Function at 0x14001b420
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Create process on windows
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xac8
mov rbx, r9
mov r15, r8
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0xac0], rax
mov rax, qword [0x1400512e0]
mov qword [rsp + 0x220], rax
movdqa xmm0, xmmword [0x1400512d0]
movdqa xmmword [rsp + 0x210], xmm0
lea r14, [r8 + 8]
mov rax, qword [r8 + 8]
test rax, rax
je 0x14001c4e9
lea rdi, [r15 + 0x10]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001b4ca
lea rbp, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbp, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001b4ca
call r12
cmp ax, 0x6f
je 0x14001c528
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001b491
mov rax, qword [r14]
mov qword [0x14005fca0], rbx
test rax, rax
je 0x14001b6ba
lea rdi, [r15 + 0x10]
lea r13, str.log_launcher_error
mov rbp, r14
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
je 0x14001b516
mov rax, qword [rbp + 8]
add rbp, 8
add rdi, 8
test rax, rax
jne 0x14001b4f7
jmp 0x14001b571
lea rsi, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rsi, rax
xor ebx, ebx
movzx ecx, word [rsi + rbx]
test cx, cx
je 0x14001b503
call r12
cmp ax, word [rbx + r13]
jne 0x14001b503
lea rax, [rbx + 2]
cmp word [rbx + r13 + 2], 0
mov rbx, rax
jne 0x14001b529
cmp word [rsi + rax], 0
jne 0x14001b503
mov rax, qword [rdi]
mov qword [rdi - 8], rax
add rdi, 8
test rax, rax
jne 0x14001b553
mov rax, qword [rsp + 0x60]
dec dword [rax]
mov byte [0x14005fca8], 1
mov rax, qword [r14]
test rax, rax
je 0x14001b6ba
lea rdi, [r15 + 0x10]
movzx ecx, word [rax]
cmp cx, 0x2d
jne 0x14001b6a0
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x63
jne 0x14001b6aa
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x6f
jne 0x14001b6aa
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x6e
jne 0x14001b6aa
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x74
jne 0x14001b6aa
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x65
jne 0x14001b6aa
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x6e
jne 0x14001b6aa
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x74
jne 0x14001b6aa
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x70
jne 0x14001b6aa
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x72
jne 0x14001b6aa
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x6f
jne 0x14001b6aa
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x14001b6aa
call r12
cmp ax, 0x63
jne 0x14001b6aa
cmp word [rbx + 0x16], 0
je 0x14001b98a
jmp 0x14001b6aa
cmp cx, 0x2f
je 0x14001b58e
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001b581
lea rcx, [rsp + 0x148]
call fcn.14001d8c0
pxor xmm0, xmm0
lea r8, [rsp + 0x680]
movdqa xmmword [r8 + 0x20], xmm0
movdqa xmmword [r8 + 0x10], xmm0
movdqa xmmword [r8], xmm0
lea rax, [rsp + 0x248]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x14001c83c
mov r8, qword [rsp + 0x6a8]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14001c871
lea rsi, [rsp + 0x6a0]
mov dword [rsi - 0x20], 0
mov byte [rsi - 8], 0
lea r9, [rsp + 0x248]
mov dword [r9], 0x209
mov rcx, rbp
mov edx, 1
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14001c8a6
cmp byte [rsp + 0x698], 1
je 0x14001c8df
mov r8d, dword [rsp + 0x680]
lea rdi, [rsp + 0xd0]
mov rcx, rdi
mov rdx, rsi
call fcn.14001e120
cmp byte [rdi + 0x18], 1
je 0x14001c8fe
lea rsi, [rsp + 0x268]
mov dword [rsi - 0x20], 1
mov byte [rsi - 8], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x14001b7cf
test eax, eax
jne 0x14001c3ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov r13d, 0x29
mov dil, 1
lea rbx, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, rbp
inc rax
cmp rax, 2
jb 0x14001b808
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x14001c851
test bl, bl
sete sil
lea rcx, [0x140054d60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001c95e
mov rax, qword [r14]
test rax, rax
je 0x14001b884
lea rdi, [r15 + 0x10]
mov rbx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001b878
lea rbp, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbp, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001b878
call rbx
cmp ax, 0x6c
je 0x14001c74a
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001b840
mov r13b, 1
mov bpl, 1
test sil, sil
je 0x14001b8ec
mov rax, qword [r14]
mov bpl, 1
test rax, rax
je 0x14001b8e9
lea rsi, [r15 + 0x10]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001b8dd
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001b8dd
call rdi
cmp ax, 0x66
je 0x14001c97b
mov rax, qword [rsi]
add rsi, 8
test rax, rax
jne 0x14001b8a5
xor r13d, r13d
mov dword [rsp + 0x6c], ebp
mov r12d, 1
cmp qword [rsp + 0x168], 0
je 0x14001c31c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14001c708
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14001c708
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14001c708
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14001c708
cmp dword [rax + rcx + 0x50], 0x148
jb 0x14001c708
mov esi, dword [rax + rcx + 8]
lea rdi, [rsp + 0x190]
cmp qword [rdi + 0x10], 0
jne 0x14001ba5e
mov rbx, qword [rsp + 0x180]
cmp qword [rsp + 0x188], 8
jb 0x14001b9bd
mov r9, qword [rsp + 0x170]
jmp 0x14001b9c5
mov rdi, qword [rsp + 0x58]
mov qword [rdi], 0
mov rcx, qword [rsp + 0xac0]
xor rcx, rsp
call fcn.140027a90
mov rax, rdi
add rsp, 0xac8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r9, [rsp + 0x170]
mov rax, qword [rsp + 0x1a8]
cmp rax, rbx
jb 0x14001c42f
mov rbp, rdi
cmp rax, 8
jb 0x14001b9e7
mov rbp, qword [rsp + 0x190]
mov qword [rsp + 0x1a0], rbx
lea r8, [rbx + rbx]
mov rcx, rbp
mov rdx, r9
call sub.ntdll.dll_memmove
mov word [rbp + rbx*2], 0
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jb 0x14001c4f5
lea rdx, [rax + 6]
mov qword [rsp + 0x1a0], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x14001ba42
mov rdx, qword [rsp + 0x190]
mov ecx, dword [0x14005137a]
mov dword [rdx + rax*2 + 8], ecx
mov rcx, qword [str.Image]
mov qword [rdx + rax*2], rcx
mov word [rdx + rax*2 + 0xc], 0
mov dword [rsp + 0x248], 4
mov rcx, qword [rsp + 0x168]
cmp qword [rsp + 0x1a8], 8
jb 0x14001ba84
mov rdi, qword [rsp + 0x190]
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x680]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x228]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c43f
cmp dword [rsp + 0x228], 4
jne 0x14001cb55
cmp dword [rsp + 0x680], esi
jne 0x14001c448
test r13b, r13b
je 0x14001c1da
lea rsi, [rsp + 0x680]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
mov qword [rsp + 0x158], rax
mov byte [rsp + 0x160], 1
mov byte [rsp + 0xe0], 0
mov dword [rsp + 0xd0], 1
cmp dword [rsp + 0xd0], 0
jne 0x14001c2b0
call fcn.14001d7b0
test al, al
jne 0x14001cba1
call int.14001dac0
test r15, r15
je 0x14001cb20
lea rsi, [rsp + 0x680]
mov rcx, rsi
call fcn.14001d9d0
mov rax, qword [rsi]
test rax, rax
je 0x14001cb20
mov qword [r15], rax
mov rax, qword [r15 + 8]
test rax, rax
je 0x14001bd1a
lea rdi, [r15 + 0x10]
mov rsi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001bcfe
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x77
jne 0x14001bcfe
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x61
jne 0x14001bcfe
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x69
jne 0x14001bcfe
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x74
jne 0x14001bcfe
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x2d
jne 0x14001bcfe
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x66
jne 0x14001bcfe
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x6f
jne 0x14001bcfe
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x72
jne 0x14001bcfe
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x2d
jne 0x14001bcfe
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x62
jne 0x14001bcfe
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x72
jne 0x14001bcfe
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x6f
jne 0x14001bcfe
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x77
jne 0x14001bcfe
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x73
jne 0x14001bcfe
movzx ecx, word [rbx + 0x1c]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x65
jne 0x14001bcfe
movzx ecx, word [rbx + 0x1e]
test cx, cx
je 0x14001bcfe
call rsi
cmp ax, 0x72
jne 0x14001bcfe
cmp word [rbx + 0x20], 0
je 0x14001bd4b
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001bb7c
mov rax, qword [r14]
test rax, rax
jne 0x14001d1c0
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001bd31
cmp byte [rax], 0
jne 0x14001bd62
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001d111
xor ebp, ebp
jmp 0x14001bd67
mov rax, qword [rdi]
mov qword [rdi - 8], rax
add rdi, 8
test rax, rax
jne 0x14001bd4b
mov rax, qword [rsp + 0x60]
dec dword [rax]
mov ebp, 1
mov rax, qword [r14]
test rax, rax
je 0x14001bdbe
lea rsi, [r15 + 0x10]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001bdb2
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001bdb2
call rdi
cmp ax, 0x6e
je 0x14001cce1
mov rax, qword [rsi]
add rsi, 8
test rax, rax
jne 0x14001bd7a
lea r9, [rsp + 0x98]
mov qword [r9], 0
mov rdx, qword [r15]
lea rsi, [rsp + 0x130]
mov rcx, rsi
mov r8d, ebp
call fcn.14002e5a0
cmp byte [rsi + 0x10], 1
je 0x14001cbfa
cmp dword [rsp + 0x130], 1
je 0x14001ce4a
lea rcx, [rsp + 0x148]
lea rsi, [rsp + 0x118]
mov rdx, rsi
call fcn.14001dbd0
cmp byte [rsi + 0x10], 1
je 0x14001cc04
mov rax, qword [rsp + 0x60]
mov edx, dword [rax]
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov r8, r15
call fcn.14001e470
mov rbx, qword [rsi]
test rbx, rbx
je 0x14001cc0e
lea rsi, [rsp + 0x88]
mov rcx, rsi
mov rdx, r15
call fcn.14001e650
cmp byte [rsi + 1], 0
je 0x14001cea7
mov qword [rsp + 0x60], rbx
mov r14d, ebp
xor eax, eax
lea rcx, [rsp + 0xf0]
mov qword [rcx - 0x20], rax
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], 3
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
call fcn.14001d7b0
test al, al
jne 0x14001cee3
lea r13, [rsp + 0xd8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov r12, rax
mov ecx, 0xfffffff5
call rdi
mov rsi, rax
mov ecx, 0xfffffff4
call rdi
mov rbp, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001bf17
mov rcx, r12
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001bf17
mov rax, qword [rsp + 0xe0]
cmp rax, qword [rsp + 0xe8]
je 0x14001d124
mov rcx, qword [rsp + 0xd8]
mov qword [rcx + rax*8], r12
inc qword [rsp + 0xe0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001bf6a
mov rcx, rsi
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001bf6a
mov rax, qword [rsp + 0xe0]
cmp rax, qword [rsp + 0xe8]
je 0x14001d141
mov rcx, qword [rsp + 0xd8]
mov qword [rcx + rax*8], rsi
inc qword [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001bfbd
mov rcx, rbp
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001bfbd
mov rax, qword [rsp + 0xe0]
cmp rax, qword [rsp + 0xe8]
je 0x14001d15e
mov rcx, qword [rsp + 0xd8]
mov qword [rcx + rax*8], rbp
inc qword [rsp + 0xe0]
lea rcx, [rsp + 0xd0]
lea rdi, [rsp + 0xb8]
lea r13, [rsp + 0x680]
mov rdx, rdi
mov r8, r13
call fcn.14002e340
cmp byte [rdi + 0x10], 1
je 0x14001cef0
xor edi, edi
cmp byte [rsp + 0xb8], 0
je 0x14001cf22
mov ebx, 0x80404
cmp qword [rsp + 0xe0], 0
je 0x14001c02f
or byte [rsp + 0x6bd], 1
mov qword [rsp + 0x6d0], r12
mov qword [rsp + 0x6d8], rsi
mov qword [rsp + 0x6e0], rbp
mov edi, 1
lea rsi, [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsi + 0x3d], 8
je 0x14001c057
mov rax, qword [rsp + 0x260]
test rax, rax
jne 0x14001d4fa
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [r15]
lea rax, [rsp + 0x70]
test rcx, rcx
jne 0x14001cf2c
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001cf63
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
test r14b, 1
je 0x14001cfbc
lea rsi, [rsp + 0x228]
mov rcx, rsi
mov rdx, rbp
call fcn.14002dbc0
mov rsi, qword [rsi]
mov rdx, qword [r15]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov r8, rbp
call fcn.14002ddb0
cmp byte [rdi + 0x10], 1
je 0x14001cfc3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
mov rdi, qword [rsp + 0x58]
je 0x14001cfe7
test r14b, 1
je 0x14001d03c
mov rcx, rbp
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001d0b0
lea rdx, [rsp + 0x228]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001d0b0
mov eax, dword [rsp + 0x228]
mov dword [rdi], eax
mov byte [rdi + 4], 1
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14001c177
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 1]
cmp rax, 2
jb 0x14001c18b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14001c19e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xd0]
call fcn.14002dab0
test rbx, rbx
je 0x14001c1b9
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14001c30a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001c30a
cmp r12d, 1
jne 0x14001c49d
lea rcx, [rsp + 0x148]
lea rsi, [rsp + 0x680]
mov rdx, rsi
call fcn.14002db60
cmp byte [rsi + 0x10], 0
jne 0x14001ccad
lea rcx, [rsp + 0x148]
lea rsi, [rsp + 0x248]
mov rdx, rsi
call fcn.14002db00
cmp byte [rsi + 0x10], 0
mov ebp, dword [rsp + 0x6c]
jne 0x14001c48f
mov dl, byte [rsp + 0x688]
test dl, dl
setne bl
mov cl, byte [rsp + 0x250]
test cl, cl
setne al
xor al, bl
test dl, dl
je 0x14001c261
test cl, cl
je 0x14001c261
mov rax, qword [rsp + 0x680]
cmp rax, qword [rsp + 0x248]
setae al
and bpl, al
movzx edi, bpl
cmp dil, 1
je 0x14001d470
lea rsi, [rsp + 0x228]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsi]
lea rax, [rsp + 0x150]
mov qword [rax - 8], rcx
mov byte [rax], 1
mov byte [rsp + 0xe0], 0
mov dword [rsp + 0xd0], edi
jmp 0x14001bb1c
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001cc4a
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
mov rdi, qword [rsp + 0x58]
jne 0x14001cc5e
lea rcx, [rsp + 0x148]
lea rsi, [rsp + 0x680]
mov rdx, rsi
call fcn.14001dbd0
cmp byte [rsi + 0x10], 1
je 0x14001cc99
mov qword [rdi], 0
lea rcx, [rsp + 0x148]
call fcn.14001def0
jmp 0x14001b996
lea rax, [rsp + 0x248]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x680]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001d0c9
mov rsi, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x168]
test rcx, rcx
jne 0x14001d106
mov qword [rsp + 0x168], rsi
mov eax, dword [rsp + 0x248]
cmp eax, 2
jne 0x14001c517
mov r12d, 1
jmp 0x14001b905
cmp byte [rsp + 0x260], 1
je 0x14001d17b
mov r8d, dword [rsp + 0x248]
lea rdi, [rsp + 0x228]
mov rcx, rdi
mov rdx, rsi
call fcn.14001e120
cmp byte [rdi + 0x18], 1
je 0x14001d19a
cmp byte [rsp + 0xe8], 0
jne 0x14001d1b9
movdqu xmm0, xmmword [rsp + 0x228]
movq xmm1, qword [rsp + 0xe0]
movq xmm2, qword [rsp + 0x238]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0xd0]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor ebx, ebx
cmp eax, 0xffff
sete bl
xor edi, edi
jmp 0x14001b7f3
mov rcx, rdi
mov rdx, rbx
call fcn.14000add0
jmp 0x14001ba05
cmp eax, 2
jne 0x14001d485
lea rcx, [rsp + 0x148]
lea rdi, [rsp + 0x680]
mov rdx, rdi
call fcn.14002df60
cmp byte [rdi + 0x10], 0
jne 0x14001ccad
lea rcx, [rsp + 0x148]
lea rdi, [rsp + 0x248]
mov rdx, rdi
mov r8d, esi
call fcn.14002dc80
cmp byte [rdi + 0x10], 0
je 0x14001bad5
movdqu xmm0, xmmword [rsp + 0x248]
jmp 0x14001ccb6
test r12d, r12d
jne 0x14001d49d
lea rsi, [rsp + 0x680]
mov qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
mov qword [rsp + 0x148], rax
mov byte [rsp + 0x150], 1
mov byte [rsp + 0xe0], 0
mov dword [rsp + 0xd0], 0
jmp 0x14001bb1c
mov qword [0x14005fca0], rbx
jmp 0x14001b6ba
mov qword [rsp + 0x20], 6
lea r9, str.Image
mov edx, 6
mov rcx, rdi
call fcn.1400073c0
jmp 0x14001ba5e
cmp eax, 1
jne 0x14001d52b
xor r12d, r12d
jmp 0x14001b905
movzx ecx, word [rbp + 2]
test cx, cx
je 0x14001b4ca
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x73
jne 0x14001b4ca
movzx ecx, word [rbp + 4]
test cx, cx
je 0x14001b4ca
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x69
jne 0x14001b4ca
movzx ecx, word [rbp + 6]
test cx, cx
je 0x14001b4ca
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6e
jne 0x14001b4ca
movzx ecx, word [rbp + 8]
test cx, cx
je 0x14001b4ca
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x74
jne 0x14001b4ca
cmp word [rbp + 0xa], 0
jne 0x14001b4ca
mov rax, qword [rsp + 0x60]
cmp dword [rax], 4
jne 0x14001c6e7
mov rax, qword [r14]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001c6e7
lea rdi, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rdi, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001c6e7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x14001c6e7
movzx ecx, word [rdi + 2]
test cx, cx
je 0x14001c6e7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x73
jne 0x14001c6e7
movzx ecx, word [rdi + 4]
test cx, cx
je 0x14001c6e7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x69
jne 0x14001c6e7
movzx ecx, word [rdi + 6]
test cx, cx
je 0x14001c6e7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6e
jne 0x14001c6e7
movzx ecx, word [rdi + 8]
test cx, cx
je 0x14001c6e7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x74
jne 0x14001c6e7
cmp word [rdi + 0xa], 0
jne 0x14001c6e7
mov rax, qword [r15 + 0x10]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001c6e7
lea r13, [rsp + 0x210]
lea rsi, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rsi, rax
lea rbp, [0x140055b84]
cmp word [rbp], 0
mov rdi, rsi
je 0x14001c6d4
add rbp, 2
mov rdi, rsi
movzx ecx, word [rdi]
test cx, cx
je 0x14001c6da
call r12
cmp ax, word [rbp - 2]
jne 0x14001c6da
add rdi, 2
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x14001c6b4
cmp word [rdi], 0
je 0x14001c6f2
mov rbp, qword [r13 + 8]
add r13, 8
test rbp, rbp
jne 0x14001c6a3
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rax, qword [r15 + 0x18]
movzx eax, word [rax]
or eax, 2
cmp ax, 0x2f
jne 0x14001b4d6
jmp 0x14001c6e7
mov byte [rsp + 0xe0], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0xd0], rax
movabs rax, 0x800700c100000021
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0xd0]
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
jmp 0x14001c2e1
movzx ecx, word [rbp + 2]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14001b878
movzx ecx, word [rbp + 4]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x75
jne 0x14001b878
movzx ecx, word [rbp + 6]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6e
jne 0x14001b878
movzx ecx, word [rbp + 8]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x63
jne 0x14001b878
movzx ecx, word [rbp + 0xa]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x68
jne 0x14001b878
movzx ecx, word [rbp + 0xc]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001b878
movzx ecx, word [rbp + 0xe]
test cx, cx
je 0x14001b878
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x72
jne 0x14001b878
cmp word [rbp + 0x10], 0
jne 0x14001b878
mov rax, qword [rdi]
mov qword [rdi - 8], rax
add rdi, 8
test rax, rax
jne 0x14001c820
mov rax, qword [rsp + 0x60]
dec dword [rax]
jmp 0x14001b88f
mov esi, eax
or esi, 0x10000000
lea rbx, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
mov r13d, 0x502
lea rcx, [rsp + 0x680]
mov qword [rcx], rbx
mov dword [rcx + 8], r13d
mov dword [rcx + 0xc], esi
xor esi, esi
xor edx, edx
call fcn.14002f0a0
jmp 0x14001b817
xor ebx, ebx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14001b7f3
cmp eax, 0x57
je 0x14001b7f3
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov r13d, 0x5c
jmp 0x14001b7e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov byte [rsp + 0x698], 1
lea rbx, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov qword [rsp + 0x688], rbx
mov r13d, 0x1e
mov dil, 1
jmp 0x14001b7f3
mov rbx, qword [rsp + 0x688]
mov r13d, dword [rsp + 0x690]
mov dil, 1
mov esi, dword [rsp + 0x694]
jmp 0x14001b7f3
mov esi, dword [rsp + 0xdc]
cmp esi, 0xd000003a
jne 0x14001cccc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
lea rdx, [rsp + 0xd0]
mov qword [rdx], rax
lea rsi, [rsp + 0x248]
mov rcx, rsi
call fcn.140033c90
cmp byte [rsi + 0x18], 1
jne 0x14001d4c3
mov rbx, qword [rsp + 0x250]
mov r13d, dword [rsp + 0x258]
mov dil, 1
mov esi, dword [rsp + 0x25c]
jmp 0x14001d4dd
cmp byte [rax], 0
je 0x14001b82d
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov sil, 1
jmp 0x14001b82d
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x14001b8dd
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x72
jne 0x14001b8dd
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x63
jne 0x14001b8dd
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001b8dd
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x2d
jne 0x14001b8dd
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6c
jne 0x14001b8dd
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14001b8dd
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x75
jne 0x14001b8dd
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6e
jne 0x14001b8dd
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x63
jne 0x14001b8dd
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x68
jne 0x14001b8dd
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001b8dd
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x14001b8dd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x72
jne 0x14001b8dd
cmp word [rbx + 0x1c], 0
jne 0x14001b8dd
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x14001caff
mov rax, qword [rsp + 0x60]
dec dword [rax]
xor r13d, r13d
xor ebp, ebp
jmp 0x14001b8ec
lea rcx, [rsp + 0x680]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x800705070000012e
mov qword [rcx + 8], rax
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
jmp 0x14001c303
mov eax, 0x3f
mov ecx, 0x8007065d
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs rbp, 0xffffff0000000000
and rbp, rdx
mov ebx, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, rbp
or rbx, rdx
mov qword [rsp + 0xd0], rbx
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xdc], ecx
jmp 0x14001ccbf
mov eax, dword [0x14005fcc0]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001d695
mov rax, qword [0x14005fcb8]
test rax, rax
je 0x14001bb37
lea rdx, [rsp + 0x680]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [case.0x14002713e.0]
jmp 0x14001bb37
lea rcx, [rsp + 0x130]
jmp 0x14001cc32
lea rcx, [rsp + 0x118]
jmp 0x14001cc32
lea rcx, [rsp + 0x680]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000159
mov qword [rcx + 8], rax
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
mov qword [rdi], 0
jmp 0x14001c1b9
cmp byte [rax], 0
je 0x14001c2c6
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14001c740
cmp word [rax], 0
je 0x14001c2e1
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul esi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140033db0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c2e1
lea rcx, [rsp + 0x680]
xor edx, edx
call fcn.14002f0a0
jmp 0x14001c303
movdqu xmm0, xmmword [rsp + 0x680]
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe0], 1
jmp 0x14001c731
mov rbx, qword [rsp + 0xd0]
mov r13d, dword [rsp + 0xd8]
jmp 0x14001c8d7
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x14001bdb2
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x2d
jne 0x14001bdb2
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x64
jne 0x14001bdb2
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001bdb2
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001bdb2
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6c
jne 0x14001bdb2
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001bdb2
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x76
jne 0x14001bdb2
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14001bdb2
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x74
jne 0x14001bdb2
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x14001bdb2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001bdb2
cmp word [rbx + 0x18], 0
jne 0x14001bdb2
mov rax, qword [rsi]
mov qword [rsi - 8], rax
add rsi, 8
test rax, rax
jne 0x14001ce2b
mov rax, qword [rsp + 0x60]
dec dword [rax]
or ebp, 2
jmp 0x14001bdbe
test ebp, ebp
jne 0x14001bdfb
cmp qword [rsp + 0x98], 0
jne 0x14001bdfb
mov rax, qword [rsp + 0x60]
mov edx, dword [rax]
lea rsi, [rsp + 0x680]
mov rcx, rsi
mov r8, r15
call fcn.14002f380
cmp byte [rsi + 0x10], 1
jne 0x14001d50f
xor esi, esi
lea rcx, [rsp + 0x680]
xor edx, edx
call fcn.14002f0a0
mov rax, qword [rsp + 0x58]
mov qword [rax], 0
jmp 0x14001d51d
lea rcx, [rsp + 0x680]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007005700000160
mov qword [rcx + 8], rax
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
mov qword [rdi], 0
jmp 0x14001c1b0
or byte [rsp + 0xd7], 0x10
jmp 0x14001be97
lea rcx, [rsp + 0xb8]
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
mov qword [rdi], 0
lea rcx, [rsp + 0xd0]
call fcn.14002dab0
mov rbx, qword [rsp + 0x60]
jmp 0x14001c1b0
mov ebx, 0x404
jmp 0x14001c02f
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x60]
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14001c0b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0x228]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x19f
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.14002f0a0
mov rdi, qword [rsp + 0x58]
mov qword [rdi], 0
lea rcx, [rsp + 0xd0]
call fcn.14002dab0
jmp 0x14001c1b0
xor esi, esi
jmp 0x14001c0e7
lea rcx, [rsp + 0xa0]
xor edx, edx
call fcn.14002f0a0
mov rcx, rbp
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x58]
jmp 0x14001d030
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0x228]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1b4
mov dword [rcx + 0xc], edx
xor edx, edx
call fcn.14002f0a0
mov rcx, rbp
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rdi], 0
jmp 0x14001c164
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov r15d, eax
neg eax
sbb ebx, ebx
xor edi, edi
mov r14d, 0
test r15d, r15d
jne 0x14001d05f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
or ebx, 0x2710
test r15d, r15d
jne 0x14001d075
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, r14d
mov r13d, ebx
sub r13d, edi
jbe 0x14001d0b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
mov edx, r13d
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x14001d0b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x14001d0b0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001d065
mov rdi, qword [rsp + 0x58]
mov dword [rdi], 0
mov byte [rdi + 4], 1
mov rbx, qword [rsp + 0x60]
jmp 0x14001c164
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x79
mov byte [rsp + 0xe0], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0xd0], rdx
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xdc], ecx
jmp 0x14001c731
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c38a
cmp byte [rax], 0
mov ebp, 0
jne 0x14001bd62
jmp 0x14001bd67
mov rcx, r13
call fcn.140033f50
test al, al
je 0x14001bf17
mov rax, qword [rsp + 0xe0]
jmp 0x14001bf03
mov rcx, r13
call fcn.140033f50
test al, al
je 0x14001bf6a
mov rax, qword [rsp + 0xe0]
jmp 0x14001bf56
mov rcx, r13
call fcn.140033f50
test al, al
je 0x14001bfbd
mov rax, qword [rsp + 0xe0]
jmp 0x14001bfa9
mov rbx, qword [rsp + 0x250]
mov r13d, dword [rsp + 0x258]
mov dil, 1
mov esi, dword [rsp + 0x25c]
jmp 0x14001b7f3
mov rbx, qword [rsp + 0x228]
mov r13d, dword [rsp + 0x230]
mov dil, 1
mov esi, dword [rsp + 0x234]
jmp 0x14001b7f3
xor ebx, ebx
jmp 0x14001c428
lea rdi, [r15 + 0x10]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001d266
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x6d
jne 0x14001d266
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x61
jne 0x14001d266
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x72
jne 0x14001d266
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x69
jne 0x14001d266
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x6f
jne 0x14001d266
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x6e
jne 0x14001d266
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x65
je 0x14001d53a
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001d1c4
mov rax, qword [r14]
test rax, rax
je 0x14001bd1a
lea rdi, [r15 + 0x10]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001d328
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x62
jne 0x14001d328
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x61
jne 0x14001d328
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x63
jne 0x14001d328
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x6b
jne 0x14001d328
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x67
jne 0x14001d328
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x72
jne 0x14001d328
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x6f
je 0x14001d599
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001d286
mov rax, qword [r14]
test rax, rax
je 0x14001bd1a
lea rdi, [r15 + 0x10]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001d3ea
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x68
jne 0x14001d3ea
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x65
jne 0x14001d3ea
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x61
jne 0x14001d3ea
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x64
jne 0x14001d3ea
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x6c
jne 0x14001d3ea
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x65
jne 0x14001d3ea
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x73
je 0x14001d66c
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001d348
mov rax, qword [r14]
test rax, rax
je 0x14001bd1a
lea r12, str.remote_debugging_port
mov rbx, r14
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001d45e
lea rbp, [rax + 2]
cmp word [rax + 2], 0x2d
lea rax, [rax + 4]
cmove rbp, rax
xor edi, edi
movzx ecx, word [rbp + rdi]
test cx, cx
je 0x14001d45e
call rsi
cmp ax, word [rdi + r12]
jne 0x14001d45e
lea rax, [rdi + 2]
cmp word [rdi + r12 + 2], 0
mov rdi, rax
jne 0x14001d42f
cmp word [rbp + rax], 0
je 0x14001bd62
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x14001d410
jmp 0x14001bd1a
lea rax, [rsp + 0x160]
mov qword [rax - 8], 0
jmp 0x14001c299
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3b
jmp 0x14001cb5f
mov byte [rsp + 0xe0], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0xd0], rax
movabs rax, 0x80070507000000ed
jmp 0x14001c729
lea rcx, [rsp + 0x680]
lea rdx, [rsp + 0x248]
call fcn.140033d20
movzx ebx, al
xor edi, edi
lea rax, [r12 + 1]
cmp rax, 2
jb 0x14001b7f3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b7f3
or byte [rsp + 0x6bd], 8
mov qword [rsp + 0x698], rax
jmp 0x14001c057
mov rax, qword [rsp + 0x58]
mov dword [rax], 0
mov sil, 1
mov rdi, qword [rsp + 0x58]
mov byte [rdi + 4], sil
jmp 0x14001c1b9
mov eax, 0x88
mov ecx, 0x80070507
jmp 0x14001d0dc
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x74
jne 0x14001d266
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001d266
call rsi
cmp ax, 0x74
jne 0x14001d266
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001d266
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001d266
cmp word [rbx + 0x14], 0
jne 0x14001d266
jmp 0x14001bd62
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x75
jne 0x14001d328
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001d328
call rsi
cmp ax, 0x6e
jne 0x14001d328
movzx ecx, word [rbx + 0x12]
test cx, cx
je 0x14001d328
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x64
jne 0x14001d328
movzx ecx, word [rbx + 0x14]
test cx, cx
je 0x14001d328
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x74
jne 0x14001d328
movzx ecx, word [rbx + 0x16]
test cx, cx
je 0x14001d328
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14001d328
movzx ecx, word [rbx + 0x18]
test cx, cx
je 0x14001d328
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x73
jne 0x14001d328
movzx ecx, word [rbx + 0x1a]
test cx, cx
je 0x14001d328
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6b
jne 0x14001d328
cmp word [rbx + 0x1c], 0
jne 0x14001d328
jmp 0x14001bd62
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001d3ea
call rsi
cmp ax, 0x73
jne 0x14001d3ea
cmp word [rbx + 0x10], 0
jne 0x14001d3ea
jmp 0x14001bd62
lea rcx, [0x14005fcc0]
call fcn.14002687c
cmp dword [0x14005fcc0], 0xffffffff
jne 0x14001cbc6
call fcn.140033ee0
lea rcx, [0x14005fcc0]
call fcn.14002681c
jmp 0x14001cbc6