Function at 0x14000d870
Capabilities:
Check os version
Create process on windows
Get common file path
Load assembly via iassembly
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7b8
movaps xmmword [rsp + 0x7a0], xmm10
movaps xmmword [rsp + 0x790], xmm9
movaps xmmword [rsp + 0x780], xmm8
movaps xmmword [rsp + 0x770], xmm7
movaps xmmword [rsp + 0x760], xmm6
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x758], rax
mov edx, dword [rcx]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.140009600
cmp dword [rbx], 0
movaps xmm10, xmmword [0x140067830]
movups xmmword [rsp + 0x1e0], xmm10
mov byte [rsp + 0x1d0], 0
lea rax, str.initial
lea rdx, str.followup
cmove rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.140015d50
movsxd rax, dword [rbx + 4]
lea rcx, str.Ek_t_
mov rdx, qword [rcx + rax*8]
movups xmmword [rsp + 0x1c0], xmm10
mov byte [rsp + 0x1b0], 0
lea rcx, [rsp + 0x1b0]
call fcn.140015d50
movsxd rax, dword [rbx + 8]
lea rcx, str.dismissed_by_timeout
mov rdx, qword [rcx + rax*8]
movups xmmword [rsp + 0x1a0], xmm10
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x190]
call fcn.140015d50
lea rcx, [rsp + 0x304]
mov r8d, 0x118
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x300], 0x11c
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000daf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.GetOSVersion
mov ecx, ebx
mov r8d, 0x5d
call fcn.140009ce0
mov rax, qword [rsp + 0x1a8]
cmp rax, 0x10
jae 0x14000da64
mov rax, qword [rsp + 0x1c8]
cmp rax, 0x10
jae 0x14000da87
mov rax, qword [rsp + 0x1e8]
cmp rax, 0x10
jae 0x14000daaa
mov rax, qword [rsp + 0x208]
cmp rax, 0x10
jae 0x14000dacd
mov rcx, qword [rsp + 0x758]
xor rcx, rsp
call fcn.140065710
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm8, xmmword [rsp + 0x780]
movaps xmm9, xmmword [rsp + 0x790]
movaps xmm10, xmmword [rsp + 0x7a0]
add rsp, 0x7b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x190]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400104b8
call fcn.140064680
jmp 0x14000d9dd
mov rcx, qword [rsp + 0x1b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400104dc
call fcn.140064680
jmp 0x14000d9ef
mov rcx, qword [rsp + 0x1d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010500
call fcn.140064680
jmp 0x14000da01
mov rcx, qword [rsp + 0x1f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010524
call fcn.140064680
jmp 0x14000da13
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov edx, 2
mov r8d, 1
call fcn.140014de0
mov edx, dword [rsp + 0x304]
mov rbp, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rbx
call rbp
lea rbx, [0x140097637]
mov rcx, rax
mov rdx, rbx
call fcn.14000bdd0
mov edx, dword [rsp + 0x308]
mov rcx, rax
call rbp
mov rcx, rax
mov rdx, rbx
call fcn.14000bdd0
mov edx, dword [rsp + 0x30c]
mov rcx, rax
call rbp
cmp dword [rsp + 0x304], 0xa
jne 0x14000dbe2
cmp dword [rsp + 0x308], 0
jne 0x14000dbe2
mov dword [rsp + 0x5c0], 4
lea rax, [rsp + 0x5c0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x140098f02]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000dbe2
lea rdx, [0x140097637]
lea rcx, [rsp + 0x210]
call fcn.14000bdd0
mov edx, dword [rsp + 0x6c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rbx, [rsp + 0x218]
lea rdx, [rsp + 0x6c0]
mov rcx, rbx
call fcn.140015540
movaps xmm7, xmmword [rsp + 0x6c0]
movaps xmm6, xmmword [rsp + 0x6d0]
lea rbp, [rsp + 0x298]
mov rax, qword [rsp + 0x210]
movsxd rax, dword [rax + 4]
lea rcx, [0x140067940]
mov qword [rsp + rax + 0x210], rcx
mov rax, qword [rsp + 0x210]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x20c], ecx
lea rax, [0x140067950]
mov qword [rsp + 0x218], rax
mov rcx, rbx
call fcn.140015480
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
movaps xmmword [rsp + 0x170], xmm7
movaps xmmword [rsp + 0x180], xmm6
xorps xmm7, xmm7
movups xmmword [rsp + 0x39a], xmm7
movaps xmmword [rsp + 0x390], xmm7
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm7
movaps xmmword [rsp + 0x360], xmm7
movaps xmmword [rsp + 0x350], xmm7
movaps xmmword [rsp + 0x340], xmm7
movaps xmmword [rsp + 0x330], xmm7
movaps xmmword [rsp + 0x320], xmm7
movaps xmmword [rsp + 0x310], xmm7
movaps xmmword [rsp + 0x300], xmm7
lea rcx, [rsp + 0x300]
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
jne 0x14000dd4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.GetOSLocale
mov ecx, ebx
mov r8d, 0x65
call fcn.140009ce0
mov rax, qword [rsp + 0x188]
cmp rax, 0x10
jb 0x14000d9cb
mov rcx, qword [rsp + 0x170]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010550
call fcn.140064680
jmp 0x14000d9cb
movups xmmword [rsp + 0x30], xmm7
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r14, [rsp + 0x300]
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r15
movsxd rbp, eax
mov rcx, rbp
call fcn.1400646bc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
movups xmmword [rsp + 0x30], xmm7
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r15
movaps xmmword [rsp + 0x220], xmm10
mov byte [rsp + 0x210], 0
lea rcx, [rsp + 0x210]
mov rdx, rbx
call fcn.140015d50
movaps xmm6, xmmword [rsp + 0x210]
movaps xmm7, xmmword [rsp + 0x220]
mov rcx, rbx
call fcn.140064680
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x160], xmm7
lea rcx, [0x140096862]
lea rdx, str.DisableTelemetry
call fcn.14000ab80
test al, al
je 0x14000de43
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x1b0]
lea r8, [rsp + 0x190]
call fcn.14000d1d0
mov ebx, eax
jmp 0x14000de84
lea rdx, str.LastPingSentAt
lea rcx, [rsp + 0x300]
call fcn.14000b430
cmp byte [rsp + 0x310], 1
jne 0x14000deb9
mov ebx, dword [rsp + 0x300]
lea rcx, str.Unable_to_read_registry:__X
lea rdx, str.GetPingAlreadySentToday
mov r8d, 0x12a
mov r9d, ebx
call fcn.140009e00
mov rax, qword [rsp + 0x168]
cmp rax, 0x10
jb 0x14000dd19
mov rcx, qword [rsp + 0x150]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010574
call fcn.140064680
jmp 0x14000dd19
mov r14, qword [rsp + 0x300]
mov bl, byte [rsp + 0x308]
test bl, bl
je 0x14000ded4
mov byte [rsp + 0x308], 0
lea rcx, [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbp, qword [rsp + 0x210]
test bl, bl
je 0x14000df25
mov rax, rbp
test rbp, rbp
jne 0x14000df0c
lea rcx, [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x210]
sub rax, r14
jbe 0x14000de22
shr rax, 9
cmp rax, 0x6388fc53
jb 0x14000de22
lea rdx, str.LastPingSentAt
lea rcx, [rsp + 0x210]
mov r8, rbp
call fcn.14000b5e0
cmp byte [rsp + 0x214], 0
jne 0x140010548
movups xmmword [rsp + 0x560], xmm10
mov byte [rsp + 0x550], 0
movups xmmword [rsp + 0x540], xmm10
mov byte [rsp + 0x530], 0
movups xmmword [rsp + 0x520], xmm10
mov byte [rsp + 0x510], 0
mov r15d, 2
movaps xmm8, xmmword [0x140067290]
lea r14, [rsp + 0x730]
movaps xmm7, xmmword [0x140067840]
lea rbx, [rsp + 0x300]
lea rbp, [rsp + 0x710]
lea r12, [rsp + 0x6f0]
xorps xmm9, xmm9
lea r13, [rsp + 0x570]
mov dword [rsp + 0x5c], eax
movups xmmword [rsp + 0x740], xmm8
mov word [rsp + 0x730], 0
mov rcx, r14
lea rdx, str.PingCacheNotificationType
call fcn.140007520
movups xmmword [rsp + 0x310], xmm7
mov dword [rsp + 0x300], 0x30
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.140006d60
mov rcx, rbx
call fcn.140007340
movups xmmword [rsp + 0x720], xmm8
mov word [rsp + 0x710], 0
mov rcx, rbp
lea rdx, str.PingCacheNotificationShown
call fcn.140007520
movups xmmword [rsp + 0x310], xmm7
mov dword [rsp + 0x300], 0x30
mov r8d, 1
mov rcx, rbp
mov rdx, rbx
call fcn.140006d60
mov rcx, rbx
call fcn.140007340
movups xmmword [rsp + 0x700], xmm8
mov word [rsp + 0x6f0], 0
mov rcx, r12
lea rdx, str.PingCacheNotificationAction
call fcn.140007520
movups xmmword [rsp + 0x310], xmm7
mov dword [rsp + 0x300], 0x30
mov r8d, 1
mov rcx, r12
mov rdx, rbx
call fcn.140006d60
mov rcx, rbx
call fcn.140007340
cmp qword [rsp + 0x748], 7
jbe 0x14000e0bf
mov r14, qword [rsp + 0x730]
mov rcx, rbx
mov edx, 1
mov r8, r14
call fcn.1400096a0
cmp qword [rsp + 0x728], 7
jbe 0x14000e0e2
mov rbp, qword [rsp + 0x710]
lea rcx, [rsp + 0x210]
mov edx, 1
mov r8, rbp
call fcn.1400096a0
cmp qword [rsp + 0x708], 7
lea rbx, [rsp + 0x680]
jbe 0x14000e112
mov r12, qword [rsp + 0x6f0]
lea rcx, [rsp + 0x6c0]
mov edx, 1
mov r8, r12
call fcn.1400096a0
movzx ebp, byte [rsp + 0x328]
movzx r14d, byte [rsp + 0x238]
mov eax, r14d
or al, bpl
movzx edx, byte [rsp + 0x6e8]
or al, dl
mov byte [rsp + 0x5b], dl
je 0x14000e4ba
cmp dl, 1
jne 0x140010548
cmp r14b, 1
jne 0x140010548
test bpl, bpl
je 0x140010548
mov eax, dword [rsp + 0x6c0]
mov ecx, dword [rsp + 0x210]
mov r9d, dword [rsp + 0x300]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, str.Error_reading_cache_data._Entry_dropped:__X___X___X
lea rdx, str.PopCache
mov r8d, 0x1ea
call fcn.140009e00
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov byte [rsp + 0x59], r14b
mov byte [rsp + 0x5a], bpl
mov dword [rsp + 0x64], r15d
movups xmmword [rsp + 0x6a0], xmm8
mov word [rsp + 0x690], 0
lea rbp, [rsp + 0x690]
mov rcx, rbp
lea rbx, str.PingCacheNotificationType
mov rdx, rbx
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x30
mov r8d, 1
mov rcx, rbp
lea r13, [rsp + 0x5c0]
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
movups xmmword [rsp + 0x680], xmm8
mov word [rsp + 0x670], 0
lea rbp, [rsp + 0x670]
mov rcx, rbp
lea r12, str.PingCacheNotificationShown
mov rdx, r12
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x30
mov r8d, 1
mov rcx, rbp
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
movups xmmword [rsp + 0x660], xmm8
mov word [rsp + 0x650], 0
lea r14, [rsp + 0x650]
mov rcx, r14
lea rbp, str.PingCacheNotificationAction
mov rdx, rbp
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x30
mov r8d, 1
mov rcx, r14
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
movups xmmword [rsp + 0x640], xmm8
mov word [rsp + 0x630], 0
lea r14, [rsp + 0x630]
mov rcx, r14
mov rdx, rbx
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x31
mov r8d, 1
mov rcx, r14
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
movups xmmword [rsp + 0x620], xmm8
mov word [rsp + 0x610], 0
lea r15, [rsp + 0x610]
mov rcx, r15
mov rdx, r12
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x31
mov r8d, 1
mov rcx, r15
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
movups xmmword [rsp + 0x600], xmm8
mov word [rsp + 0x5f0], 0
lea rbx, [rsp + 0x5f0]
mov rcx, rbx
mov rdx, rbp
call fcn.140007520
movups xmmword [rsp + 0x5d0], xmm7
mov dword [rsp + 0x5c0], 0x31
mov r8d, 1
mov rcx, rbx
mov rdx, r13
call fcn.140006d60
mov rcx, r13
call fcn.140007340
cmp qword [rsp + 0x648], 7
mov r8, r14
jbe 0x14000e3d9
mov r8, qword [rsp + 0x630]
lea rcx, [rsp + 0x5c0]
mov edx, 1
call fcn.1400096a0
cmp byte [rsp + 0x5e8], 0
lea r13, [rsp + 0x570]
jne 0x14000e46d
mov byte [rsp + 0x590], 0
cmp byte [rsp + 0x5e0], 0
jne 0x14000ed38
cmp qword [rsp + 0x6a8], 7
lea r8, [rsp + 0x690]
jbe 0x14000e42e
mov r8, qword [rsp + 0x690]
lea rcx, [rsp + 0x5a0]
mov edx, 1
call fcn.1400099b0
cmp byte [rsp + 0x590], 0
je 0x14000e46d
mov rax, qword [rsp + 0x588]
cmp rax, 0x10
jae 0x14000ecf2
movaps xmmword [rsp + 0x580], xmm10
mov byte [rsp + 0x570], 0
cmp qword [rsp + 0x628], 7
mov r8, r15
jbe 0x14000e483
mov r8, qword [rsp + 0x610]
mov rcx, r13
mov edx, 1
call fcn.1400096a0
movzx eax, byte [rsp + 0x598]
mov byte [rsp + 0x5e8], al
test al, al
je 0x14000e52a
mov eax, dword [rsp + 0x570]
mov dword [rsp + 0x5c0], eax
jmp 0x14000e5a2
test bpl, bpl
jne 0x140010548
mov byte [rsp + 0x5e0], 0
cmp byte [rsp + 0x320], 0
je 0x14000e790
movups xmm0, xmmword [rsp + 0x300]
movups xmm1, xmmword [rsp + 0x310]
movaps xmmword [rsp + 0x5d0], xmm1
movaps xmmword [rsp + 0x5c0], xmm0
mov byte [rsp + 0x5e0], 1
movups xmmword [rsp + 0x310], xmm10
mov byte [rsp + 0x300], 0
mov byte [rsp + 0x320], 0
mov al, 1
test r14b, r14b
je 0x14000e79b
jmp 0x140010548
mov byte [rsp + 0x5e0], 0
cmp byte [rsp + 0x590], 0
lea r8, [rsp + 0x670]
jne 0x14000ee36
mov byte [rsp + 0x590], 0
cmp qword [rsp + 0x688], 7
jbe 0x14000e563
mov r8, qword [rsp + 0x670]
lea rcx, [rsp + 0x5a0]
mov edx, 1
call fcn.1400099b0
cmp byte [rsp + 0x590], 0
je 0x14000e5a2
mov rax, qword [rsp + 0x588]
cmp rax, 0x10
jae 0x14000ed15
movaps xmmword [rsp + 0x580], xmm10
mov byte [rsp + 0x570], 0
cmp qword [rsp + 0x608], 7
mov r8, rbx
jbe 0x14000e5b8
mov r8, qword [rsp + 0x5f0]
mov rcx, r13
mov edx, 1
call fcn.1400096a0
movzx eax, byte [rsp + 0x598]
mov byte [rsp + 0x5e8], al
test al, al
jne 0x14000eb45
mov byte [rsp + 0x5e0], 0
cmp byte [rsp + 0x590], 0
jne 0x14000eb58
mov byte [rsp + 0x590], 0
cmp qword [rsp + 0x668], 7
lea r8, [rsp + 0x650]
jbe 0x14000e615
mov r8, qword [rsp + 0x650]
lea rcx, [rsp + 0x5a0]
mov edx, 1
call fcn.1400099b0
cmp byte [rsp + 0x590], 0
je 0x14000e654
mov rax, qword [rsp + 0x588]
cmp rax, 0x10
jae 0x14000e9b4
movaps xmmword [rsp + 0x580], xmm10
mov byte [rsp + 0x570], 0
cmp qword [rsp + 0x648], 7
mov r8, r14
jbe 0x14000e66a
mov r8, qword [rsp + 0x630]
mov rcx, r13
mov edx, 1
call fcn.1400099b0
cmp qword [rsp + 0x628], 7
mov r8, r15
jbe 0x14000e68d
mov r8, qword [rsp + 0x610]
mov rcx, r13
mov edx, 1
call fcn.1400099b0
cmp qword [rsp + 0x608], 7
mov r8, rbx
jbe 0x14000e6b0
mov r8, qword [rsp + 0x5f0]
mov rcx, r13
mov edx, 1
call fcn.1400099b0
mov rcx, rbx
call fcn.140007340
mov rcx, r15
call fcn.140007340
mov rcx, r14
call fcn.140007340
lea rcx, [rsp + 0x650]
call fcn.140007340
lea rcx, [rsp + 0x670]
call fcn.140007340
lea rcx, [rsp + 0x690]
call fcn.140007340
mov ecx, dword [rsp + 0x5c]
movzx ecx, cl
mov edx, dword [rsp + 0x60]
test dl, dl
mov eax, 0
cmovne ecx, eax
mov dword [rsp + 0x5c], ecx
movzx eax, dl
mov dword [rsp + 0x60], eax
cmp byte [rsp + 0x5b], 0
jne 0x14000e772
cmp byte [rsp + 0x6e0], 0
mov r15d, dword [rsp + 0x64]
movzx ebp, byte [rsp + 0x5a]
movzx r14d, byte [rsp + 0x59]
je 0x14000ea50
mov rax, qword [rsp + 0x6d8]
cmp rax, 0x10
jae 0x14000ec66
movups xmmword [rsp + 0x6d0], xmm10
mov byte [rsp + 0x6c0], 0
test r14b, r14b
je 0x14000ea55
jmp 0x14000ea82
mov r15d, dword [rsp + 0x64]
movzx ebp, byte [rsp + 0x5a]
movzx r14d, byte [rsp + 0x59]
test r14b, r14b
je 0x14000ea55
jmp 0x14000ea82
xor eax, eax
test r14b, r14b
jne 0x140010548
mov byte [rsp + 0x590], 0
cmp byte [rsp + 0x230], 0
je 0x14000e7f9
movups xmm0, xmmword [rsp + 0x210]
movups xmm1, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0x580], xmm1
movaps xmmword [rsp + 0x570], xmm0
mov byte [rsp + 0x590], 1
movups xmmword [rsp + 0x220], xmm10
mov byte [rsp + 0x210], 0
mov byte [rsp + 0x230], 0
mov cl, 1
test dl, dl
je 0x14000e803
jmp 0x140010548
xor ecx, ecx
test dl, dl
jne 0x140010548
mov byte [rsp + 0x6b0], 0
cmp byte [rsp + 0x6e0], 0
je 0x14000e861
movups xmm0, xmmword [rsp + 0x6c0]
movups xmm1, xmmword [rsp + 0x6d0]
movaps xmmword [rsp + 0x6a0], xmm1
movaps xmmword [rsp + 0x690], xmm0
mov byte [rsp + 0x6b0], 1
movups xmmword [rsp + 0x6d0], xmm10
mov byte [rsp + 0x6c0], 0
mov byte [rsp + 0x6e0], 0
mov dl, 1
test al, al
jne 0x14000e86b
jmp 0x14000e959
xor edx, edx
test al, al
je 0x14000e959
test cl, cl
je 0x14000e95d
test dl, dl
je 0x14000e95d
movups xmmword [rbx], xmm9
mov r12, rbx
lea rbx, [rsp + 0x670]
mov rcx, rbx
lea rdx, [rsp + 0x5c0]
call fcn.140015dc0
mov rax, qword [rsp + 0x568]
cmp rax, 0x10
jae 0x14000ef44
movups xmm0, xmmword [rsp + 0x670]
movups xmm1, xmmword [rsp + 0x680]
movaps xmmword [rsp + 0x560], xmm1
movaps xmmword [rsp + 0x550], xmm0
movups xmmword [r12], xmm9
mov rcx, rbx
mov rdx, r13
call fcn.140015dc0
mov rax, qword [rsp + 0x548]
cmp rax, 0x10
jae 0x14000ef7f
movups xmm0, xmmword [rsp + 0x670]
movups xmm1, xmmword [rsp + 0x680]
movaps xmmword [rsp + 0x540], xmm1
movaps xmmword [rsp + 0x530], xmm0
movups xmmword [r12], xmm9
mov rcx, rbx
lea rdx, [rsp + 0x690]
call fcn.140015dc0
mov rax, qword [rsp + 0x528]
cmp rax, 0x10
jae 0x14000efba
movups xmm0, xmmword [rsp + 0x670]
movups xmm1, xmmword [rsp + 0x680]
movaps xmmword [rsp + 0x520], xmm1
movaps xmmword [rsp + 0x510], xmm0
mov bl, 1
jmp 0x14000e978
or dl, cl
je 0x14000e9d7
lea rcx, str.Some_notification_data_cache_data_is_missing._Cache_entry_dropped
lea rdx, str.PopCache
mov r8d, 0x1e3
call fcn.140009e00
xor ebx, ebx
xor r12d, r12d
cmp byte [rsp + 0x6b0], 0
je 0x14000e9e5
mov rax, qword [rsp + 0x6a8]
cmp rax, 0x10
jae 0x14000eccf
movaps xmmword [rsp + 0x6a0], xmm10
mov byte [rsp + 0x690], 0
cmp byte [rsp + 0x590], 0
jne 0x14000e9ef
jmp 0x14000ea12
mov rcx, qword [rsp + 0x570]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f029
call fcn.140064680
jmp 0x14000e643
mov r12d, 1
mov al, 1
mov dword [rsp + 0x5c], eax
xor ebx, ebx
cmp byte [rsp + 0x590], 0
je 0x14000ea12
mov rax, qword [rsp + 0x588]
cmp rax, 0x10
jae 0x14000ec89
movaps xmmword [rsp + 0x580], xmm10
mov byte [rsp + 0x570], 0
cmp byte [rsp + 0x5e0], 0
je 0x14000ea3f
mov rax, qword [rsp + 0x5d8]
cmp rax, 0x10
jae 0x14000ecac
movaps xmmword [rsp + 0x5d0], xmm10
mov byte [rsp + 0x5c0], 0
mov dword [rsp + 0x60], 1
test r12d, r12d
je 0x14000e1a7
test r14b, r14b
jne 0x14000ea82
cmp byte [rsp + 0x230], 0
je 0x14000ea82
mov rax, qword [rsp + 0x228]
cmp rax, 0x10
jae 0x14000eb22
movups xmmword [rsp + 0x220], xmm10
mov byte [rsp + 0x210], 0
test bpl, bpl
lea r14, [rsp + 0x730]
lea rbp, [rsp + 0x710]
lea r12, [rsp + 0x6f0]
jne 0x14000eac8
cmp byte [rsp + 0x320], 0
je 0x14000eac8
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jae 0x14000eb02
movups xmmword [rsp + 0x310], xmm10
mov byte [rsp + 0x300], 0
mov rcx, r12
call fcn.140007340
mov rcx, rbp
call fcn.140007340
mov rcx, r14
call fcn.140007340
cmp dword [rsp + 0x60], 0
jne 0x14000f2b9
add r15d, 0xffffffff
lea rbx, [rsp + 0x300]
jne 0x14000dfc2
jmp 0x14000f31a
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000efe5
call fcn.140064680
jmp 0x14000eab7
mov rcx, qword [rsp + 0x210]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f06d
call fcn.140064680
jmp 0x14000ea71
mov eax, dword [rsp + 0x570]
mov dword [rsp + 0x5c0], eax
jmp 0x14000e654
movups xmm0, xmmword [rsp + 0x570]
movups xmm1, xmmword [rsp + 0x580]
movaps xmmword [rsp + 0x5d0], xmm1
movaps xmmword [rsp + 0x5c0], xmm0
movaps xmmword [rsp + 0x580], xmm1
movaps xmmword [rsp + 0x570], xmm0
mov byte [rsp + 0x590], 1
movaps xmmword [rsp + 0x5d0], xmm10
mov byte [rsp + 0x5c0], 0
mov byte [rsp + 0x5e0], 0
lea rax, [rsp + 0x5b0]
movups xmmword [rax], xmm9
lea rbp, [rsp + 0x5a0]
mov rcx, rbp
mov rdx, r13
call fcn.140015dc0
cmp qword [rsp + 0x5b8], 0xf
jbe 0x14000ebdb
mov rbp, qword [rsp + 0x5a0]
cmp qword [rsp + 0x668], 7
lea rdx, [rsp + 0x650]
jbe 0x14000ebf6
mov rdx, qword [rsp + 0x650]
lea rcx, [rsp + 0x68]
mov r8, rbp
call fcn.140009aa0
mov rax, qword [rsp + 0x5b8]
cmp rax, 0x10
jb 0x14000e627
mov rcx, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f1e1
call fcn.140064680
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
cmp byte [rsp + 0x590], 0
jne 0x14000e631
jmp 0x14000e654
mov rcx, qword [rsp + 0x6c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f099
call fcn.140064680
jmp 0x14000e753
mov rcx, qword [rsp + 0x570]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f0d5
call fcn.140064680
jmp 0x14000ea01
mov rcx, qword [rsp + 0x5c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f101
call fcn.140064680
jmp 0x14000ea2e
mov rcx, qword [rsp + 0x690]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f12d
call fcn.140064680
jmp 0x14000e997
mov rcx, qword [rsp + 0x570]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f159
call fcn.140064680
jmp 0x14000e45c
mov rcx, qword [rsp + 0x570]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f19d
call fcn.140064680
jmp 0x14000e591
movups xmm0, xmmword [rsp + 0x5c0]
movups xmm1, xmmword [rsp + 0x5d0]
movaps xmmword [rsp + 0x580], xmm1
movaps xmmword [rsp + 0x570], xmm0
mov byte [rsp + 0x590], 1
movups xmmword [rsp + 0x5d0], xmm10
mov byte [rsp + 0x5c0], 0
mov byte [rsp + 0x5e0], 0
lea rax, [rsp + 0x5b0]
movups xmmword [rax], xmm9
lea rbp, [rsp + 0x5a0]
mov rcx, rbp
mov rdx, r13
call fcn.140015dc0
cmp qword [rsp + 0x5b8], 0xf
jbe 0x14000edab
mov rbp, qword [rsp + 0x5a0]
cmp qword [rsp + 0x6a8], 7
lea rdx, [rsp + 0x690]
jbe 0x14000edc6
mov rdx, qword [rsp + 0x690]
lea rcx, [rsp + 0x68]
mov r8, rbp
call fcn.140009aa0
mov rax, qword [rsp + 0x5b8]
cmp rax, 0x10
jb 0x14000e440
mov rcx, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f205
call fcn.140064680
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
cmp byte [rsp + 0x590], 0
jne 0x14000e44a
jmp 0x14000e46d
movups xmm0, xmmword [rsp + 0x570]
movups xmm1, xmmword [rsp + 0x580]
movaps xmmword [rsp + 0x5d0], xmm1
movaps xmmword [rsp + 0x5c0], xmm0
movaps xmmword [rsp + 0x580], xmm1
movaps xmmword [rsp + 0x570], xmm0
mov byte [rsp + 0x590], 1
movaps xmmword [rsp + 0x5d0], xmm10
mov byte [rsp + 0x5c0], 0
mov byte [rsp + 0x5e0], 0
lea rax, [rsp + 0x5b0]
movups xmmword [rax], xmm9
lea rbp, [rsp + 0x5a0]
mov rcx, rbp
mov rdx, r13
call fcn.140015dc0
cmp qword [rsp + 0x5b8], 0xf
jbe 0x14000eeb9
mov rbp, qword [rsp + 0x5a0]
cmp qword [rsp + 0x688], 7
lea rdx, [rsp + 0x670]
jbe 0x14000eed4
mov rdx, qword [rsp + 0x670]
lea rcx, [rsp + 0x68]
mov r8, rbp
call fcn.140009aa0
mov rax, qword [rsp + 0x5b8]
cmp rax, 0x10
jb 0x14000e575
mov rcx, qword [rsp + 0x5a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f229
call fcn.140064680
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
cmp byte [rsp + 0x590], 0
jne 0x14000e57f
jmp 0x14000e5a2
mov rcx, qword [rsp + 0x550]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f24d
call fcn.140064680
lea r12, [rsp + 0x680]
lea rbx, [rsp + 0x670]
lea r13, [rsp + 0x570]
jmp 0x14000e8ac
mov rcx, qword [rsp + 0x530]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f271
call fcn.140064680
lea r12, [rsp + 0x680]
lea rbx, [rsp + 0x670]
lea r13, [rsp + 0x570]
jmp 0x14000e8ee
mov rcx, qword [rsp + 0x510]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000f295
call fcn.140064680
lea r13, [rsp + 0x570]
jmp 0x14000e935
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r14, [rsp + 0x730]
lea rbp, [rsp + 0x710]
lea r12, [rsp + 0x6f0]
lea r13, [rsp + 0x570]
jmp 0x14000eb1b
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
jmp 0x14000e9cd
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r13, [rsp + 0x570]
jmp 0x14000eb3b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r13, [rsp + 0x570]
mov r15d, dword [rsp + 0x64]
movzx ebp, byte [rsp + 0x5a]
movzx r14d, byte [rsp + 0x59]
jmp 0x14000ec7f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r13, [rsp + 0x570]
jmp 0x14000eca2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r13, [rsp + 0x570]
jmp 0x14000ecc5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, r8
lea r13, [rsp + 0x570]
jmp 0x14000ece8
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
jmp 0x14000ed0b
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
lea r13, [rsp + 0x570]
lea r14, [rsp + 0x630]
lea r15, [rsp + 0x610]
lea rbx, [rsp + 0x5f0]
jmp 0x14000ed2e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000ec2e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000edfe
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000ef0c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000ef5d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000ef98
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x14000efd3
xor ebx, ebx
cmp byte [rsp + 0x5c], 0
jne 0x14000f33e
lea rbp, [rsp + 0x1d0]
lea r14, [rsp + 0x1b0]
lea r15, [rsp + 0x190]
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.14000d1d0
lea rdx, [rsp + 0x550]
mov rcx, rbp
call fcn.14000d800
lea rdx, [rsp + 0x530]
mov rcx, r14
call fcn.14000d800
lea rdx, [rsp + 0x510]
mov rcx, r15
call fcn.14000d800
jmp 0x14000f33e
lea rcx, str.Failed_to_read_cache:__X
lea rdx, str.MaybeSwapForCached
mov ebx, 0x80004005
mov r8d, 0x24b
mov r9d, 0x80004005
call fcn.140009e00
mov rax, qword [rsp + 0x528]
cmp rax, 0x10
jae 0x14000f90d
mov rax, qword [rsp + 0x548]
cmp rax, 0x10
jae 0x14000f930
mov rax, qword [rsp + 0x568]
cmp rax, 0x10
jae 0x14000f953
test ebx, ebx
js 0x14000de84
mov edi, dword [rdi + 4]
lea r8, str.PingCurrentDefault
lea rcx, [rsp + 0x300]
mov edx, 1
call fcn.1400096a0
cmp byte [rsp + 0x328], 1
jne 0x14000f3c2
mov ebx, dword [rsp + 0x300]
lea rcx, str.Unable_to_read_registry:__X
lea rdx, str.GetAndUpdatePreviousDefaultBrowser
mov r8d, 0x150
jmp 0x14000de7c
mov byte [rsp + 0x230], 0
cmp byte [rsp + 0x320], 0
jne 0x14000faa2
lea rcx, [rsp + 0x6c0]
mov edx, edi
call fcn.140009600
mov rdi, qword [rsp + 0x6c0]
lea rax, [rsp + 0x6c8]
lea rbx, [rsp + 0x6d8]
movups xmm7, xmmword [rax]
mov rbx, qword [rbx]
cmp qword [rsp + 0x208], 0xf
jbe 0x14000f418
mov rsi, qword [rsp + 0x1f0]
lea rdx, str.PingCurrentDefault
lea rcx, [rsp + 0x6c0]
mov r8, rsi
call fcn.140009aa0
cmp byte [rsp + 0x6c4], 0
jne 0x140010548
cmp byte [rsp + 0x230], 0
je 0x14000f46a
mov rax, qword [rsp + 0x228]
cmp rax, 0x10
jae 0x14000fa7f
movaps xmmword [rsp + 0x220], xmm10
mov byte [rsp + 0x210], 0
mov qword [rsp + 0x630], rdi
movups xmmword [rsp + 0x638], xmm7
mov qword [rsp + 0x648], rbx
xorps xmm7, xmm7
movups xmmword [rsp + 0x140], xmm7
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x190]
call fcn.140015dc0
movups xmmword [rsp + 0x120], xmm7
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x1b0]
call fcn.140015dc0
movups xmmword [rsp + 0x100], xmm7
lea r12, [rsp + 0xf0]
lea rdx, [rsp + 0x1d0]
mov rcx, r12
call fcn.140015dc0
movups xmmword [rsp + 0xe0], xmm7
lea r13, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
mov rcx, r13
call fcn.140015dc0
movups xmmword [rsp + 0xc0], xmm7
lea r15, [rsp + 0xb0]
lea rdx, [rsp + 0x170]
mov rcx, r15
call fcn.140015dc0
movups xmmword [rsp + 0xa0], xmm7
lea rbp, [rsp + 0x90]
lea rdx, [rsp + 0x630]
mov rcx, rbp
call fcn.140015dc0
movups xmmword [rsp + 0x80], xmm7
lea rsi, [rsp + 0x70]
lea rdx, [rsp + 0x1f0]
mov rcx, rsi
call fcn.140015dc0
lea rbx, [rsp + 0x6c0]
mov rcx, rbx
xor edx, edx
call fcn.140017350
lea rdx, str.release
lea r14, [rsp + 0x300]
mov rcx, r14
call fcn.14001a050
lea rdx, str.build_channel
lea r8, [0x140096cd6]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, r14
mov rdx, rax
call fcn.14001a310
mov rcx, r14
call fcn.140017230
lea rdx, [0x1400973e0]
lea rdi, [rsp + 0x300]
mov rcx, rdi
call fcn.14001a050
lea rdx, str.build_version
lea r8, [0x140096c4d]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rdi
mov rdx, rax
call fcn.14001a310
mov rcx, rdi
call fcn.140017230
lea rdi, [rsp + 0x300]
mov rcx, rdi
mov rdx, rsi
call fcn.140018f00
lea rdx, [0x140096a0a]
lea r8, [0x140096a19]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rdi
mov rdx, rax
call fcn.14001a310
mov rcx, rdi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
mov rdx, rbp
call fcn.140018f00
lea rdx, str.previous_default_browser
lea r8, [0x140096a19]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
mov rdx, r15
call fcn.140018f00
lea rdx, str.os_version
lea r8, [0x140096c3f]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
mov rdx, r13
call fcn.140018f00
lea rdx, str.os_locale
lea r8, [0x1400971ad]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
mov rdx, r12
call fcn.140018f00
lea rdx, str.notification_type
lea r8, [0x140097118]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
lea rdx, [rsp + 0x110]
call fcn.140018f00
lea rdx, str.notification_shown
lea r8, [0x140096b44]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x300]
mov rcx, rsi
lea rdx, [rsp + 0x130]
call fcn.140018f00
lea rdx, str.notification_action
lea r8, [0x140096bbc]
mov rcx, rbx
call fcn.14001b1b0
mov rcx, rsi
mov rdx, rax
call fcn.14001a310
mov rcx, rsi
call fcn.140017230
lea rsi, [rsp + 0x210]
mov rcx, rsi
call fcn.14001bd40
lea rdx, [0x140097820]
lea rdi, [rsp + 0x300]
mov rcx, rdi
call fcn.14001a050
movups xmmword [rsp + 0x5d0], xmm10
mov byte [rsp + 0x5c0], 0
lea rdx, str.indentation
lea rbx, [rsp + 0x5c0]
mov rcx, rbx
call fcn.140015d50
mov rcx, rsi
mov rdx, rbx
call fcn.14001e5c0
mov rcx, rdi
mov rdx, rax
call fcn.14001a310
mov rax, qword [rsp + 0x5d8]
cmp rax, 0x10
jae 0x14000fa09
lea rcx, [rsp + 0x300]
call fcn.140017230
lea rdi, [rsp + 0x710]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x6c0]
mov rcx, rdi
call fcn.14001bd80
lea rcx, [rsp + 0x690]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x14000f882
mov ebx, eax
or ebx, 0x80010000
lea rdx, str.GenerateUUIDStr
mov ecx, ebx
mov r8d, 0x7e
call fcn.140009ce0
mov byte [rsp + 0x5e0], 1
mov dword [rsp + 0x5c0], ebx
jmp 0x1400101b3
xorps xmm0, xmm0
movups xmmword [rsp + 0x33e], xmm0
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x320], xmm0
movaps xmmword [rsp + 0x310], xmm0
movaps xmmword [rsp + 0x300], xmm0
lea rcx, [rsp + 0x690]
lea rdx, [rsp + 0x300]
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
je 0x14000fb84
lea rdx, str.GenerateUUIDStr
mov ecx, 0x8007007a
mov r8d, 0x85
call fcn.140009ce0
mov dword [rsp + 0x5c0], 0x8007007a
mov al, 1
mov byte [rsp + 0x5e0], al
test al, al
je 0x14000f97e
mov ebx, dword [rsp + 0x5c0]
jmp 0x1400101b3
mov rcx, qword [rsp + 0x510]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010598
call fcn.140064680
jmp 0x14000f350
mov rcx, qword [rsp + 0x530]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400105bc
call fcn.140064680
jmp 0x14000f362
mov rcx, qword [rsp + 0x550]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400105e0
call fcn.140064680
test ebx, ebx
jns 0x14000f37c
jmp 0x14000de84
movaps xmm0, xmmword [rsp + 0x5c0]
movaps xmm1, xmmword [rsp + 0x5d0]
movaps xmmword [rsp + 0x700], xmm1
movaps xmmword [rsp + 0x6f0], xmm0
movaps xmmword [rsp + 0x5d0], xmm8
mov word [rsp + 0x5c0], 0
lea rcx, section..rdata
lea rsi, [rsp + 0x730]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x14000fa2c
mov ebx, eax
lea rdx, str.GetPingFilePath
mov ecx, eax
mov r8d, 0x93
call fcn.140009ce0
mov byte [rsp + 0x590], 1
mov dword [rsp + 0x570], ebx
cmp byte [rsp + 0x590], 1
je 0x14000fc6b
jmp 0x14000fc77
mov rcx, qword [rsp + 0x5c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010604
call fcn.140064680
jmp 0x14000f813
mov rbx, qword [rsp + 0x730]
lea rbp, [rsp + 0x300]
mov r8d, 0x208
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x140098a34]
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x14000fb20
lea rdx, str.GetPingFilePath
mov ecx, 0x8007007a
mov r8d, 0x9f
jmp 0x14000fc3b
mov rcx, qword [rsp + 0x210]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010760
call fcn.140064680
jmp 0x14000f459
movups xmm0, xmmword [rsp + 0x300]
movups xmm1, xmmword [rsp + 0x310]
movaps xmmword [rsp + 0x220], xmm1
movaps xmmword [rsp + 0x210], xmm0
mov byte [rsp + 0x230], 1
movups xmmword [rsp + 0x310], xmm10
mov byte [rsp + 0x300], 0
mov byte [rsp + 0x320], 0
lea rcx, [rsp + 0x6c0]
lea rbx, [rsp + 0x6d8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x6d0], xmm0
lea rdx, [rsp + 0x210]
call fcn.140015dc0
mov rdi, qword [rsp + 0x6c0]
lea rax, [rsp + 0x6c8]
jmp 0x14000f3ff
lea rdx, [0x140097920]
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14000fb50
lea rdx, str.GetPingFilePath
mov ecx, 0x8007007a
mov r8d, 0xa4
jmp 0x14000fc3b
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14000fbf6
lea rdx, str.GetPingFilePath
mov ecx, 0x8007007a
mov r8d, 0xa9
jmp 0x14000fc3b
movups xmmword [rsp + 0x580], xmm8
mov word [rsp + 0x570], 0
lea r9, [rsp + 0x302]
lea rsi, [rsp + 0x570]
mov edx, 0x24
mov rcx, rsi
call fcn.1400073b0
movups xmm0, xmmword [rsp + 0x570]
movups xmm1, xmmword [rsp + 0x580]
movaps xmmword [rsp + 0x5c0], xmm0
movaps xmmword [rsp + 0x5d0], xmm1
movups xmmword [rsp + 0x580], xmm8
mov word [rsp + 0x570], 0
mov rcx, rsi
call fcn.140007340
xor eax, eax
jmp 0x14000f8f6
cmp qword [rsp + 0x708], 7
jbe 0x14000fc0b
mov rdx, qword [rsp + 0x6f0]
jmp 0x14000fc13
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14001043c
lea rdx, str.GetPingFilePath
mov ecx, 0x8007007a
mov r8d, 0xae
call fcn.140009ce0
mov byte [rsp + 0x590], 1
mov dword [rsp + 0x570], 0x8007007a
test rbx, rbx
je 0x14000fc61
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp byte [rsp + 0x590], 1
jne 0x14000fc77
mov ebx, dword [rsp + 0x570]
jmp 0x140010198
movaps xmm0, xmmword [rsp + 0x570]
movaps xmm1, xmmword [rsp + 0x580]
movaps xmmword [rsp + 0x680], xmm1
movaps xmmword [rsp + 0x670], xmm0
movaps xmmword [rsp + 0x580], xmm8
mov word [rsp + 0x570], 0
cmp qword [rsp + 0x688], 7
jbe 0x14000fcbf
mov rdx, qword [rsp + 0x670]
jmp 0x14000fcc7
lea rdx, [rsp + 0x670]
lea rbx, [rsp + 0x300]
mov rcx, rbx
call fcn.1400159f0
mov r8, qword [rsp + 0x720]
cmp qword [rsp + 0x728], 0xf
jbe 0x14000fcf2
mov rdi, qword [rsp + 0x710]
mov rcx, rbx
mov rdx, rdi
call fcn.140014b60
mov rax, qword [rsp + 0x300]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x300
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14000fd91
lea rdx, str.SendPing
mov ebx, 0x8007045d
mov ecx, 0x8007045d
mov r8d, 0xf8
call fcn.140009ce0
lea rsi, [rsp + 0x3a8]
mov rax, qword [rsp + 0x300]
movsxd rax, dword [rax + 4]
lea rcx, [0x1400679d0]
mov qword [rsp + rax + 0x300], rcx
mov rax, qword [rsp + 0x300]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x2fc], ecx
lea rcx, [rsp + 0x308]
call fcn.1400143b0
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x140010174
lea rdi, [rsp + 0x3a8]
mov rax, qword [rsp + 0x300]
movsxd rax, dword [rax + 4]
lea rcx, [0x1400679d0]
mov qword [rsp + rax + 0x300], rcx
mov rax, qword [rsp + 0x300]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x2fc], ecx
lea rcx, [rsp + 0x308]
call fcn.1400143b0
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdi, [rsp + 0x650]
mov rcx, rdi
xor edx, edx
call fcn.1400016e0
mov rcx, qword [rsp + 0x650]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000fe38
lea rdx, str.GetPingsenderPath
mov ecx, 0x8007007a
mov r8d, 0xbc
call fcn.140009ce0
mov byte [rsp + 0x6b0], 1
mov dword [rsp + 0x690], 0x8007007a
mov al, 1
jmp 0x14000ff02
lea rbp, [rsp + 0x300]
mov r8d, 0x208
mov rcx, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x650]
lea r8, str.pingsender.exe
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x14000fe93
lea rdx, str.GetPingsenderPath
mov ecx, 0x8007007a
mov r8d, 0xc3
call fcn.140009ce0
mov dword [rsp + 0x690], 0x8007007a
mov al, 1
jmp 0x14000fefb
movups xmmword [rsp + 0x740], xmm8
mov word [rsp + 0x730], 0
lea rbp, [rsp + 0x730]
lea rdx, [rsp + 0x300]
mov rcx, rbp
call fcn.140007520
movups xmm0, xmmword [rsp + 0x730]
movups xmm1, xmmword [rsp + 0x740]
movaps xmmword [rsp + 0x690], xmm0
movaps xmmword [rsp + 0x6a0], xmm1
movups xmmword [rsp + 0x740], xmm8
mov word [rsp + 0x730], 0
mov rcx, rbp
call fcn.140007340
xor eax, eax
mov byte [rsp + 0x6b0], al
mov rcx, qword [rsp + 0x650]
mov qword [rsp + 0x650], 0
test rcx, rcx
je 0x14000ff27
call fcn.140064680
mov al, byte [rsp + 0x6b0]
test al, al
je 0x14000ff37
mov ebx, dword [rsp + 0x690]
jmp 0x140010174
movaps xmm0, xmmword [rsp + 0x690]
movaps xmm1, xmmword [rsp + 0x6a0]
movaps xmmword [rsp + 0x740], xmm1
movaps xmmword [rsp + 0x730], xmm0
movaps xmmword [rsp + 0x6a0], xmm8
mov word [rsp + 0x690], 0
movups xmmword [rsp + 0x660], xmm8
mov word [rsp + 0x650], 0
lea rdx, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov rcx, rdi
call fcn.140007520
mov r8, qword [rsp + 0x700]
cmp qword [rsp + 0x708], 7
jbe 0x14000ffa9
mov rdx, qword [rsp + 0x6f0]
jmp 0x14000ffb1
lea rdx, [rsp + 0x6f0]
mov rcx, rdi
call fcn.140006d60
cmp qword [rsp + 0x748], 7
mov rax, rsi
jbe 0x14000ffcf
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x610], rax
cmp qword [rsp + 0x668], 7
jbe 0x14000ffea
mov rdi, qword [rsp + 0x650]
mov qword [rsp + 0x618], rdi
cmp qword [rsp + 0x688], 7
jbe 0x140010007
mov rax, qword [rsp + 0x670]
jmp 0x14001000f
lea rax, [rsp + 0x670]
mov qword [rsp + 0x620], rax
lea rcx, [rsp + 0x5a0]
lea rdx, [rsp + 0x610]
call fcn.1400156d0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x300], xmm0
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x340], xmm0
movaps xmmword [rsp + 0x350], xmm0
movaps xmmword [rsp + 0x320], xmm0
movaps xmmword [rsp + 0x310], xmm0
mov qword [rsp + 0x360], 0
mov dword [rsp + 0x300], 0x68
mov dword [rsp + 0x33c], 1
mov word [rsp + 0x340], 0
mov rdi, qword [rsp + 0x5a0]
cmp qword [rsp + 0x748], 7
jbe 0x1400100a6
mov rsi, qword [rsp + 0x730]
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001010f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, str.SendPing
mov ecx, ebx
mov r8d, 0x115
call fcn.140009ce0
jmp 0x14001012a
mov rcx, qword [rsp + 0x5f8]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x5f0]
call rsi
mov qword [rsp + 0x5a0], 0
test rdi, rdi
je 0x140010143
mov rcx, rdi
call fcn.140064680
lea rcx, [rsp + 0x650]
call fcn.140007340
lea rcx, [rsp + 0x730]
call fcn.140007340
cmp byte [rsp + 0x6b0], 0
jne 0x140010174
lea rcx, [rsp + 0x690]
call fcn.140007340
lea rcx, [rsp + 0x670]
call fcn.140007340
cmp byte [rsp + 0x590], 0
jne 0x140010198
lea rcx, [rsp + 0x570]
call fcn.140007340
lea rcx, [rsp + 0x6f0]
call fcn.140007340
cmp byte [rsp + 0x5e0], 0
je 0x14001042a
mov rax, qword [rsp + 0x728]
cmp rax, 0x10
jae 0x140010315
lea rax, [0x140067af0]
mov qword [rsp + 0x210], rax
lea rcx, [rsp + 0x218]
call fcn.140017230
lea rcx, [rsp + 0x6c0]
call fcn.140017230
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jae 0x140010338
movups xmmword [rsp + 0x80], xmm10
mov byte [rsp + 0x70], 0
mov rax, qword [rsp + 0xa8]
cmp rax, 0x10
jae 0x140010358
movups xmmword [rsp + 0xa0], xmm10
mov byte [rsp + 0x90], 0
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jae 0x14001037b
movups xmmword [rsp + 0xc0], xmm10
mov byte [rsp + 0xb0], 0
mov rax, qword [rsp + 0xe8]
cmp rax, 0x10
jae 0x14001039e
movups xmmword [rsp + 0xe0], xmm10
mov byte [rsp + 0xd0], 0
mov rax, qword [rsp + 0x108]
cmp rax, 0x10
jae 0x1400103c1
movups xmmword [rsp + 0x100], xmm10
mov byte [rsp + 0xf0], 0
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jae 0x1400103e4
mov rcx, qword [rsp + 0x710]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14001064c
call fcn.140064680
jmp 0x1400101c5
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010670
call fcn.140064680
jmp 0x140010200
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010694
call fcn.140064680
jmp 0x140010220
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400106b8
call fcn.140064680
jmp 0x140010243
mov rcx, qword [rsp + 0xd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400106dc
call fcn.140064680
jmp 0x140010266
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140010700
call fcn.140064680
jmp 0x140010289
lea rcx, [rsp + 0x5c0]
call fcn.140007340
jmp 0x1400101b3
movups xmmword [rsp + 0x6a0], xmm8
mov word [rsp + 0x690], 0
lea rbp, [rsp + 0x690]
lea rdx, [rsp + 0x300]
mov rcx, rbp
call fcn.140007520
mov byte [rsp + 0x590], 0
movups xmm0, xmmword [rsp + 0x690]
movups xmm1, xmmword [rsp + 0x6a0]
movaps xmmword [rsp + 0x570], xmm0
movaps xmmword [rsp + 0x580], xmm1
movups xmmword [rsp + 0x6a0], xmm8
mov word [rsp + 0x690], 0
mov rcx, rbp
call fcn.140007340
test rbx, rbx
jne 0x14000fc58
jmp 0x14000fc61
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000da7d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000daa0
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000dac3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000dae6
int3
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000dd44
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000deaf
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000f926
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000f949
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000f96c
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000fa22
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14001032e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14001034e
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140010371
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x140010394
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x1400103b7
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x1400103da
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140010780
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000fa98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
ud2