Function at 0x1400b3aa0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Patch process command line
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x878
movaps xmmword [rsp + 0x860], xmm7
movaps xmmword [rsp + 0x850], xmm6
mov rsi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x848], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x1400b6af8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
test rax, rax
je 0x1400b3b07
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
test eax, eax
je 0x1400b6afb
mov qword [rsp + 0x48], rsi
xorps xmm7, xmm7
lea rbx, [rsp + 0x260]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
mov ecx, 1
mov rdx, rbx
call fcn.14004dd50
lea rsi, [rsp + 0x580]
mov r8d, 0x278
mov rcx, rsi
mov dl, 0xaa
call fcn.1401808d0
lea r14, [rsp + 0x280]
mov rcx, rbx
mov rdx, r14
call fcn.14014b340
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call fcn.1401e5530
cmp byte [r14 + 0x17], 0
jns 0x1400b3b7f
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
lea r14, [rsp + 0x580]
mov rbp, qword [sym.imp.KERNEL32.dll_OpenProcess]
movaps xmm6, xmmword [0x140270690]
movabs r13, 0xaaaaaaaaaaaaaaaa
xor eax, eax
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov rcx, r14
call fcn.1401f1890
test al, al
je 0x1400b4111
mov rax, qword [rsp + 0x580]
mov rax, qword [rax + 8]
mov rcx, r14
call qword [case.0x1401e7f70.0]
test al, al
je 0x1400b3ba9
lea rax, [rsp + 0x598]
test rax, rax
je 0x1400b42a5
movaps xmmword [rsp + 0x240], xmm7
mov qword [rsp + 0x250], 0
mov r8d, dword [rsp + 0x5a0]
mov ecx, 0x410
xor edx, edx
call rbp
test rax, rax
je 0x1400b3c33
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp rbx, 0xffffffffffffffff
je 0x1400b4065
call fcn.140105b90
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400b3c35
xor ebx, ebx
lea r15, [rbx + 1]
cmp r15, 2
jae 0x1400b3cdf
xor esi, esi
cmp r15, 2
jb 0x1400b3c74
call fcn.140105b90
cmp qword [0x1402a45d0], 0
je 0x1400b406c
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x1401e7f70.0]
movzx eax, byte [rsp + 0x257]
test sil, sil
je 0x1400b3cc5
mov r11d, eax
and r11d, 0x7f
test al, al
mov rcx, qword [rsp + 0x240]
lea rdx, [rsp + 0x240]
cmovns rcx, rdx
cmovs r11, qword [rsp + 0x248]
cmp r11, 7
jge 0x1400b3f1a
cmp edi, dword [rsp + 0x5a0]
movzx r12d, r12b
mov ecx, 1
cmovne r12d, ecx
test al, al
jns 0x1400b3ba9
mov rcx, qword [rsp + 0x240]
call fcn.14017b254
jmp 0x1400b3ba9
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov dword [rsp + 0x1d0], 0
mov rax, qword [0x14029f518]
test rax, rax
jne 0x1400b3d28
lea rcx, str.NtQueryInformationProcess
lea rdx, [0x14029f518]
call fcn.1401ed060
mov rax, qword [0x14029f518]
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x20], rcx
xor esi, esi
mov rcx, rbx
xor edx, edx
lea r8, [rsp + 0xb0]
mov r9d, 0x30
call qword [case.0x1401e7f70.0]
test eax, eax
jne 0x1400b3c45
cmp dword [rsp + 0x1d0], 0x30
jne 0x1400b3c45
mov qword [rsp + 0x210], r13
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm6
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 0x500], 0
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov rcx, rbx
lea r8, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b3fad
cmp qword [rsp + 0x500], 0x28
jne 0x1400b400e
movaps xmmword [rsp + 0x570], xmm6
movaps xmmword [rsp + 0x560], xmm6
movaps xmmword [rsp + 0x550], xmm6
movaps xmmword [rsp + 0x540], xmm6
movaps xmmword [rsp + 0x530], xmm6
movaps xmmword [rsp + 0x520], xmm6
movaps xmmword [rsp + 0x510], xmm6
movaps xmmword [rsp + 0x500], xmm6
mov rdx, qword [rsp + 0x210]
mov qword [rsp + 0x220], 0
lea rax, [rsp + 0x220]
mov qword [rsp + 0x20], rax
mov r9d, 0x80
mov rcx, rbx
lea r8, [rsp + 0x500]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b3fad
cmp qword [rsp + 0x220], 0x80
jne 0x1400b400e
movzx ecx, word [rsp + 0x570]
test cl, 1
jne 0x1400b3c43
mov rsi, rcx
shr rsi, 1
cmp cx, 2
mov qword [rsp + 0x38], rcx
jb 0x1400b4105
and ecx, 0xfffffffe
call fcn.14017b1d8
mov r13, rax
lea rax, [rsi + rsi]
xor ecx, ecx
mov rdx, r13
add rdx, rcx
je 0x1400b6adf
mov word [rdx], 0
add rcx, 2
cmp rax, rcx
jne 0x1400b3e96
mov qword [rsp + 0x280], 0
mov rdx, qword [rsp + 0x578]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r8, r13
mov r9, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b3efc
movzx eax, word [rsp + 0x570]
cmp qword [rsp + 0x280], rax
je 0x1400b40a6
xor esi, esi
test r13, r13
je 0x1400b3f0b
mov rcx, r13
call fcn.14017b254
movabs r13, 0xaaaaaaaaaaaaaaaa
jmp 0x1400b3c45
lea rdx, [rcx + r11*2]
lea r8, [rcx + r11*2]
add r8, 0xfffffffffffffffe
add r11, r11
mov r9, rcx
shr r11, 1
add r11, 0xfffffffffffffffa
xor r10d, r10d
cmp word [r9 + r10], 0x2d
je 0x1400b3f4c
add r10, 2
dec r11
jne 0x1400b3f36
jmp 0x1400b3cb1
mov r11, r9
add r11, r10
je 0x1400b3cb1
cmp word [r9 + r10 + 2], 0x2d
jne 0x1400b3f92
cmp word [r9 + r10 + 4], 0x74
jne 0x1400b3f92
cmp word [r9 + r10 + 6], 0x79
jne 0x1400b3f92
cmp word [r9 + r10 + 8], 0x70
jne 0x1400b3f92
cmp word [r9 + r10 + 0xa], 0x65
jne 0x1400b3f92
cmp word [r9 + r10 + 0xc], 0x3d
je 0x1400b40d2
mov r11, r8
sub r11, r9
add r9, r10
add r9, 2
sub r11, r10
cmp r11, 0xd
jg 0x1400b3f2c
jmp 0x1400b3cb1
cmp dword [0x1402a0cb8], 2
jg 0x1400b3c43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rsi, [rsp + 0x280]
mov rcx, rsi
lea rdx, str.....chrome_appchrome_exe_main_win.cc
mov r8d, 0x16d
mov r9d, 2
call fcn.1401dfc50
mov r8d, 0x18
lea rcx, [rsp + 0x290]
lea rdx, str.ReadProcessMemory_failed
call fcn.1401b98e0
mov rcx, rsi
call fcn.1401dfcd0
jmp 0x1400b3c43
cmp dword [0x1402a0cb8], 2
jg 0x1400b3c43
lea rsi, [rsp + 0x280]
mov rcx, rsi
lea rdx, str.....chrome_appchrome_exe_main_win.cc
mov r8d, 0x171
mov r9d, 2
call fcn.140001120
mov r8d, 0x27
lea rcx, [rsp + 0x290]
lea rdx, str.ReadProcessMemory_incorrect_struct_size
call fcn.1401b98e0
mov rcx, rsi
call fcn.140001210
jmp 0x1400b3c43
xor ebx, ebx
jmp 0x1400b3c28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14027d081]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b410d
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400b40f7
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
jmp 0x1400b40fb
cmp word [rsp + 0x38], 2
jb 0x1400b40b7
test r13, r13
je 0x1400b6af5
lea rcx, [rsp + 0x240]
mov rdx, r13
mov r8, rsi
call fcn.14001c5a0
mov sil, 1
jmp 0x1400b3efe
cmp r11, rdx
je 0x1400b3cb1
sub rcx, r9
add rcx, 0xfffffffffffffffe
cmp rcx, r10
je 0x1400b3cb1
mov cl, 1
mov qword [rsp + 0x40], rcx
jmp 0x1400b3cc5
xor ecx, ecx
mov dl, 1
call fcn.140005a10
jmp 0x1400b3c5e
xor r13d, r13d
jmp 0x1400b3eb0
xor ecx, ecx
jmp 0x1400b40a2
test byte [rsp + 0x40], 1
je 0x1400b42a5
and r12b, 1
jne 0x1400b42a5
lea rbx, [rsp + 0x280]
mov r8d, 0x278
mov rcx, rbx
mov dl, 0xaa
call fcn.1401808d0
lea rcx, [rsp + 0x260]
lea r14, [rsp + 0x500]
mov rdx, r14
call fcn.14014b340
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call fcn.1401e5530
cmp byte [r14 + 0x17], 0
jns 0x1400b417b
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
lea rsi, [rsp + 0x298]
lea rbx, [rsp + 0x280]
lea r14, [rsp + 0x500]
lea r12, [0x14027d081]
mov rcx, rbx
call fcn.1401f1890
test al, al
je 0x1400b4298
mov rax, qword [rsp + 0x280]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [case.0x1401e7f70.0]
test al, al
je 0x1400b419a
test rsi, rsi
je 0x1400b4298
mov edx, dword [rsp + 0x2a0]
cmp edi, edx
je 0x1400b419a
movaps xmmword [rsp + 0x500], xmm6
mov rcx, r14
call fcn.1401e7d20
mov rax, qword [rsp + 0x500]
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x1400b4203
cmp byte [rsp + 0x508], 0
je 0x1400b4218
mov rcx, r14
xor edx, edx
mov r8b, 1
call fcn.1401e7e00
mov rax, qword [rsp + 0x500]
inc rax
cmp rax, 2
jb 0x1400b419a
call fcn.140105b90
mov r15, qword [rsp + 0x500]
cmp qword [0x1402a45d0], 0
je 0x1400b4257
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r15
call qword [case.0x1401e7f70.0]
jmp 0x1400b419a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b4294
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400b4289
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
jmp 0x1400b428d
xor ecx, ecx
mov dl, 1
call fcn.140005a10
jmp 0x1400b423c
xor ecx, ecx
jmp 0x1400b4285
lea rcx, [rsp + 0x280]
call fcn.1401e5590
lea rdi, [rsp + 0x580]
mov rcx, rdi
call fcn.1401e5590
cmp byte [rsp + 0x277], 0
jns 0x1400b42cc
mov rcx, qword [rsp + 0x260]
call fcn.14017b254
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
lea r15, [rsp + 0x1d0]
je 0x1400b438a
lea rbx, [rsp + 0x582]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401808d0
mov word [rbx - 2], 0
lea rbx, [rsp + 0x580]
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x1400b438a
mov eax, eax
lea rdx, [rsp + 0xb0]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rbx, [rsp + 0x500]
mov rcx, rbx
call fcn.14014b0f0
lea r14, [rsp + 0x280]
mov rcx, rbx
mov rdx, r14
call fcn.14014ae20
mov rcx, r14
call fcn.1400735e0
cmp byte [r14 + 0x17], 0
jns 0x1400b4373
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
cmp byte [rsp + 0x517], 0
jns 0x1400b438a
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
call qword [sym.imp.chrome_elf.dll_GetInstallDetailsPayload]
mov rbx, rax
mov ecx, 0x10
call fcn.14017b1d8
lea rcx, [0x14026bcb0]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [0x1402a2c18], rax
call sub.chrome_elf.dll_SignalInitializeCrashReporting
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x1400b43c7
mov byte [0x14029f520], 1
lea rcx, [0x1401e7cf0]
call fcn.14017c244
mov ecx, 1
call fcn.14017c218
xor ecx, ecx
xor edx, edx
call fcn.14002b310
mov r14, qword [0x1402a0c90]
lea rdx, str.maxsafe
mov rcx, r14
call fcn.1401667d0
test al, al
jne 0x1400b4b38
lea rdx, str.mx_url_protocol
mov rcx, r14
call fcn.1401667d0
test al, al
je 0x1400b45dc
call fcn.1400c8420
mov qword [rsp + 0x590], r13
movaps xmmword [rsp + 0x580], xmm6
lea rax, str.mx_name
lea r8, [rsp + 0xa0]
mov qword [r8], rax
mov qword [r8 + 8], 7
mov rcx, r14
mov rdx, rdi
call fcn.14014f460
xorps xmm6, xmm6
lea rbx, [rsp + 0x280]
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x580]
movaps xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
lea rdx, [rsp + 0x80]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0x588]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x500]
mov rcx, rsi
call fcn.14014f5a0
movzx eax, byte [rsp + 0x517]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rsi, qword [rsp + 0x500]
lea rcx, [rsp + 0x90]
mov qword [rcx], rsi
cmovs rdx, qword [rsp + 0x508]
mov qword [rcx + 8], rdx
mov rdx, rbx
call fcn.14004f590
cmp byte [rsp + 0x517], 0
jns 0x1400b44fa
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
movzx eax, byte [rsp + 0x297]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rbx, qword [rsp + 0x280]
cmovs rdx, qword [rsp + 0x288]
lea rsi, [rsp + 0x500]
movaps xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
mov rcx, rbx
mov r8, rsi
call fcn.140143000
mov rcx, rsi
call fcn.1400c8740
cmp byte [rsi + 0x17], 0
jns 0x1400b4554
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
mov rax, qword [r14 + 0x18]
cmp qword [r14 + 0x20], rax
je 0x1400b6b1a
movzx ecx, byte [rax + 0x17]
mov r8d, ecx
and r8d, 0x7f
test cl, cl
mov rcx, qword [rax]
cmovns rcx, rax
lea rdx, [rsp + 0xb0]
mov qword [rdx], rcx
cmovs r8, qword [rax + 8]
mov qword [rdx + 8], r8
lea rsi, [rsp + 0x500]
mov rcx, rsi
call fcn.14014b0f0
mov rcx, rsi
call fcn.1400b6be0
cmp byte [rsi + 0x17], 0
jns 0x1400b45b5
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
cmp byte [rsp + 0x297], 0
jns 0x1400b45cc
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
cmp byte [rsp + 0x597], 0
jns 0x1400b55f3
jmp 0x1400b4647
lea rdx, str.mx_firewall
mov rcx, r14
call fcn.1401667d0
test al, al
je 0x1400b4654
mov rax, qword [r14 + 0x18]
cmp qword [r14 + 0x20], rax
je 0x1400b6b1d
movzx ecx, byte [rax + 0x17]
mov r8d, ecx
and r8d, 0x7f
test cl, cl
mov rcx, qword [rax]
cmovns rcx, rax
lea rdx, [rsp + 0x280]
mov qword [rdx], rcx
cmovs r8, qword [rax + 8]
mov qword [rdx + 8], r8
lea rsi, [rsp + 0x580]
mov rcx, rsi
call fcn.14014b0f0
mov rcx, rsi
call fcn.1400b6be0
cmp byte [rsi + 0x17], 0
jns 0x1400b55f3
mov rcx, qword [rsp + 0x580]
jmp 0x1400b55ee
lea rdx, str.mx_aes_en
mov rcx, r14
call fcn.1401667d0
test al, al
jne 0x1400b467e
lea rdx, str.mx_aes_de
mov rcx, r14
call fcn.1401667d0
test al, al
je 0x1400b488f
lea rsi, [rsp + 0x280]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
lea rax, str.path
lea r8, [rsp + 0x198]
mov qword [r8], rax
mov qword [r8 + 8], 4
mov rcx, r14
mov rdx, rdi
call fcn.14014f460
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x580]
lea rdx, [rsp + 0x1a8]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0x588]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.14014b0f0
cmp byte [rsp + 0x597], 0
jns 0x1400b4701
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
lea rsi, str.mx_aes_en
mov rcx, r14
mov rdx, rsi
call fcn.1401667d0
mov ebx, eax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x500], xmm0
mov qword [rsp + 0x510], 0
test al, al
je 0x1400b4757
lea r8, [rsp + 0x188]
mov qword [r8], rsi
mov qword [r8 + 8], 9
lea rdx, [rsp + 0x500]
mov rcx, r14
call fcn.14001ab30
jmp 0x1400b479d
lea rax, str.mx_aes_de
lea r8, [rsp + 0x178]
mov qword [r8], rax
mov qword [r8 + 8], 9
lea rsi, [rsp + 0x580]
mov rcx, r14
mov rdx, rsi
call fcn.14001ab30
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x510], rax
movdqu xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0x500], xmm0
lea rsi, [rsp + 0x280]
mov rcx, rsi
call fcn.140073320
test al, al
je 0x1400b4815
lea rsi, [rsp + 0x580]
mov r8d, 0x2c8
mov rcx, rsi
mov dl, 0xaa
call fcn.1401808d0
lea rdx, [rsp + 0x280]
mov rcx, rsi
mov r8b, 1
mov r9d, 1
call fcn.140073da0
lea rdi, [rsp + 0xb0]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
mov rcx, rsi
mov rdx, rdi
call fcn.1400319e0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1400b4ba5
mov rcx, qword [rsp + 0xb8]
jmp 0x1400b4baa
cmp byte [rsp + 0x297], 0
jns 0x1400b4827
mov rsi, qword [rsp + 0x280]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400b55c5
movabs r14, 0x7fffffffffffffef
lea rdi, [rsp + 0x280]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
test bl, bl
je 0x1400b526b
call fcn.14014ae20
lea rsi, [rsp + 0x260]
mov rcx, rdi
mov rdx, rsi
call fcn.14014b340
movzx ebx, byte [rsi + 0x17]
test bl, bl
jns 0x1400b52f3
mov rdi, qword [rsp + 0x268]
jmp 0x1400b52f8
lea rdx, str.vbox
mov rcx, r14
call fcn.1401667d0
test al, al
jne 0x1400b48b9
lea rdx, [0x140270881]
mov rcx, r14
call fcn.1401667d0
test al, al
je 0x1400b529c
xorps xmm7, xmm7
lea rsi, [rsp + 0x260]
movaps xmmword [rsi], xmm7
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov ecx, 0x6f
mov rdx, rsi
call fcn.14004dd50
mov qword [rsp + 0x250], r13
movaps xmmword [rsp + 0x240], xmm6
mov qword [rsp + 0x590], rbx
movaps xmmword [rsp + 0x580], xmm7
lea rcx, str.VBox
mov edx, 4
mov r8, rdi
call fcn.140143000
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x580]
cmovns rax, rdi
lea r8, [rsp + 0x500]
mov qword [r8], rax
cmovs rcx, qword [rsp + 0x588]
mov qword [r8 + 8], rcx
lea rdx, [rsp + 0x280]
mov rcx, rsi
call fcn.14014a8b0
cmp byte [rsp + 0x597], 0
jns 0x1400b4968
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
movaps xmmword [rsp + 0x580], xmm7
mov qword [rsp + 0x590], 0
lea rcx, [0x140270d45]
mov edx, 4
mov r8, rdi
call fcn.140143000
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x580]
cmovns rax, rdi
lea rbx, [rsp + 0x500]
mov qword [rbx], rax
cmovs rcx, qword [rsp + 0x588]
mov qword [rbx + 8], rcx
lea rcx, [rsp + 0x280]
lea rdx, [rsp + 0x240]
mov r8, rbx
call fcn.14014a8b0
cmp byte [rsp + 0x597], 0
jns 0x1400b49f2
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
cmp byte [rsp + 0x297], 0
jns 0x1400b4a09
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
lea rdx, [0x140270888]
lea rsi, [rsp + 0x280]
mov r8d, 0xc8
mov rcx, rsi
call fcn.140180220
lea rdx, [rsp + 0x240]
mov rcx, rsi
xor r8d, r8d
call fcn.1400b9f60
lea rsi, [rsp + 0x220]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
lea rax, [0x140270881]
lea r8, [rsp + 0x138]
mov qword [r8], rax
mov qword [r8 + 8], 2
mov rcx, r14
mov rdx, rsi
call fcn.14001ab30
lea r14, [rsp + 0x2a0]
mov rcx, r14
mov rdx, rsi
call fcn.1400b9350
test al, al
jne 0x1400b5f4c
lea rdx, str.Password_Error
lea r8, [0x140270ad8]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [rsp + 0x237], 0
jns 0x1400b4ab8
mov rcx, qword [rsp + 0x220]
call fcn.14017b254
mov rcx, r14
call fcn.1400b9250
mov rdi, qword [rsp + 0x288]
test rdi, rdi
je 0x1400b4b06
mov rsi, qword [rsp + 0x290]
mov rcx, rdi
cmp rsi, rdi
je 0x1400b4af9
add rsi, 0xfffffffffffffe90
mov rcx, rsi
call fcn.1400b7e20
cmp rsi, rdi
jne 0x1400b4add
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x290], rdi
call fcn.14017b254
cmp byte [rsp + 0x257], 0
jns 0x1400b4b1d
mov rcx, qword [rsp + 0x240]
call fcn.14017b254
cmp byte [rsp + 0x277], 0
jns 0x1400b55f3
mov rcx, qword [rsp + 0x260]
jmp 0x1400b55ee
mov qword [rsp + 0x290], r13
movaps xmmword [rsp + 0x280], xmm6
lea rdx, str.maxthon_ipc_class
lea rsi, [rsp + 0x280]
mov rcx, rsi
call fcn.1401bc8c0
cmp byte [rsp + 0x297], 0
jns 0x1400b4b71
mov rsi, qword [rsp + 0x280]
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400b5ce9
cmp byte [rsp + 0x297], 0
jns 0x1400b4404
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
jmp 0x1400b4404
mov ecx, eax
and ecx, 0x7f
test rcx, rcx
je 0x1400b5203
lea r14, [rsp + 0x1f0]
lea r15, [rsp + 0x260]
lea rdi, [rsp + 0x1b8]
xorps xmm7, xmm7
lea r12, [rsp + 0x1d0]
lea rbp, [rsp + 0x220]
mov qword [rsp + 0x200], r13
movaps xmmword [rsp + 0x1f0], xmm6
cmp byte [rsp + 0x297], 0
jns 0x1400b4c19
mov rdx, qword [rsp + 0x280]
mov r8, qword [rsp + 0x288]
mov rcx, r14
call fcn.140008850
mov al, byte [rsp + 0xc7]
jmp 0x1400b4c3b
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x200], rcx
movdqa xmm0, xmmword [rsp + 0x280]
movdqa xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x270], r13
movaps xmmword [rsp + 0x260], xmm6
test al, al
jns 0x1400b4c69
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xb8]
mov rcx, r15
call fcn.140008850
jmp 0x1400b4c8b
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x270], rax
movdqa xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x250], r13
movaps xmmword [rsp + 0x240], xmm6
movzx r8d, byte [rsp + 0x207]
test r8b, r8b
jns 0x1400b4cb3
mov r8, qword [rsp + 0x1f8]
jmp 0x1400b4cb7
and r8d, 0x7f
inc r8
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x240]
mov rdx, r15
mov r9, 0xffffffffffffffff
call fcn.1400239e0
lea rsi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
test bl, bl
je 0x1400b4d1c
call fcn.14014ae20
mov rcx, rsi
lea rdx, [rsp + 0x138]
call fcn.14014b340
movzx edi, byte [rsp + 0x14f]
test dil, dil
jns 0x1400b4d4c
mov rsi, qword [rsp + 0x140]
jmp 0x1400b4d51
call fcn.14014ae20
mov rcx, rsi
lea rdx, [rsp + 0x138]
call fcn.14014b340
movzx edi, byte [rsp + 0x14f]
test dil, dil
jns 0x1400b4dc4
mov rsi, qword [rsp + 0x140]
jmp 0x1400b4dc9
mov esi, edi
and esi, 0x7f
lea r15, [rsi + 3]
movabs rax, 0x7fffffffffffffef
cmp r15, rax
ja 0x1400b6b20
cmp r15, 0xa
jbe 0x1400b4e3c
mov r14, r15
or r14, 7
inc r14
js 0x1400b6b28
lea rcx, [r14 + r14]
call fcn.14017b1d8
mov rcx, rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], r15
lea r14, [rsp + 0x1f0]
jmp 0x1400b4e60
mov esi, edi
and esi, 0x7f
lea r14, [rsi + 3]
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x1400b6b20
cmp r14, 0xa
jbe 0x1400b4f8d
mov r15, r14
or r15, 7
inc r15
js 0x1400b6b28
lea rcx, [r15 + r15]
call fcn.14017b1d8
mov rcx, rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r15
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], r14
lea r15, [rsp + 0x260]
jmp 0x1400b4fb1
movaps xmmword [rsp + 0x150], xmm7
mov qword [rsp + 0x160], 0
mov byte [rsp + 0x167], r15b
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x138]
test dil, dil
lea r15, [rsp + 0x260]
jns 0x1400b4e7d
mov rdx, qword [rsp + 0x138]
lea rdi, [rcx + rsi*2]
cmp rdx, rcx
jb 0x1400b4e8f
cmp rdi, rdx
ja 0x1400b6b38
test rsi, rsi
je 0x1400b4e9f
add rsi, rsi
mov r8, rsi
call fcn.140180220
lea rax, [0x14027086c]
cmp rdi, rax
ja 0x1400b4ebf
lea rax, [rdi + 6]
lea rcx, [0x14027086c]
cmp rax, rcx
ja 0x1400b6b3b
movabs rax, 0x6e0065005f
mov qword [rdi], rax
movzx eax, byte [rsp + 0x167]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x150]
lea rdx, [rsp + 0x150]
cmovns rax, rdx
mov qword [rsp + 0x168], rax
cmovs rcx, qword [rsp + 0x158]
mov qword [rsp + 0x170], rcx
lea rdi, [rsp + 0x1b8]
mov rcx, rdi
mov rdx, r12
lea r8, [rsp + 0x168]
call fcn.14014a8b0
movzx eax, byte [rsp + 0x257]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x240]
lea rdx, [rsp + 0x240]
cmovns rax, rdx
mov qword [rsp + 0x128], rax
cmovs rcx, qword [rsp + 0x248]
mov qword [rsp + 0x130], rcx
mov rcx, r12
mov rdx, rbp
lea r8, [rsp + 0x128]
call fcn.14014a8b0
lea rcx, [rsp + 0xb0]
mov rdx, rbp
lea r8, [rsp + 0x500]
mov r9b, 1
jmp 0x1400b50d9
movaps xmmword [rsp + 0x150], xmm7
mov qword [rsp + 0x160], 0
mov byte [rsp + 0x167], r14b
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x138]
test dil, dil
lea r14, [rsp + 0x1f0]
jns 0x1400b4fce
mov rdx, qword [rsp + 0x138]
lea rdi, [rcx + rsi*2]
cmp rdx, rcx
jb 0x1400b4fe0
cmp rdi, rdx
ja 0x1400b6b3e
test rsi, rsi
je 0x1400b4ff0
add rsi, rsi
mov r8, rsi
call fcn.140180220
lea rax, [0x140270874]
cmp rdi, rax
ja 0x1400b5010
lea rax, [rdi + 6]
lea rcx, [0x140270874]
cmp rax, rcx
ja 0x1400b6b41
movabs rax, 0x650064005f
mov qword [rdi], rax
movzx eax, byte [rsp + 0x167]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x150]
lea rdx, [rsp + 0x150]
cmovns rax, rdx
mov qword [rsp + 0x118], rax
cmovs rcx, qword [rsp + 0x158]
mov qword [rsp + 0x120], rcx
lea rdi, [rsp + 0x1b8]
mov rcx, rdi
mov rdx, r12
lea r8, [rsp + 0x118]
call fcn.14014a8b0
movzx eax, byte [rsp + 0x257]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x240]
lea rdx, [rsp + 0x240]
cmovns rax, rdx
mov qword [rsp + 0x108], rax
cmovs rcx, qword [rsp + 0x248]
mov qword [rsp + 0x110], rcx
mov rcx, r12
mov rdx, rbp
lea r8, [rsp + 0x108]
call fcn.14014a8b0
lea rcx, [rsp + 0xb0]
mov rdx, rbp
lea r8, [rsp + 0x500]
xor r9d, r9d
call fcn.1400b72d0
cmp byte [rsp + 0x237], 0
jns 0x1400b50f5
mov rcx, qword [rsp + 0x220]
call fcn.14017b254
cmp byte [rsp + 0x1e7], 0
jns 0x1400b510c
mov rcx, qword [rsp + 0x1d0]
call fcn.14017b254
cmp byte [rsp + 0x167], 0
jns 0x1400b5123
mov rcx, qword [rsp + 0x150]
call fcn.14017b254
cmp byte [rsp + 0x14f], 0
jns 0x1400b513a
mov rcx, qword [rsp + 0x138]
call fcn.14017b254
cmp byte [rsp + 0x1cf], 0
jns 0x1400b5151
mov rcx, qword [rsp + 0x1b8]
call fcn.14017b254
cmp byte [rsp + 0x257], 0
jns 0x1400b5168
mov rcx, qword [rsp + 0x240]
call fcn.14017b254
cmp byte [rsp + 0x277], 0
jns 0x1400b517f
mov rcx, qword [rsp + 0x260]
call fcn.14017b254
cmp byte [rsp + 0x207], 0
jns 0x1400b5196
mov rcx, qword [rsp + 0x1f0]
call fcn.14017b254
lea rcx, [rsp + 0x580]
mov rdx, r14
call fcn.1400319e0
cmp byte [rsp + 0xc7], 0
jns 0x1400b51bd
mov rcx, qword [rsp + 0xb0]
call fcn.14017b254
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xc0], rax
movdqu xmm0, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0xb0], xmm0
movzx eax, byte [rsp + 0xc7]
test al, al
jns 0x1400b51f5
mov rcx, qword [rsp + 0xb8]
jmp 0x1400b51fa
mov ecx, eax
and ecx, 0x7f
test rcx, rcx
jne 0x1400b4bde
test al, al
jns 0x1400b5214
mov rcx, qword [rsp + 0xb0]
call fcn.14017b254
mov rcx, qword [rsp + 0x7d8]
cmp rcx, 0xffffffffffffffff
jne 0x1400b6b2d
lea rsi, [rsp + 0x828]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
mov rcx, rsi
call fcn.1400345a0
mov rcx, qword [rsi]
call fcn.14017b220
cmp byte [rsi - 0x11], 0
js 0x1400b5cd7
cmp byte [rsp + 0x7f7], 0
jns 0x1400b55c5
mov rcx, qword [rsp + 0x7e0]
jmp 0x1400b55c0
call fcn.14014ae20
lea rsi, [rsp + 0x260]
mov rcx, rdi
mov rdx, rsi
call fcn.14014b340
movzx ebx, byte [rsi + 0x17]
test bl, bl
jns 0x1400b534f
mov rdi, qword [rsp + 0x268]
jmp 0x1400b5354
mov qword [rsp + 0x1e0], r13
movaps xmmword [rsp + 0x1d0], xmm6
lea rax, str.type
lea r8, [rsp + 0x70]
mov qword [r8], rax
mov qword [r8 + 8], 4
mov rcx, r14
mov rdx, r15
call fcn.14001ab30
movzx eax, byte [rsp + 0x1e7]
test al, al
jns 0x1400b562b
mov rax, qword [rsp + 0x1d8]
mov r15, qword [rsp + 0x1d0]
jmp 0x1400b562e
mov edi, ebx
and edi, 0x7f
lea r15, [rdi + 3]
cmp r15, r14
ja 0x1400b6b20
cmp r15, 0xa
jbe 0x1400b53b3
mov r12, r15
or r12, 7
inc r12
js 0x1400b6b28
lea rcx, [r12 + r12]
call fcn.14017b1d8
mov rcx, rax
add r14, 0x11
or r14, r12
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], r15
jmp 0x1400b53cf
mov edi, ebx
and edi, 0x7f
lea r15, [rdi + 3]
cmp r15, r14
ja 0x1400b6b20
cmp r15, 0xa
jbe 0x1400b5487
mov r12, r15
or r12, 7
inc r12
js 0x1400b6b28
lea rcx, [r12 + r12]
call fcn.14017b1d8
mov rcx, rax
add r14, 0x11
or r14, r12
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], r15
lea r14, [rsp + 0x1f0]
jmp 0x1400b54b3
pxor xmm0, xmm0
lea rcx, [rsp + 0x1f0]
movdqa xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x17], r15b
test bl, bl
jns 0x1400b53db
mov rsi, qword [rsp + 0x260]
lea rbx, [rcx + rdi*2]
cmp rsi, rcx
jb 0x1400b53ed
cmp rbx, rsi
ja 0x1400b6b56
test rdi, rdi
je 0x1400b5400
add rdi, rdi
mov rdx, rsi
mov r8, rdi
call fcn.140180220
lea rax, [0x14027086c]
cmp rbx, rax
ja 0x1400b5419
lea rcx, [rbx + 6]
cmp rcx, rax
ja 0x1400b6b59
movabs rax, 0x6e0065005f
mov qword [rbx], rax
lea rax, [rsp + 0x1f0]
movzx ecx, byte [rax + 0x17]
mov edx, ecx
and edx, 0x7f
test cl, cl
mov rcx, qword [rax]
cmovns rcx, rax
lea r8, [rsp + 0xf8]
mov qword [r8], rcx
cmovs rdx, qword [rax + 8]
mov qword [r8 + 8], rdx
lea rcx, [rsp + 0xb0]
lea rsi, [rsp + 0x580]
mov rdx, rsi
call fcn.14014a8b0
lea rcx, [rsp + 0x280]
lea r8, [rsp + 0x500]
mov rdx, rsi
mov r9b, 1
jmp 0x1400b5568
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x200], 0
mov byte [rsp + 0x207], r15b
lea r14, [rsp + 0x1f0]
mov rcx, r14
test bl, bl
jns 0x1400b54bf
mov rsi, qword [rsp + 0x260]
lea rbx, [rcx + rdi*2]
cmp rsi, rcx
jb 0x1400b54d1
cmp rbx, rsi
ja 0x1400b6b5c
test rdi, rdi
je 0x1400b54e4
add rdi, rdi
mov rdx, rsi
mov r8, rdi
call fcn.140180220
lea rax, [0x140270874]
cmp rbx, rax
ja 0x1400b54fd
lea rcx, [rbx + 6]
cmp rcx, rax
ja 0x1400b6b5f
movabs rax, 0x650064005f
mov qword [rbx], rax
movzx eax, byte [rsp + 0x207]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs r14, qword [rsp + 0x1f0]
lea r8, [rsp + 0xe8]
mov qword [r8], r14
cmovs rcx, qword [rsp + 0x1f8]
mov qword [r8 + 8], rcx
lea rcx, [rsp + 0xb0]
lea rsi, [rsp + 0x580]
mov rdx, rsi
call fcn.14014a8b0
lea rcx, [rsp + 0x280]
lea r8, [rsp + 0x500]
mov rdx, rsi
xor r9d, r9d
call fcn.1400b72d0
cmp byte [rsi + 0x17], 0
jns 0x1400b5580
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
cmp byte [rsp + 0x207], 0
jns 0x1400b5597
mov rcx, qword [rsp + 0x1f0]
call fcn.14017b254
cmp byte [rsp + 0x277], 0
jns 0x1400b55ae
mov rcx, qword [rsp + 0x260]
call fcn.14017b254
cmp byte [rsp + 0xc7], 0
jns 0x1400b55c5
mov rcx, qword [rsp + 0xb0]
call fcn.14017b254
cmp byte [rsp + 0x517], 0
jns 0x1400b55dc
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
cmp byte [rsp + 0x297], 0
jns 0x1400b55f3
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
xor esi, esi
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.14017e7b0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x850]
movaps xmm7, xmmword [rsp + 0x860]
add rsp, 0x878
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
and eax, 0x7f
test rax, rax
je 0x1400b563c
test r15, r15
je 0x1400b6b53
cmp rax, 0x10
jne 0x1400b567a
movdqu xmm0, xmmword [r15]
pcmpeqb xmm0, xmmword [str.crashpad_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400b5dad
movdqu xmm0, xmmword [r15]
pcmpeqb xmm0, xmmword [str.fallback_handler]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400b6606
mov qword [rsp + 0x138], r13
mov rax, qword [fcn.1401193e0]
lea rcx, [0x140179e10]
cmp rax, rcx
jne 0x1400b6a92
lea rsi, [rsp + 0x580]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
movabs rcx, 0x8637bd05af6
cmp rax, rcx
jg 0x1400b6b62
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402a2810]
mov qword [rsp + 0x138], rax
call sub.chrome_elf.dll_SignalChromeElf
xorps xmm7, xmm7
movaps xmmword [rsp + 0x290], xmm7
movaps xmmword [rsp + 0x280], xmm7
mov qword [rsp + 0x2a0], 0
mov rax, qword [0x1402a0c88]
mov qword [rsp + 0x2a8], rax
lea rax, [rsp + 0x280]
mov qword [0x1402a0c88], rax
cmp qword [r14 + 0x40], 1
jbe 0x1400b5b30
lea rdx, [rsp + 0x580]
movaps xmmword [rdx], xmm7
mov qword [rdx + 0x10], 0
mov ecx, 1
call fcn.14004dd50
test al, al
je 0x1400b68bc
lea rsi, [rsp + 0x580]
mov rcx, rsi
call fcn.1400c4f00
test al, al
je 0x1400b68bc
mov qword [rsp + 0x508], r13
xor eax, eax
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x508], 0
mov qword [rsp + 0x510], rax
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6875
mov rcx, qword [rsp + 0x500]
test rcx, rcx
jne 0x1400b6bb9
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x508], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
cmp byte [rsp + 0x597], 0
jns 0x1400b581f
mov rsi, qword [rsp + 0x580]
lea rcx, [rsp + 0x500]
lea rdi, [rsp + 0xb0]
mov rdx, rsi
mov r8, rdi
call fcn.14001c480
test eax, eax
jne 0x1400b685e
lea rsi, [rsp + 0x1f0]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
lea rdx, [0x140270cda]
lea r8, [rsp + 0x240]
movzx eax, byte [rsp + 0xc7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0xb0]
mov qword [r8], rdx
mov qword [r8 + 8], 1
lea rdx, [rsp + 0x220]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0xb8]
mov qword [rdx + 8], rcx
mov dword [rsp + 0x20], 1
mov rcx, rsi
mov r9d, 1
call fcn.140033980
lea r14, str.WIN95
mov rdi, qword [rsi + 8]
lea r15, str.WIN95
mov rbx, r13
mov r13, qword [rsp + 0x1f0]
cmp r13, rdi
je 0x1400b5934
mov rsi, qword [r14]
test rsi, rsi
je 0x1400b6b4d
mov rcx, rsi
call fcn.14017bd98
movzx edx, byte [r13 + 0x17]
mov rcx, r13
test dl, dl
jns 0x1400b58fb
mov rcx, qword [r13]
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x1400b5909
test rcx, rcx
je 0x1400b6b47
cmp rdx, rax
jne 0x1400b592b
test rax, rax
je 0x1400b593c
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rsi + rdx*2]
jne 0x1400b592b
inc rdx
cmp rax, rdx
jne 0x1400b5915
jmp 0x1400b593c
add r13, 0x18
cmp r13, rdi
jne 0x1400b58e7
mov r13, rbx
jmp 0x1400b5a87
lea rax, [r13 + 0x18]
cmp rax, rdi
je 0x1400b59e9
mov r12, r13
mov rbp, r13
mov r13, rax
mov rcx, rsi
call fcn.14017bd98
movzx edx, byte [rbp + 0x2f]
mov rcx, r13
test dl, dl
jns 0x1400b596d
mov rdx, qword [rbp + 0x20]
mov rcx, qword [r13]
test rdx, rdx
je 0x1400b597b
test rcx, rcx
je 0x1400b6b25
cmp rdx, rax
jne 0x1400b599d
test rax, rax
je 0x1400b59d2
xor edx, edx
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rsi + rdx*2]
jne 0x1400b599d
inc rdx
cmp rax, rdx
jne 0x1400b5987
jmp 0x1400b59d2
cmp byte [r12 + 0x17], 0
jns 0x1400b59ae
mov rcx, qword [r12]
call fcn.14017b254
mov rax, qword [r13 + 0x10]
mov qword [r12 + 0x10], rax
movdqu xmm0, xmmword [r13]
movdqu xmmword [r12], xmm0
mov byte [rbp + 0x2f], 0
mov word [r13], 0
add r12, 0x18
lea rax, [r13 + 0x18]
cmp rax, rdi
jne 0x1400b594c
mov rdi, qword [rsp + 0x1f8]
jmp 0x1400b59ec
mov r12, r13
mov rsi, rdi
sub rsi, r12
jb 0x1400b6b50
mov r13, rbx
je 0x1400b5a87
mov rax, r12
add rax, rsi
cmp rax, rdi
je 0x1400b5a5c
lea r13, [r12 + rsi]
cmp byte [r12 + 0x17], 0
jns 0x1400b5a21
mov rcx, qword [r12]
call fcn.14017b254
mov rax, qword [r13 + 0x10]
mov qword [r12 + 0x10], rax
movdqu xmm0, xmmword [r13]
movdqu xmmword [r12], xmm0
lea rax, [r12 + rsi]
add rax, 0x18
mov byte [rax - 1], 0
mov word [rax - 0x18], 0
add r12, 0x18
cmp rax, rdi
jne 0x1400b5a0c
mov rdi, qword [rsp + 0x1f8]
mov r13, rbx
cmp rdi, r12
je 0x1400b5a7c
lea rsi, [rdi - 0x18]
cmp byte [rdi - 1], 0
jns 0x1400b5a74
mov rcx, qword [rdi - 0x18]
call fcn.14017b254
mov rdi, rsi
cmp rsi, r12
jne 0x1400b5a61
mov qword [rsp + 0x1f8], r12
mov rdi, r12
add r14, 8
cmp r14, r15
jne 0x1400b58c3
mov rax, qword [rsp + 0x1f0]
cmp rax, rdi
je 0x1400b6593
mov qword [rsp + 0x270], r13
movaps xmmword [rsp + 0x260], xmm6
lea r8, [rsp + 0x1b8]
lea rcx, [0x140270cda]
mov qword [r8], rcx
mov qword [r8 + 8], 1
sub rdi, rax
sar rdi, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rcx, rdi
lea rdx, [rsp + 0x150]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x260]
mov rcx, rdi
call fcn.140073c80
cmp byte [rsp + 0x277], 0
jns 0x1400b5b15
mov rdi, qword [rsp + 0x260]
cmp byte [rsp + 0x597], 0
jns 0x1400b65ae
mov rsi, qword [rsp + 0x580]
jmp 0x1400b65b6
mov rax, qword [r14 + 0x30]
add r14, 0x38
cmp rax, r14
je 0x1400b5bdd
movzx ecx, byte [rax + 0x37]
test cl, cl
js 0x1400b5b4f
lea rdx, [rax + 0x20]
jmp 0x1400b5b57
mov rdx, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400b5b65
test rdx, rdx
je 0x1400b6b4a
cmp rcx, 0x11
jne 0x1400b572c
movdqu xmm0, xmmword [rdx]
movzx ecx, byte [rdx + 0x10]
movzx edx, byte [0x140278b80]
movd xmm1, ecx
movd xmm2, edx
pcmpeqb xmm0, xmmword [str.profile_directory]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb ecx, xmm0
cmp ecx, 0xffff
jne 0x1400b572c
test rax, rax
je 0x1400b6b44
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1400b5bc6
mov rcx, qword [rax + 0x10]
cmp qword [rcx], rax
mov rax, rcx
je 0x1400b5bd1
jmp 0x1400b5bb8
mov rcx, rdx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400b5bc6
mov rax, rcx
cmp rcx, r14
jne 0x1400b5b41
pxor xmm0, xmm0
lea rdx, [rsp + 0x500]
movdqa xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov ecx, 3
call fcn.14004dd50
test al, al
je 0x1400b64d2
lea rax, str.User_Data
lea r8, [rsp + 0xb0]
mov qword [r8], rax
mov qword [r8 + 8], 9
lea rsi, [rsp + 0x500]
lea rdx, [rsp + 0x580]
mov rcx, rsi
call fcn.14014a8b0
cmp byte [rsi + 0x17], 0
jns 0x1400b5c4c
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
mov rax, qword [rsp + 0x590]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x580]
movdqa xmmword [rdx], xmm0
mov rcx, 0xffffffff80000002
call fcn.14005d690
test al, al
jne 0x1400b5c91
lea rdx, [rsp + 0x500]
mov rcx, 0xffffffff80000001
call fcn.14005d690
lea rcx, [rsp + 0x500]
call fcn.1400c9760
test rax, rax
je 0x1400b64d2
mov rcx, rax
call fcn.1400c9870
mov esi, eax
cmp byte [rsp + 0x517], 0
jns 0x1400b5cc8
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
test esi, esi
jne 0x1400b572c
xor esi, esi
jmp 0x1400b69df
mov rcx, qword [rsp + 0x800]
call fcn.14017b254
jmp 0x1400b5250
mov rbx, rax
mov qword [rsp + 0x510], r13
movaps xmmword [rsp + 0x500], xmm6
lea rdx, str.maxsafe
lea rsi, [rsp + 0x500]
mov rcx, rsi
call fcn.1401bae30
xor r14d, r14d
mov r8d, 0x200
mov rcx, rdi
xor edx, edx
call fcn.1401808d0
movzx eax, byte [rsp + 0x517]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs rsi, qword [rsp + 0x500]
cmovs r8, qword [rsp + 0x508]
mov rcx, rdi
mov rdx, rsi
call fcn.140180220
lea rsi, [rsp + 0xb0]
mov qword [rsi + 8], r13
mov qword [rsi], r14
mov rcx, rdi
call fcn.1401a3fd0
inc eax
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdi
lea rax, [rsp + 0x1f0]
mov qword [rax], r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 0x4a
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x1400b55c5
mov rcx, r14
call fcn.140064e70
lea rdx, str.no_periodic_tasks
mov rcx, r14
call fcn.1401667d0
test al, al
jne 0x1400b63f9
lea rsi, [rsp + 0x580]
mov qword [rsi + 0x40], r13
pxor xmm0, xmm0
movdqa xmmword [rsi], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], 0xffffffffffffffff
mov qword [rsi + 0x38], 0
mov byte [rsi + 0x40], 0
lea rax, str.initial_client_data
lea r8, [rsp + 0x60]
mov qword [r8], rax
mov qword [r8 + 8], 0x13
lea r15, [rsp + 0x280]
mov rcx, r14
mov rdx, r15
call fcn.14001ab30
mov rcx, rsi
mov rdx, r15
call fcn.1400504b0
mov ebx, eax
cmp byte [r15 + 0x17], 0
jns 0x1400b5e49
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
test bl, bl
je 0x1400b63f9
lea rsi, [rsp + 0x500]
mov qword [rsi], 0xffffffffffffffff
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rbx, rax
mov r15, qword [rsp + 0x5b8]
call r12
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov rcx, rax
mov rdx, r15
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400b63f9
lea rsi, [rsp + 0x280]
movaps xmmword [rsi], xmm6
mov rdx, qword [rsp + 0x500]
mov rcx, rsi
call fcn.140157be0
mov ecx, 0xa8
call fcn.14017b1d8
mov rbx, rax
mov rcx, rax
call fcn.1400671a0
lea r15, [rsp + 0x50]
mov rcx, r15
mov rdx, rsi
call fcn.140073b00
mov rcx, rbx
mov rdx, r15
call fcn.1400745d0
test al, al
je 0x1400b5f01
mov rcx, rbx
call fcn.1400ca7d0
mov rax, qword [rsp + 0x280]
inc rax
cmp rax, 2
jb 0x1400b63fb
call fcn.140105b90
mov rsi, qword [rsp + 0x280]
cmp qword [0x1402a45d0], 0
je 0x1400b6aa5
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [case.0x1401e7f70.0]
jmp 0x1400b63fb
lea rcx, [rsp + 0xb0]
mov qword [rcx + 0x20], r13
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
mov dl, 7
call fcn.140029f80
mov r14, qword [rsp + 0x288]
mov r12, qword [rsp + 0x290]
cmp r14, r12
lea r15, [rsp + 0x1f0]
je 0x1400b623f
lea rbp, [rsp + 0x580]
lea rsi, [rsp + 0x1d0]
xorps xmm7, xmm7
lea r13, str.address
mov r8d, 0x170
mov rcx, rbp
lea rdx, [0x140270950]
call fcn.140180220
mov rcx, rbp
mov rdx, r14
call fcn.1400b7560
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x210], rax
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm6
mov rcx, r15
mov dl, 6
call fcn.140029f80
mov rcx, rbp
mov rdx, rsi
lea r8, [rsp + 0x650]
xor r9d, r9d
call fcn.1400b8390
cmp qword [rsp + 0x210], 6
jne 0x1400b6af0
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x510], rax
movaps xmm0, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x1d0], xmm7
mov qword [rsp + 0x1e0], 0
mov qword [rsp + 0x520], 4
lea rax, str.private_key
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 0xb
mov rcx, r15
lea rdx, [rsp + 0x150]
mov r8, rbx
call fcn.1401435c0
mov rdx, qword [rsp + 0x520]
mov qword [rsp + 0x1a8], rbx
lea rcx, [rsp + 0x1a8]
call fcn.140109270
cmp byte [rsp + 0x1e7], 0
jns 0x1400b60b4
mov rcx, qword [rsp + 0x1d0]
call fcn.14017b254
cmp qword [rsp + 0x210], 6
jne 0x1400b6af0
movzx eax, byte [rsp + 0x64f]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0x640]
mov rax, qword [rsp + 0x638]
lea rdx, [rsp + 0x638]
cmovns rax, rdx
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], rcx
lea rax, str.public_key
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 0xa
lea r15, [rsp + 0x1f0]
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.14003b9a0
cmp qword [rsp + 0x210], 6
jne 0x1400b6af0
movzx eax, byte [rsp + 0x67f]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0x670]
mov rax, qword [rsp + 0x668]
lea rdx, [rsp + 0x668]
cmovns rax, rdx
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], rcx
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1d8], 7
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.14003b9a0
cmp qword [rsp + 0xd0], 7
jne 0x1400b6b12
mov r15, qword [rsp + 0xb8]
cmp r15, qword [rsp + 0xc0]
jae 0x1400b61dc
mov rcx, r15
lea rdx, [rsp + 0x1f0]
call fcn.140029e90
add r15, 0x28
mov qword [rsp + 0xb8], r15
jmp 0x1400b61f9
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x1f0]
call fcn.140036bc0
mov r15, qword [rsp + 0xb8]
cmp qword [rsp + 0xb0], r15
je 0x1400b6b17
mov rdx, qword [rsp + 0x210]
lea r15, [rsp + 0x1f0]
mov qword [rsp + 0x500], r15
mov rcx, rbx
call fcn.140109270
mov rcx, rbp
call fcn.1400b7e20
add r14, 0x170
cmp r14, r12
jne 0x1400b5fa1
xorps xmm7, xmm7
lea rbx, [rsp + 0x1f0]
movaps xmmword [rbx], xmm7
xor r14d, r14d
mov qword [rbx + 0x10], r14
mov ecx, 1
mov rdx, rbx
call fcn.14004dd50
lea rsi, [rsp + 0x1d0]
mov rcx, rbx
mov rdx, rsi
call fcn.14014ae20
mov qword [rsp + 0x590], r14
movaps xmmword [rsp + 0x580], xmm7
lea rcx, str.vbox.json
mov edx, 9
mov r8, rdi
call fcn.140143000
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x580]
lea r8, [rsp + 0x150]
mov qword [r8], rdi
cmovs rcx, qword [rsp + 0x588]
mov qword [r8 + 8], rcx
lea rdx, [rsp + 0x500]
mov rcx, rsi
call fcn.14014a8b0
cmp byte [rsp + 0x597], 0
jns 0x1400b62ef
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
cmp byte [rsp + 0x207], 0
movabs rsi, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x2a0]
jns 0x1400b6318
mov rcx, qword [rsp + 0x1f0]
call fcn.14017b254
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x200], rax
movups xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x517], 0
mov word [rsp + 0x500], 0
cmp byte [rsp + 0x1e7], 0
jns 0x1400b6361
mov rcx, qword [rsp + 0x1d0]
call fcn.14017b254
lea rcx, [rsp + 0x588]
mov qword [rcx + 0x10], rsi
movups xmmword [rcx], xmm6
lea rax, [0x14026b930]
mov qword [rcx - 8], rax
lea rdi, [rsp + 0x1f0]
mov rdx, rdi
call fcn.1401567f0
lea rbx, [rsp + 0x1b8]
lea rsi, [rsp + 0xb0]
mov rcx, rbx
mov rdx, rsi
call fcn.1400c7510
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x10], rax
movdqu xmm0, xmmword [rbx]
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x580]
xor r8d, r8d
call fcn.1401df430
test al, al
je 0x1400b6527
cmp byte [rsp + 0x207], 0
jns 0x1400b63e8
mov rdi, qword [rsp + 0x1f0]
lea r8, str.Sucess
xor ecx, ecx
mov rdx, rdi
jmp 0x1400b6537
xor ebx, ebx
lea rsi, [rsp + 0x280]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
lea rax, str.user_data_dir
lea r8, [rsp + 0xb0]
mov qword [r8], rax
mov qword [r8 + 8], 0xd
mov rcx, r14
mov rdx, rdi
call fcn.14014f460
movzx eax, byte [rsp + 0x597]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x580]
lea rdx, [rsp + 0x500]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0x588]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.14014b0f0
cmp byte [rsp + 0x597], 0
js 0x1400b6581
mov rcx, qword [0x1402a0c90]
lea r8, str.type
lea r9, str.user_data_dir
lea rdx, [rsp + 0x280]
call fcn.1400caa00
mov esi, eax
test rbx, rbx
je 0x1400b64f2
test esi, esi
je 0x1400b64f2
mov rcx, qword [rbx + 0xa0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400b64b9
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [rsp + 0x297], 0
jns 0x1400b6512
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
jmp 0x1400b6512
cmp byte [rsp + 0x517], 0
jns 0x1400b572c
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
jmp 0x1400b572c
cmp byte [rsp + 0x297], 0
jns 0x1400b6509
mov rcx, qword [rsp + 0x280]
call fcn.14017b254
test rbx, rbx
je 0x1400b69ec
mov rcx, rbx
call fcn.14004f880
mov rcx, rbx
call fcn.14017b254
jmp 0x1400b69ec
lea rdx, str.Error
lea r8, [0x140270ad8]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x580]
call fcn.1401df3b0
cmp byte [rsp + 0x207], 0
jns 0x1400b6564
mov rcx, qword [rsp + 0x1f0]
call fcn.14017b254
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x580]
mov qword [rcx], rsi
call fcn.140109270
jmp 0x1400b4aa1
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
jmp 0x1400b6475
cmp byte [rsp + 0x597], 0
jns 0x1400b67fb
mov rdx, qword [rsp + 0x580]
jmp 0x1400b6803
lea rsi, [rsp + 0x580]
mov rcx, rdi
call fcn.14017bd98
add eax, eax
add eax, 2
mov rcx, qword [rsp + 0x500]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [rsp + 0x277], 0
jns 0x1400b6811
mov rcx, qword [rsp + 0x260]
call fcn.14017b254
jmp 0x1400b6811
lea rsi, [rsp + 0x580]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.1401808d0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400b6bc7
pxor xmm0, xmm0
lea rsi, [rsp + 0x280]
movdqa xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
lea rdi, [rsp + 0x500]
mov qword [rdi + 0x10], rax
movdqa xmmword [rdi], xmm0
mov qword [rsp + 0xc0], rax
movdqa xmmword [rsp + 0xb0], xmm0
lea rbx, [rsp + 0x1f0]
mov qword [rbx + 0x10], rax
movdqa xmmword [rbx], xmm0
lea r15, [rsp + 0x260]
lea rdx, [rsp + 0x580]
mov rcx, r15
call fcn.1401bc8c0
lea r12, [rsp + 0xb0]
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.1400ca470
cmp byte [r15 + 0x17], 0
jns 0x1400b66c8
mov rcx, qword [rsp + 0x260]
call fcn.14017b254
movzx eax, byte [rsp + 0xc7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs r12, qword [rsp + 0xb0]
lea rdx, [rsp + 0x1b8]
mov qword [rdx], r12
cmovs rcx, qword [rsp + 0xb8]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0x260]
mov rcx, rbx
call fcn.14014f5a0
movzx eax, byte [rsp + 0x517]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rdi, qword [rsp + 0x500]
lea rdx, [rsp + 0x150]
mov qword [rdx], rdi
cmovs rcx, qword [rsp + 0x508]
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x240]
mov rcx, rdi
call fcn.14014f5a0
movzx eax, byte [rsp + 0x297]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rsi, qword [rsp + 0x280]
lea rdx, [rsp + 0x138]
mov qword [rdx], rsi
cmovs rcx, qword [rsp + 0x288]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x220]
mov rcx, rsi
call fcn.14014f5a0
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.1401e9de0
mov esi, eax
cmp byte [rsp + 0x207], 0
jns 0x1400b67b2
mov rcx, qword [rsp + 0x1f0]
call fcn.14017b254
cmp byte [rsp + 0xc7], 0
jns 0x1400b67c9
mov rcx, qword [rsp + 0xb0]
call fcn.14017b254
cmp byte [rsp + 0x517], 0
jns 0x1400b67e0
mov rcx, qword [rsp + 0x500]
call fcn.14017b254
cmp byte [rsp + 0x297], 0
jns 0x1400b69ec
mov rcx, qword [rsp + 0x280]
jmp 0x1400b651d
lea rdx, [rsp + 0x580]
mov rcx, qword [rsp + 0x500]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rsp + 0x1f0]
test rsi, rsi
je 0x1400b685e
mov rax, qword [rsp + 0x1f8]
mov rcx, rsi
cmp rax, rsi
je 0x1400b6851
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x1400b6841
mov rcx, qword [rax - 0x18]
call fcn.14017b254
mov rax, rdi
cmp rdi, rsi
jne 0x1400b682e
mov rcx, qword [rsp + 0x1f0]
mov qword [rsp + 0x1f8], rsi
call fcn.14017b254
cmp byte [rsp + 0xc7], 0
jns 0x1400b6875
mov rcx, qword [rsp + 0xb0]
call fcn.14017b254
mov rcx, qword [rsp + 0x500]
test rcx, rcx
je 0x1400b689f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x500], 0
mov dword [rsp + 0x508], 0
mov rcx, qword [rsp + 0x510]
mov qword [rsp + 0x510], 0
test rcx, rcx
jne 0x1400b6a83
cmp byte [rsp + 0x597], 0
jns 0x1400b68d3
mov rcx, qword [rsp + 0x580]
call fcn.14017b254
mov rcx, qword [0x1402a0cc8]
test rcx, rcx
mov rbx, qword [rsp + 0x48]
jne 0x1400b6b89
xor ecx, ecx
sub ecx, dword [0x1402a0cb8]
mov eax, 0xffffffff
cmovns eax, ecx
test eax, eax
jg 0x1400b6a39
mov ecx, 0x28
call fcn.14017b1d8
mov rdi, rax
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm0
lea rax, [0x14026d8b0]
mov qword [rdi], rax
mov r8, qword [rsp + 0x138]
mov rcx, rdi
mov rdx, rbx
call fcn.1400bbde0
mov esi, eax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400b6958
movzx eax, byte [rdi + 0x27]
test al, al
js 0x1400b6bad
test rax, rax
je 0x1400b6a18
test rdi, rdi
je 0x1400b697e
lea rax, [0x14026d8a0]
mov qword [rdi], rax
cmp byte [rdi + 0x27], 0
jns 0x1400b6976
mov rcx, qword [rdi + 0x10]
call fcn.14017b254
mov rcx, rdi
call fcn.14017b254
lea rax, [rsp + 0x1d0]
movzx edx, byte [rax + 0x17]
mov ecx, edx
and ecx, 0x7f
test dl, dl
cmovs rcx, qword [rax + 8]
cmovs rax, qword [rax]
test rcx, rcx
je 0x1400b69a8
test rax, rax
je 0x1400b6bb6
cmp rcx, 5
je 0x1400b69c7
cmp rcx, 7
jne 0x1400b6a0c
mov ecx, dword [rax]
xor ecx, dword [str.utility]
mov eax, dword [rax + 3]
xor eax, dword [0x140271563]
jmp 0x1400b69db
mov ecx, dword [rax]
xor ecx, dword [str.ppapi]
mov al, byte [rax + 4]
xor al, byte [0x14027153a]
movzx eax, al
or eax, ecx
je 0x1400b6a11
lea rcx, [rsp + 0x280]
call fcn.1400c41a0
cmp byte [rsp + 0x1e7], 0
jns 0x1400b55f5
mov rcx, qword [rsp + 0x1d0]
call fcn.14017b254
jmp 0x1400b55f5
test rcx, rcx
jne 0x1400b69df
mov ecx, esi
call fcn.1400c7fa0
lea rdx, str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b6bc4
call qword [case.0x1401e7f70.0]
jmp 0x1400b6958
lea rdx, str.....chrome_appchrome_exe_main_win.cc
lea rsi, [rsp + 0x580]
mov rcx, rsi
mov r8d, 0x2bf
mov r9d, 0xffffffff
call fcn.140001120
lea rcx, [rsp + 0x590]
lea rdx, str.About_to_load_main_DLL.
mov r8d, 0x17
call fcn.1401b98e0
mov rcx, rsi
call fcn.140001210
jmp 0x1400b6900
mov edx, 1
call fcn.140047e20
jmp 0x1400b68bc
lea rcx, [rsp + 0x138]
call qword [case.0x1401e7f70.0]
jmp 0x1400b56df
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b6bca
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400b6ae2
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
jmp 0x1400b6ae6
int3
xor ecx, ecx
mov dl, 1
call fcn.140005a10
jmp 0x1400b5f31
call fcn.1401bbb10
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0
cmp eax, 6
jne 0x1400b3b07
int3
call fcn.1401bbb10
int3
int3
int3
call fcn.14017b5a8
int3
call fcn.1401be9c0
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400b5226
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov rcx, qword [0x1402a2810]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x1400b56d7
lea rdx, [rsp + 0x580]
lea rax, str.....chrome_appchrome_exe_main_win.cc
mov qword [rdx], rax
mov qword [rdx + 8], 0x27
call fcn.1401f0060
jmp 0x1400b68f8
mov rax, qword [rdi + 0x18]
jmp 0x1400b694f
int3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b57d9
int3
int3
xor ecx, ecx
jmp 0x1400b6adb