Function at 0x1400195d0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check os version
Create process on windows
Encrypt data using speck
Get system information on windows
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports
Resume thread
Set environment variable
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb88
movaps xmmword [rsp + 0xb70], xmm6
mov qword [rsp + 0x70], rdx
mov r14d, ecx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0xb68], rax
lea rdi, [rsp + 0x71c]
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rdi - 0xc], 0x11c
mov r13, qword [sym.imp.ntdll.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r13
mov rcx, rax
mov edx, 1
mov r8b, 3
call r13
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r13
movabs rcx, 0x200000006
mov qword [rdi - 8], rcx
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x710]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14001bf6e
lea rcx, str.PATH
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140019734
mov ebp, eax
mov rbx, r14
mov ecx, eax
add rcx, rcx
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
mov esi, ebp
dec esi
lea rcx, str.PATH
mov rdx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp esi, eax
jne 0x140019728
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
lea eax, [r15 - 1]
cmp eax, 0x7ffe
ja 0x140019728
mov ecx, r15d
add rcx, rcx
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
mov rcx, rdi
mov rdx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001971f
lea rcx, str.PATH
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
mov r14, rbx
lea rcx, [0x140059638]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, r14d
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
call fcn.14001cff0
test al, al
je 0x14001bf63
lea rcx, str.Mozilla
mov rax, rcx
mov qword [rsp + 0xa8], rcx
mov qword [0x140062cc0], rcx
lea r12, [rsi + 8]
mov rax, qword [rsi + 8]
test rax, rax
je 0x14001990e
lea rcx, [rsi + 0x10]
mov edx, 0xff
mov r10, rax
mov r8, r12
movzx r9d, word [r10]
cmp r9d, 0x2d
je 0x1400197bc
cmp r9d, 0x2f
je 0x14001bf4c
mov r10, qword [r8 + 8]
add r8, 8
add rcx, 8
test r10, r10
jne 0x140019792
jmp 0x140019856
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x6c
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x1400197a6
cmp r11b, 0x2d
je 0x1400197f8
lea edi, [r11 - 0x30]
cmp dil, 0xa
jb 0x1400197f8
lea edi, [r11 - 0x61]
cmp dil, 0x19
ja 0x1400197a6
movzx edi, si
cmp edi, edx
cmovae esi, edx
lea edi, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp dil, 0x1a
movzx edi, bl
cmovae edi, esi
cmp dil, r11b
jne 0x1400197a6
lea r11, str.log_launcher_error
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x12
jne 0x1400197d4
cmp word [r9 + 0x24], 0
jne 0x1400197a6
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140019838
dec r14d
mov byte [0x140062cc8], 1
mov rax, qword [r12]
test rax, rax
je 0x14001990e
mov ecx, 0xff
lea rdx, str.contentproc
mov r8, r12
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x1400198f3
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x63
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x1400198fd
cmp r10b, 0x2d
je 0x1400198b3
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x1400198b3
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x1400198fd
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x1400198fd
mov r10b, byte [rax + rdx + 1]
inc rax
cmp rax, 0xb
jne 0x14001988e
cmp word [r9 + 0x16], 0
je 0x14001b53f
jmp 0x1400198fd
cmp r9d, 0x2f
je 0x14001c076
mov rax, qword [r8 + 8]
add r8, 8
test rax, rax
jne 0x14001986e
lea rcx, [rsp + 0x1e0]
call fcn.14001d630
pxor xmm0, xmm0
lea rsi, [rsp + 0x710]
movdqa xmmword [rsi + 0x20], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi], xmm0
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rsi
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
mov ebp, eax
mov eax, dword [rsi + 0x28]
lea r15, str._builds_worker_workspace_obj_build_dist_include_mozilla_NativeNt.h
test ebp, ebp
cmovns r15, rax
js 0x14001c1ac
mov ecx, 0x1000
xor edx, edx
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001c1db
lea r15, [rsp + 0x730]
mov dword [r15 - 0x20], 0
mov byte [r15 - 8], 0
lea r9, [rsp + 0x2d0]
mov dword [r9], 0x209
mov rcx, rdi
mov edx, 1
mov r8, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rbx, r12
test eax, eax
je 0x14001c214
cmp byte [rsp + 0x728], 0
jne 0x14001c24d
mov r8d, dword [rsp + 0x710]
lea r12, [rsp + 0x140]
mov rcx, r12
mov rdx, r15
call fcn.14001dc60
cmp byte [r12 + 0x18], 0
jne 0x14001c26c
lea r15, [rsp + 0x2f0]
mov dword [r15 - 0x20], 1
mov byte [r15 - 8], 0
xor ecx, ecx
mov rdx, r15
mov r8d, 0x209
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x209
je 0x140019a37
test eax, eax
jne 0x14001bb8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r12d, 0x29
mov sil, 1
lea r15, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov rax, rdi
inc rax
cmp rax, 2
jb 0x140019a70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x14001c1bb
test r15b, r15b
sete dil
lea rcx, [0x140057304]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
mov r15, rbx
jne 0x14001c2ec
mov rax, qword [r15]
test rax, rax
je 0x140019d06
mov rcx, qword [rsp + 0x70]
add rcx, 0x10
mov edx, 0xff
mov r9, rax
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x140019adb
cmp r8d, 0x2f
je 0x14001c082
mov r9, qword [rcx]
add rcx, 8
test r9, r9
jne 0x140019ab6
jmp 0x140019d06
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
movzx r9d, word [r8]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
cmp r10d, edx
cmovae r9d, edx
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6c
jne 0x140019aca
movzx r9d, word [r8 + 2]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x61
jne 0x140019aca
movzx r9d, word [r8 + 4]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x75
jne 0x140019aca
movzx r9d, word [r8 + 6]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x6e
jne 0x140019aca
movzx r9d, word [r8 + 8]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x63
jne 0x140019aca
movzx r9d, word [r8 + 0xa]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x68
jne 0x140019aca
movzx r9d, word [r8 + 0xc]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x65
jne 0x140019aca
movzx r9d, word [r8 + 0xe]
test r9w, r9w
je 0x140019aca
movzx r10d, r9w
mov r11d, 0xff
cmp r10d, r11d
cmovae r9d, r11d
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, 0x72
jne 0x140019aca
cmp word [r8 + 0x10], 0
jne 0x140019aca
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x140019cee
dec r14d
mov rax, qword [r15]
jmp 0x140019d15
mov bpl, 1
mov sil, 1
test dil, dil
je 0x140019dc1
mov sil, 1
test rax, rax
je 0x140019dbf
mov rcx, qword [rsp + 0x70]
add rcx, 0x10
mov edx, 0xff
mov r8, r15
movzx r9d, word [rax]
cmp r9d, 0x2d
jne 0x140019da0
lea r9, [rax + 2]
lea r10, [rax + 4]
cmp word [rax + 2], 0x2d
cmove r9, r10
mov r10b, 0x66
xor eax, eax
movzx r11d, word [r9 + rax*2]
test r11w, r11w
je 0x140019daa
cmp r10b, 0x2d
je 0x140019d77
lea edi, [r10 - 0x30]
cmp dil, 0xa
jb 0x140019d77
lea edi, [r10 - 0x61]
cmp dil, 0x19
ja 0x140019daa
movzx edi, r11w
cmp edi, edx
cmovae r11d, edx
lea edi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp dil, 0x1a
movzx edi, bl
cmovae edi, r11d
cmp dil, r10b
jne 0x140019daa
jmp 0x14001c309
cmp r9d, 0x2f
je 0x14001c34a
mov rax, qword [r8 + 8]
add r8, 8
add rcx, 8
test rax, rax
jne 0x140019d32
xor ebp, ebp
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r14
mov r12d, 1
cmp qword [rsp + 0x200], 0
je 0x14001bc11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x14001bfba
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14001bfba
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14001bfba
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x14001bfba
cmp dword [rax + rcx + 0x50], 0x148
jb 0x14001bfba
mov r14d, dword [rax + rcx + 8]
lea rdi, [rsp + 0x228]
cmp qword [rdi + 0x10], 0
jne 0x140019ec0
mov r15, qword [rsp + 0x218]
cmp qword [rsp + 0x220], 8
jb 0x140019e62
mov r8, qword [rsp + 0x208]
jmp 0x140019e6a
lea r8, [rsp + 0x208]
mov rax, qword [rsp + 0x240]
cmp rax, r15
jae 0x14001c3f1
mov rcx, rdi
mov rdx, r15
call fcn.14000cb40
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
mov rdx, rcx
sub rdx, rax
cmp rdx, 6
jae 0x14001c428
lea r8, str.Image
mov edx, 6
mov r9d, 6
mov rcx, rdi
call fcn.14000cc60
mov dword [rsp + 0x2d0], 4
mov rcx, qword [rsp + 0x200]
cmp qword [rsp + 0x240], 8
jb 0x140019ee6
mov rdi, qword [rsp + 0x228]
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x140]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001be13
cmp dword [rsp + 0x140], 4
jne 0x14001c53d
cmp dword [rsp + 0x710], r14d
jne 0x14001be1c
test bpl, bpl
je 0x140019f9a
lea rdi, [rsp + 0x710]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov qword [rsp + 0x1f0], rax
mov byte [rsp + 0x1f8], 1
mov byte [rsp + 0x150], 0
mov dword [rsp + 0x140], 1
mov r14, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x140]
mov sil, 1
test ebx, ebx
jne 0x14001a090
mov bpl, 1
jmp 0x14001a0be
cmp r12d, 1
mov r14, qword [rsp + 0x60]
jne 0x14001bec9
lea rdi, [rsp + 0x1e0]
mov rcx, rdi
call fcn.14001db60
mov rdx, qword [rdi + 0x20]
lea rdi, [rsp + 0x710]
mov rcx, rdi
mov r8, rax
call fcn.14001ce30
cmp byte [rdi + 0x10], 0
jne 0x14001c79b
lea rdi, [rsp + 0x1e0]
mov rcx, rdi
call fcn.14001da80
mov rdx, qword [rdi + 0x20]
lea rdi, [rsp + 0x2d0]
mov rcx, rdi
mov r8, rax
call fcn.14001ce30
cmp byte [rdi + 0x10], 0
jne 0x14001cb19
mov dl, byte [rsp + 0x718]
test dl, dl
setne r8b
mov cl, byte [rsp + 0x2d8]
test cl, cl
setne al
xor al, r8b
test dl, dl
je 0x14001a042
test cl, cl
je 0x14001a042
mov rax, qword [rsp + 0x710]
cmp rax, qword [rsp + 0x2d0]
setae al
and sil, al
movzx ebx, sil
cmp bl, 1
je 0x14001cb27
lea rdi, [rsp + 0x140]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rdi]
lea rax, [rsp + 0x1e8]
mov qword [rax - 8], rcx
mov byte [rax], 1
mov byte [rsp + 0x150], 0
mov dword [rsp + 0x140], ebx
jmp 0x140019f87
lea rcx, str.MOZ_DEBUG_BROWSER_PROCESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001c7d2
lea rcx, str.MOZ_DEBUG_BROWSER_PAUSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
jne 0x14001c7e6
xor ebp, ebp
cmp qword [rsp + 0x200], 0
je 0x14001bca2
lea rdi, [rsp + 0x2a8]
cmp qword [rdi + 0x10], 0
jne 0x14001a157
mov r15, qword [rsp + 0x218]
cmp qword [rsp + 0x220], 8
jb 0x14001a0f9
mov r8, qword [rsp + 0x208]
jmp 0x14001a101
lea r8, [rsp + 0x208]
mov rax, qword [rsp + 0x2c0]
cmp rax, r15
jae 0x14001c467
mov rcx, rdi
mov rdx, r15
call fcn.14000cb40
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2c0]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xa
jae 0x14001c4a3
lea r8, str.Blocklist
mov edx, 0xa
mov r9d, 0xa
mov rcx, rdi
call fcn.14000cc60
mov rcx, qword [rsp + 0x200]
cmp qword [rsp + 0x2c0], 8
mov r8, rdi
jb 0x14001a175
mov r8, qword [rsp + 0x2a8]
lea rax, [rsp + 0x710]
mov qword [rsp + 0x30], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14001bd39
mov r12d, dword [rsp + 0x710]
and r12d, 0xfffffffe
mov rcx, r12
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x200]
cmp qword [rsp + 0x2c0], 8
jb 0x14001a1e2
mov rdi, qword [rsp + 0x2a8]
lea rax, [rsp + 0x710]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rdi
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
mov r12, qword [rsp + 0x68]
jne 0x14001c592
xor eax, eax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], 7
mov word [rsp + 0x710], 0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rdi, rax
lea rcx, [rsp + 0x710]
cmp rax, 7
jbe 0x14001c5ef
mov rdx, rdi
mov r8, r15
call fcn.14000cb40
mov rdi, qword [rsp + 0x710]
movups xmm0, xmmword [rsp + 0x718]
movaps xmmword [rsp + 0x90], xmm0
mov rbx, qword [rsp + 0x728]
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
mov qword [rsp + 0x1b0], rdi
movdqa xmm0, xmmword [rsp + 0x90]
mov qword [rsp + 0x98], 0
movdqu xmmword [rsp + 0x1b8], xmm0
mov qword [rsp + 0x1c8], rbx
mov al, 1
mov byte [rsp + 0x1d0], al
test sil, bpl
je 0x14001ab79
mov eax, dword [0x140062d5c]
cmp eax, 0x3838
ja 0x14001a392
mov eax, dword [0x14006204c]
cmp eax, 0x383a
jb 0x14001a404
lea rdi, [rsp + 0x718]
mov r8d, 0x114
mov rcx, rdi
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rdi - 8], rax
mov dword [rdi + 4], 0x3839
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r13
mov rcx, rax
mov edx, 1
mov r8b, 3
call r13
mov rcx, rax
mov edx, 4
mov r8b, 3
call r13
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r13
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call r13
lea rcx, [rsp + 0x710]
mov edx, 0x37
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14001c610
mov eax, 0x3839
xchg dword [0x140062d5c], eax
mov eax, dword [0x140062ce0]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14001a3d9
lea rcx, [0x140062ce0]
call fcn.14002b4a4
cmp dword [0x140062ce0], 0xffffffff
jne 0x14001a3d9
call fcn.1400319a0
lea rcx, [0x140062ce0]
call fcn.14002b444
mov rax, qword [0x140062cd8]
test rax, rax
je 0x14001a404
lea rdx, [rsp + 0x710]
mov dword [rdx], 4
mov r8d, 4
mov ecx, 0xa
call qword [0x140068010]
mov ecx, 0x403
call fcn.14001f680
call fcn.14001d520
cmp qword [rsp + 0x70], 0
je 0x14001c356
lea rdi, [rsp + 0x710]
mov rcx, rdi
call fcn.14001d780
mov rax, qword [rdi]
test rax, rax
je 0x14001c356
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14001aa33
lea rax, [rcx + 0x10]
mov ecx, 0xff
lea rdx, str.wait_for_browser
mov r10, rdi
mov r8, r12
movzx r9d, word [r10]
cmp r9d, 0x2d
jne 0x14001a4e6
lea r9, [r10 + 2]
lea r11, [r10 + 4]
cmp word [r10 + 2], 0x2d
cmove r9, r11
mov r11b, 0x77
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x14001a4f0
cmp r11b, 0x2d
je 0x14001a4aa
lea ebx, [r11 - 0x30]
cmp bl, 0xa
jb 0x14001a4aa
lea ebx, [r11 - 0x61]
cmp bl, 0x19
ja 0x14001a4f0
movzx ebx, si
cmp ebx, ecx
cmovae esi, ecx
lea ebx, [rsi - 0x41]
mov ebp, esi
or bpl, 0x20
cmp bl, 0x1a
movzx ebx, bpl
cmovae ebx, esi
cmp bl, r11b
jne 0x14001a4f0
mov r11b, byte [r10 + rdx + 1]
inc r10
cmp r10, 0x10
jne 0x14001a488
cmp word [r9 + 0x20], 0
je 0x14001aa73
jmp 0x14001a4f0
cmp r9d, 0x2f
je 0x14001c620
mov r10, qword [r8 + 8]
add r8, 8
add rax, 8
test r10, r10
jne 0x14001a466
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov ecx, 0xff
mov r8, rdi
movzx edx, word [r8]
cmp edx, 0x2f
je 0x14001a53c
cmp edx, 0x2d
jne 0x14001a6cf
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x14001a543
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x14001a6cf
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001a6cf
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x72
jne 0x14001a6cf
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x69
jne 0x14001a6cf
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x14001a6cf
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6e
jne 0x14001a6cf
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
je 0x14001cbdb
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001a516
mov eax, 0xff
lea rcx, str.backgroundtask
mov r9, rdi
mov rdx, qword [rsp + 0x68]
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x14001a71b
cmp r8d, 0x2d
jne 0x14001a78b
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x14001a722
add r9, 2
mov r8, r9
mov r10b, 0x62
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001a78b
cmp r10b, 0x2d
je 0x14001a74d
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001a74d
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001a78b
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14001a78b
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0xe
jne 0x14001a728
cmp word [r8 + 0x1c], 0
je 0x14001cce5
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
jne 0x14001a6f3
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov ecx, 0xff
mov r8, rdi
movzx edx, word [r8]
cmp edx, 0x2f
je 0x14001a7d3
cmp edx, 0x2d
jne 0x14001a966
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
jmp 0x14001a7da
add r8, 2
mov rdx, r8
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x68
jne 0x14001a966
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001a966
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001a966
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x14001a966
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6c
jne 0x14001a966
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001a966
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
je 0x14001cc9f
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001a7ad
mov eax, 0xff
lea rcx, str.remote_debugging_port
mov r9, rdi
mov rdx, qword [rsp + 0x68]
movzx r8d, word [r9]
cmp r8d, 0x2f
je 0x14001a9b2
cmp r8d, 0x2d
jne 0x14001aa22
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
jmp 0x14001a9b9
add r9, 2
mov r8, r9
mov r10b, 0x72
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001aa22
cmp r10b, 0x2d
je 0x14001a9e4
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001a9e4
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001aa22
movzx esi, r11w
cmp esi, eax
cmovae r11d, eax
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14001aa22
mov r10b, byte [r9 + rcx + 1]
inc r9
cmp r9, 0x15
jne 0x14001a9bf
cmp word [r8 + 0x2a], 0
je 0x14001cce5
mov r9, qword [rdx + 8]
add rdx, 8
test r9, r9
jne 0x14001a98a
lea rcx, str.MOZ_AUTOMATION
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001aa4e
cmp byte [rax], 0
jne 0x14001cce5
lea rcx, str.MOZ_HEADLESS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001ca90
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
xor r15d, r15d
jmp 0x14001aa90
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001aa73
dec r14d
mov rdi, qword [r12]
mov r15d, 1
test rdi, rdi
je 0x14001ac98
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov ecx, 0xff
mov r9, rdi
mov rdx, r12
movzx r8d, word [r9]
cmp r8d, 0x2d
je 0x14001aad7
cmp r8d, 0x2f
je 0x14001c388
mov r9, qword [rdx + 8]
add rdx, 8
add rax, 8
test r9, r9
jne 0x14001aaad
jmp 0x14001aba5
lea r8, [r9 + 2]
lea r10, [r9 + 4]
cmp word [r9 + 2], 0x2d
cmove r8, r10
mov r10b, 0x6e
xor r9d, r9d
movzx r11d, word [r8 + r9*2]
test r11w, r11w
je 0x14001aac1
cmp r10b, 0x2d
je 0x14001ab14
lea esi, [r10 - 0x30]
cmp sil, 0xa
jb 0x14001ab14
lea esi, [r10 - 0x61]
cmp sil, 0x19
ja 0x14001aac1
movzx esi, r11w
cmp esi, ecx
cmovae r11d, ecx
lea esi, [r11 - 0x41]
mov ebx, r11d
or bl, 0x20
cmp sil, 0x1a
movzx esi, bl
cmovae esi, r11d
cmp sil, r10b
jne 0x14001aac1
lea r10, str.no_deelevate
mov r10b, byte [r9 + r10 + 1]
inc r9
cmp r9, 0xc
jne 0x14001aaef
cmp word [r8 + 0x18], 0
jne 0x14001aac1
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001ab59
dec r14d
mov r12, qword [rsp + 0x68]
mov rdi, qword [r12]
xor eax, eax
jmp 0x14001aba7
lea rcx, [rsp + 0x1e0]
lea rdi, [rsp + 0x710]
mov rdx, rdi
call fcn.14001d870
cmp byte [rdi + 0x10], 0
jne 0x14001c62c
xor esi, esi
xor r13d, r13d
jmp 0x14001b4ed
mov al, 1
test rdi, rdi
je 0x14001ac90
mov rcx, qword [rsp + 0x70]
add rcx, 0x10
mov edx, 0xff
mov r8, r12
movzx r9d, word [rdi]
cmp r9d, 0x2d
je 0x14001abeb
cmp r9d, 0x2f
je 0x14001c394
mov rdi, qword [r8 + 8]
add r8, 8
add rcx, 8
test rdi, rdi
jne 0x14001abc1
jmp 0x14001ac90
lea r9, [rdi + 2]
lea r10, [rdi + 4]
cmp word [rdi + 2], 0x2d
cmove r9, r10
mov r11b, 0x61
xor r10d, r10d
movzx esi, word [r9 + r10*2]
test si, si
je 0x14001abd5
cmp r11b, 0x2d
je 0x14001ac26
lea edi, [r11 - 0x30]
cmp dil, 0xa
jb 0x14001ac26
lea edi, [r11 - 0x61]
cmp dil, 0x19
ja 0x14001abd5
movzx edi, si
cmp edi, edx
cmovae esi, edx
lea edi, [rsi - 0x41]
mov ebx, esi
or bl, 0x20
cmp dil, 0x1a
movzx edi, bl
cmovae edi, esi
cmp dil, r11b
jne 0x14001abd5
lea r11, str.attempting_deelevation
mov r11b, byte [r10 + r11 + 1]
inc r10
cmp r10, 0x16
jne 0x14001ac02
cmp word [r9 + 0x2c], 0
jne 0x14001abd5
mov rdx, qword [rcx]
mov qword [rcx - 8], rdx
add rcx, 8
test rdx, rdx
jne 0x14001ac66
dec r14d
lea ecx, [r15 + 2]
test al, al
cmovne ecx, r15d
or ecx, 4
mov r15d, ecx
mov r12, qword [rsp + 0x68]
jmp 0x14001ac98
test al, al
jne 0x14001ac98
or r15d, 2
lea r9, [rsp + 0xd8]
mov qword [r9], 0
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
lea rdi, [rsp + 0x198]
mov rcx, rdi
mov r8d, r15d
call fcn.140032b00
cmp byte [rdi + 0x10], 0
jne 0x14001c640
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
jne 0x14001c65b
mov eax, dword [rsp + 0x198]
test eax, eax
jne 0x14001c665
xor eax, eax
cmp r15d, 4
setae al
lea esi, [rax + rax]
inc esi
lea rcx, [rsp + 0x1e0]
lea rdi, [rsp + 0x180]
mov rdx, rdi
call fcn.14001d870
cmp byte [rdi + 0x10], 0
jne 0x14001c6c3
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0xd0]
xor r13d, r13d
mov rcx, rdi
mov edx, r14d
mov r8, qword [rsp + 0x70]
xor r9d, r9d
call fcn.1400208d0
mov rax, qword [rdi]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14001c6dc
mov r8, qword [r12]
test r8, r8
je 0x14001affc
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov ecx, 0xff
movzx edx, word [r8]
cmp edx, 0x2d
je 0x14001ad95
cmp edx, 0x2f
je 0x14001c3bd
mov r8, qword [rax]
add rax, 8
test r8, r8
jne 0x14001ad72
jmp 0x14001affc
lea rdx, [r8 + 2]
lea r9, [r8 + 4]
cmp word [r8 + 2], 0x2d
cmove rdx, r9
movzx r8d, word [rdx]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x14001ad84
movzx r8d, word [rdx + 2]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x61
jne 0x14001ad84
movzx r8d, word [rdx + 4]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x66
jne 0x14001ad84
movzx r8d, word [rdx + 6]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001ad84
movzx r8d, word [rdx + 8]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x2d
jne 0x14001ad84
movzx r8d, word [rdx + 0xa]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6d
jne 0x14001ad84
movzx r8d, word [rdx + 0xc]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x6f
jne 0x14001ad84
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x64
jne 0x14001ad84
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x14001ad84
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001ad84
cmp word [rdx + 0x12], 0
jne 0x14001ad84
lea rcx, str.DisableSafeMode
call fcn.14001f390
mov edi, eax
xor dil, 1
jmp 0x14001affe
xor edi, edi
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x88], esi
jne 0x14001c823
mov dword [rsp + 0x7c], edi
xor eax, eax
lea r13, [rsp + 0x148]
mov qword [r13 - 8], rax
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], 3
lea rcx, [rsp + 0x160]
mov qword [rcx - 0x18], rcx
mov qword [rcx + 0x18], rax
lea rcx, [rsp + 0x140]
call fcn.140031c00
mov rsi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rsi
mov rdi, rax
mov ecx, 0xfffffff5
call rsi
mov r14, rax
mov ecx, 0xfffffff4
call rsi
mov rbp, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001b0d3
mov rcx, rdi
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001b0d3
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x14001c9f3
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], rdi
inc qword [rsp + 0x150]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001b126
mov rcx, r14
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001b126
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x14001ca10
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], r14
inc qword [rsp + 0x150]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xfffffffd
cmp eax, 1
jne 0x14001b179
mov rcx, rbp
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14001b179
mov rax, qword [rsp + 0x150]
cmp rax, qword [rsp + 0x158]
je 0x14001ca2d
mov rcx, qword [rsp + 0x148]
mov qword [rcx + rax*8], rbp
inc qword [rsp + 0x150]
lea rcx, [rsp + 0x140]
lea r12, [rsp + 0x128]
lea r13, [rsp + 0x710]
mov rdx, r12
mov r8, r13
call fcn.1400328b0
cmp byte [r12 + 0x10], 0
jne 0x14001c83b
xor esi, esi
cmp byte [rsp + 0x128], 0
je 0x14001c70e
mov r12d, 0x80404
cmp qword [rsp + 0x150], 0
je 0x14001b1ee
or byte [rsp + 0x74d], 1
mov qword [rsp + 0x760], rdi
mov qword [rsp + 0x768], r14
mov qword [rsp + 0x770], rbp
mov esi, 1
xorps xmm6, xmm6
lea rdi, [rsp + 0x2d0]
movaps xmmword [rdi], xmm6
movaps xmmword [rdi + 0x50], xmm6
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
mov qword [rdi + 0x60], 0
mov dword [rdi], 0x68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rdi + 0x3d], 8
je 0x14001b23e
mov rax, qword [rsp + 0x2e8]
test rax, rax
jne 0x14001cb3c
lea rax, [rsp + 0xb0]
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
test rbx, rbx
jne 0x14001c861
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
mov rcx, rdx
mov r12, qword [rsp + 0x80]
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov rsi, qword [rsp + 0x68]
je 0x14001c719
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
test r15b, 1
je 0x14001c763
lea r14, [rsp + 0xb50]
mov rcx, r14
mov rdx, rdi
call fcn.140031ac0
mov r14, qword [r14]
mov rdx, qword [rsi]
test rdx, rdx
je 0x14001b396
mov eax, 0xff
movzx ecx, word [rdx]
cmp ecx, 0x2d
je 0x14001b30a
cmp ecx, 0x2f
je 0x14001c3c9
mov rdx, qword [rsi + 8]
add rsi, 8
test rdx, rdx
jne 0x14001b2e7
jmp 0x14001b396
lea rcx, [rdx + 2]
lea r8, [rdx + 4]
cmp word [rdx + 2], 0x2d
cmove rcx, r8
mov r8b, 0x64
xor edx, edx
movzx r9d, word [rcx + rdx*2]
test r9w, r9w
je 0x14001b2f8
cmp r8b, 0x2d
je 0x14001b345
lea r10d, [r8 - 0x30]
cmp r10b, 0xa
jb 0x14001b345
lea r10d, [r8 - 0x61]
cmp r10b, 0x19
ja 0x14001b2f8
movzx r10d, r9w
cmp r10d, eax
cmovae r9d, eax
lea r10d, [r9 - 0x41]
mov r11d, r9d
or r11b, 0x20
cmp r10b, 0x1a
movzx r10d, r11b
cmovae r10d, r9d
cmp r10b, r8b
jne 0x14001b2f8
lea r8, str.disabledynamicblocklist
mov r8b, byte [rdx + r8 + 1]
inc rdx
cmp rdx, 0x17
jne 0x14001b320
cmp word [rcx + 0x2e], 0
jne 0x14001b2f8
mov rsi, r15
mov r15, rbx
mov al, 1
jmp 0x14001b39e
mov rsi, r15
mov r15, rbx
xor eax, eax
cmp byte [rsp + 0x7c], 0
setne bl
or bl, al
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xe0], xmm0
movdqa xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0x100], 0
cmp byte [rsp + 0x1d0], 0
je 0x14001b3e5
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x1b0]
call fcn.14001cf10
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
lea r12, [rsp + 0x110]
mov rcx, r12
mov r8, rdi
mov r9d, dword [rsp + 0x88]
call fcn.140031ec0
cmp byte [r12 + 0x10], 0
jne 0x14001c8a3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
mov rbx, r15
je 0x14001c8cd
test sil, 1
je 0x14001c920
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001c3d5
lea rdx, [rsp + 0xb50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001c3d5
mov r13d, dword [rsp + 0xb50]
mov sil, 1
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14001b491
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 1]
cmp rax, 2
mov r12, qword [rsp + 0x80]
jb 0x14001b4ac
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rdi + 1]
cmp rax, 2
mov r14, qword [rsp + 0x60]
jb 0x14001b4c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x140]
call fcn.140031950
test r12, r12
je 0x14001b4df
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
lea rax, [rbx + 1]
cmp rax, 2
jae 0x14001c76b
cmp byte [rsp + 0x1d0], 0
je 0x14001b529
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x14001b529
mov rcx, qword [rsp + 0x1b0]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
jne 0x14001c3a0
call qword [sym.imp.mozglue.dll_free]
lea rcx, [rsp + 0x1e0]
call fcn.14001ec10
test sil, sil
jne 0x14001b953
mov qword [rsp + 0x60], r14
lea eax, [r14 + 1]
shl rax, 3
cmp r14d, 0xffffffff
mov rsi, 0xffffffffffffffff
cmovge rsi, rax
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rsp + 0x68], rax
movsxd rax, r14d
mov qword [rsp + 0x80], rax
test r14d, r14d
jle 0x14001bf15
mov qword [rsp + 0x88], rsi
xor ebp, ebp
xorps xmm6, xmm6
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x80]
mov r15, qword [r14 + rbp*8]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r12, rax
lea rbx, [rax + rax*2]
lea rcx, [rax + rax*2]
add rcx, 2
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r13, rax
inc ebx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, r12d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cdqe
mov byte [r13 + rax], 0
mov qword [rsi + rbp*8], r13
inc rbp
cmp rdi, rbp
jne 0x14001b59c
mov qword [rsi + rdi*8], 0
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
test edi, edi
jle 0x14001b629
mov r8d, dword [rsp + 0x60]
shl r8, 3
mov rcx, rbx
mov rdx, rsi
call sub.ntdll.dll_memcpy
lea rcx, [0x140057364]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
mov rdi, qword [rax]
lea rcx, [rsp + 0x2d0]
mov dl, 1
call qword [sym.imp.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_init_void____ptr64_]
call qword [sym.imp.mozglue.dll_public:_static_class_mozilla::baseprofiler::ProfilingStack____ptr64___cdecl_mozilla::baseprofiler::AutoProfilerLabel::GetProfilingStack_void_]
mov qword [rsp + 0x140], rax
test rax, rax
je 0x14001b6c0
mov r15, rax
mov r14d, dword [rax + 0x10]
cmp r14d, dword [rax]
jb 0x14001b685
mov rcx, r15
call qword [sym.imp.mozglue.dll_private:_void___cdecl_mozilla::baseprofiler::ProfilingStack::ensureCapacitySlow_void____ptr64]
mov rax, qword [r15 + 8]
lea rcx, [r14 + r14*4]
lea rdx, str.nsBrowserApp_main
mov qword [rax + rcx*8], rdx
mov qword [rax + rcx*8 + 8], 0
lea rdx, [rsp + 0x140]
mov qword [rax + rcx*8 + 0x10], rdx
mov dword [rax + rcx*8 + 0x24], 0x10001
mov eax, dword [r15 + 0x10]
inc eax
mov dword [r15 + 0x10], eax
mov r14, qword [rsp + 0x60]
cmp r14d, 2
jl 0x14001bfa3
mov rax, qword [rsp + 0x68]
lea r15, [rax + 8]
mov rax, qword [rax + 8]
movzx ecx, byte [rax]
cmp ecx, 0x2d
jne 0x14001b982
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001b98b
lea r12d, [r14 - 1]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsi + r12*8]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::SetGeckoProcessType_char_const____ptr64_]
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov rdx, qword [rsi + 8]
mov edi, r14d
test rdx, rdx
je 0x14001b7fd
mov rax, qword [rsp + 0x68]
add rax, 0x10
movzx ecx, byte [rdx]
cmp ecx, 0x2d
je 0x14001b766
cmp ecx, 0x2f
je 0x14001bf58
mov rdx, qword [r15 + 8]
add r15, 8
add rax, 8
test rdx, rdx
jne 0x14001b73f
jmp 0x14001b7fa
lea rcx, [rdx + 1]
lea r8, [rdx + 2]
cmp byte [rdx + 1], 0x2d
cmove rcx, r8
mov r8b, 0x77
xor edx, edx
mov r9b, byte [rcx + rdx]
test r9b, r9b
je 0x14001b750
cmp r8b, 0x2d
je 0x14001b79e
lea r10d, [r8 - 0x30]
cmp r10b, 0xa
jb 0x14001b79e
lea r10d, [r8 - 0x61]
cmp r10b, 0x19
ja 0x14001b750
lea r10d, [r9 - 0x41]
movzx r11d, r9b
or r9b, 0x20
cmp r10b, 0x1a
movzx r9d, r9b
cmovae r9d, r11d
cmp r9b, r8b
jne 0x14001b750
lea r8, str.win32klockeddown
mov r8b, byte [rdx + r8 + 1]
inc rdx
cmp rdx, 0x10
jne 0x14001b77b
cmp byte [rcx + 0x10], 0
jne 0x14001b750
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14001b7da
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::SetWin32kLockedDownInPolicy_void_]
mov edi, r12d
mov r14, qword [rsp + 0x60]
jmp 0x14001b7fd
mov edi, r14d
mov eax, dword [0x140062da0]
mov ecx, eax
or ecx, 1
mov rdx, qword [sym.imp.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov edx, dword [rdx]
add edx, 0xfffffffc
cmp edx, 7
ja case.0x14001b827.6
lea r8, [0x14001cd34]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x14001c000
call qword [sym.imp.mozglue.dll_enum_mozilla::WindowsDpiInitializationResult___cdecl_mozilla::WindowsDpiInitialization_void_]
xor ecx, ecx
call fcn.14001df20
test eax, eax
js 0x14001c01a
mov r15, qword [0x140062a90]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x710], xmm0
mov qword [rsp + 0x720], 0
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x14001c025
dec edi
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsi + rdi*8]
mov rax, qword [r15]
mov rax, qword [rax + 0x50]
mov rcx, r15
call qword [0x140068010]
mov rax, qword [r15]
mov rax, qword [rax + 0x48]
mov rcx, r15
call qword [0x140068010]
cmp eax, 9
je 0x14001c054
mov rax, qword [r15]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x710]
mov rcx, r15
mov edx, edi
mov r8, rsi
call qword [0x140068010]
mov r13d, eax
shr r13d, 0x1f
mov rcx, qword [0x140062a90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140068010]
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::UnregisterRuntimeExceptionModule_void_]
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x14001b907
mov ecx, dword [rax + 0x10]
dec ecx
mov dword [rax + 0x10], ecx
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_shutdown_void_]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.mozglue.dll_free]
test r14d, r14d
mov rax, qword [rsp + 0x80]
je 0x14001b94a
dec rax
mov rdi, qword [sym.imp.mozglue.dll_free]
mov rsi, rax
mov rcx, qword [rbx + rax*8]
test rcx, rcx
je 0x14001b93d
call rdi
mov rcx, rsi
mov rax, rsi
dec rax
test ecx, ecx
jne 0x14001b92f
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov rcx, qword [rsp + 0xb68]
xor rcx, rsp
call fcn.14002c610
mov eax, r13d
movaps xmm6, xmmword [rsp + 0xb70]
add rsp, 0xb88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp ecx, 0x2f
je 0x14001c100
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov ecx, dword [0x140062da0]
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
mov rax, qword [r15]
movzx ecx, byte [rax]
cmp ecx, 0x2d
jne 0x14001bb68
lea rcx, [rax + 1]
lea rdx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rcx, rdx
lea rdx, str.silentmode
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14001c187
call qword [sym.imp.mozglue.dll_enum_mozilla::WindowsDpiInitializationResult___cdecl_mozilla::WindowsDpiInitialization_void_]
call fcn.14001cd60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, r14d
mov r8, qword [rsp + 0x68]
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::CreateAndStorePreXULSkeletonUI_struct_HINSTANCE______ptr64__int__char____ptr64____ptr64_]
mov ecx, 1
call fcn.14001df20
test eax, eax
js 0x14001c01a
mov rcx, qword [0x140062a90]
movdqu xmm0, xmmword [rsp + 0x2d0]
lea r8, [rsp + 0x1e0]
movdqa xmmword [r8], xmm0
mov rax, qword [rsp + 0x2e0]
mov qword [r8 + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov edx, 1
call qword [0x140068010]
mov rcx, qword [0x140062a90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [0x140068010]
lea rcx, str.XUL_APP_FILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r15, rax
test rax, rax
jne 0x14001c08e
cmp r14d, 1
jle 0x14001c0b6
mov r12, qword [rsp + 0x68]
mov rcx, qword [r12 + 8]
lea rdx, [0x1400563ed]
call fcn.1400318b0
test al, al
jne 0x14001c0c3
mov rcx, qword [r12 + 8]
lea rdx, str.xpcshell
call fcn.1400318b0
mov ebp, r14d
test al, al
jne 0x14001c10b
test r15, r15
jne 0x14001c162
lea r15, [0x140056177]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x718], rax
mov qword [rsp + 0x720], r15
call fcn.1400318f0
test rax, rax
je 0x14001c0e9
mov qword [rsp + 0x710], rax
mov ecx, ebp
mov rdx, r12
call fcn.14001ee90
test al, al
je 0x14001bf63
mov rcx, qword [0x140062a90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
lea r9, [rsp + 0x710]
mov edx, ebp
mov r8, r12
call qword [0x140068010]
mov r13d, eax
call qword [sym.imp.mozglue.dll_void___cdecl_mozilla::CleanupProcessRuntime_void_]
mov rcx, qword [0x140062a90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140068010]
mov rcx, qword [0x140062a90]
mov qword [0x140062a90], 0
test rcx, rcx
je 0x14001b8ec
mov rax, qword [rcx]
mov rax, qword [rax + 8]
jmp 0x14001b8e6
cmp ecx, 0x2f
jne 0x14001b9d1
inc rax
mov rcx, rax
jmp 0x14001b9bc
or eax, 9
jmp 0x14001bb84
or eax, 0x11
mov ecx, eax
jmp case.0x14001b827.6
cmp byte [rsp + 0x2e8], 0
jne 0x14001ca4a
mov r8d, dword [rsp + 0x2d0]
lea r12, [rsp + 0x1b0]
mov rcx, r12
mov rdx, r15
call fcn.14001dc60
cmp byte [r12 + 0x18], 0
jne 0x14001ca69
cmp byte [rsp + 0x158], 0
jne 0x14001ca88
movdqu xmm0, xmmword [rsp + 0x1b0]
movq xmm1, qword [rsp + 0x150]
movq xmm2, qword [rsp + 0x1c0]
pcmpeqb xmm2, xmm1
pcmpeqb xmm0, xmmword [rsp + 0x140]
pand xmm0, xmm2
pmovmskb eax, xmm0
xor r15d, r15d
cmp eax, 0xffff
sete r15b
xor esi, esi
jmp 0x140019a5b
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x710]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001caae
mov rdi, qword [rsp + 0x710]
mov rcx, qword [rsp + 0x200]
test rcx, rcx
jne 0x14001cadd
mov qword [rsp + 0x200], rdi
mov eax, dword [rsp + 0x2d0]
cmp eax, 2
jne 0x14001bf3b
mov r12d, 1
jmp 0x140019de0
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x710]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001cae8
mov rdi, qword [rsp + 0x710]
mov rcx, qword [rsp + 0x200]
test rcx, rcx
jne 0x14001cb0e
mov qword [rsp + 0x200], rdi
mov eax, dword [rsp + 0x2d0]
dec eax
cmp eax, 1
jbe 0x14001a0cd
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x14001cafb
cmp eax, 2
jne 0x14001cb51
lea rcx, [rsp + 0x1e0]
lea rdi, [rsp + 0x710]
mov rdx, rdi
call fcn.1400214b0
cmp byte [rdi + 0x20], 0
mov r12, qword [rsp + 0x68]
jne 0x14001c779
lea rcx, [rsp + 0x1e0]
call fcn.1400324a0
mov ecx, dword [rsp + 0x720]
cmp qword [rsp + 0x728], 8
jb 0x14001bd90
mov rdi, qword [rsp + 0x710]
lea edx, [rcx + rcx]
add edx, 2
cmp qword [rax + 0x18], 8
jb 0x14001bda0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x200]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdi
mov rdx, rax
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001cb69
cmp byte [rsp + 0x730], 0
jne 0x14001c779
lea rcx, [rsp + 0x710]
mov rdi, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x90], xmm0
mov rbx, qword [rcx + 0x18]
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
call fcn.140031b90
jmp 0x14001a295
cmp eax, 2
jne 0x14001cb8e
lea rcx, [rsp + 0x1e0]
lea rdi, [rsp + 0x710]
mov rdx, rdi
call fcn.1400322b0
cmp byte [rdi + 0x10], 0
jne 0x14001c79b
lea rcx, [rsp + 0x1e0]
call fcn.1400321d0
mov dword [rsp + 0x2d0], r14d
cmp qword [rax + 0x18], 8
jb 0x14001be5d
mov rax, qword [rax]
mov rcx, qword [rsp + 0x200]
lea rdx, [rsp + 0x2d0]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 4
mov rdx, rax
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140019f38
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsp + 0x150], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x148], 0x79
jmp 0x14001c586
test r12d, r12d
jne 0x14001cba6
lea rdi, [rsp + 0x710]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov qword [rsp + 0x1e0], rax
mov byte [rsp + 0x1e8], 1
mov byte [rsp + 0x150], 0
mov dword [rsp + 0x140], 0
jmp 0x140019f80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov qword [rax + rcx*8], 0
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
jmp 0x14001b629
cmp eax, 1
jne 0x14001cbcc
xor r12d, r12d
jmp 0x140019de0
add r10, 2
mov r9, r10
jmp 0x1400197ce
inc rdx
mov rcx, rdx
jmp 0x14001b776
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rdi, [rsp + 0x710]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rdi], 0
jne 0x140019689
lea rcx, str.user32.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140019689
call qword [sym.imp.mozglue.dll_void___cdecl_CrashReporter::RegisterRuntimeExceptionModule_void_]
mov ecx, dword [0x140062da0]
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
jmp 0x14001b9d1
mov byte [rsp + 0x150], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rax
movabs rax, 0x800700c100000025
mov qword [rsp + 0x148], rax
xor esi, esi
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.140034cf0
xor ebp, ebp
mov r14, qword [rsp + 0x60]
jmp 0x14001a0be
call fcn.140050fb0
test rax, rax
jne 0x14001b83d
lea rcx, str.Failed_to_initialize_the_sandbox_target_services.
call fcn.140033ad0
mov r13d, 0xff
jmp 0x14001b8ec
call fcn.140050fb0
mov qword [rsp + 0x710], rax
test rax, rax
je 0x14001c177
lea rax, [0x14003a800]
mov qword [rsp + 0x718], rax
mov r14, qword [rsp + 0x60]
jmp 0x14001b880
call fcn.1400318f0
mov qword [rsp + 0x720], rax
jmp 0x14001b8b4
or eax, 0x21
jmp 0x14001bb84
or eax, 5
jmp 0x14001bb84
add rax, 2
mov r9, rax
jmp 0x140019889
add r9, 2
mov r8, r9
jmp 0x140019aed
mov al, byte [r15]
cmp r14d, 2
jl 0x14001c09f
test al, al
je 0x14001ba79
cmp r14d, 1
mov r12, qword [rsp + 0x68]
jg 0x14001ba97
mov ebp, r14d
jmp 0x14001c165
mov ebp, r14d
mov r12, qword [rsp + 0x68]
jmp 0x14001babc
cmp r14d, 2
jne 0x14001c4e6
lea rcx, str.Incorrect_number_of_arguments_passed_to__app
call fcn.140033ad0
mov r13d, 0xff
mov r14, qword [rsp + 0x60]
jmp 0x14001bb27
lea rcx, str.Couldnt_initialize_the_broker_services._n
call fcn.140033ad0
mov r13d, 0xff
jmp 0x14001bb27
inc rax
mov rcx, rax
jmp 0x14001b6f8
mov rsi, qword [rsp + 0x68]
lea rcx, [rsi + 8]
mov rdx, rsi
add rdx, 0x10
lea r15d, [r14 - 1]
lea r8, [r15*8]
call sub.ntdll.dll_memmove
call fcn.1400318f0
mov qword [rsp + 0x710], rax
mov rcx, qword [0x140062a90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
lea rdx, [rsp + 0x710]
mov qword [rsp + 0x20], rdx
mov edx, r15d
mov r8, rsi
mov r9, rdi
jmp 0x14001bb1e
mov al, byte [r15]
test al, al
jne 0x14001c3dd
mov r14, qword [rsp + 0x60]
jmp 0x14001babc
mov r13d, 1
mov r14, qword [rsp + 0x60]
jmp 0x14001b8d8
lea rcx, str.MOZ_APP_SILENT_START1
mov r14, qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
call r14
lea rcx, str.MOZ_APP_ALLOW_WINDOWLESS1
call r14
mov r14, qword [rsp + 0x60]
jmp 0x14001b9d1
mov rbx, r12
or ebp, 0x10000000
mov r12d, 0x519
lea rcx, [rsp + 0x710]
mov qword [rcx], r15
mov dword [rcx + 8], r12d
mov dword [rcx + 0xc], ebp
xor edi, edi
xor edx, edx
call fcn.140034cf0
jmp 0x140019a80
mov rbx, r12
xor r15d, r15d
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140019a5b
cmp eax, 0x57
je 0x140019a5b
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r12d, 0x5c
jmp 0x140019a51
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov byte [rsp + 0x728], 1
lea r15, str._builds_worker_checkouts_gecko_browser_app_winlauncher_SameBinary.h
mov qword [rsp + 0x718], r15
mov r12d, 0x1e
mov sil, 1
jmp 0x140019a5b
mov r15, qword [rsp + 0x718]
mov r12d, dword [rsp + 0x720]
mov sil, 1
mov ebp, dword [rsp + 0x724]
jmp 0x140019a5b
mov ebp, dword [rsp + 0x14c]
cmp ebp, 0xd000003a
jne 0x14001c7ba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x140]
mov qword [rsp + 0x60], rax
mov qword [rdx], rax
lea r15, [rsp + 0x2d0]
mov rcx, r15
call fcn.1400392b0
cmp byte [r15 + 0x18], 0
je 0x14001ccf4
mov r15, qword [rsp + 0x2d8]
mov r12d, dword [rsp + 0x2e0]
mov sil, 1
mov ebp, dword [rsp + 0x2e4]
mov rax, qword [rsp + 0x60]
inc rax
cmp rax, 2
jb 0x140019a5b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140019a5b
cmp byte [rax], 0
je 0x140019a99
lea rcx, str.MOZ_LAUNCHER_PROCESS
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov dil, 1
jmp 0x140019a99
lea r10, str.force_launcher
mov r10b, byte [rax + r10 + 1]
inc rax
cmp rax, 0xe
jne 0x140019d52
cmp word [r9 + 0x1c], 0
jne 0x140019daa
mov rax, qword [rcx]
mov qword [rcx - 8], rax
add rcx, 8
test rax, rax
jne 0x14001c32e
dec r14d
xor ebp, ebp
xor esi, esi
jmp 0x140019dc1
add rax, 2
mov r9, rax
jmp 0x140019d4d
lea rcx, [rsp + 0x710]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x8007050700000156
mov qword [rcx + 8], rax
xor esi, esi
xor edx, edx
call fcn.140034cf0
jmp 0x14001ab9d
add r9, 2
mov r8, r9
jmp 0x14001aae9
add rdi, 2
mov r9, rdi
jmp 0x14001abfc
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001cd2a
mov rcx, rax
jmp 0x14001b523
add r8, 2
mov rdx, r8
jmp 0x14001ada7
add rdx, 2
mov rcx, rdx
jmp 0x14001b31b
xor r13d, r13d
jmp 0x14001b47b
xor eax, eax
mov qword [rsp + 0xa8], rax
mov r14, qword [rsp + 0x60]
jmp 0x14001bac3
mov rbx, rdi
cmp rax, 8
jb 0x14001c402
mov rbx, qword [rsp + 0x228]
mov qword [rsp + 0x238], r15
lea rax, [r15 + r15]
mov rcx, rbx
mov rdx, r8
mov r8, rax
call sub.ntdll.dll_memmove
mov word [rbx + r15*2], 0
jmp 0x140019e86
lea rdx, [rax + 6]
mov qword [rsp + 0x238], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x14001c445
mov rdx, qword [rsp + 0x228]
movabs rcx, 0x61006d0049007c
mov qword [rdx + rax*2], rcx
mov dword [rdx + rax*2 + 8], 0x650067
mov word [rdx + rax*2 + 0xc], 0
jmp 0x140019ec0
mov r12, rdi
cmp rax, 8
jb 0x14001c478
mov r12, qword [rsp + 0x2a8]
mov qword [rsp + 0x2b8], r15
lea rax, [r15 + r15]
mov rcx, r12
mov rdx, r8
mov r8, rax
call sub.ntdll.dll_memmove
mov word [r12 + r15*2], 0
mov r14, qword [rsp + 0x60]
jmp 0x14001a11d
lea rdx, [rax + 0xa]
mov qword [rsp + 0x2b8], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x14001c4c0
mov rdx, qword [rsp + 0x2a8]
movdqa xmm0, xmmword [str.Blocklist]
movdqu xmmword [rdx + rax*2], xmm0
mov dword [rdx + rax*2 + 0x10], 0x740073
mov word [rdx + rax*2 + 0x14], 0
mov r14, qword [rsp + 0x60]
jmp 0x14001a157
mov rax, qword [rsp + 0x68]
mov r15, qword [rax + 0x10]
lea rdi, [rsp + 0x710]
mov rcx, rdi
mov r8, r15
call fcn.140033be0
mov rcx, rdi
call qword [sym.imp.mozglue.dll_strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
test eax, eax
jne 0x14001c9cd
mov rcx, qword [rsp + 0x68]
mov r12, rcx
add r12, 0x10
mov rax, qword [rcx]
mov qword [rcx + 0x10], rax
mov r14, qword [rsp + 0x60]
lea ebp, [r14 - 2]
jmp 0x14001bab3
mov eax, 0x43
mov ecx, 0x8007065d
mov byte [rsp + 0x150], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
movabs r8, 0xffffff0000000000
and r8, rdx
mov r9d, edx
shr rdx, 0x20
movzx edx, dl
shl rdx, 0x20
or rdx, r8
or r9, rdx
mov qword [rsp + 0x140], r9
mov dword [rsp + 0x148], eax
mov dword [rsp + 0x14c], ecx
jmp 0x14001bfe3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, r15
call qword [sym.imp.mozglue.dll_free]
mov eax, 0x5c
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x94], edi
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1d0], 0
xor eax, eax
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jmp 0x14001a2c5
mov qword [rcx + 0x10], rdi
mov r8, rdi
add r8, rdi
mov rdx, r15
call sub.ntdll.dll_memcpy
mov word [rsp + rdi*2 + 0x710], 0
jmp 0x14001a26c
mov eax, 0x3839
xchg dword [0x14006204c], eax
jmp 0x14001a404
add r10, 2
mov r9, r10
jmp 0x14001a482
lea rcx, [rsp + 0x710]
xor edx, edx
call fcn.140034cf0
jmp 0x14001ab9b
xor esi, esi
lea rcx, [rsp + 0x198]
xor edx, edx
call fcn.140034cf0
mov rbx, qword [rsp + 0xd8]
jmp 0x14001c6d4
mov esi, 4
jmp 0x14001acfa
xor esi, esi
cmp eax, 1
jne 0x14001acfa
mov esi, 2
test r15b, 3
jne 0x14001acfa
mov esi, 5
cmp r15d, 3
ja 0x14001acfa
lea rdi, [rsp + 0x710]
mov rcx, rdi
mov rbx, r14
mov edx, r14d
mov r8, qword [rsp + 0x70]
call fcn.140038390
mov sil, 1
cmp byte [rdi + 0x10], 0
jne 0x14001cd14
xor r13d, r13d
mov r14, rbx
xor ebx, ebx
jmp 0x14001b4df
xor esi, esi
lea rcx, [rsp + 0x180]
xor edx, edx
call fcn.140034cf0
xor r13d, r13d
jmp 0x14001b4df
lea rcx, [rsp + 0x710]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
movabs rax, 0x800705070000019e
mov qword [rcx + 8], rax
xor edx, edx
call fcn.140034cf0
xor esi, esi
jmp 0x14001b4df
mov r12d, 0x404
jmp 0x14001b1ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb50]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1e4
mov dword [rcx + 0xc], edx
xor esi, esi
xor edx, edx
call fcn.140034cf0
xor r13d, r13d
mov r14, qword [rsp + 0x60]
jmp 0x14001b4c4
xor r14d, r14d
jmp 0x14001b2d6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b4ed
mov rax, qword [rsp + 0x718]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x710]
call fcn.140031b90
jmp 0x14001c5bc
movdqu xmm0, xmmword [rsp + 0x710]
movdqa xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x150], 1
jmp 0x14001bfe3
mov r15, qword [rsp + 0x140]
mov sil, 1
mov r12d, dword [rsp + 0x148]
jmp 0x140019a5b
cmp byte [rax], 0
je 0x14001a0a6
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14001a0bc
cmp word [rax], 0
je 0x14001bff4
xor ebp, ebp
mov rcx, rax
xor edx, edx
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
imul edi, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.1400393d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001bff6
cmp byte [rax], 0
movzx eax, dil
mov ecx, 1
cmove ecx, eax
mov dword [rsp + 0x7c], ecx
jmp 0x14001b024
xor esi, esi
lea rcx, [rsp + 0x128]
xor edx, edx
call fcn.140034cf0
xor r13d, r13d
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x80]
jmp 0x14001b4c4
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov r12, qword [rsp + 0x80]
mov r8, r12
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14001b299
xor esi, esi
lea rcx, [rsp + 0x110]
xor edx, edx
call fcn.140034cf0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r13d, r13d
mov rbx, r15
jmp 0x14001b47e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
lea rcx, [rsp + 0xb50]
mov byte [rcx + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LauncherProcessWin.cpp
mov qword [rcx], rax
mov dword [rcx + 8], 0x1ff
mov dword [rcx + 0xc], edx
xor esi, esi
xor edx, edx
call fcn.140034cf0
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r13d, r13d
jmp 0x14001b47e
mov qword [rsp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
test eax, eax
setne cl
neg ecx
mov dword [rsp + 0x68], ecx
xor r12d, r12d
mov dword [rsp + 0xa4], 0
mov dword [rsp + 0x7c], eax
test eax, eax
jne 0x14001c95e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xa4], eax
or dword [rsp + 0x68], 0x2710
mov rbx, qword [rsp + 0x88]
cmp dword [rsp + 0x7c], 0
jne 0x14001c986
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
sub r12d, dword [rsp + 0xa4]
mov sil, 1
mov r15d, dword [rsp + 0x68]
xor r13d, r13d
sub r15d, r12d
jbe 0x14001c9e6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
mov edx, r15d
call qword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0xffffffff
jne 0x14001c9e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5bf
jne 0x14001b47e
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c96e
lea rcx, str.Couldnt_set__s._n
lea rdx, [rsp + 0x710]
call fcn.140033ad0
jmp 0x14001c0d9
mov rbx, qword [rsp + 0x88]
jmp 0x14001b47e
mov rcx, r13
call fcn.140039500
test al, al
je 0x14001b0d3
mov rax, qword [rsp + 0x150]
jmp 0x14001b0bf
mov rcx, r13
call fcn.140039500
test al, al
je 0x14001b126
mov rax, qword [rsp + 0x150]
jmp 0x14001b112
mov rcx, r13
call fcn.140039500
test al, al
je 0x14001b179
mov rax, qword [rsp + 0x150]
jmp 0x14001b165
mov r15, qword [rsp + 0x2d8]
mov r12d, dword [rsp + 0x2e0]
mov sil, 1
mov ebp, dword [rsp + 0x2e4]
jmp 0x140019a5b
mov r15, qword [rsp + 0x1b0]
mov r12d, dword [rsp + 0x1b8]
mov sil, 1
mov ebp, dword [rsp + 0x1bc]
jmp 0x140019a5b
xor r15d, r15d
jmp 0x14001bc0a
cmp byte [rax], 0
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov r15d, 0
jne 0x14001aa8a
jmp 0x14001aa90
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov byte [rsp + 0x150], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rdx
jmp 0x14001c57f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001bc7f
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x94], ecx
jmp 0x14001c5bc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001bd10
movdqu xmm0, xmmword [rsp + 0x2d0]
jmp 0x14001c7a4
lea rax, [rsp + 0x1f8]
mov qword [rax - 8], 0
jmp 0x14001a079
or byte [rsp + 0x74d], 8
mov qword [rsp + 0x728], rax
jmp 0x14001b23e
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x54
jmp 0x14001c5ae
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x90], 0x6a
mov dword [rsp + 0x94], ecx
jmp 0x14001c789
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x3f
jmp 0x14001c547
mov byte [rsp + 0x150], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsp + 0x140], rax
movabs rax, 0x8007050700000119
jmp 0x14001bfdb
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x14001cac1
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x14001a6cf
movzx r8d, word [rdx + 0x10]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x74
jne 0x14001a6cf
movzx r8d, word [rdx + 0x12]
test r8w, r8w
je 0x14001a6cf
movzx r9d, r8w
mov r10d, 0xff
cmp r9d, r10d
cmovae r8d, r10d
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x65
jne 0x14001a6cf
cmp word [rdx + 0x14], 0
jne 0x14001a6cf
jmp 0x14001cce5
movzx r8d, word [rdx + 0xe]
test r8w, r8w
je 0x14001a966
movzx r9d, r8w
cmp r9d, ecx
cmovae r8d, ecx
lea r9d, [r8 - 0x41]
mov r10d, r8d
or r10b, 0x20
cmp r9b, 0x1a
movzx r9d, r10b
cmovae r9d, r8d
cmp r9b, 0x73
jne 0x14001a966
cmp word [rdx + 0x10], 0
jne 0x14001a966
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jmp 0x14001aa8a
lea rcx, [rsp + 0x710]
lea rdx, [rsp + 0x2d0]
call fcn.140039340
movzx r15d, al
xor esi, esi
jmp 0x14001c2ca
xor esi, esi
lea rcx, [rsp + 0x710]
xor edx, edx
call fcn.140034cf0
jmp 0x14001c6b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3