Function at 0x140035b10
Capabilities:
Access the windows event log
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x818
movaps xmmword [rsp + 0x800], xmm6
mov rsi, r8
mov rbx, rdx
mov rax, qword [0x1400ab070]
xor rax, rsp
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x50], rcx
mov eax, dword [rcx]
cmp rax, 0xc
ja 0x140035bf3
lea rcx, [0x14006b4a8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x358], 0xf
mov byte [rsp + 0x340], 0
mov r15, qword [rax]
mov r14, qword [rax + 8]
cmp r14, 0xf
jbe 0x140035c1b
test r14, r14
js 0x14003a49d
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
cmp rdi, 0xfff
jae 0x14003a501
lea rcx, [rdi + 1]
call fcn.140054ae0
mov r12, rax
mov qword [rsp + 0x350], r14
mov qword [rsp + 0x358], rdi
mov rcx, r12
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + r14], 0
mov qword [rsp + 0x340], r12
jmp 0x140035c3b
xor eax, eax
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x358], 0xf
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x340], 0
jmp 0x140035c3b
lea rcx, [rsp + 0x340]
mov qword [rcx + 0x10], r14
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + r14 + 0x340], 0
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
cmp qword [rbx + 0x18], 0x10
jb 0x140035c4e
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x68]
cmp rdi, 0xf
ja 0x140035c6c
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x320], xmm0
mov r14d, 0xf
jmp 0x140035cc9
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmovae rdi, rax
mov r14, rdi
cmp rdi, 0xfff
jb 0x140035ca4
lea rcx, [rdi + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140035cb0
lea rcx, [rdi + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x320], rcx
mov rdi, qword [rsp + 0x68]
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x330], rdi
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x338], r14
cmp dword [rsi], 0
mov qword [rsp + 0x318], 0xf
jne 0x140035d17
mov dword [rsp + 0x303], 0x6c616974
mov dword [rsp + 0x300], 0x74696e69
mov byte [rsp + 0x307], 0
mov eax, 7
jmp 0x140035d36
movabs rax, 0x7075776f6c6c6f66
mov qword [rsp + 0x300], rax
mov byte [rsp + 0x308], 0
mov eax, 8
mov qword [rsp + 0x310], rax
mov eax, dword [rsi + 4]
cmp eax, 2
je 0x140035d84
cmp eax, 1
jne 0x140035dc2
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x776f6873
mov byte [rsp + 0x2e4], 0x6e
jmp 0x140035dbb
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 5
mov dword [rsp + 0x2e0], 0x6f727265
mov byte [rsp + 0x2e4], 0x72
mov eax, 5
jmp 0x140035df9
mov qword [rsp + 0x2f8], 0xf
mov qword [rsp + 0x2f0], 9
movabs rax, 0x776f68732d746f6e
mov qword [rsp + 0x2e0], rax
mov byte [rsp + 0x2e8], 0x6e
mov eax, 9
mov byte [rsp + rax + 0x2e0], 0
mov edx, dword [rsi + 8]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x70], rcx
call fcn.140031d00
lea r14, [rsp + 0x4d4]
mov r8d, 0x118
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [r14 - 4], 0x11c
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140035f51
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea rbp, str.GetOSVersion
mov rcx, r13
mov edx, r12d
mov r8, rbp
mov r9d, 0x5e
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x5e
mov rcx, r14
mov rdx, rbx
mov r9, r13
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140035f2c
mov r15, rax
lea rax, [rsp + 0x360]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
test r12d, r12d
jne 0x140036501
xor eax, eax
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor r13d, r13d
xor ebp, ebp
jmp 0x1400362c3
lea rax, [0x14006b5f0]
lea r15, [rsp + 0x3e8]
mov qword [r15 - 0x88], rax
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b838]
mov qword [r15], rax
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
lea rdi, [0x14006b5e8]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r15 - 0x88]
movsxd rax, dword [rax + 4]
mov ebx, 0xffffff78
lea ecx, [rax + rbx]
mov dword [rsp + rax + 0x35c], ecx
lea r12, [rsp + 0x368]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b848]
mov qword [rsp + rax + 0x360], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x35c], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x360
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add ebx, eax
mov dword [rsp + rax + 0x35c], ebx
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, [0x14006b570]
mov qword [r12], rbx
mov qword [r12 + 0x68], 0
mov dword [r12 + 0x70], 4
mov edx, dword [rsp + 0x4d4]
mov rbp, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x360]
call rbp
mov r14, rax
lea r13, [0x1400a188b]
mov rcx, rax
mov rdx, r13
call fcn.140059b00
mov edx, dword [rsp + 0x4d8]
mov rcx, r14
call rbp
mov r14, rax
mov rcx, rax
mov rdx, r13
call fcn.140059b00
mov edx, dword [rsp + 0x4dc]
mov rcx, r14
call rbp
cmp dword [rsp + 0x4d4], 0xa
jne 0x140036103
cmp dword [rsp + 0x4d8], 0
jne 0x140036103
lea rax, [rsp + 0x228]
mov dword [rax], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x748]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea r8, [0x1400a3d2c]
mov rcx, 0xffffffff80000002
mov r9d, 0x10018
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140036c33
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov eax, dword [rsp + 0x3d8]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x140036d85
mov rcx, qword [rsp + 0x3a8]
mov r14, qword [rcx]
test r14, r14
je 0x140036d85
lea rax, [rsp + 0x388]
mov rcx, qword [rax + 0x48]
cmp r14, rcx
cmovb r14, rcx
mov rax, qword [rax]
mov r13, qword [rax]
test r13, r13
je 0x14003a4a2
sub r14, r13
cmp r14, 0xf
jbe 0x140036c5f
test r14, r14
js 0x14003a49d
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
cmp rcx, 0xfff
mov qword [rsp + 0x60], rcx
jae 0x14003a4b1
inc rcx
call fcn.140054ae0
mov rbp, rax
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14], 0
mov qword [rsp + 0x748], rbp
mov rbp, qword [rsp + 0x748]
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x360], rdi
mov rax, qword [rsp + 0x360]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x35c], ecx
mov qword [rsp + 0x368], rbx
test byte [rsp + 0x3d8], 1
je 0x14003625f
mov rax, qword [rsp + 0x3a8]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003a4cb
mov rcx, qword [rsp + rcx + 0x360]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x380]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003a4e0
call fcn.140054b24
mov rax, qword [rsp + 0x380]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3b8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3c0]
mov dword [rax], ecx
mov qword [rsp + 0x3d0], rcx
and byte [rsp + 0x3d8], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2b0], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2b8], rax
lea rdi, [rsp + 0x4d0]
mov r8d, 0xaa
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov edx, 0x55
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
mov qword [rsp + 0xa8], rbp
je 0x140036693
lea rdi, [rsp + 0x360]
lea rdx, [rsp + 0x4d0]
mov rcx, rdi
call fcn.14002d430
cmp dword [rdi + 0x20], 0
jne 0x140036f5c
mov rbp, qword [rsp + 0x360]
mov rax, qword [rsp + 0x368]
mov rbx, qword [rsp + 0x370]
mov r15, qword [rsp + 0x378]
mov byte [rsp + 0x360], 0
mov qword [rsp + 0x370], 0
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], r15
xor eax, eax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
lea r8, str.PrevNotificationAction
lea r13, [rsp + 0x4d0]
mov rcx, r13
mov edx, 1
xor r9d, r9d
call fcn.14002ced0
lea rdx, [rsp + 0x4f8]
mov r12d, dword [rdx]
test r12d, r12d
je 0x140036792
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_prev_action_from_registry:__X
lea r8, str.ReadPreviousNotificationAction
mov r9d, 0x177
call fcn.14002b7d0
cmp dword [rsp + 0x4f8], 0
je 0x1400367f4
test r12d, r12d
jns 0x140036806
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140036470
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003646b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x298]
cmp rax, 0x10
jb 0x1400364b7
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400364b2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x2b8]
cmp rax, 0x10
jb 0x140036501
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400364fc
mov r8, rax
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
mov rdx, r8
add rdx, 0x28
mov rcx, rax
call fcn.140054b24
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140036548
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036543
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x14003658f
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003658a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x1400365d6
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400365d1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x338]
cmp rax, 0x10
jb 0x14003661d
mov rcx, qword [rsp + 0x320]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140036618
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x358]
cmp rax, 0x10
jb 0x140036664
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003665f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rcx, qword [rsp + 0x7f8]
xor rcx, rsp
call fcn.140055a90
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x800]
add rsp, 0x818
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rbx, str.0x_X_in__S:_d
lea r8, str.GetOSLocale
mov rcx, rbx
mov edx, r12d
mov r9d, 0x66
call fcn.140057a20
cdqe
lea rdi, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
lea rax, str.GetOSLocale
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x66
mov rcx, r15
mov rdx, rdi
mov r9, rbx
call fcn.140057aa0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036777
mov r13, rax
lea rax, [rsp + 0x360]
mov qword [rax], r15
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140054b24
test r12d, r12d
je 0x140036c25
mov rax, qword [rsp + 0x60]
jmp 0x1400364bf
lea rdi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rdi - 0x18], xmm0
movaps xmmword [rdi - 0x28], xmm0
mov byte [rdi - 8], 0
mov rcx, rdi
call fcn.140059470
cmp byte [rdi - 8], 0
jne 0x14003699d
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
jmp 0x14003803e
lea rcx, [rsp + 0x4d0]
call fcn.140059590
jmp 0x140036420
cmp dword [rsi + 4], 1
jne 0x1400368bc
mov edx, dword [rsi + 8]
mov rcx, r13
call fcn.140031d00
cmp qword [rsp + 0x4e8], 0x10
jb 0x14003682e
mov r13, qword [rsp + 0x4d0]
lea rdx, str.PrevNotificationAction
lea rsi, [rsp + 0x360]
mov rcx, rsi
mov r8, r13
xor r9d, r9d
call fcn.14002c5d0
mov eax, dword [rsi]
test eax, eax
je 0x140036875
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Unable_to_write_prev_action_to_registry:__X
lea r8, str.MaybeWritePreviousNotificationAction
mov r9d, 0x196
call fcn.14002b7d0
mov rax, qword [rsp + 0x4e8]
cmp rax, 0x10
jb 0x1400368bc
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400368b7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
xor eax, eax
lea rsi, [rsp + 0x228]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], 0
lea r8, str.PingCache
mov edx, 9
mov rcx, rsi
call fcn.140058e00
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
jb 0x140036daf
lea rdx, [rax + 8]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x140036920
mov rsi, qword [rsp + 0x228]
movups xmm0, xmmword [str._version]
movups xmmword [rsi + rax*2], xmm0
mov word [rsi + rax*2 + 0x10], 0
mov qword [rsp + 0x4d0], 0
mov qword [rsp + 0x4e8], 7
mov qword [rsp + 0x4e0], 1
mov dword [rsp + 0x4d0], 0x32
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
cmp rcx, rax
je 0x140036dd3
lea rdx, [rax + 1]
mov qword [rsp + 0x238], rdx
cmp rcx, 8
jb 0x140036afa
mov rcx, qword [rsp + 0x228]
jmp 0x140036b02
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.1400594e0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
lea rcx, [rsp + 0x260]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
lea rdx, str.dismissed_by_timeout
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.dismissed_to_action_center
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.dismissed_by_button
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.dismissed_by_application_hidden
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.remind_me_later
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.make_firefox_default_button
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.toast_clicked
lea rcx, [rsp + 0x260]
call fcn.140059ab0
test al, al
je 0x14003803e
lea rdx, str.no_action
lea rdi, [rsp + 0x260]
mov rcx, rdi
call fcn.140059ab0
test al, al
je 0x14003803e
mov rax, qword [rsp + 0x278]
cmp rax, 9
jae 0x140038011
mov ecx, 0x10
call fcn.140054ae0
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
movabs rcx, 0x6f697463612d6f6e
mov qword [rax], rcx
mov word [rax + 8], 0x6e
mov qword [rsp + 0x260], rax
jmp 0x14003803e
lea rcx, [rsp + 0x228]
mov word [rcx + rax*2], 0x32
mov word [rcx + rax*2 + 2], 0
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 2
mov dword [rsp + 0x258], 0
lea rcx, [0x1400a077d]
lea rdx, str.DisableTelemetry
call fcn.14003a5b0
test al, al
je 0x140036b80
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.1400354f0
mov r12d, eax
jmp 0x140036bce
lea r8, str.LastPingSentAt
lea rsi, [rsp + 0x748]
mov rcx, rsi
mov edx, 1
call fcn.14002fd40
mov r12d, dword [rsi + 0x10]
test r12d, r12d
je 0x140036c98
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0xf9
call fcn.14002b7d0
mov rax, qword [rsp + 0x240]
cmp rax, 8
jb 0x140036429
mov rcx, qword [rsp + 0x228]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140036c1b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
jmp 0x140036429
xor r15d, r15d
xor ebx, ebx
xor eax, eax
xor ebp, ebp
jmp 0x140036374
lea rdx, [0x1400a188b]
lea r14, [rsp + 0x360]
mov rcx, r14
call fcn.140059b00
mov edx, dword [rsp + 0x748]
mov rcx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140036103
lea rbp, [rsp + 0x748]
mov qword [rbp + 0x10], r14
mov rcx, rbp
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x748], 0
mov r13, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x1400361d1
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x748]
mov r12b, byte [rsp + 0x750]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdi, qword [rsi]
test r12b, r12b
je 0x140036cfe
mov rax, rdi
test rdi, rdi
jne 0x140036ce5
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsi]
sub rax, rbx
jbe 0x140036b49
shr rax, 9
cmp rax, 0x6388fc53
jb 0x140036b49
mov qword [rsp + 0x6e0], rdi
xor edi, edi
lea rsi, [rsp + 0x4d0]
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.LastPingSentAt
mov edx, 0xe
mov rcx, rsi
call fcn.140058e00
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x370], xmm1
movaps xmmword [rsp + 0x360], xmm0
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
mov word [rsi], di
lea r8, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rsi
call fcn.140058e00
cmp qword [rsp + 0x378], 8
jb 0x140036df8
mov r8, qword [rsp + 0x360]
jmp 0x140036e00
mov ecx, 0xf
mov qword [rsp + 0x60], rcx
test al, 4
jne 0x140036da7
mov rax, qword [rsp + 0x3a0]
mov r14, qword [rax]
test r14, r14
jne 0x14003a51c
xor r14d, r14d
jmp 0x1400361d1
lea r8, str._version
lea rcx, [rsp + 0x228]
mov edx, 8
mov r9d, 8
call fcn.1400592e0
jmp 0x140036932
lea rcx, [rsp + 0x228]
lea r8, [rsp + 0x4d0]
mov edx, 1
mov r9d, 1
call fcn.1400592e0
jmp 0x140036b0f
lea r8, [rsp + 0x360]
cmp qword [rsp + 0x4e8], 8
jb 0x140036e13
mov rsi, qword [rsp + 0x4d0]
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
mov rcx, 0xffffffff80000001
mov rdx, rsi
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
test eax, eax
jne 0x140037905
mov rax, qword [rsp + 0x4e8]
cmp rax, 8
jb 0x140036e9e
mov rcx, qword [rsp + 0x4d0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140036e99
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x378]
cmp rax, 8
jb 0x140036eec
mov rcx, qword [rsp + 0x360]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140036ee7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
test esi, esi
je 0x140036f18
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], 0
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetPingAlreadySentToday
mov r9d, 0x109
call fcn.14002b7d0
lea rcx, [rsp + 0x228]
lea rsi, [rsp + 0x4b0]
mov rdx, rsi
call fcn.14002a9c0
mov r12d, dword [rsi]
test r12d, r12d
je 0x140036f6b
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], r12d
jmp 0x140037abf
mov r15d, 0xf
xor ebp, ebp
xor ebx, ebx
jmp 0x140036374
lea rcx, [rsp + 0x228]
mov r8d, dword [rcx + 0x2c]
lea r13, [rsp + 0x7d8]
mov rdx, r13
call fcn.14002c360
mov eax, 0x90
lea rcx, [rsp + 0x360]
add rcx, rax
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x4d0]
add rax, rcx
mov qword [rsp + 0x58], rax
xor r12d, r12d
xorps xmm6, xmm6
mov esi, 0xf
xor edi, edi
cmp dword [rsp + 0x258], 0
je 0x14003787b
mov qword [rsp + 0x750], r12
mov qword [rsp + 0x760], r12
mov qword [rsp + 0x768], rsi
mov byte [rsp + 0x750], r12b
mov qword [rsp + 0x770], r12
mov qword [rsp + 0x780], r12
mov qword [rsp + 0x788], rsi
mov byte [rsp + 0x770], r12b
mov qword [rsp + 0x790], r12
mov qword [rsp + 0x7a0], r12
mov qword [rsp + 0x7a8], rsi
mov byte [rsp + 0x790], r12b
mov byte [rsp + 0x7d0], r12b
cmp qword [rsp + 0x7f0], 8
mov r8, r13
jb 0x140037048
mov r8, qword [rsp + 0x7d8]
lea rcx, [rsp + 0x360]
lea rdx, str.CacheEntryVersion
call fcn.14002d7d0
mov ebx, dword [rsp + 0x368]
test ebx, ebx
jne 0x1400378a2
mov rax, qword [rsp + 0x360]
mov rcx, rax
shr rcx, 0x20
test cl, cl
je 0x1400376f6
mov dword [rsp + 0x748], eax
test eax, eax
je 0x140037773
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
mov r8, r13
lea r9, str.NotificationType
call fcn.14002dbe0
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x1400377d3
movaps xmmword [rsp + 0x6f0], xmm6
movaps xmmword [rsp + 0x6e0], xmm6
mov byte [rsp + 0x700], 0
lea rcx, [rsp + 0x708]
lea rdx, [rsp + 0x738]
call fcn.140059470
mov r13d, 4
cmp byte [rsp + 0x700], 0
je 0x140037852
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.1400594e0
mov rax, qword [rsp + 0x768]
cmp rax, 0x10
jb 0x140037161
mov rcx, qword [rsp + 0x750]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003715c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a28b0]
call fcn.14002dbe0
cmp dword [rsp + 0x738], 0
jne 0x1400371c0
lea rcx, [rsp + 0x710]
call fcn.140059590
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.140059470
cmp dword [rsp + 0x388], 0
jne 0x14003721a
lea rcx, [rsp + 0x360]
call fcn.140059590
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.140059470
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.140059890
mov rcx, rbx
call fcn.140059590
cmp byte [rsp + 0x700], 0
je 0x140037852
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.1400594e0
mov rax, qword [rsp + 0x788]
cmp rax, 0x10
jb 0x1400372e0
mov rcx, qword [rsp + 0x770]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400372db
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x20], xmm0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, [0x1400a292a]
call fcn.14002dbe0
cmp dword [rsp + 0x738], 0
jne 0x140037340
lea rcx, [rsp + 0x710]
call fcn.140059590
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.140059470
cmp dword [rsp + 0x388], 0
jne 0x14003739a
lea rcx, [rsp + 0x360]
call fcn.140059590
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.140059470
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.140059890
mov rcx, rbx
call fcn.140059590
cmp byte [rsp + 0x700], 0
je 0x140037852
lea rcx, [rsp + 0x6e0]
lea rdx, [rsp + 0x360]
call fcn.1400594e0
mov rax, qword [rsp + 0x7a8]
cmp rax, 0x10
jb 0x140037460
mov rcx, qword [rsp + 0x790]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003745b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
movups xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
lea rax, [rsp + 0x750]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x748]
mov dword [rsp + 0x78], eax
cmp eax, 2
setae byte [rsp + 0x20]
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
lea r8, [rsp + 0x7d8]
lea r9, str.PrevNotificationAction
call fcn.14002dbe0
cmp dword [rsp + 0x738], 0
jne 0x1400374ce
lea rcx, [rsp + 0x710]
call fcn.140059590
mov ebx, dword [rsp + 0x388]
mov dword [rsp + 0x738], ebx
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x720], xmm6
movaps xmmword [rsp + 0x710], xmm6
mov byte [rsp + 0x730], 0
lea rcx, [rsp + 0x738]
lea rdx, [rsp + 0x388]
call fcn.140059470
cmp dword [rsp + 0x388], 0
jne 0x140037528
lea rcx, [rsp + 0x360]
call fcn.140059590
mov ebx, dword [rsp + 0x738]
test ebx, ebx
jne 0x140037830
movaps xmmword [rsp + 0x370], xmm6
movaps xmmword [rsp + 0x360], xmm6
mov byte [rsp + 0x380], 0
lea rcx, [rsp + 0x388]
lea rdx, [rsp + 0x738]
call fcn.140059470
lea rcx, [rsp + 0x6e0]
lea rbx, [rsp + 0x360]
mov rdx, rbx
call fcn.140059890
mov rcx, rbx
call fcn.140059590
cmp dword [rsp + 0x78], 2
jb 0x140037599
cmp byte [rsp + 0x700], 0
je 0x140037852
lea rcx, [rsp + 0x7b0]
lea rdx, [rsp + 0x6e0]
call fcn.140059960
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x490]
call fcn.14002dac0
mov ebx, dword [rsp + 0x490]
test ebx, ebx
jne 0x140037830
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x748]
call fcn.14002ddb0
mov r13b, 1
mov byte [rsp + 0x3f0], r13b
mov r8d, 0x91
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0x4d0], eax
lea rcx, [rsp + 0x388]
movups xmm0, xmmword [rcx - 0x20]
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmmword [rbx + 8], xmm0
mov qword [rsp + 0x378], r12
mov qword [rsp + 0x380], rsi
mov byte [rsp + 0x368], r12b
lea rax, [rsp + 0x388]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x4f8]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x398], r12
mov qword [rsp + 0x3a0], rsi
mov byte [rsp + 0x388], r12b
movups xmm0, xmmword [rcx + 0x20]
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm1
mov qword [rsp + 0x3b8], r12
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x3a8], r12b
movups xmmword [rbx + 0x68], xmm6
movups xmmword [rbx + 0x78], xmm6
mov byte [rbx + 0x88], r12b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
call fcn.140059470
mov byte [rsp + 0x560], r13b
cmp byte [rsp + 0x3f0], r12b
je 0x1400376e6
lea rcx, [rsp + 0x360]
call fcn.14002b970
mov dword [rsp + 0x570], 0
jmp 0x14003784c
cmp qword [rsp + 0x7f0], 8
mov rax, r13
jb 0x14003770c
mov rax, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Missing_expected_value___s__from___s_
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1bb
call fcn.14002b7d0
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x710]
call fcn.14002dac0
mov ebx, dword [rsp + 0x710]
test ebx, ebx
jne 0x140037a35
lea rcx, [rsp + 0x748]
call fcn.14002b970
jmp 0x140037814
cmp qword [rsp + 0x7f0], 8
jb 0x140037786
mov r13, qword [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea rdx, str.Invalid_entry_version_of__u_in___s_
lea r8, str.Dequeue
mov r9d, 0x208
call fcn.14002b7d0
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x360]
call fcn.14002dac0
mov ebx, dword [rsp + 0x360]
test ebx, ebx
je 0x140037828
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x748]
call fcn.14002b970
cmp r13d, 4
lea r13, [rsp + 0x7d8]
jne 0x140037a60
inc edi
cmp edi, dword [rsp + 0x250]
jbe 0x140036fbc
jmp 0x1400378be
mov r13d, 4
jmp 0x1400377f5
mov r8d, 0xa0
lea rcx, [rsp + 0x4d0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x570], ebx
mov r13d, 1
lea rcx, [rsp + 0x6e0]
call fcn.140059590
cmp dword [rsp + 0x738], 0
jne 0x1400377f5
lea rcx, [rsp + 0x710]
call fcn.140059590
jmp 0x1400377f5
lea rsi, [rsp + 0x4d0]
mov r8d, 0x91
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0
jmp 0x140037a60
cmp qword [rsp + 0x7f0], 8
jb 0x1400379f8
mov rax, qword [rsp + 0x7d8]
jmp 0x140037a00
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Unexpected:_This_line_shouldnt_be_reached
lea r8, str.Dequeue
mov r9d, 0x24c
call fcn.14002b7d0
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], 0x80004005
jmp 0x140037a60
movzx r12d, si
or r12d, 0x80070000
test esi, esi
cmovle r12d, esi
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x58], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegistrySetValueQword
mov edx, r12d
mov r9d, 0xee
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegistrySetValueQword
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xee
mov rcx, rbx
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400379eb
mov r13, rax
lea rax, [rsp + 0x710]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
jmp 0x140036e50
lea rax, [rsp + 0x7d8]
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, str.CacheEntryVersion
mov qword [rsp + 0x20], rax
lea rdx, str.Failed_to_read___s__from___s_:__X
lea r8, str.ReadEntryKeyDword
mov r9d, 0x1b5
call fcn.14002b7d0
lea rsi, [rsp + 0x4d0]
mov r8d, 0xa0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsi + 0xa0], ebx
lea rcx, [rsp + 0x748]
call fcn.14002b970
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x140037aae
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140037aa9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov r12d, dword [rsp + 0x570]
test r12d, r12d
je 0x140037be2
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Failed_to_read_cache:__X
lea r8, str.MaybeSwapForCached
mov r9d, 0x15c
call fcn.14002b7d0
cmp dword [rsp + 0x570], 0
jne 0x140037b05
cmp byte [rsp + 0x560], 0
je 0x140037b05
lea rcx, [rsp + 0x4d0]
call fcn.14002b970
test r12d, r12d
js 0x140036bce
mov rax, qword [rsp + 0x50]
mov edi, dword [rax + 4]
lea r8, str.PingCurrentDefault
lea rcx, [rsp + 0x4d0]
mov edx, 1
xor r9d, r9d
call fcn.14002ced0
lea r13, [rsp + 0x4f8]
mov r12d, dword [r13]
test r12d, r12d
je 0x140038050
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_read_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x11f
call fcn.14002b7d0
xor edi, edi
xor ebx, ebx
xor edx, edx
xor eax, eax
cmp dword [rsp + 0x4f8], 0
je 0x140038127
test r12d, r12d
jne 0x140036bce
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x210], rbx
mov rsi, rdx
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x220], rax
mov rdi, qword [rsp + 0x270]
cmp qword [rsp + 0x278], 0x10
jb 0x140038185
mov r12, qword [rsp + 0x260]
jmp 0x14003818d
lea rcx, [rsp + 0x360]
mov r8d, 0x91
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x560], 0
je 0x140037ae4
lea rsi, [rsp + 0x560]
lea rdi, [rsp + 0x3f0]
mov eax, dword [rsi - 0x90]
mov dword [rdi - 0x90], eax
movups xmm0, xmmword [rsi - 0x88]
movups xmmword [rdi - 0x88], xmm0
movups xmm0, xmmword [rsi - 0x78]
movups xmmword [rdi - 0x78], xmm0
xor ebx, ebx
mov qword [rsi - 0x78], rbx
mov eax, 0xf
mov qword [rsi - 0x70], rax
mov byte [rsi - 0x88], bl
movups xmm0, xmmword [rsi - 0x68]
movups xmmword [rdi - 0x68], xmm0
movups xmm0, xmmword [rsi - 0x58]
movups xmmword [rdi - 0x58], xmm0
mov qword [rsi - 0x58], rbx
mov qword [rsi - 0x50], rax
mov byte [rsi - 0x68], bl
movups xmm0, xmmword [rsi - 0x48]
movups xmmword [rdi - 0x48], xmm0
movups xmm0, xmmword [rsi - 0x38]
movups xmmword [rdi - 0x38], xmm0
mov qword [rsi - 0x38], rbx
mov qword [rsi - 0x30], rax
mov byte [rsi - 0x48], bl
mov byte [rdi - 8], bl
xorps xmm0, xmm0
movups xmmword [rdi - 0x18], xmm0
movups xmmword [rdi - 0x28], xmm0
mov rcx, rdi
mov rdx, rsi
call fcn.140059470
mov byte [rdi], 1
cmp byte [rsi], bl
je 0x140037cc7
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.14002b970
mov byte [rsi + 0x90], 0
cmp byte [rsp + 0x3f0], 0
je 0x140037ae4
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x300]
lea r8, [rsp + 0x2e0]
lea r9, [rsp + 0x2c0]
call fcn.1400354f0
cmp byte [rsp + 0x3f0], 0
je 0x14003a487
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002ddb0
mov rax, qword [rsp + 0x318]
cmp rax, 0x10
jb 0x140037d63
mov rcx, qword [rsp + 0x300]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037d5e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x310], xmm1
movaps xmmword [rsp + 0x300], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0xf
mov byte [rcx + 8], 0
call fcn.14002b970
cmp byte [rsp + 0x3f0], 0
je 0x14003a487
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002ddb0
mov rax, qword [rsp + 0x2f8]
cmp rax, 0x10
jb 0x140037e0d
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037e08
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x2f0], xmm1
movaps xmmword [rsp + 0x2e0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], 0
call fcn.14002b970
cmp byte [rsp + 0x3f0], 0
je 0x14003a487
lea rcx, [rsp + 0x748]
lea rdx, [rsp + 0x360]
call fcn.14002ddb0
mov rax, qword [rsp + 0x2d8]
cmp rax, 0x10
jb 0x140037eb8
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037eb3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rax, [rsp + 0x750]
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x2d0], xmm1
movaps xmmword [rsp + 0x2c0], xmm0
lea rcx, [rsp + 0x748]
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
call fcn.14002b970
cmp byte [rsp + 0x3f0], 0
je 0x14003a487
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002ddb0
mov bl, byte [rsi + 0x88]
mov rcx, rsi
call fcn.14002b970
test bl, bl
je 0x140039905
cmp byte [rsp + 0x3f0], 0
je 0x14003a487
lea rsi, [rsp + 0x748]
lea rdx, [rsp + 0x360]
mov rcx, rsi
call fcn.14002ddb0
cmp byte [rsi + 0x88], 0
je 0x14003a492
mov rsi, qword [rsp + 0x7b0]
movups xmm6, xmmword [rsp + 0x7b8]
mov rdi, qword [rsp + 0x7c8]
mov qword [rsp + 0x7c0], 0
mov qword [rsp + 0x7c8], 0xf
mov byte [rsp + 0x7b0], 0
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x140037fe7
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140037fe2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov qword [rsp + 0x260], rsi
movups xmmword [rsp + 0x268], xmm6
mov qword [rsp + 0x278], rdi
lea rcx, [rsp + 0x748]
call fcn.14002b970
jmp 0x140039980
cmp rax, 0x10
jb 0x14003801f
mov rdi, qword [rsp + 0x260]
mov qword [rsp + 0x270], 9
movabs rax, 0x6f697463612d6f6e
mov qword [rdi], rax
mov word [rdi + 8], 0x6e
lea rcx, [rsp + 0x360]
call fcn.140059590
jmp 0x140036412
lea rsi, [rsp + 0x388]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, r13
call fcn.140059470
cmp byte [rsi - 8], 0
jne 0x14003814f
cmp edi, 0xc
ja 0x1400381df
lea rax, [0x14006b4a8]
mov rax, qword [rax + rdi*8]
mov qword [rsp + 0x748], 0
mov qword [rsp + 0x760], 0xf
mov byte [rsp + 0x748], 0
mov rdi, qword [rax]
mov rax, qword [rax + 8]
mov rsi, rax
cmp rax, 0xf
jbe 0x14003970c
test rsi, rsi
js 0x14003a49d
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ecx, 0x16
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jae 0x14003a585
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140054ae0
mov r12, rax
mov rcx, r12
mov rdx, rdi
mov rdi, rsi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rsi], 0
mov qword [rsp + 0x748], r12
jmp 0x1400381ff
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x50], rdx
mov rsi, r13
mov r13, rax
call fcn.140059590
mov rax, r13
mov r13, rsi
mov rdx, qword [rsp + 0x50]
jmp 0x140037b82
lea rcx, [rsp + 0x360]
lea rdi, [rsp + 0x748]
mov rdx, rdi
call fcn.1400594e0
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov rbx, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x140039750
lea r12, [rsp + 0x260]
cmp rdi, 0xf
ja 0x1400381a7
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1e0], xmm0
mov ebx, 0xf
jmp 0x140038224
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140038204
lea rcx, [rbx + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038210
mov qword [rsp + 0x748], 0
mov byte [rsp + 0x748], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
xor esi, esi
jmp 0x140039743
lea rcx, [rbx + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x1e0], rcx
lea r8, [rdi + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], rbx
mov rbx, qword [rsp + 0x2d0]
cmp qword [rsp + 0x2d8], 0x10
jb 0x140038254
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x70], rax
cmp rbx, 0xf
ja 0x140038276
mov rax, qword [rsp + 0x70]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1c0], xmm0
mov eax, 0xf
mov qword [rsp + 0x78], rax
jmp 0x1400382df
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x78], rcx
cmp rcx, 0xfff
jb 0x1400382b8
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400382c9
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x1c0], rcx
lea r8, [rbx + 1]
mov rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1d0], rbx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1d8], rax
mov rbx, qword [rsp + 0x2f0]
cmp qword [rsp + 0x2f8], 0x10
jb 0x140038311
mov r12, qword [rsp + 0x2e0]
jmp 0x140038319
lea r12, [rsp + 0x2e0]
cmp rbx, 0xf
ja 0x14003833b
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x1a0], xmm0
mov eax, 0xf
mov qword [rsp + 0x88], rax
jmp 0x1400383ab
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x88], rcx
cmp rcx, 0xfff
jb 0x140038383
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038397
mov rax, qword [rsp + 0x88]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x1a0], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1b0], rbx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1b8], rax
mov rbx, qword [rsp + 0x310]
cmp qword [rsp + 0x318], 0x10
jb 0x1400383e0
mov r12, qword [rsp + 0x300]
jmp 0x1400383e8
lea r12, [rsp + 0x300]
cmp rbx, 0xf
ja 0x14003840a
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x180], xmm0
mov eax, 0xf
mov qword [rsp + 0x80], rax
jmp 0x14003847a
mov rcx, rbx
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x80], rcx
cmp rcx, 0xfff
jb 0x140038452
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038466
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x180], rcx
lea r8, [rbx + 1]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x198], rax
cmp r15, 0x10
lea r15, [rsp + 0x280]
cmovae r15, rbp
mov qword [rsp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
cmp qword [rsp + 0xa0], 0xf
ja 0x1400384dc
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x160], xmm0
mov eax, 0xf
mov qword [rsp + 0x58], rax
jmp 0x140038550
mov rcx, qword [rsp + 0xa0]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x58], rcx
cmp rcx, 0xfff
jb 0x140038523
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038534
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x160], rcx
mov rax, qword [rsp + 0xa0]
lea r8, [rax + 1]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x60], 0x10
lea rbx, [rsp + 0x2a0]
cmovae rbx, qword [rsp + 0xa8]
cmp r14, 0xf
ja 0x1400385a1
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x140], xmm0
mov eax, 0xf
mov qword [rsp + 0x70], rax
jmp 0x140038608
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x70], rcx
cmp rcx, 0xfff
jb 0x1400385e3
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400385f4
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x140], rcx
lea r8, [r14 + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0xb0], 0x10
jb 0x14003861d
mov rbx, qword [rsp + 0x320]
jmp 0x140038625
lea rbx, [rsp + 0x320]
mov qword [rsp + 0x150], r14
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x68], 0xf
ja 0x140038659
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x120], xmm0
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x1400386c7
mov rcx, qword [rsp + 0x68]
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x60], rcx
cmp rcx, 0xfff
jb 0x14003869d
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400386ae
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x68]
lea r8, [rax + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x98], 0x10
lea rbx, [rsp + 0x208]
cmovae rbx, qword [rsp + 0x90]
mov qword [rsp + 0x100], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
cmp rsi, 0xf
ja 0x14003872f
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x100], xmm0
mov eax, 0xf
mov qword [rsp + 0x50], rax
jmp 0x140038796
mov rcx, rsi
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x50], rcx
cmp rcx, 0xfff
jb 0x140038771
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038782
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0x100], rcx
lea r8, [rsi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x110], rsi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x118], rax
mov r14, qword [rsp + 0x350]
cmp qword [rsp + 0x358], 0x10
jb 0x1400387c8
mov rsi, qword [rsp + 0x340]
jmp 0x1400387d0
lea rsi, [rsp + 0x340]
cmp r14, 0xf
ja 0x1400387ed
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov eax, 0xf
mov qword [rsp + 0x68], rax
jmp 0x140038854
mov rcx, r14
or rcx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x68], rcx
cmp rcx, 0xfff
jb 0x14003882f
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140038840
mov rax, qword [rsp + 0x68]
lea rcx, [rax + 1]
call fcn.140054ae0
mov rcx, rax
mov qword [rsp + 0xe0], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rsp + 0xe0]
mov qword [rbx + 0x10], r14
lea rsi, [rsp + 0x748]
and dword [rsi + 8], 0xfffffe00
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
lea rdx, str.release
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044e0
lea rdx, str.build_channel
lea r8, [0x1400a0e57]
mov rcx, rsi
call fcn.1400045f0
mov rcx, r14
mov rdx, rax
call fcn.140004440
mov rcx, r14
call fcn.1400011f0
lea rdx, [0x1400a15e8]
lea r14, [rsp + 0x4d0]
mov rcx, r14
call fcn.1400044e0
lea rdx, str.build_version
lea r8, [0x1400a0da6]
mov rcx, rsi
call fcn.1400045f0
mov rcx, r14
mov rdx, rax
call fcn.140004440
mov rcx, r14
call fcn.1400011f0
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, rbx
call fcn.14005e420
lea rdx, [0x1400a0acf]
lea r8, [0x1400a0ade]
mov rcx, rsi
call fcn.1400045f0
mov rcx, r14
mov rdx, rax
call fcn.140004440
mov rcx, r14
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.previous_default_browser
lea r8, [0x1400a0ade]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.default_pdf_viewer_raw
lea r8, [0x1400a0831]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x140]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.os_version
lea r8, [0x1400a0d98]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.os_locale
lea r8, [0x1400a1380]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.notification_type
lea r8, [0x1400a12af]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.notification_shown
lea r8, [0x1400a0c1a]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.14005e420
lea rdx, [0x1400a0c9c]
lea r8, [0x1400a0caf]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rbx, [rsp + 0x4d0]
lea rdx, [rsp + 0x1e0]
mov rcx, rbx
call fcn.14005e420
lea rdx, str.previous_notification_action
lea r8, [0x1400a0caf]
mov rcx, rsi
call fcn.1400045f0
mov rcx, rbx
mov rdx, rax
call fcn.140004440
mov rcx, rbx
call fcn.1400011f0
lea rcx, [rsp + 0x360]
call fcn.140055c70
lea rdx, [0x1400a19b3]
lea rsi, [rsp + 0x4d0]
mov rcx, rsi
call fcn.1400044e0
lea r8, [rsp + 0x71b]
mov qword [r8 + 0xd], 0xf
mov qword [r8 + 5], 0xb
movabs rax, 0x7461746e65646e69
mov qword [r8 - 0xb], rax
mov dword [r8 - 4], 0x6e6f6974
mov byte [r8], 0
lea rcx, [rsp + 0x368]
lea rbx, [rsp + 0x710]
mov rdx, rbx
call fcn.1400045f0
mov rcx, rsi
mov rdx, rax
call fcn.140004440
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x140038c07
mov rcx, qword [rsp + 0x710]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140038c02
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rbx, [rsp + 0x4d0]
mov rcx, rbx
call fcn.1400011f0
lea rax, [0x14006b5f0]
mov qword [rbx], rax
lea rsi, [rsp + 0x558]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b838]
mov qword [rsi], rax
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
lea r15, [0x14006b5e8]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov esi, 0xffffff78
lea ecx, [rax + rsi]
mov dword [rsp + rax + 0x4cc], ecx
lea r12, [rsp + 0x4d8]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b848]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
xor edi, edi
mov rdx, r12
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [r12 - 8]
movsxd rax, dword [rax + 4]
add esi, eax
mov dword [rsp + rax + 0x4cc], esi
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, [0x14006b570]
mov qword [r12], rsi
mov qword [r12 + 0x68], rdi
mov dword [r12 + 0x70], 4
lea rcx, [rsp + 0x360]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400af010]
mov r14, rax
mov rax, qword [rax]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x748]
lea rbx, [rsp + 0x4d0]
mov rcx, r14
mov r8, rbx
call qword [0x1400af010]
mov qword [rsp + 0x6e0], rdi
mov qword [rsp + 0x6f0], rdi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
mov eax, dword [rbx + 0x78]
mov ecx, eax
and ecx, 0x22
cmp ecx, 2
je 0x14003a40d
mov rcx, qword [rsp + 0x518]
mov rbx, qword [rcx]
test rbx, rbx
je 0x14003a40d
mov rax, qword [rsp + 0x540]
cmp rbx, rax
cmovb rbx, rax
mov rax, qword [r13]
mov rbp, qword [rax]
test rbp, rbp
je 0x140038e10
sub rbx, rbp
cmp rbx, 0xf
jbe 0x140039aa8
test rbx, rbx
js 0x14003a49d
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jae 0x14003a533
call fcn.140054ae0
mov r13, rax
mov qword [rsp + 0x6f0], rbx
mov qword [rsp + 0x6f8], rdi
mov rcx, r13
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [r13 + rbx], 0
mov qword [rsp + 0x6e0], r13
mov rax, qword [r14]
mov rax, qword [rax]
mov rcx, r14
mov edx, 1
call qword [0x1400af010]
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], r15
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x88]
mov dword [rsp + rax + 0x4cc], ecx
mov qword [rsp + 0x4d8], rsi
test byte [rsp + 0x548], 1
je 0x140038eaa
mov rax, qword [rsp + 0x518]
mov rax, qword [rax]
mov ecx, 0x60
test rax, rax
je 0x14003a54d
mov rcx, qword [rsp + rcx + 0x4d0]
movsxd rdx, dword [rcx]
add rdx, rax
mov rax, qword [rsp + 0x4f0]
mov rcx, qword [rax]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14003a562
call fcn.140054b24
mov rax, qword [rsp + 0x4f0]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x510]
mov qword [rax], rcx
mov rax, qword [rsp + 0x528]
mov dword [rax], ecx
mov rax, qword [rsp + 0x4f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x518]
mov qword [rax], rcx
mov rax, qword [rsp + 0x530]
mov dword [rax], ecx
mov qword [rsp + 0x540], rcx
and byte [rsp + 0x548], 0xfe
mov rcx, r12
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x558]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rcx, [rsp + 0x710]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x1400390be
xorps xmm0, xmm0
lea rsi, [rsp + 0x4d0]
movups xmmword [rsi + 0x3e], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rcx, [rsp + 0x710]
mov rdx, rsi
mov r8d, 0x27
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
jne 0x140039190
lea rbx, [rsp + 0x4d2]
mov ecx, 0x50
call fcn.140054ae0
mov r14, rax
mov r8d, 0x48
mov rcx, rax
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + 0x48], 0
mov qword [rsp + 0x7d8], r14
mov qword [rsp + 0x7e0], 0
mov qword [rsp + 0x7e8], 0x24
mov qword [rsp + 0x7f0], 0x27
lea rcx, section..rdata
lea r9, [rsp + 0x4b0]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0xa8], r9
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x14003984a
mov r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov rcx, rdi
mov edx, eax
mov r8, r13
mov r9d, 0x75
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x75
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400390b1
mov r14, rax
mov qword [rsp + 0x4d0], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
jmp 0x14003a3b6
mov r12d, eax
or r12d, 0x80010000
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r13, str.GenerateUUIDStr
mov rcx, r14
mov edx, r12d
mov r8, r13
mov r9d, 0x2e
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140054b1c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0x2e
mov rcx, rsi
mov rdx, rbp
mov r9, r14
call fcn.140057aa0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039267
mov rbx, rax
mov qword [rsp + 0x4d0], rsi
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, r12d
jmp 0x140039258
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.GenerateUUIDStr
mov r12d, 0x8007007a
mov rcx, r14
mov edx, 0x8007007a
mov r8, r15
mov r9d, 0x35
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0x35
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rsi
mov rdx, r13
mov r9, r14
call fcn.140057aa0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039267
mov rbx, rax
lea rax, [rsp + 0x7d8]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140054b24
mov rax, qword [rsp + 0x6f8]
cmp rax, 0x10
jb 0x1400392b6
mov rcx, qword [rsp + 0x6e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400392b1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rcx, [rsp + 0x360]
call fcn.140061d40
lea rcx, [rsp + 0x748]
call fcn.1400011f0
cmp qword [rsp + 0x68], 0x10
jb 0x14003931a
mov rcx, qword [rsp + 0xe0]
cmp qword [rsp + 0x68], 0xfff
jb 0x14003930b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x68], 0x28
mov rcx, rax
jmp 0x140039310
inc qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140054b24
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
cmp qword [rsp + 0x50], 0x10
jb 0x140039384
mov rcx, qword [rsp + 0x100]
cmp qword [rsp + 0x50], 0xfff
jb 0x140039375
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x50], 0x28
mov rcx, rax
jmp 0x14003937a
inc qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140054b24
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0xf
mov byte [rsp + 0x100], 0
cmp qword [rsp + 0x60], 0x10
jb 0x1400393ee
mov rcx, qword [rsp + 0x120]
cmp qword [rsp + 0x60], 0xfff
jb 0x1400393df
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x60], 0x28
mov rcx, rax
jmp 0x1400393e4
inc qword [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
call fcn.140054b24
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0xf
mov byte [rsp + 0x120], 0
cmp qword [rsp + 0x70], 0x10
jb 0x140039458
mov rcx, qword [rsp + 0x140]
cmp qword [rsp + 0x70], 0xfff
jb 0x140039449
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x70], 0x28
mov rcx, rax
jmp 0x14003944e
inc qword [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140054b24
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0xf
mov byte [rsp + 0x140], 0
cmp qword [rsp + 0x58], 0x10
jb 0x1400394c2
mov rcx, qword [rsp + 0x160]
cmp qword [rsp + 0x58], 0xfff
jb 0x1400394b3
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x58], 0x28
mov rcx, rax
jmp 0x1400394b8
inc qword [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
call fcn.140054b24
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0xf
mov byte [rsp + 0x160], 0
cmp qword [rsp + 0x80], 0x10
jb 0x14003953b
mov rcx, qword [rsp + 0x180]
cmp qword [rsp + 0x80], 0xfff
jb 0x140039526
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x80], 0x28
mov rcx, rax
jmp 0x14003952e
inc qword [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140054b24
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
cmp qword [rsp + 0x88], 0x10
jb 0x1400395b4
mov rcx, qword [rsp + 0x1a0]
cmp qword [rsp + 0x88], 0xfff
jb 0x14003959f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x88], 0x28
mov rcx, rax
jmp 0x1400395a7
inc qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
call fcn.140054b24
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
cmp qword [rsp + 0x78], 0x10
jb 0x14003961e
mov rcx, qword [rsp + 0x1c0]
cmp qword [rsp + 0x78], 0xfff
jb 0x14003960f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add qword [rsp + 0x78], 0x28
mov rcx, rax
jmp 0x140039614
inc qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
call fcn.140054b24
mov qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
mov rax, qword [rsp + 0x1f8]
cmp rax, 0x10
jb 0x140039685
mov rcx, qword [rsp + 0x1e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039680
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0xf
mov byte [rsp + 0x1e0], 0
cmp qword [rsp + 0x98], 0x10
jb 0x140036bce
mov rax, qword [rsp + 0x98]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400396fa
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
mov rdx, qword [rsp + 0x98]
add rdx, 0x28
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140054b24
jmp 0x140036bce
lea r12, [rsp + 0x748]
mov qword [r12 + 0x10], rsi
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x748], 0
mov rbx, qword [r12 + 8]
mov rsi, qword [r12 + 0x10]
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x748]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x358], 0x10
jb 0x140039765
mov r8, qword [rsp + 0x340]
jmp 0x14003976d
lea r8, [rsp + 0x340]
lea rdx, str.PingCurrentDefault
lea rdi, [rsp + 0x748]
mov rcx, rdi
xor r9d, r9d
call fcn.14002c5d0
mov r12d, dword [rdi]
test r12d, r12d
jne 0x14003979e
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
jmp 0x14003982a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], r12d
lea rdx, str.Unable_to_write_registry:__X
lea r8, str.GetAndUpdatePreviousDefaultBrowser
mov r9d, 0x12e
call fcn.14002b7d0
xor edi, edi
mov ebx, 0
mov esi, 0
mov r13d, 0
cmp qword [rsp + 0x50], 0x10
jb 0x14003982a
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039817
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
mov rdx, qword [rsp + 0x50]
add rdx, 0x28
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140054b24
xor edi, edi
xor ebx, ebx
xor esi, esi
xor r13d, r13d
lea rcx, [rsp + 0x360]
call fcn.140059590
mov rax, r13
lea r13, [rsp + 0x4f8]
mov rdx, rsi
jmp 0x140037b74
mov rsi, qword [rsp + 0x4b0]
lea rbx, [rsp + 0x4d0]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [0x1400a348e]
mov rcx, rbx
mov qword [rsp + 0xb0], rsi
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x1400399a0
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r13, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, r13
mov r9d, 0x81
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea rsi, [rax + rax]
add rsi, 2
mov rcx, rsi
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0x81
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, rbp
jmp 0x140039b71
mov rax, qword [rsp + 0x278]
cmp rax, 0x10
jb 0x14003994c
mov rcx, qword [rsp + 0x260]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140039947
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
movabs rax, 0x6f697463612d6f6e
mov qword [rsp + 0x260], rax
mov word [rsp + 0x268], 0x6e
mov qword [rsp + 0x270], 9
mov qword [rsp + 0x278], 0xf
cmp byte [rsp + 0x3f0], 0
je 0x140037ae4
lea rcx, [rsp + 0x360]
call fcn.14002b970
jmp 0x140037ae4
lea rdx, [0x1400a1bcc]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x140039a22
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x86
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x86
jmp 0x140039b63
lea rdx, str.Pending_Pings
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x140039acc
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x8b
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x8b
jmp 0x140039b63
lea rcx, [rsp + 0x6e0]
mov qword [rcx + 0x10], rbx
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x6e0], 0
jmp 0x140038e10
cmp qword [rsp + 0x7f0], 8
jb 0x140039ae1
mov rdx, qword [rsp + 0x7d8]
jmp 0x140039ae9
lea rdx, [rsp + 0x7d8]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x140039fbf
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea rsi, str.GetPingFilePath
mov r12d, 0x8007007a
mov rcx, r15
mov edx, 0x8007007a
mov r8, rsi
mov r9d, 0x90
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x90
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, r13
mov r9, r15
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039bdb
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
xorps xmm6, xmm6
xor r14d, r14d
xor edi, edi
xor esi, esi
cmp qword [rsp + 0xb0], 0
je 0x140039c06
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test dil, dil
je 0x14003a3b6
mov qword [rsp + 0x4b0], r14
movups xmmword [rsp + 0x4b8], xmm6
cmp rsi, 8
lea rax, [rsp + 0x4b0]
cmovb r14, rax
mov qword [rsp + 0x4c8], rsi
lea rax, [0x14006b498]
lea rsi, [rsp + 0x578]
mov qword [rsi - 0xa8], rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::ios_base::constructor_void____ptr64]
lea rax, [0x14006b838]
mov qword [rsi], rax
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
lea rbx, [0x14006b4a0]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [rsi - 0xa8]
movsxd rax, dword [rax + 4]
mov edi, 0xffffff58
lea ecx, [rax + rdi]
mov dword [rsp + rax + 0x4cc], ecx
lea r15, [rsp + 0x4d8]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b848]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x10]
mov dword [rsp + rax + 0x4cc], ecx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov rdx, r15
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::init_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
mov qword [rsp + rax + 0x4d0], rbx
mov rax, qword [r15 - 8]
movsxd rax, dword [rax + 4]
add edi, eax
mov dword [rsp + rax + 0x4cc], edi
mov rcx, r15
call fcn.14005ae30
mov rcx, r15
mov rdx, r14
call fcn.14005aeb0
test rax, rax
jne 0x140039d43
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
mov r8, qword [rsp + 0x6f0]
cmp qword [rsp + 0x6f8], 0x10
jb 0x140039d66
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0xb8], rax
lea r14, [rsp + 0x4d0]
mov rcx, r14
mov rdx, qword [rsp + 0xb8]
call fcn.140002f40
mov rax, qword [r14]
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x4d0
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x140039ed0
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r8, str.SendPing
mov r12d, 0x8007045d
mov rcx, rdi
mov edx, 0x8007045d
mov r9d, 0xc6
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SendPing
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0xc6
mov dword [rsp + 0x20], 0x8007045d
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140039e7e
mov r14, rax
mov qword [rsp + 0x710], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x710]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007045d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b4a0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.140059e70
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
jmp 0x14003a368
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea rcx, [0x14006b4a0]
mov qword [rsp + rax + 0x4d0], rcx
mov rax, qword [rsp + 0x4d0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rsp + rax + 0x4cc], ecx
mov rcx, r15
call fcn.140059e70
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
lea rdx, str.pingsender.exe
lea rsi, [rsp + 0x710]
mov rcx, rsi
call fcn.140031080
mov r12d, dword [rsi + 0x20]
test r12d, r12d
jne 0x14003a368
movups xmm0, xmmword [rsp + 0x710]
movups xmm1, xmmword [rsp + 0x720]
movaps xmmword [rsp + 0x4a0], xmm1
movaps xmmword [rsp + 0x490], xmm0
xor eax, eax
mov qword [rsp + 0x720], rax
mov ecx, 7
mov qword [rsp + 0x728], rcx
mov word [rsp + 0x710], ax
lea rsi, [rsp + 0x470]
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov word [rsi], ax
lea r8, str.https:__incoming.telemetry.mozilla.org_submit_default_browser_agent_default_browser_1_
mov edx, 0x56
mov rcx, rsi
call fcn.140058e00
mov r9, qword [rsp + 0x7e8]
cmp qword [rsp + 0x7f0], 8
jb 0x14003a01f
mov r8, qword [rsp + 0x7d8]
jmp 0x14003a027
xor eax, eax
mov qword [rsp + 0x710], rax
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x728], 7
mov word [rsp + 0x710], 0
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rbx, rax
lea rcx, [rsp + 0x710]
cmp rax, 7
jbe 0x14003a443
lea r8, [rsp + 0x4d0]
mov rdx, rbx
call fcn.140058e00
jmp 0x14003a464
lea r8, [rsp + 0x7d8]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r9
jae 0x14003a054
lea rcx, [rsp + 0x470]
mov rdx, r9
call fcn.1400592e0
jmp 0x14003a086
lea rdi, [rax + r9]
mov qword [rsp + 0x480], rdi
cmp rcx, 8
jb 0x14003a06e
mov rsi, qword [rsp + 0x470]
lea rcx, [rsi + rax*2]
add r9, r9
mov rdx, r8
mov r8, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rdi*2], 0
lea rbx, [rsp + 0x490]
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14003a0a0
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x450], rax
cmp qword [rsp + 0x488], 8
jb 0x14003a0bd
mov rax, qword [rsp + 0x470]
jmp 0x14003a0c5
lea rax, [rsp + 0x470]
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x4c8], 8
jb 0x14003a0e8
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0x450]
mov rax, qword [rsp + 0xa8]
mov qword [r8 + 0x10], rax
lea rsi, [rsp + 0xd8]
mov rcx, rsi
mov edx, 3
call fcn.140005740
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4d0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x520], xmm0
movaps xmmword [rsp + 0x510], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x4e0], xmm0
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x4d0], 0x68
mov dword [rsp + 0x50c], 1
mov rsi, qword [rsi]
cmp qword [rsp + 0x4a8], 8
jb 0x14003a17c
mov rbx, qword [rsp + 0x490]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003a2a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdi, str.0x_X_in__S:_d
lea r13, str.SendPing
mov rcx, rdi
mov edx, r12d
mov r8, r13
mov r9d, 0xe4
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], 0xe4
mov rcx, rbx
mov rdx, rbp
mov r9, rdi
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003a29a
mov r14, rax
lea rax, [rsp + 0x6d8]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
jmp 0x14003a2bf
mov rcx, qword [rsp + 0xc8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xc0]
call rdi
test rsi, rsi
je 0x14003a2cc
mov rcx, rsi
call fcn.140054b24
mov rax, qword [rsp + 0x488]
cmp rax, 8
jb 0x14003a31a
mov rcx, qword [rsp + 0x470]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a315
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x4a8]
cmp rax, 8
jb 0x14003a368
mov rcx, qword [rsp + 0x490]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a363
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x4c8]
cmp rax, 8
jb 0x14003a3b6
mov rcx, qword [rsp + 0x4b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a3b1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rax, qword [rsp + 0x7f0]
cmp rax, 8
jb 0x14003926f
mov rcx, qword [rsp + 0x7d8]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003a403
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003a57f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
jmp 0x14003926f
test al, 4
jne 0x140038e10
mov rax, qword [rsp + 0x510]
mov rbx, qword [rax]
test rbx, rbx
je 0x140038e10
lea rax, [rsp + 0x4f0]
mov r13, rax
mov rax, qword [rax + 0x38]
movsxd rax, dword [rax]
add rbx, rax
jmp 0x140038d95
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x4d0]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx*2 + 0x710], 0
mov r14, qword [rsp + 0x710]
movups xmm6, xmmword [rsp + 0x718]
mov rsi, qword [rsp + 0x728]
xor r12d, r12d
mov dil, 1
jmp 0x140039bed
int3
int3
call fcn.140058ca0
mov eax, 0xf
mov qword [rsp + 0x60], rax
jmp 0x140036da7
add rcx, 0x28
call fcn.140054ae0
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x1400361b5
mov rax, qword [rsp + 0x3a0]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140036231
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add rdx, 0x27
mov rcx, rax
jmp 0x14003625a
lea rcx, [rdi + 0x28]
call fcn.140054ae0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140035bc6
lea rax, [rsp + 0x380]
mov rcx, qword [rax + 0x38]
movsxd rcx, dword [rcx]
add r14, rcx
jmp 0x14003615f
lea rcx, [rdi + 0x28]
call fcn.140054ae0
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x140038de4
mov rax, qword [rsp + 0x510]
mov rax, qword [rax]
mov ecx, 0x58
jmp 0x140038e7c
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14003a57f
add rdx, 0x27
mov rcx, rax
jmp 0x140038ea5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 0x28]
call fcn.140054ae0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140038104