsi + 0x10]
mov eax, dword [0x1400aa4c0]
cmp eax, 0x9ffffff
ja 0x14003dc3e
mov eax, dword [0x1400aa088]
cmp eax, 0xa000001
jb 0x14003ddbb
lea rdi, [rsp + 0xbc]
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0xa0000011c
mov qword [rdi - 0xc], rax
mov dword [rdi - 4], 0
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rdi
lea rcx, [rsp + 0xb0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14003ddb0
mov eax, 0xa000000
xchg dword [0x1400aa4c0], eax
lea r8, str.InitialNotificationShown
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032460
cmp dword [rdi + 4], 0
jne 0x14003dd88
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003dd88
movzx eax, al
test ax, ax
je 0x14003dd88
lea r8, str.FollowupRequestTime
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032840
xor ebp, ebp
cmp byte [rdi + 8], 0
mov ebx, 0
je 0x14003dcb4
mov rbx, qword [rsp + 0xb0]
lea rdi, [rsp + 0xb0]
cmp dword [rdi + 0x10], 0
cmovne rbx, rbp
lea r8, str.FollowupNotificationShown
mov rcx, rdi
mov edx, 1
call fcn.140032460
cmp dword [rdi + 4], 0
jne 0x14003dcf7
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
setae cl
test al, al
setne bpl
and bpl, cl
test rbx, rbx
je 0x14003dde4
test bpl, bpl
jne 0x14003dde4
lea r8, str.FollowupNotificationSuppressed
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov edx, 1
call fcn.140032460
cmp dword [rdi + 4], 0
jne 0x14003dd46
movzx eax, word [rsp + 0xb0]
cmp eax, 0x100
jb 0x14003dd46
movzx eax, al
test ax, ax
jne 0x14003dde4
lea rdi, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rdi]
sub rax, rbx
jbe 0x14003dde4
shr rax, 0xe
cmp rax, 0x1600a391
jb 0x14003dde4
cmp dword [rsp + 0x330], 4
jne 0x14003ddc8
lea rcx, [rsp + 0xb0]
mov edx, 1
jmp 0x14003dda6
cmp dword [rsp + 0x330], 4
jne 0x14003ddbb
cmp dword [rsp + 0x334], 1
jne 0x14003ddbb
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rsi
call fcn.1400300b0
jmp 0x14003de01
mov eax, 0xa000000
xchg dword [0x1400aa088], eax
mov dword [rsp + 0xb0], 0
jmp 0x14003ddef
lea r8, str.FollowupNotificationSuppressed
lea rcx, [rsp + 0xb0]
mov edx, 1
mov r9b, 1
call fcn.140032660
mov dword [rsp + 0xb0], 1
movabs rax, 0x700000000
mov qword [rsp + 0xb4], rax
lea rcx, [rsp + 0x330]
lea rsi, [rsp + 0x2e0]
lea r8, [rsp + 0xb0]
mov rdx, rsi
call fcn.140036710
mov edi, eax
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14003c61c
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003df11
call fcn.1400574f0
jmp 0x14003c61c
lea rcx, [rdi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x2b0], rcx
lea r8, [rbp + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d374
lea rcx, [rbp + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x310], rcx
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003d46c
movabs rdi, 0xb00000000
jmp case.0x14003d52d.0
lea rdx, [rsp + 0x2d8]
jmp 0x14003d3aa
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003df91
add rbp, 0x28
mov rcx, rax
jmp 0x14003dac2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003df91
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003dae8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003df91
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003de4a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003df91
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003d76a
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003df91
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003d78d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003df91
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14003d7b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3