Function at 0x1400366f0
Capabilities:
Access the windows event log
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x818
movaps xmmword [rsp + 0x800], xmm6
mov rsi, r8
mov rbx, rdx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x50], rcx
mov eax, dword [rcx]
cmp rax, 0xc
ja 0x1400367d3
lea rcx, str.._n_
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x358], 0xf
mov byte [rsp + 0x340], 0
mov r15, qword [rax]
mov r14, qword [rax + 8]
cmp r14, 0xf
jbe 0x1400367fb
test r14, r14
js 0x14003b07d
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003b0e1
lea rcx, [rdi + 1]
call fcn.140055aa0
mov r12, rax
mov qword [rsp + 0x350], r14
mov qword [rsp + 0x358], rdi
mov rcx, r12
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + r14], 0
mov qword [rsp + 0x340], r12
jmp 0x14003681b
xor eax, eax
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x358], 0xf
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x340], 0
jmp 0x14003681b
lea rcx, [rsp + 0x340]
mov qword [rcx + 0x10], r14
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + r14 + 0x340], 0
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
cmp qword [rbx + 0x18], 0x10
jb 0x14003682e
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x68]
cmp rdi, 0xf
ja 0x14003684c
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x320], xmm0
mov r14d, 0xf
jmp 0x1400368a9
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
mov r14, rdi
cmp rdi, 0xfff
jb 0x140036884
lea rcx, [rdi + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140036890
lea rcx, [rdi + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x320], rcx
mov rdi, qword [rsp + 0x68]
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x338], r14
cmp dword [rsi], 0
mov qword [rsp + 0x318], 0xf
jne 0x1400368f7
mov dword [rsp + 0x303], 0x6c616974
mov dword [rsp + 0x300], 0x74696e69
mov byte [rsp + 0x307], 0
mov eax, 7
jmp 0x140036916
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x300], rax
mov byte [rsp + 0x308], 0
mov eax, 8
mov qword [rsp + 0x310], rax
mov eax, dword [rsi + 4]
cmp eax, 2
je 0x140036964
cmp eax, 1
jne 0x1400369a2
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x776f6873
mov byte [rsp + 0x2e4], 0x6e
jmp 0x14003699b
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x6f727265
mov byte [rsp + 0x2e4], 0x72
mov eax, 5
jmp 0x1400369d9
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x2e8], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x2e0], 0
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x70], rcx
call fcn.1400328e0
lea r14, [rsp + 0x4d4]
mov r8d, 0x118
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [r14 - 4], 0x11c
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140036b31
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbp, str.GetOSVersion
mov rcx, r13
mov edx, r12d
mov r8, rbp
mov r9d, 0x5e
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x5e
mov rcx, r14
mov rdx, rbx
mov r9, r13
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036b0c
mov r15, rax
lea rax, [rsp + 0x360]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
test r12d, r12d
jne 0x1400370e1
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
jmp 0x140036ea3
lea rax, [0x14006c640]
lea r15, [rsp + 0x3e8]
mov qword [r15 - 0x88], rax
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [r15], rax
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
lea rdi, [0x14006c638]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff78
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x35c], ecx
lea r12, [rsp + 0x368]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x360], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x35c], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x360
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x35c], ebx
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, [0x14006c5c0]
mov qword [r12], rbx
mov qword [r12 + 0x68], 0
mov dword [r12 + 0x70], 4
mov edx, dword [rsp + 0x4d4]
mov rbp, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x360]
call rbp
mov r14, rax
lea r13, [0x1400a2906]
mov rcx, rax
mov rdx, r13
call fcn.14005aac0
mov edx, dword [rsp + 0x4d8]
mov rcx, r14
call rbp
mov r14, rax
mov rcx, rax
mov rdx, r13
call fcn.14005aac0
mov edx, dword [rsp + 0x4dc]
mov rcx, r14
call rbp
cmp dword [rsp + 0x4d4], 0xa
jne 0x140036ce3
cmp dword [rsp + 0x4d8], 0
jne 0x140036ce3
lea rax, [rsp + 0x228]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x748]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a4da8]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140037813
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov eax, dword [rsp + 0x3d8]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x140037965
mov rcx, qword [rsp + 0x3a8]
mov r14, qword [rcx]
test r14, r14
je 0x140037965
lea rax, [rsp + 0x388]
mov rcx, qword [rax + 0x48]
cmp r14, rcx
cmovb r14, rcx
mov rax, qword [rax]
mov r13, qword [rax]
test r13, r13
je 0x14003b082
sub r14, r13
cmp r14, 0xf
jbe 0x14003783f
test r14, r14
js 0x14003b07d
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0x60], rcx
jae 0x14003b091
inc rcx
call fcn.140055aa0
mov rbp, rax
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14], 0
mov qword [rsp + 0x748], rbp
mov rbp, qword [rsp + 0x748]
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x35c], ecx
mov qword [rsp + 0x368], rbx
test byte [rsp + 0x3d8], 1
je 0x140036e3f
mov rax, qword [rsp + 0x3a8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b0ab
mov rcx, qword [rsp + rcx + 0x360]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b0c0
call fcn.140055ae4
mov rax, qword [rsp + 0x380]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c0]
mov dword [rax], ecx
mov qword [rsp + 0x3d0], rcx
and byte [rsp + 0x3d8], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2b0], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2b8], rax
lea rdi, [rsp + 0x4d0]
mov r8d, 0xaa
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
mov qword [rsp + 0xa8], rbp
je 0x140037273
lea rdi, [rsp + 0x360]
lea rdx, [rsp + 0x4d0]
mov rcx, rdi
call fcn.14002e010
cmp dword [rdi + 0x20], 0
jne 0x140037b3c
mov rbp, qword [rsp + 0x360]
mov rax, qword [rsp + 0x368]
mov rbx, qword [rsp + 0x370]
mov r15, qword [rsp + 0x378]
mov byte [rsp + 0x360], 0
mov qword [rsp + 0x370], 0
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], r15
xor eax, eax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
lea r8, str.PrevNotificationAction
lea r13, [rsp + 0x4d0]
mov rcx, r13
mov edx, 1
xor r9d, r9d
call fcn.14002dab0
lea rdx, [rsp + 0x4f8]
mov r12d, dword [rdx]
test r12d, r12d
je 0x140037372
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x177
call fcn.14002c3b0
cmp dword [rsp + 0x4f8], 0
je 0x1400373d4
test r12d, r12d
jns 0x1400373e6
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140037050
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003704b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
jb 0x140037097
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037092
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x1400370e1
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400370dc
mov r8, rax
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
mov rdx, r8
add rdx, 0x28
mov rcx, rax
call fcn.140055ae4
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140037128
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037123
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x14003716f
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003716a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x1400371b6
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400371b1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jb 0x1400371fd
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400371f8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x358]
cmp rax, 0x10
jb 0x140037244
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003723f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rcx, qword [rsp + 0x7f8]
xor rcx, rsp
call fcn.140056a50
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x800]
add rsp, 0x818
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rbx, str.0x_X_in__S:_d
lea r8, str.GetOSLocale
mov rcx, rbx
mov edx, r12d
mov r9d, 0x66
call fcn.1400589e0
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetOSLocale
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x66
mov rcx, r15
mov rdx, rdi
mov r9, rbx
call fcn.140058a60
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140037357
mov r13, rax
lea rax, [rsp + 0x360]
mov qword [rax], r15
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055ae4
test r12d, r12d
je 0x140037805
mov rax, qword [rsp + 0x60]
jmp 0x14003709f
lea rdi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rdi - 0x18], xmm0
movaps xmmword [rdi - 0x28], xmm0
mov byte [rdi - 8], 0
mov rcx, rdi
call fcn.14005a430
cmp byte [rdi - 8], 0
jne 0x14003757d
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
jmp 0x140038c1e
lea rcx, [rsp + 0x4d0]
call fcn.14005a550
jmp 0x140037000
cmp dword [rsi + 4], 1
jne 0x14003749c
mov edx, dword [rsi + 8]
mov rcx, r13
call fcn.1400328e0
cmp qword [rsp + 0x4e8], 0x10
jb 0x14003740e
mov r13, qword [rsp + 0x4d0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8, r13
xor r9d, r9d
call fcn.14002d1b0
mov eax, dword [rsi]
test eax, eax
je 0x140037455
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x196
call fcn.14002c3b0
mov rax, qword [rsp + 0x4e8]
cmp rax, 0x10
jb 0x14003749c
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037497
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
xor eax, eax
lea rsi, [rsp + 0x228]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r8, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.140059dc0
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x14003798f
lea rdx, [rax + 8]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x140037500
mov rsi, qword [rsp + 0x228]
movups xmm0, xmmword [str._version]
movups xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4d0], 0
mov qword [rsp + 0x4e8], 7
mov qword [rsp + 0x4e0], 1
mov dword [rsp + 0x4d0], 0x32
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
cmp rcx, rax
je 0x1400379b3
lea rdx, [rax + 1]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x1400376da
mov rcx, qword [rsp + 0x228]
jmp 0x1400376e2
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.14005a4a0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
lea rcx, [rsp + 0x260]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
lea rdx, str.dismissed_by_timeout
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.dismissed_to_action_center
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.dismissed_by_button
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.dismissed_by_application_hidden
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.remind_me_later
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.make_firefox_default_button
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.toast_clicked
lea rcx, [rsp + 0x260]
call fcn.14005aa70
test al, al
je 0x140038c1e
lea rdx, str.no_action
lea rdi, [rsp + 0x260]
mov rcx, rdi
call fcn.14005aa70
test al, al
je 0x140038c1e
mov rax, qword [rsp + 0x278]
cmp rax, 9
jae 0x140038bf1
mov ecx, 0x10
call fcn.140055aa0
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
movabs rcx, 0x6f697463612d6f6e
mov qword [rax], rcx
mov word [rax + 8], 0x6e
mov qword [rsp + 0x260], rax
jmp 0x140038c1e
lea rcx, [rsp + 0x228]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 2
mov dword [rsp + 0x258], 0
lea rcx, [0x1400a17fd]
lea rdx, str.DisableTelemetry
call fcn.14003b190
test al, al
je 0x140037760
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.1400360d0
mov r12d, eax
jmp 0x1400377ae
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x748]
mov rcx, rsi
mov edx, 1
call fcn.140030920
mov r12d, dword [rsi + 0x10]
test r12d, r12d
je 0x140037878
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0xf9
call fcn.14002c3b0
mov rax, qword [rsp + 0x240]
cmp rax, 8
jb 0x140037009
mov rcx, qword [rsp + 0x228]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400377fb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
jmp 0x140037009
xor r15d, r15d
xor ebx, ebx
xor eax, eax
xor ebp, ebp
jmp 0x140036f54
lea rdx, [0x1400a2906]
lea r14, [rsp + 0x360]
mov rcx, r14
call fcn.14005aac0
mov edx, dword [rsp + 0x748]
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036ce3
lea rbp, [rsp + 0x748]
mov qword [rbp + 0x10], r14
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x748], 0
mov r13, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140036db1
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x748]
mov r12b, byte [rsp + 0x750]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdi, qword [rsi]
test r12b, r12b
je 0x1400378de
mov rax, rdi
test rdi, rdi
jne 0x1400378c5
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
sub rax, rbx
jbe 0x140037729
shr rax, 9
cmp rax, 0x6388fc53
jb 0x140037729
mov qword [rsp + 0x6e0], rdi
xor edi, edi
lea rsi, [rsp + 0x4d0]
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.LastPingSentAt
mov edx, 0xe
mov rcx, rsi
call fcn.140059dc0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x370], xmm1
movaps xmmword [rsp + 0x360], xmm0
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rsi
call fcn.140059dc0
cmp qword [rsp + 0x378], 8
jb 0x1400379d8
mov r8, qword [rsp + 0x360]
jmp 0x1400379e0
mov ecx, 0xf
mov qword [rsp + 0x60], rcx
test al, 4
jne 0x140037987
mov rax, qword [rsp + 0x3a0]
mov r14, qword [rax]
test r14, r14
jne 0x14003b0fc
xor r14d, r14d
jmp 0x140036db1
lea r8, str._version
lea rcx, [rsp + 0x228]
mov edx, 8
mov r9d, 8
call fcn.14005a2a0
jmp 0x140037512
lea rcx, [rsp + 0x228]
lea r8, [rsp + 0x4d0]
mov edx, 1
mov r9d, 1
call fcn.14005a2a0
jmp 0x1400376ef
lea r8, [rsp + 0x360]
cmp qword [rsp + 0x4e8], 8
jb 0x1400379f3
mov rsi, qword [rsp + 0x4d0]
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, rsi
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
test eax, eax
jne 0x1400384e5
mov rax, qword [rsp + 0x4e8]
cmp rax, 8
jb 0x140037a7e
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037a79
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x378]
cmp rax, 8
jb 0x140037acc
mov rcx, qword [rsp + 0x360]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037ac7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
test esi, esi
je 0x140037af8
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x109
call fcn.14002c3b0
lea rcx, [rsp + 0x228]
lea rsi, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14002b5a0
mov r12d, dword [rsi]
test r12d, r12d
je 0x140037b4b
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r12d
jmp 0x14003869f
mov r15d, 0xf
xor ebp, ebp
xor ebx, ebx
jmp 0x140036f54
lea rcx, [rsp + 0x228]
mov r8d, dword [rcx + 0x2c]
lea r13, [rsp + 0x7d8]
mov rdx, r13
call fcn.14002cf40
mov eax, 0x90
lea rcx, [rsp + 0x360]
add rcx, rax
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x4d0]
add rax, rcx
mov qword [rsp + 0x58], rax
xor r12d, r12d
xorps xmm6, xmm6
mov esi, 0xf
xor edi, edi
cmp dword [rsp + 0x258], 0
je 0x14003845b
mov qword [rsp + 0x750], r12
mov qword [rsp + 0x760], r12
mov qword [rsp + 0x768], rsi
mov byte [rsp + 0x750], r12b
mov qword [rsp + 0x770], r12
mov qword [rsp + 0x780], r12
mov qword [rsp + 0x788], rsi
mov byte [rsp + 0x770], r12b
mov qword [rsp + 0x790], r12
mov qword [rsp + 0x7a0], r12
mov qword [rsp + 0x7a8], rsi
mov byte [rsp + 0x790], r12b
mov byte [rsp + 0x7d0], r12b
cmp qword [rsp + 0x7f0], 8
mov r8, r13
jb 0x140037c28
mov r8, qword [rsp + 0x7d8]
lea rcx, [rsp + 0x360]
lea rdx, str.CacheEntryVersion
call fcn.14002e3b0
mov ebx, dword [rsp + 0x368]
test ebx, ebx
jne 0x140038482
mov rax, qword [rsp + 0x360]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x1400382d6
mov dword [rsp + 0x748], eax
test eax, eax
je 0x140038353
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
mov r8, r13
lea r9, str.NotificationType
call fcn.14002e7c0
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x1400383b3
movaps xmmword [rsp + 0x6f0], xmm6
movaps xmmword [rsp + 0x6e0], xmm6
mov byte [rsp + 0x700], 0
lea rcx, [rsp + 0x708]
lea rdx, [rsp + 0x738]
call fcn.14005a430
mov r13d, 4
cmp byte [rsp + 0x700], 0
je 0x140038432
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a4a0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jb 0x140037d41
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037d3c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a392c]
call fcn.14002e7c0
cmp dword [rsp + 0x738], 0
jne 0x140037da0
lea rcx, [rsp + 0x710]
call fcn.14005a550
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a430
cmp dword [rsp + 0x388], 0
jne 0x140037dfa
lea rcx, [rsp + 0x360]
call fcn.14005a550
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a430
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a850
mov rcx, rbx
call fcn.14005a550
cmp byte [rsp + 0x700], 0
je 0x140038432
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a4a0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jb 0x140037ec0
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037ebb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x20], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a39a6]
call fcn.14002e7c0
cmp dword [rsp + 0x738], 0
jne 0x140037f20
lea rcx, [rsp + 0x710]
call fcn.14005a550
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a430
cmp dword [rsp + 0x388], 0
jne 0x140037f7a
lea rcx, [rsp + 0x360]
call fcn.14005a550
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a430
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a850
mov rcx, rbx
call fcn.14005a550
cmp byte [rsp + 0x700], 0
je 0x140038432
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.14005a4a0
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jb 0x140038040
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003803b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x748]
mov dword [rsp + 0x78], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, str.PrevNotificationAction
call fcn.14002e7c0
cmp dword [rsp + 0x738], 0
jne 0x1400380ae
lea rcx, [rsp + 0x710]
call fcn.14005a550
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.14005a430
cmp dword [rsp + 0x388], 0
jne 0x140038108
lea rcx, [rsp + 0x360]
call fcn.14005a550
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140038410
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.14005a430
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.14005a850
mov rcx, rbx
call fcn.14005a550
cmp dword [rsp + 0x78], 2
jb 0x140038179
cmp byte [rsp + 0x700], 0
je 0x140038432
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x6e0]
call fcn.14005a920
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x490]
call fcn.14002e6a0
mov ebx, dword [rsp + 0x490]
test ebx, ebx
jne 0x140038410
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x748]
call fcn.14002e990
mov r13b, 1
mov byte [rsp + 0x3f0], r13b
mov r8d, 0x91
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0x4d0], eax
lea rcx, [rsp + 0x388]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmmword [rbx + 8], xmm0
mov qword [rsp + 0x378], r12
mov qword [rsp + 0x380], rsi
mov byte [rsp + 0x368], r12b
lea rax, [rsp + 0x388]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x4f8]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x3a0], rsi
mov byte [rsp + 0x388], r12b
movups xmm0, xmmword [rcx + 0x20]
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm1
mov qword [rsp + 0x3b8], r12
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x3a8], r12b
movups xmmword [rbx + 0x68], xmm6
movups xmmword [rbx + 0x78], xmm6
mov byte [rbx + 0x88], r12b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
call fcn.14005a430
mov byte [rsp + 0x560], r13b
cmp byte [rsp + 0x3f0], r12b
je 0x1400382c6
lea rcx, [rsp + 0x360]
call fcn.14002c550
mov dword [rsp + 0x570], 0
jmp 0x14003842c
cmp qword [rsp + 0x7f0], 8
mov rax, r13
jb 0x1400382ec
mov rax, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1bb
call fcn.14002c3b0
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
call fcn.14002e6a0
mov ebx, dword [rsp + 0x710]
test ebx, ebx
jne 0x140038615
lea rcx, [rsp + 0x748]
call fcn.14002c550
jmp 0x1400383f4
cmp qword [rsp + 0x7f0], 8
jb 0x140038366
mov r13, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x208
call fcn.14002c3b0
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
call fcn.14002e6a0
mov ebx, dword [rsp + 0x360]
test ebx, ebx
je 0x140038408
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x748]
call fcn.14002c550
cmp r13d, 4
lea r13, [rsp + 0x7d8]
jne 0x140038640
inc edi
cmp edi, dword [rsp + 0x250]
jbe 0x140037b9c
jmp 0x14003849e
mov r13d, 4
jmp 0x1400383d5
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x6e0]
call fcn.14005a550
cmp dword [rsp + 0x738], 0
jne 0x1400383d5
lea rcx, [rsp + 0x710]
call fcn.14005a550
jmp 0x1400383d5
lea rsi, [rsp + 0x4d0]
mov r8d, 0x91
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0
jmp 0x140038640
cmp qword [rsp + 0x7f0], 8
jb 0x1400385d8
mov rax, qword [rsp + 0x7d8]
jmp 0x1400385e0
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24c
call fcn.14002c3b0
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
jmp 0x140038640
movzx r12d, si
or r12d, 0x80070000
test esi, esi
cmovle r12d, esi
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x58], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegistrySetValueQword
mov edx, r12d
mov r9d, 0xee
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegistrySetValueQword
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xee
mov rcx, rbx
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400385cb
mov r13, rax
lea rax, [rsp + 0x710]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
jmp 0x140037a30
lea rax, [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b5
call fcn.14002c3b0
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], ebx
lea rcx, [rsp + 0x748]
call fcn.14002c550
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x14003868e
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140038689
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov r12d, dword [rsp + 0x570]
test r12d, r12d
je 0x1400387c2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x15c
call fcn.14002c3b0
cmp dword [rsp + 0x570], 0
jne 0x1400386e5
cmp byte [rsp + 0x560], 0
je 0x1400386e5
lea rcx, [rsp + 0x4d0]
call fcn.14002c550
test r12d, r12d
js 0x1400377ae
mov rax, qword [rsp + 0x50]
mov edi, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rcx, [rsp + 0x4d0]
mov edx, 1
xor r9d, r9d
call fcn.14002dab0
lea r13, [rsp + 0x4f8]
mov r12d, dword [r13]
test r12d, r12d
je 0x140038c30
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x11f
call fcn.14002c3b0
xor edi, edi
xor ebx, ebx
xor edx, edx
xor eax, eax
cmp dword [rsp + 0x4f8], 0
je 0x140038d07
test r12d, r12d
jne 0x1400377ae
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x210], rbx
mov rsi, rdx
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x220], rax
mov rdi, qword [rsp + 0x270]
cmp qword [rsp + 0x278], 0x10
jb 0x140038d65
mov r12, qword [rsp + 0x260]
jmp 0x140038d6d
lea rcx, [rsp + 0x360]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x560], 0
je 0x1400386c4
lea rsi, [rsp + 0x560]
lea rdi, [rsp + 0x3f0]
mov eax, dword [rsi - 0x90]
mov dword [rdi - 0x90], eax
movups xmm0, xmmword [rsi - 0x88]
movups xmmword [rdi - 0x88], xmm0
movups xmm0, xmmword [rsi - 0x78]
movups xmmword [rdi - 0x78], xmm0
xor ebx, ebx
mov qword [rsi - 0x78], rbx
mov eax, 0xf
mov qword [rsi - 0x70], rax
mov byte [rsi - 0x88], bl
movups xmm0, xmmword [rsi - 0x68]
movups xmmword [rdi - 0x68], xmm0
movups xmm0, xmmword [rsi - 0x58]
movups xmmword [rdi - 0x58], xmm0
mov qword [rsi - 0x58], rbx
mov qword [rsi - 0x50], rax
mov byte [rsi - 0x68], bl
movups xmm0, xmmword [rsi - 0x48]
movups xmmword [rdi - 0x48], xmm0
movups xmm0, xmmword [rsi - 0x38]
movups xmmword [rdi - 0x38], xmm0
mov qword [rsi - 0x38], rbx
mov qword [rsi - 0x30], rax
mov byte [rsi - 0x48], bl
mov byte [rdi - 8], bl
xorps xmm0, xmm0
movups xmmword [rdi - 0x18], xmm0
movups xmmword [rdi - 0x28], xmm0
mov rcx, rdi
mov rdx, rsi
call fcn.14005a430
mov byte [rdi], 1
cmp byte [rsi], bl
je 0x1400388a7
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.14002c550
mov byte [rsi + 0x90], 0
cmp byte [rsp + 0x3f0], 0
je 0x1400386c4
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.1400360d0
cmp byte [rsp + 0x3f0], 0
je 0x14003b067
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e990
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x140038943
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003893e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x310], xmm1
movaps xmmword [rsp + 0x300], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0xf
mov byte [rcx + 8], 0
call fcn.14002c550
cmp byte [rsp + 0x3f0], 0
je 0x14003b067
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e990
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x1400389ed
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400389e8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x2f0], xmm1
movaps xmmword [rsp + 0x2e0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], 0
call fcn.14002c550
cmp byte [rsp + 0x3f0], 0
je 0x14003b067
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002e990
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140038a98
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038a93
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x2d0], xmm1
movaps xmmword [rsp + 0x2c0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
call fcn.14002c550
cmp byte [rsp + 0x3f0], 0
je 0x14003b067
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002e990
mov bl, byte [rsi + 0x88]
mov rcx, rsi
call fcn.14002c550
test bl, bl
je 0x14003a4e5
cmp byte [rsp + 0x3f0], 0
je 0x14003b067
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002e990
cmp byte [rsi + 0x88], 0
je 0x14003b072
mov rsi, qword [rsp + 0x7b0]
movups xmm6, xmmword [rsp + 0x7b8]
mov rdi, qword [rsp + 0x7c8]
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0xf
mov byte [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140038bc7
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038bc2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov qword [rsp + 0x260], rsi
movups xmmword [rsp + 0x268], xmm6
mov qword [rsp + 0x278], rdi
lea rcx, [rsp + 0x748]
call fcn.14002c550
jmp 0x14003a560
cmp rax, 0x10
jb 0x140038bff
mov rdi, qword [rsp + 0x260]
mov qword [rsp + 0x270], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rdi], rax
mov word [rdi + 8], 0x6e
lea rcx, [rsp + 0x360]
call fcn.14005a550
jmp 0x140036ff2
lea rsi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, r13
call fcn.14005a430
cmp byte [rsi - 8], 0
jne 0x140038d2f
cmp edi, 0xc
ja 0x140038dbf
lea rax, str.._n_
mov rax, qword [rax + rdi*8]
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov rdi, qword [rax]
mov rax, qword [rax + 8]
mov rsi, rax
cmp rax, 0xf
jbe 0x14003a2ec
test rsi, rsi
js 0x14003b07d
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x14003b165
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140055aa0
mov r12, rax
mov rcx, r12
mov rdx, rdi
mov rdi, rsi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rsi], 0
mov qword [rsp + 0x748], r12
jmp 0x140038ddf
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x50], rdx
mov rsi, r13
mov r13, rax
call fcn.14005a550
mov rax, r13
mov r13, rsi
mov rdx, qword [rsp + 0x50]
jmp 0x140038762
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.14005a4a0
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov rbx, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14003a330
lea r12, [rsp + 0x260]
cmp rdi, 0xf
ja 0x140038d87
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1e0], xmm0
mov ebx, 0xf
jmp 0x140038e04
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038de4
lea rcx, [rbx + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038df0
mov qword [rsp + 0x748], 0
mov byte [rsp + 0x748], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
xor esi, esi
jmp 0x14003a323
lea rcx, [rbx + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x1e0], rcx
lea r8, [rdi + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], rbx
mov rbx, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x140038e34
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x70], rax
cmp rbx, 0xf
ja 0x140038e56
mov rax, qword [rsp + 0x70]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1c0], xmm0
mov eax, 0xf
mov qword [rsp + 0x78], rax
jmp 0x140038ebf
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x78], rcx
cmp rcx, 0xfff
jb 0x140038e98
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038ea9
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rbx + 1]
mov rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1d0], rbx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1d8], rax
mov rbx, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x140038ef1
mov r12, qword [rsp + 0x2e0]
jmp 0x140038ef9
lea r12, [rsp + 0x2e0]
cmp rbx, 0xf
ja 0x140038f1b
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1a0], xmm0
mov eax, 0xf
mov qword [rsp + 0x88], rax
jmp 0x140038f8b
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x88], rcx
cmp rcx, 0xfff
jb 0x140038f63
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038f77
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1b0], rbx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1b8], rax
mov rbx, qword [rsp + 0x310]
cmp qword [rsp + 0x318], 0x10
jb 0x140038fc0
mov r12, qword [rsp + 0x300]
jmp 0x140038fc8
lea r12, [rsp + 0x300]
cmp rbx, 0xf
ja 0x140038fea
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x180], xmm0
mov eax, 0xf
mov qword [rsp + 0x80], rax
jmp 0x14003905a
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jb 0x140039032
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039046
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x180], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x198], rax
cmp r15, 0x10
lea r15, [rsp + 0x280]
cmovae r15, rbp
mov qword [rsp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
cmp qword [rsp + 0xa0], 0xf
ja 0x1400390bc
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x160], xmm0
mov eax, 0xf
mov qword [rsp + 0x58], rax
jmp 0x140039130
mov rcx, qword [rsp + 0xa0]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x58], rcx
cmp rcx, 0xfff
jb 0x140039103
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039114
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x160], rcx
mov rax, qword [rsp + 0xa0]
lea r8, [rax + 1]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x60], 0x10
lea rbx, [rsp + 0x2a0]
cmovae rbx, qword [rsp + 0xa8]
cmp r14, 0xf
ja 0x140039181
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x140], xmm0
mov eax, 0xf
mov qword [rsp + 0x70], rax
jmp 0x1400391e8
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x70], rcx
cmp rcx, 0xfff
jb 0x1400391c3
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400391d4
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x140], rcx
lea r8, [r14 + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0xb0], 0x10
jb 0x1400391fd
mov rbx, qword [rsp + 0x320]
jmp 0x140039205
lea rbx, [rsp + 0x320]
mov qword [rsp + 0x150], r14
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x68], 0xf
ja 0x140039239
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x120], xmm0
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x1400392a7
mov rcx, qword [rsp + 0x68]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x60], rcx
cmp rcx, 0xfff
jb 0x14003927d
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14003928e
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x98], 0x10
lea rbx, [rsp + 0x208]
cmovae rbx, qword [rsp + 0x90]
mov qword [rsp + 0x100], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
cmp rsi, 0xf
ja 0x14003930f
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x100], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
jmp 0x140039376
mov rcx, rsi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jb 0x140039351
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039362
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0x100], rcx
lea r8, [rsi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x110], rsi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x118], rax
mov r14, qword [rsp + 0x350]
cmp qword [rsp + 0x358], 0x10
jb 0x1400393a8
mov rsi, qword [rsp + 0x340]
jmp 0x1400393b0
lea rsi, [rsp + 0x340]
cmp r14, 0xf
ja 0x1400393cd
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov eax, 0xf
mov qword [rsp + 0x68], rax
jmp 0x140039434
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x68], rcx
cmp rcx, 0xfff
jb 0x14003940f
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140039420
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0xe0], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rsp + 0xe0]
mov qword [rbx + 0x10], r14
lea rsi, [rsp + 0x748]
and dword [rsi + 8], 0xfffffe00
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
lea rdx, str.release
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044a0
lea rdx, str.build_channel
lea r8, [0x1400a1ed7]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea rdx, [0x1400a26ae]
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044a0
lea rdx, str.build_version
lea r8, [0x1400a1e26]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, rbx
call fcn.14005f3e0
lea rdx, [0x1400a1b4f]
lea r8, [0x1400a1b5e]
mov rcx, rsi
call fcn.1400045b0
mov rcx, r14
mov rdx, rax
call fcn.140004400
mov rcx, r14
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.previous_default_browser
lea r8, [0x1400a1b5e]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a18b1]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x140]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.os_version
lea r8, [0x1400a1e18]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.os_locale
lea r8, [0x1400a2400]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.notification_type
lea r8, [0x1400a232f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.notification_shown
lea r8, [0x1400a1c9a]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, [0x1400a1d1c]
lea r8, [0x1400a1d2f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.14005f3e0
lea rdx, str.previous_notification_action
lea r8, [0x1400a1d2f]
mov rcx, rsi
call fcn.1400045b0
mov rcx, rbx
mov rdx, rax
call fcn.140004400
mov rcx, rbx
call fcn.1400011b0
lea rcx, [rsp + 0x360]
call fcn.140056c30
lea rdx, [0x1400a2a2e]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.1400044a0
lea r8, [rsp + 0x71b]
mov qword [r8 + 0xd], 0xf
mov qword [r8 + 5], 0xb
movabs rax, 0x7461746e65646e69
mov qword [r8 - 0xb], rax
mov dword [r8 - 4], 0x6e6f6974
mov byte [r8], 0
lea rcx, [rsp + 0x368]
lea rbx, [rsp + 0x710]
mov rdx, rbx
call fcn.1400045b0
mov rcx, rsi
mov rdx, rax
call fcn.140004400
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x1400397e7
mov rcx, qword [rsp + 0x710]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400397e2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
call fcn.1400011b0
lea rax, [0x14006c640]
mov qword [rbx], rax
lea rsi, [rsp + 0x558]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [rsi], rax
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
lea r15, [0x14006c638]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x4cc], ecx
lea r12, [rsp + 0x4d8]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
xor edi, edi
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x4cc], esi
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, [0x14006c5c0]
mov qword [r12], rsi
mov qword [r12 + 0x68], rdi
mov dword [r12 + 0x70], 4
lea rcx, [rsp + 0x360]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400b0010]
mov r14, rax
mov rax, qword [rax]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x748]
lea rbx, [rsp + 0x4d0]
mov rcx, r14
mov r8, rbx
call qword [0x1400b0010]
mov qword [rsp + 0x6e0], rdi
mov qword [rsp + 0x6f0], rdi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
mov eax, dword [rbx + 0x78]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x14003afed
mov rcx, qword [rsp + 0x518]
mov rbx, qword [rcx]
test rbx, rbx
je 0x14003afed
mov rax, qword [rsp + 0x540]
cmp rbx, rax
cmovb rbx, rax
mov rax, qword [r13]
mov rbp, qword [rax]
test rbp, rbp
je 0x1400399f0
sub rbx, rbp
cmp rbx, 0xf
jbe 0x14003a688
test rbx, rbx
js 0x14003b07d
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jae 0x14003b113
call fcn.140055aa0
mov r13, rax
mov qword [rsp + 0x6f0], rbx
mov qword [rsp + 0x6f8], rdi
mov rcx, r13
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [r13 + rbx], 0
mov qword [rsp + 0x6e0], r13
mov rax, qword [r14]
mov rax, qword [rax]
mov rcx, r14
mov edx, 1
call qword [0x1400b0010]
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x4cc], ecx
mov qword [rsp + 0x4d8], rsi
test byte [rsp + 0x548], 1
je 0x140039a8a
mov rax, qword [rsp + 0x518]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003b12d
mov rcx, qword [rsp + rcx + 0x4d0]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x4f0]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003b142
call fcn.140055ae4
mov rax, qword [rsp + 0x4f0]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
mov rax, qword [rsp + 0x528]
mov dword [rax], ecx
mov rax, qword [rsp + 0x4f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x518]
mov qword [rax], rcx
mov rax, qword [rsp + 0x530]
mov dword [rax], ecx
mov qword [rsp + 0x540], rcx
and byte [rsp + 0x548], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rcx, [rsp + 0x710]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x140039c9e
xorps xmm0, xmm0
lea rsi, [rsp + 0x4d0]
movups xmmword [rsi + 0x3e], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rcx, [rsp + 0x710]
mov rdx, rsi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
jne 0x140039d70
lea rbx, [rsp + 0x4d2]
mov ecx, 0x50
call fcn.140055aa0
mov r14, rax
mov r8d, 0x48
mov rcx, rax
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + 0x48], 0
mov qword [rsp + 0x7d8], r14
mov qword [rsp + 0x7e0], 0
mov qword [rsp + 0x7e8], 0x24
mov qword [rsp + 0x7f0], 0x27
lea rcx, section..rdata
lea r9, [rsp + 0x4b0]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0xa8], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x14003a42a
mov r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov rcx, rdi
mov edx, eax
mov r8, r13
mov r9d, 0x75
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x75
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058a60
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039c91
mov r14, rax
mov qword [rsp + 0x4d0], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
jmp 0x14003af96
mov r12d, eax
or r12d, 0x80010000
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r13, str.GenerateUUIDStr
mov rcx, r14
mov edx, r12d
mov r8, r13
mov r9d, 0x2e
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055adc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x2e
mov rcx, rsi
mov rdx, rbp
mov r9, r14
call fcn.140058a60
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039e47
mov rbx, rax
mov qword [rsp + 0x4d0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, r12d
jmp 0x140039e38
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.GenerateUUIDStr
mov r12d, 0x8007007a
mov rcx, r14
mov edx, 0x8007007a
mov r8, r15
mov r9d, 0x35
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0x35
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rsi
mov rdx, r13
mov r9, r14
call fcn.140058a60
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039e47
mov rbx, rax
lea rax, [rsp + 0x7d8]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140055ae4
mov rax, qword [rsp + 0x6f8]
cmp rax, 0x10
jb 0x140039e96
mov rcx, qword [rsp + 0x6e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039e91
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rcx, [rsp + 0x360]
call fcn.140062c30
lea rcx, [rsp + 0x748]
call fcn.1400011b0
cmp qword [rsp + 0x68], 0x10
jb 0x140039efa
mov rcx, qword [rsp + 0xe0]
cmp qword [rsp + 0x68], 0xfff
jb 0x140039eeb
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x68], 0x28
mov rcx, rax
jmp 0x140039ef0
inc qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140055ae4
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0x50], 0x10
jb 0x140039f64
mov rcx, qword [rsp + 0x100]
cmp qword [rsp + 0x50], 0xfff
jb 0x140039f55
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x50], 0x28
mov rcx, rax
jmp 0x140039f5a
inc qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140055ae4
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
cmp qword [rsp + 0x60], 0x10
jb 0x140039fce
mov rcx, qword [rsp + 0x120]
cmp qword [rsp + 0x60], 0xfff
jb 0x140039fbf
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x60], 0x28
mov rcx, rax
jmp 0x140039fc4
inc qword [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
call fcn.140055ae4
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
cmp qword [rsp + 0x70], 0x10
jb 0x14003a038
mov rcx, qword [rsp + 0x140]
cmp qword [rsp + 0x70], 0xfff
jb 0x14003a029
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x70], 0x28
mov rcx, rax
jmp 0x14003a02e
inc qword [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140055ae4
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
cmp qword [rsp + 0x58], 0x10
jb 0x14003a0a2
mov rcx, qword [rsp + 0x160]
cmp qword [rsp + 0x58], 0xfff
jb 0x14003a093
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x58], 0x28
mov rcx, rax
jmp 0x14003a098
inc qword [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
call fcn.140055ae4
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
cmp qword [rsp + 0x80], 0x10
jb 0x14003a11b
mov rcx, qword [rsp + 0x180]
cmp qword [rsp + 0x80], 0xfff
jb 0x14003a106
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x80], 0x28
mov rcx, rax
jmp 0x14003a10e
inc qword [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140055ae4
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
cmp qword [rsp + 0x88], 0x10
jb 0x14003a194
mov rcx, qword [rsp + 0x1a0]
cmp qword [rsp + 0x88], 0xfff
jb 0x14003a17f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x88], 0x28
mov rcx, rax
jmp 0x14003a187
inc qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
call fcn.140055ae4
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
cmp qword [rsp + 0x78], 0x10
jb 0x14003a1fe
mov rcx, qword [rsp + 0x1c0]
cmp qword [rsp + 0x78], 0xfff
jb 0x14003a1ef
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add qword [rsp + 0x78], 0x28
mov rcx, rax
jmp 0x14003a1f4
inc qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
call fcn.140055ae4
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
mov rax, qword [rsp + 0x1f8]
cmp rax, 0x10
jb 0x14003a265
mov rcx, qword [rsp + 0x1e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a260
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0xf
mov byte [rsp + 0x1e0], 0
cmp qword [rsp + 0x98], 0x10
jb 0x1400377ae
mov rax, qword [rsp + 0x98]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a2da
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
mov rdx, qword [rsp + 0x98]
add rdx, 0x28
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140055ae4
jmp 0x1400377ae
lea r12, [rsp + 0x748]
mov qword [r12 + 0x10], rsi
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x748], 0
mov rbx, qword [r12 + 8]
mov rsi, qword [r12 + 0x10]
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x748]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x358], 0x10
jb 0x14003a345
mov r8, qword [rsp + 0x340]
jmp 0x14003a34d
lea r8, [rsp + 0x340]
lea rdx, str.PingCurrentDefault
lea rdi, [rsp + 0x748]
mov rcx, rdi
xor r9d, r9d
call fcn.14002d1b0
mov r12d, dword [rdi]
test r12d, r12d
jne 0x14003a37e
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
jmp 0x14003a40a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002c3b0
xor edi, edi
mov ebx, 0
mov esi, 0
mov r13d, 0
cmp qword [rsp + 0x50], 0x10
jb 0x14003a40a
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a3f7
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140055ae4
xor edi, edi
xor ebx, ebx
xor esi, esi
xor r13d, r13d
lea rcx, [rsp + 0x360]
call fcn.14005a550
mov rax, r13
lea r13, [rsp + 0x4f8]
mov rdx, rsi
jmp 0x140038754
mov rsi, qword [rsp + 0x4b0]
lea rbx, [rsp + 0x4d0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a450a]
mov rcx, rbx
mov qword [rsp + 0xb0], rsi
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x14003a580
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, r13
mov r9d, 0x81
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea rsi, [rax + rax]
add rsi, 2
mov rcx, rsi
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0x81
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, rbp
jmp 0x14003a751
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x14003a52c
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003a527
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
cmp byte [rsp + 0x3f0], 0
je 0x1400386c4
lea rcx, [rsp + 0x360]
call fcn.14002c550
jmp 0x1400386c4
lea rdx, [0x1400a2c48]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003a602
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x86
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x86
jmp 0x14003a743
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003a6ac
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x8b
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x8b
jmp 0x14003a743
lea rcx, [rsp + 0x6e0]
mov qword [rcx + 0x10], rbx
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x6e0], 0
jmp 0x1400399f0
cmp qword [rsp + 0x7f0], 8
jb 0x14003a6c1
mov rdx, qword [rsp + 0x7d8]
jmp 0x14003a6c9
lea rdx, [rsp + 0x7d8]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14003ab9f
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x90
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x90
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, r13
mov r9, r15
call fcn.140058a60
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a7bb
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
xorps xmm6, xmm6
xor r14d, r14d
xor edi, edi
xor esi, esi
cmp qword [rsp + 0xb0], 0
je 0x14003a7e6
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test dil, dil
je 0x14003af96
mov qword [rsp + 0x4b0], r14
movups xmmword [rsp + 0x4b8], xmm6
cmp rsi, 8
lea rax, [rsp + 0x4b0]
cmovb r14, rax
mov qword [rsp + 0x4c8], rsi
lea rax, [0x14006c4e8]
lea rsi, [rsp + 0x578]
mov qword [rsi - 0xa8], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006c888]
mov qword [rsi], rax
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
lea rbx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
mov edi, 0xffffff58
lea ecx, [rax + rdi]
mov dword [rsp + rax + 0x4cc], ecx
lea r15, [rsp + 0x4d8]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c898]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
add edi, eax
mov dword [rsp + rax + 0x4cc], edi
mov rcx, r15
call fcn.14005bdf0
mov rcx, r15
mov rdx, r14
call fcn.14005be70
test rax, rax
jne 0x14003a923
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6f0]
cmp qword [rsp + 0x6f8], 0x10
jb 0x14003a946
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, qword [rsp + 0xb8]
call fcn.140002f00
mov rax, qword [r14]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14003aab0
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r8, str.SendPing
mov r12d, 0x8007045d
mov rcx, rdi
mov edx, 0x8007045d
mov r9d, 0xc6
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SendPing
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0xc6
mov dword [rsp + 0x20], 0x8007045d
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058a60
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003aa5e
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007045d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.14005ae30
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003af48
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006c4f0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.14005ae30
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdx, str.pingsender.exe
lea rsi, [rsp + 0x710]
mov rcx, rsi
call fcn.140031c60
mov r12d, dword [rsi + 0x20]
test r12d, r12d
jne 0x14003af48
movups xmm0, xmmword [rsp + 0x710]
movups xmm1, xmmword [rsp + 0x720]
movaps xmmword [rsp + 0x4a0], xmm1
movaps xmmword [rsp + 0x490], xmm0
xor eax, eax
mov qword [rsp + 0x720], rax
mov ecx, 7
mov qword [rsp + 0x728], rcx
mov word [rsp + 0x710], ax
lea rsi, [rsp + 0x470]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov word [rsi], ax
lea r8, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rsi
call fcn.140059dc0
mov r9, qword [rsp + 0x7e8]
cmp qword [rsp + 0x7f0], 8
jb 0x14003abff
mov r8, qword [rsp + 0x7d8]
jmp 0x14003ac07
xor eax, eax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], 7
mov word [rsp + 0x710], 0
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rbx, rax
lea rcx, [rsp + 0x710]
cmp rax, 7
jbe 0x14003b023
lea r8, [rsp + 0x4d0]
mov rdx, rbx
call fcn.140059dc0
jmp 0x14003b044
lea r8, [rsp + 0x7d8]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r9
jae 0x14003ac34
lea rcx, [rsp + 0x470]
mov rdx, r9
call fcn.14005a2a0
jmp 0x14003ac66
lea rdi, [rax + r9]
mov qword [rsp + 0x480], rdi
cmp rcx, 8
jb 0x14003ac4e
mov rsi, qword [rsp + 0x470]
lea rcx, [rsi + rax*2]
add r9, r9
mov rdx, r8
mov r8, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rdi*2], 0
lea rbx, [rsp + 0x490]
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14003ac80
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x450], rax
cmp qword [rsp + 0x488], 8
jb 0x14003ac9d
mov rax, qword [rsp + 0x470]
jmp 0x14003aca5
lea rax, [rsp + 0x470]
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x4c8], 8
jb 0x14003acc8
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0x450]
mov rax, qword [rsp + 0xa8]
mov qword [r8 + 0x10], rax
lea rsi, [rsp + 0xd8]
mov rcx, rsi
mov edx, 3
call fcn.140005800
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4d0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x520], xmm0
movaps xmmword [rsp + 0x510], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x4e0], xmm0
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x4d0], 0x68
mov dword [rsp + 0x50c], 1
mov rsi, qword [rsi]
cmp qword [rsp + 0x4a8], 8
jb 0x14003ad5c
mov rbx, qword [rsp + 0x490]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003ae84
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.SendPing
mov rcx, rdi
mov edx, r12d
mov r8, r13
mov r9d, 0xe4
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xe4
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140058a60
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003ae7a
mov r14, rax
lea rax, [rsp + 0x6d8]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
jmp 0x14003ae9f
mov rcx, qword [rsp + 0xc8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xc0]
call rdi
test rsi, rsi
je 0x14003aeac
mov rcx, rsi
call fcn.140055ae4
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003aefa
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003aef5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x14003af48
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003af43
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x14003af96
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003af91
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x140039e4f
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003afe3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003b15f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
jmp 0x140039e4f
test al, 4
jne 0x1400399f0
mov rax, qword [rsp + 0x510]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400399f0
lea rax, [rsp + 0x4f0]
mov r13, rax
mov rax, qword [rax + 0x38]
movsxd rax, dword [rax]
add rbx, rax
jmp 0x140039975
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x4d0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx*2 + 0x710], 0
mov r14, qword [rsp + 0x710]
movups xmm6, xmmword [rsp + 0x718]
mov rsi, qword [rsp + 0x728]
xor r12d, r12d
mov dil, 1
jmp 0x14003a7cd
int3
int3
call fcn.140059c60
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x140037987
add rcx, 0x28
call fcn.140055aa0
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x140036d95
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036e11
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add rdx, 0x27
mov rcx, rax
jmp 0x140036e3a
lea rcx, [rdi + 0x28]
call fcn.140055aa0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x1400367a6
lea rax, [rsp + 0x380]
mov rcx, qword [rax + 0x38]
movsxd rcx, dword [rcx]
add r14, rcx
jmp 0x140036d3f
lea rcx, [rdi + 0x28]
call fcn.140055aa0
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x1400399c4
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140039a5c
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003b15f
add rdx, 0x27
mov rcx, rax
jmp 0x140039a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140055aa0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140038ce4