Function at 0x140036710
Capabilities:
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x808
movaps xmmword [rsp + 0x7f0], xmm6
mov r14, r8
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x1400aa050]
xor rax, rsp
mov qword [rsp + 0x7e8], rax
movsxd rax, dword [rcx]
cmp rax, 0xb
ja 0x140036799
lea rcx, [0x14006b0a0]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x370], 0
mov qword [rsp + 0x378], 0xf
mov byte [rsp + 0x360], 0
mov r9, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rsp + 0x360]
cmp rsi, 0xf
jbe 0x1400367bb
mov rdx, rsi
call fcn.140001070
jmp 0x1400367d2
mov qword [rsp + 0x378], 0xf
mov qword [rsp + 0x370], 0
mov byte [rsp + 0x360], 0
jmp 0x1400367d2
mov qword [rcx + 0x10], rsi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x360], 0
mov rbx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1400367e0
mov rdi, qword [rdi]
cmp rbx, 0xf
ja 0x1400370c4
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x340], xmm0
mov r15d, 0xf
mov qword [rsp + 0x350], rbx
mov qword [rsp + 0x358], r15
cmp dword [r14], 0
mov qword [rsp + 0x338], 0xf
je 0x140036847
mov qword [rsp + 0x330], 8
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x320], rax
mov byte [rsp + 0x328], 0
jmp 0x140036871
mov qword [rsp + 0x330], 7
mov dword [rsp + 0x320], 0x74696e69
mov dword [rsp + 0x323], 0x6c616974
mov byte [rsp + 0x327], 0
mov eax, dword [r14 + 4]
cmp eax, 2
je 0x1400368ac
cmp eax, 1
jne 0x1400368de
mov qword [rsp + 0x318], 0xf
mov qword [rsp + 0x310], 5
mov dword [rsp + 0x300], 0x776f6873
mov byte [rsp + 0x304], 0x6e
jmp 0x1400368d7
mov qword [rsp + 0x318], 0xf
mov qword [rsp + 0x310], 5
mov dword [rsp + 0x300], 0x6f727265
mov byte [rsp + 0x304], 0x72
mov eax, 5
jmp 0x140036915
mov qword [rsp + 0x318], 0xf
mov qword [rsp + 0x310], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x300], rax
mov byte [rsp + 0x308], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x300], 0
mov edx, dword [r14 + 8]
lea rdi, [rsp + 0x2e0]
mov rcx, rdi
call fcn.1400319f0
lea rsi, [rsp + 0x4c4]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi - 4], 0x11c
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140036d23
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSVersion
mov edx, r12d
mov r9d, 0x59
call fcn.14002cdf0
test r12d, r12d
jne 0x140036bd7
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x60], rdi
xor ebp, ebp
xor r13d, r13d
xor esi, esi
xor edi, edi
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], r13
mov qword [rsp + 0x2d8], rbp
lea rsi, [rsp + 0x4c0]
mov r8d, 0xaa
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x140036b91
lea rsi, [rsp + 0x380]
lea rdx, [rsp + 0x4c0]
mov rcx, rsi
call fcn.140032280
cmp dword [rsi + 0x20], 0
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb8], r15
jne 0x140038fac
mov rcx, qword [rsp + 0x380]
mov rax, qword [rsp + 0x388]
mov rbx, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x398]
mov byte [rsp + 0x380], 0
mov qword [rsp + 0x390], 0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x2a0], rcx
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x290], 0
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
lea r8, str.PrevNotificationAction
lea rbp, [rsp + 0x4c0]
mov rcx, rbp
mov edx, 1
xor r9d, r9d
call fcn.14002f720
lea r13, [rsp + 0x4e8]
mov r12d, dword [r13]
test r12d, r12d
je 0x14003711d
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x186
call fcn.14002cf00
cmp dword [rsp + 0x4e8], 0
jne 0x140036b40
cmp byte [rsp + 0x4e0], 0
je 0x140036b40
mov rax, qword [rsp + 0x4d8]
cmp rax, 0x10
jae 0x1400370fa
test r12d, r12d
jns 0x14003722b
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
mov r15, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xa8]
jae 0x1400370a1
cmp rsi, 0x10
jb 0x140036bcd
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jae 0x14003b8e1
mov rcx, qword [rsp + 0xb0]
call fcn.1400574f0
jmp 0x140036bcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetOSLocale
mov edx, r12d
mov r9d, 0x61
call fcn.14002cdf0
test r12d, r12d
je 0x14003707f
cmp rbp, 0x10
jae 0x140036d05
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jae 0x140036c54
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jae 0x140036c77
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jae 0x140036c9a
cmp r15, 0x10
jae 0x140036cbd
mov rax, qword [rsp + 0x378]
cmp rax, 0x10
jae 0x140036ce2
mov rcx, qword [rsp + 0x7e8]
xor rcx, rsp
call fcn.140058610
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x7f0]
add rsp, 0x808
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b7e9
call fcn.1400574f0
jmp 0x140036be5
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b80d
call fcn.1400574f0
jmp 0x140036bf7
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b831
call fcn.1400574f0
jmp 0x140036c09
mov rcx, qword [rsp + 0x340]
cmp r15, 0xfff
jae 0x14003b7c8
inc r15
mov rdx, r15
call fcn.1400574f0
jmp 0x140036c13
mov rcx, qword [rsp + 0x360]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b855
call fcn.1400574f0
jmp 0x140036c25
lea rdx, [rbp + 1]
cmp rdx, 0x1000
jae 0x14003b8ba
mov rcx, rdi
call fcn.1400574f0
jmp 0x140036bd7
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x60], rdi
lea rax, [0x14006b080]
lea r12, [rsp + 0x408]
mov qword [r12 - 0x88], rax
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b088]
mov qword [r12], rax
mov rax, qword [r12 - 0x88]
movsxd rax, dword [rax + 4]
lea rbx, [0x14006b078]
mov qword [rsp + rax + 0x380], rbx
mov rax, qword [r12 - 0x88]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x37c], ecx
lea rdi, [rsp + 0x388]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b098]
mov qword [rsp + rax + 0x380], rcx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x37c], ecx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x380
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x380], rbx
mov rax, qword [rdi - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x37c], esi
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006b000]
mov qword [rdi], rax
mov qword [rdi + 0x68], 0
mov dword [rdi + 0x70], 4
mov edx, dword [rsp + 0x4c4]
mov rbx, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x380]
call rbx
lea rsi, [0x1400a12f5]
mov rcx, rax
mov rdx, rsi
call fcn.14005b7e0
mov edx, dword [rsp + 0x4c8]
mov rcx, rax
call rbx
mov rcx, rax
mov rdx, rsi
call fcn.14005b7e0
mov edx, dword [rsp + 0x4cc]
mov rcx, rax
call rbx
cmp dword [rsp + 0x4c4], 0xa
jne 0x140036edf
cmp dword [rsp + 0x4c8], 0
jne 0x140036edf
lea rax, [rsp + 0x248]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x738]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a362e]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14003769d
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x750], 0xf
mov byte [rsp + 0x738], 0
mov eax, dword [rsp + 0x3f8]
test al, 2
jne 0x14003794b
mov rcx, qword [rsp + 0x3c8]
mov rsi, qword [rcx]
test rsi, rsi
je 0x14003794b
mov rax, qword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x3f0]
mov r9, qword [rax]
cmp rsi, rcx
cmovb rsi, rcx
sub rsi, r9
mov rbx, r15
lea rcx, [rsp + 0x738]
cmp rsi, 0xf
jbe 0x1400376c6
mov rdx, rsi
call fcn.140001070
mov r15, qword [rsp + 0x738]
mov rsi, qword [rsp + 0x740]
mov r13, qword [rsp + 0x748]
mov rbp, qword [rsp + 0x750]
mov rax, qword [rsp + 0x380]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b078]
mov qword [rsp + rax + 0x380], rcx
mov rax, qword [rsp + 0x380]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x37c], ecx
lea rax, [0x14006b000]
mov qword [rsp + 0x388], rax
test byte [rsp + 0x3f8], 1
je 0x140037010
mov rax, qword [rsp + 0x3c8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b945
mov rcx, qword [rsp + rcx + 0x380]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x3a0]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b95a
call fcn.1400574f0
mov rax, qword [rsp + 0x3a0]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3d8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x3a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3e0]
mov dword [rax], ecx
mov qword [rsp + 0x3f0], rcx
and byte [rsp + 0x3f8], 0xfe
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov rdi, r15
mov r15, rbx
jmp 0x1400369c0
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb8], r15
mov qword [rsp + 0x68], r13
xor esi, esi
xor ebx, ebx
xor eax, eax
xor ecx, ecx
jmp 0x140036a79
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b915
call fcn.1400574f0
jmp 0x140036b6b
mov r15, rbx
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmovae r15, rax
cmp r15, 0xfff
jae 0x140037393
lea rcx, [r15 + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x1400373a8
mov rcx, qword [rsp + 0x4c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003b97b
call fcn.1400574f0
jmp 0x140036b40
mov qword [rsp + 0x88], rsi
lea rsi, [rsp + 0x3a8]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, r13
call fcn.14005ba80
cmp byte [rsi - 8], 0
mov qword [rsp + 0x78], rdi
je 0x1400374dd
lea rax, [rsp + 0x380]
mov rcx, qword [rax]
mov rsi, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
cmp rdx, 0x10
mov r15, rax
cmovae r15, rcx
cmp rsi, 0xf
ja 0x140037705
cmp rdx, 0x10
mov rdi, qword [r15]
cmovae rax, rcx
mov rax, qword [rax + 8]
mov ecx, 0xf
mov qword [rsp + 0x280], rdi
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rcx
cmp rsi, 0x14
jne 0x14003b9ab
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movdqu xmm0, xmmword [rax]
movd xmm1, dword [rax + 0x10]
pcmpeqb xmm1, xmmword [0x14006acf0]
pcmpeqb xmm0, xmmword [str.dismissed_by_tim]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140037517
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovb rdi, rax
mov qword [rax + 0x10], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rdi], rax
mov word [rdi + 8], 0x6e
jmp 0x140037517
cmp dword [r14 + 4], 1
jne 0x1400372ba
mov r12, rbx
mov rbx, rsi
mov edx, dword [r14 + 8]
mov rcx, rbp
call fcn.1400319f0
cmp qword [rsp + 0x4d8], 0x10
jb 0x14003725b
mov rbp, qword [rsp + 0x4c0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x380]
mov rcx, rsi
mov r8, rbp
xor r9d, r9d
call fcn.14002ec20
mov eax, dword [rsi]
test eax, eax
je 0x1400372a2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x1a5
call fcn.14002cf00
mov rax, qword [rsp + 0x4d8]
cmp rax, 0x10
mov rsi, rbx
jae 0x1400376e2
mov rbx, r12
mov qword [rsp + 0x78], rdi
lea rdi, [rsp + 0x248]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, str.PingCache
mov edx, 9
mov rcx, rdi
call fcn.14005b6e0
mov rax, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x14003764e
lea rdx, [rax + 8]
mov qword [rsp + 0x258], rdx
cmp rcx, 8
jb 0x140037322
mov rdi, qword [rsp + 0x248]
movdqu xmm0, xmmword [str._version]
movdqu xmmword [rdi + rax*2], xmm0
mov word [rdi + rax*2 + 0x10], 0
mov qword [rsp + 0x4d8], 7
mov qword [rsp + 0x4d0], 1
mov dword [rsp + 0x4c0], 0x32
mov rax, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x260]
cmp rcx, rax
mov rdi, qword [rsp + 0x78]
je 0x140037675
lea rdx, [rax + 1]
mov qword [rsp + 0x258], rdx
cmp rcx, 8
jb 0x1400373c1
mov rcx, qword [rsp + 0x248]
jmp 0x1400373c9
lea rcx, [r15 + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x340], rcx
lea r8, [rbx + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400367fd
lea rcx, [rsp + 0x248]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov rax, qword [rsp + 0x4d8]
cmp rax, 8
jb 0x140037406
mov rcx, qword [rsp + 0x4c0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140038ffe
call fcn.1400574f0
mov qword [rsp + 0x268], 0
mov qword [rsp + 0x270], 2
mov dword [rsp + 0x278], 0
lea rcx, [0x1400a02c5]
lea rdx, str.DisableTelemetry
call fcn.140031b70
test al, al
je 0x14003747a
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x320]
lea r8, [rsp + 0x300]
lea r9, [rsp + 0x2e0]
call fcn.1400359d0
mov r12d, eax
jmp 0x140037615
mov qword [rsp + 0x88], rsi
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x738]
mov rcx, rsi
mov edx, 1
call fcn.140032840
mov r12d, dword [rsi + 0x10]
test r12d, r12d
je 0x140037567
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x108
call fcn.14002cf00
mov rsi, qword [rsp + 0x88]
jmp 0x140037615
mov byte [rsp + 0x280], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x281], rax
mov byte [rsp + 0x289], 0
mov qword [rsp + 0x290], 9
mov qword [rsp + 0x298], 0xf
cmp byte [rsp + 0x3a0], 0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
je 0x140036b1a
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jb 0x140036b1a
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bae8
call fcn.1400574f0
jmp 0x140036b1a
mov qword [rsp + 0xa0], rbx
mov rbp, qword [rsp + 0x738]
mov bl, byte [rsp + 0x740]
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdi, qword [rsi]
test bl, bl
mov rsi, qword [rsp + 0x88]
je 0x140037742
mov rax, rdi
test rdi, rdi
jne 0x1400375c6
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
mov rsi, qword [rsp + 0x88]
sub rax, rbp
jbe 0x1400375db
shr rax, 9
cmp rax, 0x6388fc53
jae 0x140037742
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x320]
lea r8, [rsp + 0x300]
lea r9, [rsp + 0x2e0]
call fcn.1400359d0
mov r12d, eax
mov rdi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x260]
cmp rax, 8
jb 0x140036b49
mov rcx, qword [rsp + 0x248]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003902a
call fcn.1400574f0
jmp 0x140036b49
mov qword [rsp + 0x20], 8
lea r9, str._version
lea rcx, [rsp + 0x248]
mov edx, 8
call fcn.14005b590
jmp 0x140037336
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x248]
lea r9, [rsp + 0x4c0]
mov edx, 1
call fcn.14005b590
jmp 0x1400373d6
lea rdx, [0x1400a12f5]
lea rcx, [rsp + 0x380]
call fcn.14005b7e0
mov edx, dword [rsp + 0x738]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036edf
mov qword [rcx + 0x10], rsi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x738], 0
jmp 0x140036f5c
mov rcx, qword [rsp + 0x4c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bbcd
call fcn.1400574f0
jmp 0x1400372b7
mov rcx, rsi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0xa0], rcx
jae 0x14003798b
inc rcx
call fcn.1400574f8
mov rdi, rax
jmp 0x1400379a0
mov qword [rsp + 0x6d0], rdi
xor esi, esi
lea rdi, [rsp + 0x4c0]
mov qword [rdi + 0x10], rsi
mov r14d, 7
mov qword [rdi + 0x18], r14
mov word [rdi], si
lea r9, str.LastPingSentAt
mov edx, 0xe
mov rcx, rdi
call fcn.14005b6e0
movzx eax, word [rdi]
mov rcx, qword [rdi + 2]
mov qword [rsp + 0x700], rcx
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x706], rcx
mov rcx, qword [rdi + 0x10]
mov rbp, qword [rdi + 0x18]
mov word [rdi], ax
mov rax, qword [rsp + 0x700]
mov rdx, qword [rsp + 0x706]
mov qword [rdi + 2], rax
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rbp
lea rbx, [rsp + 0x380]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r14
mov word [rbx], si
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rbx
call fcn.14005b6e0
cmp rbp, 8
jb 0x1400377f4
mov rdi, qword [rsp + 0x4c0]
cmp qword [rsp + 0x398], 8
mov r15, qword [rsp + 0xa8]
jb 0x14003780f
mov rbx, qword [rsp + 0x380]
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, rbx
mov r8, rdi
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
je 0x14003786a
movzx edx, di
or edx, 0x80070000
test edi, edi
cmovle edx, edi
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.RegistrySetValueQword
mov r9d, 0xed
call fcn.14002cdf0
mov rax, qword [rsp + 0x398]
cmp rax, 8
jb 0x14003789a
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a3c4
call fcn.1400574f0
mov rax, qword [rsp + 0x4d8]
cmp rax, 8
jb 0x1400378ca
mov rcx, qword [rsp + 0x4c0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a3eb
call fcn.1400574f0
test edi, edi
je 0x1400378f6
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x118
call fcn.14002cf00
lea rcx, [rsp + 0x248]
lea rsi, [rsp + 0x490]
mov rdx, rsi
call fcn.14002d0b0
mov r12d, dword [rsi]
test r12d, r12d
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0xa8], r15
je 0x1400379bc
lea rsi, [rsp + 0x4c0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r12d
jmp 0x1400390de
mov rbx, r15
test al, 4
jne 0x140036f5c
mov rax, qword [rsp + 0x3c0]
mov rsi, qword [rax]
test rsi, rsi
je 0x140036f5c
mov rax, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x3d8]
mov r9, qword [rax]
movsxd rax, dword [rcx]
add rsi, rax
sub rsi, r9
jmp 0x140036f42
add rcx, 0x28
call fcn.1400574f8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
lea r8, [rsi + 1]
mov rcx, rdi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0xa0]
jmp 0x140037195
lea rcx, [rsp + 0x248]
mov r8d, dword [rcx + 0x2c]
lea rbx, [rsp + 0x7c8]
mov rdx, rbx
call fcn.14002ea00
mov eax, 0x90
lea rcx, [rsp + 0x380]
mov r12, rcx
add rcx, rax
mov qword [rsp + 0xe0], rcx
lea rcx, [rsp + 0x4c0]
add rax, rcx
mov qword [rsp + 0xc0], rax
xorps xmm6, xmm6
xor r15d, r15d
mov esi, 0xf
lea rbp, str.CacheEntryVersion
xor r14d, r14d
cmp dword [rsp + 0x278], 0
je 0x140038fba
mov qword [rsp + 0x750], r15
mov qword [rsp + 0x758], rsi
mov byte [rsp + 0x740], r15b
mov qword [rsp + 0x770], r15
mov qword [rsp + 0x778], rsi
mov byte [rsp + 0x760], r15b
mov qword [rsp + 0x790], r15
mov qword [rsp + 0x798], rsi
mov byte [rsp + 0x780], r15b
mov byte [rsp + 0x7c0], r15b
cmp qword [rsp + 0x7e0], 8
mov r8, rbx
jb 0x140037a8f
mov r8, qword [rsp + 0x7c8]
mov rcx, r12
mov rdx, rbp
call fcn.14002dc80
mov edi, dword [rsp + 0x388]
test edi, edi
je 0x140037be4
cmp qword [rsp + 0x7e0], 8
mov rax, rbx
jb 0x140037abf
mov rax, qword [rsp + 0x7c8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b4
call fcn.14002cf00
mov r8d, 0xa0
lea rcx, [rsp + 0x4c0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x560], edi
mov edi, 1
cmp byte [rsp + 0x7c0], 0
je 0x140037b4a
mov rax, qword [rsp + 0x7b8]
cmp rax, 0x10
jae 0x140037f13
mov qword [rsp + 0x7b0], 0
mov qword [rsp + 0x7b8], 0xf
mov byte [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x798]
cmp rax, 0x10
jae 0x140037e4c
mov qword [rsp + 0x790], 0
mov qword [rsp + 0x798], 0xf
mov byte [rsp + 0x780], 0
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x140037e6f
mov qword [rsp + 0x770], 0
mov qword [rsp + 0x778], 0xf
mov byte [rsp + 0x760], 0
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jae 0x140037e92
cmp edi, 4
mov rdi, qword [rsp + 0x78]
jne 0x140039098
inc r14d
cmp r14d, dword [rsp + 0x270]
jbe 0x140037a1b
jmp 0x140039056
mov rax, qword [rsp + 0x380]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x140037eb5
mov dword [rsp + 0x738], eax
test eax, eax
je 0x140037f36
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x700]
mov r8, rbx
lea r9, str.NotificationType
call fcn.14002f4b0
mov edi, dword [rsp + 0x728]
test edi, edi
jne 0x140037aed
movaps xmmword [rsp + 0x6e0], xmm6
movaps xmmword [rsp + 0x6d0], xmm6
mov byte [rsp + 0x6f0], 0
lea rcx, [rsp + 0x6f8]
lea rdx, [rsp + 0x728]
call fcn.14005ba80
mov edi, 4
cmp byte [rsp + 0x6f0], 0
je 0x140037dfb
mov rax, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6e0]
mov r8, qword [rsp + 0x6e8]
cmp r8, 0x10
lea rdx, [rsp + 0x6d0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x58], rcx
cmp rcx, 0xf
ja 0x14003855b
cmp r8, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x6d0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jae 0x140037fa2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x748], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x750], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x758], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x248]
mov rdx, r12
mov r8, rbx
lea r9, [0x1400a216a]
call fcn.14002f4b0
cmp dword [rsp + 0x728], 0
jne 0x140037da0
cmp byte [rsp + 0x720], 0
je 0x140037da0
mov rax, qword [rsp + 0x718]
cmp rax, 0x10
jae 0x140037fe8
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 0xf
mov byte [rsp + 0x700], 0
mov eax, dword [rsp + 0x3a8]
mov dword [rsp + 0x728], eax
mov dword [rsp + 0x58], eax
test eax, eax
je 0x14003800b
mov r8d, 0xa0
lea rcx, [rsp + 0x4c0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x560], eax
mov edi, 1
cmp byte [rsp + 0x6f0], 0
je 0x140037dfb
mov rax, qword [rsp + 0x6e8]
cmp rax, 0x10
jae 0x140037fc5
cmp dword [rsp + 0x728], 0
jne 0x140037b0e
cmp byte [rsp + 0x720], 0
je 0x140037b0e
mov rax, qword [rsp + 0x718]
cmp rax, 0x10
jb 0x140037b0e
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038c04
call fcn.1400574f0
jmp 0x140037b0e
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003880a
call fcn.1400574f0
jmp 0x140037b5c
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003882e
call fcn.1400574f0
jmp 0x140037b8e
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038852
call fcn.1400574f0
jmp 0x140037bc0
cmp qword [rsp + 0x7e0], 8
mov rax, rbx
jb 0x140037ecb
mov rax, qword [rsp + 0x7c8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1ba
call fcn.14002cf00
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x700]
call fcn.14002f390
mov edi, dword [rsp + 0x700]
jmp 0x140037f90
mov rcx, qword [rsp + 0x7a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038876
call fcn.1400574f0
jmp 0x140037b2a
cmp qword [rsp + 0x7e0], 8
mov rax, rbx
jb 0x140037f4c
mov rax, qword [rsp + 0x7c8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x207
call fcn.14002cf00
lea rcx, [rsp + 0x248]
mov rdx, r12
call fcn.14002f390
mov edi, dword [rsp + 0x380]
test edi, edi
jne 0x140037aed
mov edi, 4
jmp 0x140037b0e
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400388bd
call fcn.1400574f0
jmp 0x140037d04
mov rcx, qword [rsp + 0x6d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038c28
call fcn.1400574f0
jmp 0x140037dfb
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038c4c
call fcn.1400574f0
jmp 0x140037d80
movaps xmmword [rsp + 0x710], xmm6
movaps xmmword [rsp + 0x700], xmm6
mov byte [rsp + 0x720], 0
lea rcx, [rsp + 0x728]
lea rdx, [rsp + 0x3a8]
call fcn.14005ba80
cmp dword [rsp + 0x3a8], 0
jne 0x14003805e
cmp byte [rsp + 0x3a0], 0
je 0x14003805e
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x1400385d7
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140037dba
movaps xmmword [rsp + 0x390], xmm6
movaps xmmword [rsp + 0x380], xmm6
mov byte [rsp + 0x3a0], 0
lea rcx, [rsp + 0x3a8]
lea rdx, [rsp + 0x728]
call fcn.14005ba80
lea rcx, [rsp + 0x6d0]
mov rdx, r12
call fcn.14005baf0
cmp byte [rsp + 0x3a0], 0
je 0x1400380ca
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x1400385fa
cmp byte [rsp + 0x6f0], 0
je 0x140037dfb
mov rax, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6e0]
mov r8, qword [rsp + 0x6e8]
cmp r8, 0x10
lea rdx, [rsp + 0x6d0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x58], rcx
cmp rcx, 0xf
ja 0x140038663
cmp r8, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x6d0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xd0], rax
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x14003861d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x768], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x770], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x778], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x248]
mov rdx, r12
mov r8, rbx
lea r9, [0x1400a21e4]
call fcn.14002f4b0
cmp dword [rsp + 0x728], 0
jne 0x1400381fb
cmp byte [rsp + 0x720], 0
je 0x1400381fb
mov rax, qword [rsp + 0x718]
cmp rax, 0x10
jae 0x140038640
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 0xf
mov byte [rsp + 0x700], 0
mov eax, dword [rsp + 0x3a8]
mov dword [rsp + 0x728], eax
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140037dba
movaps xmmword [rsp + 0x710], xmm6
movaps xmmword [rsp + 0x700], xmm6
mov byte [rsp + 0x720], 0
lea rcx, [rsp + 0x728]
lea rdx, [rsp + 0x3a8]
call fcn.14005ba80
cmp dword [rsp + 0x3a8], 0
jne 0x140038268
cmp byte [rsp + 0x3a0], 0
je 0x140038268
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x1400386df
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140037dba
movaps xmmword [rsp + 0x390], xmm6
movaps xmmword [rsp + 0x380], xmm6
mov byte [rsp + 0x3a0], 0
lea rcx, [rsp + 0x3a8]
lea rdx, [rsp + 0x728]
call fcn.14005ba80
lea rcx, [rsp + 0x6d0]
mov rdx, r12
call fcn.14005baf0
cmp byte [rsp + 0x3a0], 0
je 0x1400382d4
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x140038702
cmp byte [rsp + 0x6f0], 0
je 0x140037dfb
mov rax, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6e0]
mov r8, qword [rsp + 0x6e8]
cmp r8, 0x10
lea rdx, [rsp + 0x6d0]
cmovae rdx, rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x58], rcx
cmp rcx, 0xf
ja 0x14003876b
cmp r8, 0x10
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x6d0]
cmovb rax, rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x798]
cmp rax, 0x10
jae 0x140038725
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x780], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x788], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x790], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x798], rax
mov eax, dword [rsp + 0x738]
mov dword [rsp + 0x50], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x248]
mov rdx, r12
mov r8, rbx
lea r9, str.PrevNotificationAction
call fcn.14002f4b0
cmp dword [rsp + 0x728], 0
jne 0x140038413
cmp byte [rsp + 0x720], 0
je 0x140038413
mov rax, qword [rsp + 0x718]
cmp rax, 0x10
jae 0x140038748
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 0xf
mov byte [rsp + 0x700], 0
mov eax, dword [rsp + 0x3a8]
mov dword [rsp + 0x728], eax
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140037dba
movaps xmmword [rsp + 0x710], xmm6
movaps xmmword [rsp + 0x700], xmm6
mov byte [rsp + 0x720], 0
lea rcx, [rsp + 0x728]
lea rdx, [rsp + 0x3a8]
call fcn.14005ba80
cmp dword [rsp + 0x3a8], 0
jne 0x140038480
cmp byte [rsp + 0x3a0], 0
je 0x140038480
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x1400387e7
mov eax, dword [rsp + 0x728]
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140037dba
movaps xmmword [rsp + 0x390], xmm6
movaps xmmword [rsp + 0x380], xmm6
mov byte [rsp + 0x3a0], 0
lea rcx, [rsp + 0x3a8]
lea rdx, [rsp + 0x728]
call fcn.14005ba80
lea rcx, [rsp + 0x6d0]
mov rdx, r12
call fcn.14005baf0
cmp byte [rsp + 0x3a0], 0
je 0x1400384ec
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x14003889a
cmp dword [rsp + 0x50], 2
jb 0x140038501
cmp byte [rsp + 0x6f0], 0
je 0x140037dfb
lea rcx, [rsp + 0x7a0]
lea rdx, [rsp + 0x6d0]
call fcn.14005bb90
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x470]
call fcn.14002f390
mov edi, dword [rsp + 0x470]
test edi, edi
je 0x1400388e1
mov r8d, 0xa0
lea rcx, [rsp + 0x4c0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x560], edi
jmp 0x140037dda
mov rcx, qword [rsp + 0x58]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x140038598
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov qword [rsp + 0x70], rax
jmp 0x1400385b7
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x70], rcx
mov qword [rcx - 8], rax
mov rax, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140037cf2
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038d30
call fcn.1400574f0
jmp 0x14003805e
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038e68
call fcn.1400574f0
jmp 0x1400380ca
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038e8c
call fcn.1400574f0
jmp 0x14003815f
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038eb0
call fcn.1400574f0
jmp 0x1400381db
mov rcx, qword [rsp + 0x58]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x1400386a0
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov qword [rsp + 0x70], rax
jmp 0x1400386bf
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x70], rcx
mov qword [rcx - 8], rax
mov rax, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003814d
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038ed4
call fcn.1400574f0
jmp 0x140038268
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038ef8
call fcn.1400574f0
jmp 0x1400382d4
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f1c
call fcn.1400574f0
jmp 0x140038369
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f40
call fcn.1400574f0
jmp 0x1400383f3
mov rcx, qword [rsp + 0x58]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x1400387a8
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov qword [rsp + 0x70], rax
jmp 0x1400387c7
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rsp + 0x70], rcx
mov qword [rcx - 8], rax
mov rax, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038357
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f64
call fcn.1400574f0
jmp 0x140038480
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037e65
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037e88
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037eab
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037f2c
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140038f88
call fcn.1400574f0
jmp 0x1400384ec
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037fbb
mov eax, dword [rsp + 0x738]
mov dword [rsp + 0x380], eax
lea rax, [rsp + 0x3a8]
movups xmmword [rax - 0x10], xmm6
cmp qword [rsp + 0x758], 0x10
lea rax, [rsp + 0x740]
mov qword [rsp + 0x58], rax
jb 0x140038920
mov rax, qword [rsp + 0x740]
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0x750]
cmp rdi, 0xf
ja 0x140038c70
mov rax, qword [rsp + 0x58]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x3a8]
movdqu xmmword [rax - 0x20], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x398], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x3a0], rax
lea rax, [rsp + 0x3a8]
movups xmmword [rax + 0x10], xmm6
mov rdi, qword [rsp + 0x770]
cmp qword [rsp + 0x778], 0x10
lea rax, [rsp + 0x760]
mov qword [rsp + 0x58], rax
jb 0x1400389a0
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x58], rax
cmp rdi, 0xf
ja 0x140038cb0
mov rax, qword [rsp + 0x58]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x3a8]
movdqu xmmword [rax], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x3b8], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x3a8]
movups xmmword [rax + 0x30], xmm6
mov rdi, qword [rsp + 0x790]
cmp qword [rsp + 0x798], 0x10
lea rax, [rsp + 0x780]
mov qword [rsp + 0x58], rax
jb 0x140038a17
mov rax, qword [rsp + 0x780]
mov qword [rsp + 0x58], rax
cmp rdi, 0xf
ja 0x140038cf0
mov rax, qword [rsp + 0x58]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x3a8]
movdqu xmmword [rax + 0x20], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x3d8], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x3e0], rax
lea rax, [rsp + 0x3a8]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
mov byte [rax + 0x60], 0
cmp byte [rsp + 0x7c0], 0
je 0x140038af8
lea rax, [rsp + 0x3a8]
movups xmmword [rax + 0x50], xmm6
cmp qword [rsp + 0x7b8], 0x10
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x58], rax
jb 0x140038aa9
mov rax, qword [rsp + 0x7a0]
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0x7b0]
cmp rdi, 0xf
ja 0x140038d54
mov rax, qword [rsp + 0x58]
movdqu xmm0, xmmword [rax]
lea rax, [rsp + 0x3a8]
movdqu xmmword [rax + 0x40], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x3f8], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x400], rax
mov byte [rsp + 0x408], 1
mov al, 1
mov byte [rsp + 0x410], al
mov r8d, 0x91
lea rdi, [rsp + 0x4c0]
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x380]
mov dword [rsp + 0x4c0], eax
lea rcx, [rsp + 0x3a8]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdi + 0x18], xmm1
movups xmmword [rdi + 8], xmm0
mov qword [rsp + 0x398], r15
mov qword [rsp + 0x3a0], rsi
mov byte [rsp + 0x388], r15b
lea rax, [rsp + 0x3a8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm1
mov qword [rsp + 0x3b8], r15
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x3a8], r15b
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movdqu xmmword [rdi + 0x48], xmm0
movdqu xmmword [rdi + 0x58], xmm1
mov qword [rsp + 0x3d8], r15
mov qword [rsp + 0x3e0], rsi
mov byte [rsp + 0x3c8], r15b
movups xmmword [rdi + 0x68], xmm6
movups xmmword [rdi + 0x78], xmm6
mov byte [rdi + 0x88], r15b
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xe0]
call fcn.14005ba80
mov al, 1
mov byte [rsp + 0x550], al
mov rdi, r12
mov rcx, r12
call fcn.14003e360
mov dword [rsp + 0x560], 0
mov rcx, r12
call fcn.14002fd80
jmp 0x140037dda
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037e42
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140037fde
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038001
mov rcx, rdi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x140038d94
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x140038dae
mov rcx, rdi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x140038dc9
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x140038de3
mov rcx, rdi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x140038dfe
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x140038e18
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x1400385f0
mov rcx, rdi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x140038e33
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x140038e4d
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x388], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038952
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x3a8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400389c9
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x3c8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038a41
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x3e8], rcx
lea r8, [rdi + 1]
mov rdx, qword [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140038adb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038613
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038636
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038659
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x1400386f8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003871b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003873e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038761
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140038800
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x1400388b3
mov esi, 0xf
xor ebx, ebx
xor ecx, ecx
jmp 0x140036a74
lea rsi, [rsp + 0x380]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x4c0]
mov dword [rcx + 0xa0], 0
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
call fcn.14002fd80
jmp 0x140039098
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov rdi, qword [rsp + 0x78]
jmp 0x140037401
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
mov rdi, qword [rsp + 0x78]
jmp 0x140037644
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24b
call fcn.14002cf00
lea rsi, [rsp + 0x4c0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
mov rax, qword [rsp + 0x7e0]
cmp rax, 8
jb 0x1400390cd
mov rcx, qword [rsp + 0x7c8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003a655
call fcn.1400574f0
mov rdi, qword [rsp + 0x78]
mov r12d, dword [rsp + 0x560]
test r12d, r12d
je 0x140039232
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x16b
call fcn.14002cf00
mov rsi, qword [rsp + 0x88]
cmp dword [rsp + 0x560], 0
jne 0x140039122
lea rcx, [rsp + 0x4c0]
call fcn.14002fd80
test r12d, r12d
js 0x140037615
mov rax, qword [rsp + 0x98]
movsxd rdi, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
mov edx, 1
xor r9d, r9d
call fcn.14002f720
mov r12d, dword [rsi + 0x28]
test r12d, r12d
je 0x1400392a5
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002cf00
xor ecx, ecx
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
cmp dword [rsp + 0x4e8], 0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
jne 0x1400391c5
cmp byte [rsp + 0x4e0], 0
je 0x1400391c5
mov rax, qword [rsp + 0x4d8]
cmp rax, 0x10
jae 0x14003926f
test r12d, r12d
jne 0x140037615
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], r13
mov r14, rbp
mov qword [rsp + 0x240], rbp
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x210], xmm0
mov rsi, qword [rsp + 0x290]
cmp qword [rsp + 0x298], 0x10
jb 0x14003931b
mov rdi, qword [rsp + 0x280]
jmp 0x140039323
xor r12d, r12d
lea rcx, [rsp + 0x380]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x550], 0
jne 0x140039cb3
lea rcx, [rsp + 0x380]
call fcn.14002fd80
mov rdi, qword [rsp + 0x78]
jmp 0x140039103
mov rbx, rcx
mov rcx, qword [rsp + 0x4c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bbf4
call fcn.1400574f0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov rcx, rbx
jmp 0x1400391c5
lea rdx, [rsp + 0x4e8]
lea rsi, [rsp + 0x3a8]
pxor xmm0, xmm0
movdqa xmmword [rsi - 0x18], xmm0
movdqa xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
call fcn.14005ba80
cmp byte [rsi - 8], 0
je 0x1400399e4
lea rax, [rsp + 0x380]
mov rcx, qword [rax]
mov r13, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
cmp rdx, 0x10
mov rbx, rax
cmovae rbx, rcx
cmp r13, 0xf
ja 0x14003a67c
cmp rdx, 0x10
mov rdi, qword [rbx]
cmovae rax, rcx
mov r14, qword [rax + 8]
mov r15d, 0xf
jmp 0x14003a2dc
lea rdi, [rsp + 0x280]
cmp rsi, 0xf
ja 0x14003a463
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x200], xmm0
mov ebx, 0xf
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1f0], xmm0
mov rsi, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x14003937c
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x60], rax
cmp rsi, 0xf
ja 0x14003a499
mov rax, qword [rsp + 0x60]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x1e0], xmm0
mov edi, 0xf
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1d0], xmm0
mov rsi, qword [rsp + 0x310]
cmp qword [rsp + 0x318], 0x10
jb 0x1400393d7
mov rdi, qword [rsp + 0x300]
jmp 0x1400393df
lea rdi, [rsp + 0x300]
cmp rsi, 0xf
ja 0x14003a4cf
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x1c0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1b0], xmm0
mov rsi, qword [rsp + 0x330]
cmp qword [rsp + 0x338], 0x10
jb 0x140039435
mov rdi, qword [rsp + 0x320]
jmp 0x14003943d
lea rdi, [rsp + 0x320]
cmp rsi, 0xf
ja 0x14003a505
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x1a0], xmm0
mov ebx, 0xf
mov qword [rsp + 0x1b0], rsi
cmp qword [rsp + 0x88], 0x10
lea rdi, [rsp + 0x2a0]
cmovae rdi, qword [rsp + 0xb0]
mov qword [rsp + 0x1b8], rbx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x190], xmm0
cmp qword [rsp + 0xa0], 0xf
ja 0x14003a53b
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x180], xmm0
mov esi, 0xf
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x190], rax
cmp r15, 0x10
lea rdi, [rsp + 0x2c0]
cmovae rdi, qword [rsp + 0x78]
mov qword [rsp + 0x198], rsi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x170], xmm0
cmp qword [rsp + 0x68], 0xf
ja 0x14003a576
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x160], xmm0
mov esi, 0xf
cmp qword [rsp + 0xb8], 0x10
jb 0x14003951b
mov rdi, qword [rsp + 0x340]
jmp 0x140039523
lea rdi, [rsp + 0x340]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rsi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x150], xmm0
cmp qword [rsp + 0x80], 0xf
ja 0x14003a5ae
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x140], xmm0
mov esi, 0xf
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x150], rax
cmp r14, 0x10
lea rdi, [rsp + 0x228]
cmovae rdi, qword [rsp + 0x98]
mov qword [rsp + 0x158], rsi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x130], xmm0
cmp r13, 0xf
ja 0x14003a5e9
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x120], xmm0
mov esi, 0xf
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], rsi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x110], xmm0
mov rsi, qword [rsp + 0x370]
cmp qword [rsp + 0x378], 0x10
jb 0x1400395f6
mov rdi, qword [rsp + 0x360]
jmp 0x1400395fe
lea rdi, [rsp + 0x360]
cmp rsi, 0xf
ja 0x14003a61f
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x100], xmm0
mov ebx, 0xf
lea rdi, [rsp + 0x100]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
lea rbx, [rsp + 0x738]
mov rcx, rbx
xor edx, edx
call fcn.1400056f0
lea rdx, str.release
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
call fcn.140004ed0
lea rdx, str.build_channel
lea r8, [0x1400a08d3]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rdx, [0x1400a109d]
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
call fcn.140004ed0
lea rdx, str.build_version
lea r8, [0x1400a0822]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
mov rdx, rdi
call fcn.140060020
lea rdx, [0x1400a057c]
lea r8, [0x1400a058b]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x120]
mov rcx, rsi
call fcn.140060020
lea rdx, str.previous_default_browser
lea r8, [0x1400a058b]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.140060020
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a0379]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.140060020
lea rdx, str.os_version
lea r8, [0x1400a0814]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x180]
mov rcx, rsi
call fcn.140060020
lea rdx, str.os_locale
lea r8, [0x1400a0e03]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x1a0]
mov rcx, rsi
call fcn.140060020
lea rdx, str.notification_type
lea r8, [0x1400a0d49]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x1c0]
mov rcx, rsi
call fcn.140060020
lea rdx, str.notification_shown
lea r8, [0x1400a06bc]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
call fcn.140060020
lea rdx, [0x1400a0744]
lea r8, [0x1400a0757]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x4c0]
lea rdx, [rsp + 0x200]
mov rcx, rsi
call fcn.140060020
lea rdx, str.previous_notification_action
lea r8, [0x1400a0757]
mov rcx, rbx
call fcn.140004310
mov rcx, rsi
mov rdx, rax
call fcn.140001400
mov rcx, rsi
call fcn.140001240
lea rsi, [rsp + 0x380]
mov rcx, rsi
call fcn.140058a70
lea rdx, [0x1400a141d]
lea rdi, [rsp + 0x4c0]
mov rcx, rdi
call fcn.140004ed0
lea rbx, [rsp + 0x700]
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0xb
movabs rax, 0x7461746e65646e69
mov qword [rbx], rax
mov dword [rbx + 7], 0x6e6f6974
mov byte [rbx + 0xb], 0
mov rcx, rsi
mov rdx, rbx
call fcn.140005860
mov rcx, rdi
mov rdx, rax
call fcn.140001400
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jae 0x14003a101
lea rcx, [rsp + 0x4c0]
call fcn.140001240
lea rsi, [rsp + 0x6d0]
lea rdx, [rsp + 0x380]
lea r8, [rsp + 0x738]
mov rcx, rsi
call fcn.140001ae0
lea rcx, [rsp + 0x7c8]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x140039a3e
mov r12d, eax
or r12d, 0x80010000
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov edx, r12d
mov r9d, 0x2c
jmp 0x140039aa1
cmp edi, 0xb
ja 0x14003a0dc
lea rax, [0x14006b0a0]
mov rax, qword [rax + rdi*8]
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x750], 0xf
mov byte [rsp + 0x738], 0
mov r9, qword [rax]
mov rsi, qword [rax + 8]
lea rcx, [rsp + 0x738]
cmp rsi, 0xf
jbe 0x14003a2a5
mov rdx, rsi
call fcn.140001070
jmp 0x14003a2bc
pxor xmm0, xmm0
lea rdx, [rsp + 0x4c0]
movdqu xmmword [rdx + 0x3e], xmm0
movdqa xmmword [rdx + 0x30], xmm0
movdqa xmmword [rdx + 0x20], xmm0
movdqa xmmword [rdx + 0x10], xmm0
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0x7c8]
mov rcx, rdi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
je 0x14003a6b2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GenerateUUIDStr
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x33
call fcn.14002cdf0
mov rax, qword [rsp + 0x6e8]
cmp rax, 0x10
jae 0x14003a124
lea rax, [0x14006b150]
lea rcx, [rsp + 0x388]
mov qword [rcx - 8], rax
call fcn.140001240
lea rcx, [rsp + 0x738]
call fcn.140001240
mov rax, qword [rsp + 0x118]
cmp rax, 0x10
jae 0x14003a147
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
mov rax, qword [rsp + 0x138]
cmp rax, 0x10
jae 0x14003a16a
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
mov rax, qword [rsp + 0x158]
cmp rax, 0x10
jae 0x14003a18d
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
mov rax, qword [rsp + 0x178]
cmp rax, 0x10
jae 0x14003a1b0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
mov rax, qword [rsp + 0x198]
cmp rax, 0x10
jae 0x14003a1d3
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rax, qword [rsp + 0x1b8]
cmp rax, 0x10
jae 0x14003a1f6
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rax, qword [rsp + 0x1d8]
cmp rax, 0x10
jae 0x14003a219
lea rdi, [rsp + 0x410]
lea rbp, [rsp + 0x4c0]
mov eax, dword [rbp]
mov dword [rdi - 0x90], eax
lea rcx, [rsp + 0x4c0]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movups xmmword [rdi - 0x88], xmm0
movups xmmword [rdi - 0x78], xmm1
xor esi, esi
mov qword [rbp + 0x18], rsi
mov eax, 0xf
mov qword [rbp + 0x20], rax
mov byte [rbp + 8], sil
movups xmm0, xmmword [r13]
movups xmm1, xmmword [r13 + 0x10]
movups xmmword [rdi - 0x68], xmm0
movups xmmword [rdi - 0x58], xmm1
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x28], sil
movdqu xmm0, xmmword [rcx + 0x48]
movdqu xmm1, xmmword [rcx + 0x58]
movdqu xmmword [rdi - 0x48], xmm0
movdqu xmmword [rdi - 0x38], xmm1
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x48], sil
mov byte [rdi - 8], sil
pxor xmm0, xmm0
movdqu xmmword [rdi - 0x18], xmm0
movdqu xmmword [rdi - 0x28], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0xc0]
call fcn.14005ba80
mov byte [rdi], 1
mov rcx, rbp
call fcn.14003e360
cmp byte [rdi], sil
je 0x140039258
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x248]
lea rsi, [rsp + 0x320]
lea r8, [rsp + 0x300]
lea r9, [rsp + 0x2e0]
mov rdx, rsi
call fcn.1400359d0
lea rcx, [rsp + 0x380]
lea rdx, [rsp + 0x738]
call fcn.140036440
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jae 0x14003a86f
lea rax, [rsp + 0x740]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x330], xmm1
movdqa xmmword [rsp + 0x320], xmm0
cmp byte [rax + 0x80], 0
je 0x140039e04
mov rax, qword [rsp + 0x7b8]
cmp rax, 0x10
jae 0x14003abc8
mov rax, qword [rsp + 0x798]
cmp rax, 0x10
jae 0x14003a892
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x14003a8b5
lea rcx, [rsp + 0x380]
lea rdx, [rsp + 0x738]
call fcn.140036440
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jae 0x14003a8d8
lea rax, [rsp + 0x760]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmmword [rsp + 0x300], xmm0
cmp byte [rax + 0x60], 0
je 0x140039e96
mov rax, qword [rsp + 0x7b8]
cmp rax, 0x10
jae 0x14003abeb
mov qword [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x798]
cmp rax, 0x10
jae 0x14003a8fb
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jae 0x14003a91e
lea rcx, [rsp + 0x380]
lea rdx, [rsp + 0x738]
call fcn.140036440
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jae 0x14003a941
lea rax, [rsp + 0x780]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmmword [rsp + 0x2e0], xmm0
mov qword [rax + 0x10], 0
cmp byte [rax + 0x40], 0
je 0x140039f30
mov rax, qword [rsp + 0x7b8]
cmp rax, 0x10
jae 0x14003ac0e
mov qword [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x14003a964
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jae 0x14003a987
lea rcx, [rsp + 0x380]
lea rsi, [rsp + 0x738]
mov rdx, rsi
call fcn.140036440
mov sil, byte [rsi + 0x88]
test sil, sil
je 0x140039fa2
mov rax, qword [rsp + 0x7b8]
cmp rax, 0x10
jae 0x14003ac31
mov qword [rsp + 0x7b0], 0
mov qword [rsp + 0x7b8], 0xf
mov rax, qword [rsp + 0x798]
cmp rax, 0x10
jae 0x14003a9aa
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x14003a9cd
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jae 0x14003a9f0
test sil, sil
je 0x14003a412
lea rcx, [rsp + 0x380]
lea rsi, [rsp + 0x738]
mov rdx, rsi
call fcn.140036440
cmp byte [rsi + 0x88], 0
je 0x14003b267
mov bpl, byte [rsp + 0x7a0]
mov rsi, qword [rsp + 0x7b0]
mov rdi, qword [rsp + 0x7b8]
mov qword [rsp + 0x7b0], 0
mov qword [rsp + 0x7b8], 0xf
mov byte [rsp + 0x7a0], 0
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
jae 0x14003ac54
lea rax, [rsp + 0x7a1]
mov byte [rsp + 0x280], bpl
mov rcx, qword [rax]
mov rdx, qword [rax + 7]
mov qword [rsp + 0x281], rcx
mov qword [rsp + 0x288], rdx
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rdi
mov rax, qword [rax - 9]
cmp rax, 0x10
jae 0x14003ac77
mov rax, qword [rsp + 0x778]
cmp rax, 0x10
jae 0x14003ac9a
mov rax, qword [rsp + 0x758]
cmp rax, 0x10
jb 0x140039258
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bfcd
call fcn.1400574f0
jmp 0x140039258
mov qword [rsp + 0x750], 0xf
mov qword [rsp + 0x748], 0
mov byte [rsp + 0x738], 0
jmp 0x14003a2bc
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc18
call fcn.1400574f0
jmp 0x14003997b
mov rcx, qword [rsp + 0x6d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc3c
call fcn.1400574f0
jmp 0x140039ab8
mov rcx, qword [rsp + 0x100]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc60
call fcn.1400574f0
jmp 0x140039aef
mov rcx, qword [rsp + 0x120]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bc84
call fcn.1400574f0
jmp 0x140039b21
mov rcx, qword [rsp + 0x140]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bca8
call fcn.1400574f0
jmp 0x140039b53
mov rcx, qword [rsp + 0x160]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bccc
call fcn.1400574f0
jmp 0x140039b85
mov rcx, qword [rsp + 0x180]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bcf0
call fcn.1400574f0
jmp 0x140039bb7
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bd14
call fcn.1400574f0
jmp 0x140039be9
mov qword [rcx + 0x10], rsi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x738], 0
mov rdi, qword [rsp + 0x738]
mov r14, qword [rsp + 0x740]
mov r13, qword [rsp + 0x748]
mov r15, qword [rsp + 0x750]
cmp qword [rsp + 0x378], 0x10
jb 0x14003a2f1
mov r8, qword [rsp + 0x360]
jmp 0x14003a2f9
lea r8, [rsp + 0x360]
lea rdx, str.PingCurrentDefault
lea rsi, [rsp + 0x738]
mov rcx, rsi
xor r9d, r9d
call fcn.14002ec20
mov r12d, dword [rsi]
test r12d, r12d
je 0x14003a37e
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x13d
call fcn.14002cf00
xor esi, esi
mov r14d, 0
mov r13d, 0
mov ebp, 0
cmp r15, 0x10
jb 0x14003a384
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jae 0x14003bdd5
mov rcx, rdi
call fcn.1400574f0
xor esi, esi
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
jmp 0x14003a384
mov rsi, rdi
mov rbp, r15
cmp byte [rsp + 0x3a0], 0
je 0x14003a39c
mov rax, qword [rsp + 0x398]
cmp rax, 0x10
jae 0x14003a3a4
mov rcx, rsi
jmp 0x140039192
mov rcx, qword [rsp + 0x380]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bdf9
call fcn.1400574f0
jmp 0x14003a39c
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140037895
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x1400378c5
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
jae 0x14003ad09
mov byte [rsp + 0x280], 0x6e
movabs rax, 0x6e6f697463612d6f
mov qword [rsp + 0x281], rax
mov byte [rsp + 0x289], 0
mov qword [rsp + 0x290], 9
mov qword [rsp + 0x298], 0xf
jmp 0x140039258
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003aa13
lea rcx, [rbx + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003aa28
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003aa41
lea rcx, [rdi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003aa56
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003aa71
lea rcx, [rbx + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003aa86
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003aa9f
lea rcx, [rbx + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003aab4
mov rsi, qword [rsp + 0xa0]
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003aacd
lea rcx, [rsi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003aae2
mov rsi, qword [rsp + 0x68]
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003ab03
lea rcx, [rsi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003ab18
mov rsi, qword [rsp + 0x80]
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003ab36
lea rcx, [rsi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003ab4b
mov rsi, r13
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmovae rsi, rax
cmp rsi, 0xfff
jae 0x14003ab6c
lea rcx, [rsi + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003ab81
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jae 0x14003ab9a
lea rcx, [rbx + 1]
call fcn.1400574f8
mov rcx, rax
jmp 0x14003abaf
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x1400390c3
mov r15, r13
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmovae r15, rax
cmp r15, 0xfff
jae 0x14003acbd
lea rcx, [r15 + 1]
call fcn.1400574f8
mov rdi, rax
jmp 0x14003acd2
lea r13, [rsp + 0x700]
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 7
mov word [r13], 0
lea r9, [rsp + 0x4c2]
mov edx, 0x24
mov rcx, r13
call fcn.14005b6e0
movzx eax, word [r13]
mov rcx, qword [r13 + 8]
mov qword [rsp + 0x4b6], rcx
mov rcx, qword [r13 + 2]
mov qword [rsp + 0x4b0], rcx
movdqu xmm0, xmmword [r13 + 0x10]
mov word [rsp + 0x7c8], ax
mov rax, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4b6]
mov qword [rsp + 0x7ca], rax
mov qword [rsp + 0x7d0], rcx
movdqu xmmword [rsp + 0x7d8], xmm0
lea rcx, section..rdata
lea r9, [rsp + 0x490]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x80], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14003ace6
mov rbp, qword [rsp + 0x490]
lea rbx, [rsp + 0x4c0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a2de6]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003ad2c
lea rdx, [0x1400a1636]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ad4d
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ad6e
cmp qword [rsp + 0x7e0], 8
jb 0x14003a7ec
mov rdi, qword [rsp + 0x7c8]
lea rcx, [rsp + 0x4c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14003ad8f
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 7
mov word [rsp + 0x700], 0
lea rcx, [rsp + 0x4c0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
lea rcx, [rsp + 0x700]
cmp rax, 7
ja 0x14003b09d
mov qword [rcx + 0x10], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x4c0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rdi*2 + 0x700], 0
jmp 0x14003b0ad
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be1d
call fcn.1400574f0
jmp 0x140039dc6
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be41
call fcn.1400574f0
jmp 0x140039e16
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be65
call fcn.1400574f0
jmp 0x140039e28
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003be89
call fcn.1400574f0
jmp 0x140039e4f
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bead
call fcn.1400574f0
jmp 0x140039ea8
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bed1
call fcn.1400574f0
jmp 0x140039eba
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bef5
call fcn.1400574f0
jmp 0x140039ee1
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf19
call fcn.1400574f0
jmp 0x140039f42
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf3d
call fcn.1400574f0
jmp 0x140039f54
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf61
call fcn.1400574f0
jmp 0x140039fb4
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bf85
call fcn.1400574f0
jmp 0x140039fc6
mov rcx, qword [rsp + 0x740]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bfa9
call fcn.1400574f0
jmp 0x140039fd8
lea rcx, [rbx + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x200], rcx
lea r8, [rsi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003933f
lea rcx, [rdi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x1e0], rcx
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003939d
lea rcx, [rbx + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rsi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400393fb
lea rcx, [rbx + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rsi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140039459
lea rcx, [rsi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x180], rcx
mov rax, qword [rsp + 0xa0]
lea r8, [rax + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400394b1
lea rcx, [rsi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x160], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140039506
lea rcx, [rsi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x140], rcx
mov rax, qword [rsp + 0x80]
lea r8, [rax + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140039566
lea rcx, [rsi + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x120], rcx
lea r8, [r13 + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400395bc
lea rcx, [rbx + 0x28]
call fcn.1400574f8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x100], rcx
lea r8, [rsi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003961a
mov rcx, qword [rsp + 0x7a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003bff1
call fcn.1400574f0
jmp 0x140039e04
mov rcx, qword [rsp + 0x7a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c015
call fcn.1400574f0
jmp 0x140039e8a
mov rcx, qword [rsp + 0x7a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c039
call fcn.1400574f0
jmp 0x140039f24
mov rcx, qword [rsp + 0x7a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c05d
call fcn.1400574f0
jmp 0x140039f8a
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c081
call fcn.1400574f0
jmp 0x14003a050
mov rcx, qword [rsp + 0x780]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0a1
call fcn.1400574f0
jmp 0x14003a095
mov rcx, qword [rsp + 0x760]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0c1
call fcn.1400574f0
jmp 0x14003a0a7
lea rcx, [r15 + 0x28]
call fcn.1400574f8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
lea r8, [r13 + 1]
mov rcx, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003a2dc
mov r12d, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov edx, eax
mov r9d, 0x70
call fcn.14002cdf0
jmp 0x14003adda
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14003c0e1
call fcn.1400574f0
jmp 0x14003a424
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x7c
jmp 0x14003adae
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x81
jmp 0x14003adae
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x86
jmp 0x14003adae
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingFilePath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x8b
call fcn.14002cdf0
xor eax, eax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x68], rax
xor ebx, ebx
xor edi, edi
xor r15d, r15d
test rbp, rbp
je 0x14003add6
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test bl, bl
jne 0x14003ae13
mov rax, qword [rsp + 0x7e0]
cmp rax, 8
jb 0x140039aa6
mov rcx, qword [rsp + 0x7c8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b240
call fcn.1400574f0
jmp 0x140039aa6
mov qword [rsp + 0x490], r15
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x4a0], rax
cmp rdi, 8
lea rax, [rsp + 0x490]
cmovb r15, rax
mov qword [rsp + 0x4a8], rdi
lea rax, [0x14006afe8]
lea rdi, [rsp + 0x568]
mov qword [rdi - 0xa8], rax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b088]
mov qword [rdi], rax
mov rax, qword [rdi - 0xa8]
movsxd rax, dword [rax + 4]
lea r12, [0x14006aff0]
mov qword [rsp + rax + 0x4c0], r12
mov rax, qword [rdi - 0xa8]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff58
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x4bc], ecx
lea rbp, [rsp + 0x4c8]
mov rax, qword [rbp - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b098]
mov qword [rsp + rax + 0x4c0], rcx
mov rax, qword [rbp - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4bc], ecx
mov rax, qword [rbp - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4c0
xor edi, edi
mov rdx, rbp
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbp - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4c0], r12
mov rax, qword [rbp - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x4bc], ebx
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, [0x14006af70]
mov qword [rbp], rax
mov byte [rbp + 0x7c], dil
mov byte [rbp + 0x71], dil
lea rax, [rsp + 0x4d0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4d8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4f0]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x4f8]
mov qword [rax + 0x10], rax
lea rax, [rsp + 0x510]
mov qword [rax + 8], rax
lea rax, [rsp + 0x514]
mov qword [rax + 0xc], rax
mov qword [rax - 4], rdi
mov qword [rax + 0x34], rdi
pxor xmm0, xmm0
movdqu xmmword [rax - 0x44], xmm0
movdqu xmmword [rax - 0x24], xmm0
mov rcx, qword [0x1400aa4d4]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x1c], rdi
mov rcx, rbp
mov rdx, r15
call fcn.14005d540
test rax, rax
jne 0x14003afdc
mov rax, qword [rsp + 0x4c0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4c0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6e0]
cmp qword [rsp + 0x6e8], 0x10
jb 0x14003aff7
mov rsi, qword [rsp + 0x6d0]
lea rdi, [rsp + 0x4c0]
mov rcx, rdi
mov rdx, rsi
call fcn.140003660
mov rax, qword [rdi]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4c0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003b0e1
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov r12d, 0x8007045d
mov edx, 0x8007045d
mov r9d, 0xd6
call fcn.14002cdf0
mov rax, qword [rsp + 0x4c0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4c0], rcx
mov rax, qword [rsp + 0x4c0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4bc], ecx
mov rcx, rbp
call fcn.14005cca0
lea rcx, [rsp + 0x568]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003b2c8
lea r9, [rsp + 0x4c0]
mov rdx, rdi
call fcn.14005b6e0
mov r15, qword [rsp + 0x700]
mov rax, qword [rsp + 0x708]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x710]
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x718]
xor r12d, r12d
mov bl, 1
jmp 0x14003adc8
mov rax, qword [rsp + 0x4c0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006aff0]
mov qword [rsp + rax + 0x4c0], rcx
mov rax, qword [rsp + 0x4c0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4bc], ecx
mov rcx, rbp
call fcn.14005cca0
lea rcx, [rsp + 0x568]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdi, [rsp + 0x470]
mov rcx, rdi
xor edx, edx
call fcn.1400019f0
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003b1f1
lea rdi, [rsp + 0x4c0]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x470]
lea r8, str.pingsender.exe
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003b212
mov qword [rsp + 0x710], 0
mov qword [rsp + 0x718], 7
mov word [rsp + 0x700], 0
lea rcx, [rsp + 0x4c0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
lea rcx, [rsp + 0x700]
cmp rax, 7
ja 0x14003b272
mov qword [rcx + 0x10], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x4c0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rdi*2 + 0x700], 0
jmp 0x14003b282
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0x99
jmp 0x14003b231
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.GetPingsenderPath
mov r12d, 0x8007007a
mov edx, 0x8007007a
mov r9d, 0xa0
call fcn.14002cdf0
xor ebx, ebx
xor edi, edi
xor ebp, ebp
xor esi, esi
jmp 0x14003b2a5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003ae09
int3
lea r9, [rsp + 0x4c0]
mov rdx, rdi
call fcn.14005b6e0
mov rbx, qword [rsp + 0x700]
mov rdi, qword [rsp + 0x708]
mov rbp, qword [rsp + 0x710]
mov rsi, qword [rsp + 0x718]
xor r12d, r12d
mov rcx, qword [rsp + 0x470]
mov qword [rsp + 0x470], 0
test rcx, rcx
je 0x14003b2c3
call fcn.1400574f0
test r12d, r12d
je 0x14003b301
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x14003adda
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003b893
call fcn.1400574f0
jmp 0x14003adda
mov qword [rsp + 0x700], rbx
mov qword [rsp + 0x708], rdi
mov qword [rsp + 0x710], rbp
mov qword [rsp + 0x718], rsi
lea rdi, [rsp + 0x470]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
lea r9, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rdi
call fcn.14005b6e0
mov r8, qword [rsp + 0x7d8]
cmp qword [rsp + 0x7e0], 8
jb 0x14003b36f
mov r9, qword [rsp + 0x7c8]
jmp 0x14003b377
lea r9, [rsp + 0x7c8]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x14003b879
lea rsi, [rax + r8]
mov qword [rsp + 0x480], rsi
cmp rcx, 8
jb 0x14003b3b0
mov rdi, qword [rsp + 0x470]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], 0
cmp qword [rsp + 0x718], 8
jb 0x14003b3d8
mov r13, qword [rsp + 0x700]
cmp qword [rsp + 0x488], 8
jb 0x14003b3ed
mov rax, qword [rsp + 0x470]
jmp 0x14003b3f5
lea rax, [rsp + 0x470]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x4a8], 8
jb 0x14003b415
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x80], rax
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
mov rcx, r13
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea r12d, [rdi + 2]
test rax, rax
cmove r12d, edi
test rbx, rbx
jne 0x14003c107
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
mov rcx, rsi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ebp, [rdi + 2]
test rax, rax
cmove ebp, edi
test rbx, rbx
jne 0x14003c134
mov rsi, qword [rsp + 0x80]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
mov rcx, rsi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
lea rdx, [0x14006aff8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
lea ecx, [rdi + 2]
test rax, rax
cmove ecx, edi
test rbx, rbx
jne 0x14003c161
add r12d, ebp
lea eax, [rcx + r12]
add eax, 3
test eax, eax
mov ecx, 1
cmovne ecx, eax
movsxd rax, ecx
add rax, rax
mov rdi, 0xffffffffffffffff
cmovae rdi, rax
mov rcx, rdi
call fcn.14005753c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov rcx, r13
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rdi, rax
lea rdx, [0x14006aff8]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rbp, rax
mov qword [rsp + 0x68], rbx
test rax, rax
jne 0x14003c191
test rdi, rdi
jne 0x14003c1a4
mov rcx, rbx
mov rdx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test rbp, rbp
jne 0x14003c1f3
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rdi, rax
test rax, rax
jne 0x14003c201
add rbx, 2
test rsi, rsi
jne 0x14003c210
mov rcx, rbx
mov rsi, qword [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test rdi, rdi
jne 0x14003c267
mov word [rbx], 0x20
mov rdi, qword [rsp + 0x80]
mov rcx, rdi
mov dx, 0x22
call sub.VCRUNTIME140.dll_wcschr
mov rsi, rax
lea rdx, [0x14006aff8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rdi, rax
test rax, rax
jne 0x14003c275
add rbx, 2
test rsi, rsi
jne 0x14003c284
mov rcx, rbx
mov rsi, qword [rsp + 0x80]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rbx + rax*2]
test rdi, rdi
jne 0x14003c2e4
mov word [rbx], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x4c0], xmm0
movdqa xmmword [rsp + 0x4f0], xmm0
movdqa xmmword [rsp + 0x510], xmm0
movdqa xmmword [rsp + 0x500], xmm0
movdqa xmmword [rsp + 0x4e0], xmm0
movdqa xmmword [rsp + 0x4d0], xmm0
mov qword [rsp + 0x520], 0
mov dword [rsp + 0x4c0], 0x68
mov dword [rsp + 0x4fc], 1
cmp qword [rsp + 0x718], 8
jb 0x14003b6bb
mov rcx, qword [rsp + 0x700]
jmp 0x14003b6c3
lea rcx, [rsp + 0x700]
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003b722
mov rcx, qword [rsp + 0xf0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xe8]
call rsi
jmp 0x14003b755
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r8, str.SendPing
mov edx, r12d
mov r9d, 0xf3
call fcn.14002cdf0
mov rcx, qword [rsp + 0x68]
call fcn.1400574f0
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003b78f
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003ba9a
call fcn.1400574f0
mov rax, qword [rsp + 0x718]
cmp rax, 8
jb 0x14003b2c8
mov rcx, qword [rsp + 0x700]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14003bac1
call fcn.1400574f0
jmp 0x14003b2c8
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c101
add r15, 0x28
mov rcx, rax
jmp 0x140036cd5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036c6d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036c90
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036cb3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140036cfb
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x470]
mov rdx, r8
call fcn.14005b590
jmp 0x14003b3c5
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003b2f7
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14003c101
mov rbx, r15
add rbp, 0x28
mov rdx, rbp
mov rdi, rax
jmp 0x140036d16
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c101
mov rbx, r15
mov rdx, rsi
add rdx, 0x28
mov qword [rsp + 0xb0], rax
jmp 0x140036b82
mov rbx, r15
mov r15, rbp
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
mov rbp, r15
mov r15, rbx
jmp 0x1400370ba
mov rax, qword [rsp + 0x3c0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036fe2
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003c101
add rdx, 0x27
mov rcx, rax
jmp 0x14003700b
mov r8, rsi
mov rsi, rdi
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
jmp 0x140037113
cmp rsi, 0x12
jg 0x14003b9ea
cmp rsi, 9
jne 0x14003ba28
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movabs rdx, 0x6f697463612d6f6e
xor rdx, qword [rax]
movzx eax, byte [rax + 8]
xor rax, 0x6e
or rax, rdx
jne 0x1400371fb
jmp 0x140037517
cmp rsi, 0x1a
jg 0x14003ba62
cmp rsi, 0x13
jne 0x14003bb1a
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 3]
pcmpeqb xmm1, xmmword [0x14006acb0]
pcmpeqb xmm0, xmmword [0x14006acc0]
jmp 0x1400371e8
cmp rsi, 0xd
jne 0x14003bb52
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movabs rsi, 0x6c632d7473616f74
xor rsi, qword [rax]
movabs rdx, 0x64656b63696c632d
xor rdx, qword [rax + 5]
jmp 0x14003bb87
cmp rsi, 0x1b
jne 0x14003bb95
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xb]
pcmpeqb xmm1, xmmword [str.x_default_buttonmake_firefox_defplication_hiddendismissed_by_appmissed_by_buttondismissed_by_butto_action_centerdismissed_to_acteout]
pcmpeqb xmm0, xmmword [0x14006ac80]
jmp 0x1400371e8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003b78a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14003b7be
mov rsi, rdi
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rdi
mov rdi, rsi
mov rsi, qword [rsp + 0x88]
jmp 0x14003755d
cmp rsi, 0x1a
jne 0x1400371fb
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xa]
pcmpeqb xmm1, xmmword [0x14006acd0]
pcmpeqb xmm0, xmmword [0x14006ace0]
jmp 0x1400371e8
cmp rsi, 0xf
jne 0x1400371fb
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movabs rsi, 0x6d2d646e696d6572
xor rsi, qword [rax]
movabs rdx, 0x726574616c2d656d
xor rdx, qword [rax + 7]
or rdx, rsi
jne 0x1400371fb
jmp 0x140037517
cmp rsi, 0x1f
jne 0x1400371fb
cmp rcx, 0x10
lea rax, [rsp + 0x280]
cmovae rax, rdi
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xf]
pcmpeqb xmm1, xmmword [0x14006ac90]
pcmpeqb xmm0, xmmword [0x14006aca0]
jmp 0x1400371e8
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
mov rsi, rbx
jmp 0x1400376fb
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x14003928b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a11a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a13d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a160
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a183
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a1a6
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a1c9
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a1ec
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a20f
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14003c101
add r15, 0x28
mov rdx, r15
mov rdi, rax
jmp 0x14003a36a
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x14003a3bd
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a888
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a8ab
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a8ce
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a8f1
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a914
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a937
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a95a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a97d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a9a0
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a9c3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003a9e6
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003aa09
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003abe1
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac04
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac27
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac4a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14003ac6d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ac90
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003acb3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14003c101
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14003ad22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ecx, ecx
mov rax, r13
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c122
cmp edx, 0x5c
je 0x14003c12c
test edx, edx
jne 0x14003c128
jmp 0x14003b453
add r12d, ecx
inc r12d
xor ecx, ecx
jmp 0x14003c12e
inc ecx
add rax, 2
jmp 0x14003c10c
xor ecx, ecx
mov rax, qword [rsp + 0x60]
movzx edx, word [rax]
cmp edx, 0x22
je 0x14003c151
cmp edx, 0x5c
je 0x14003c159
test edx, edx
jne 0x14003c155
jmp 0x14003b494
add ebp, ecx
inc ebp
xor ecx, ecx
jmp 0x14003c15b
inc ecx
add rax, 2
jmp 0x14003c13b
xor edx, edx
mov rax, qword [rsp + 0x80]
movzx ebx, word [rax]
cmp ebx, 0x22
je 0x14003c181
cmp ebx, 0x5c
je 0x14003c189
test ebx, ebx
jne 0x14003c185
jmp 0x14003b4d8
add ecx, edx
inc ecx
xor edx, edx
jmp 0x14003c18b
inc edx
add rax, 2
jmp 0x14003c16b
mov rbx, qword [rsp + 0x68]
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b545
xor eax, eax
movzx ecx, word [r13]
cmp ecx, 0x22
je 0x14003c1be
cmp ecx, 0x5c
je 0x14003c1d8
test ecx, ecx
jne 0x14003c1e4
jmp 0x14003b566
test eax, eax
js 0x14003c1e0
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c1c4
movzx ecx, word [r13]
jmp 0x14003c1e4
inc eax
mov cx, 0x5c
jmp 0x14003c1e6
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add r13, 2
jmp 0x14003c1a6
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b56f
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003b5a8
xor eax, eax
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c22d
cmp ecx, 0x5c
je 0x14003c24a
test ecx, ecx
jne 0x14003c256
jmp 0x14003b5ce
test eax, eax
js 0x14003c252
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c233
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax]
jmp 0x14003c256
inc eax
mov cx, 0x5c
jmp 0x14003c258
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x60], 2
jmp 0x14003c212
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b5d7
mov word [rbx + 2], 0x22
add rbx, 4
jmp 0x14003b613
xor eax, eax
mov rcx, qword [rsp + 0x80]
movzx ecx, word [rcx]
cmp ecx, 0x22
je 0x14003c2a4
cmp ecx, 0x5c
je 0x14003c2c4
test ecx, ecx
jne 0x14003c2d0
jmp 0x14003b63c
test eax, eax
js 0x14003c2cc
inc eax
mov word [rbx], 0x5c
add rbx, 2
dec eax
jne 0x14003c2aa
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
jmp 0x14003c2d0
inc eax
mov cx, 0x5c
jmp 0x14003c2d2
mov cx, 0x22
xor eax, eax
mov word [rbx], cx
add rbx, 2
add qword [rsp + 0x80], 2
jmp 0x14003c286
mov word [rbx], 0x22
add rbx, 2
jmp 0x14003b645