Function at 0x140031d70
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea r8, [0x1400a2e72]
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
xor r9d, r9d
call fcn.14002e620
cmp dword [r14 + 0x28], 0
je 0x140032358
mov rcx, r13
xor edx, edx
call fcn.140034550
lea rax, [rsp + 0x230]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140066030]
lea r9, [0x140066020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140032523
mov rcx, qword [rsp + 0x230]
xorps xmm0, xmm0
lea r10, [rsp + 0x1e0]
movaps xmmword [r10], xmm0
xor eax, eax
mov qword [r10 + 0x10], rax
lea r9, [rsp + 0x1c0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x1a0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], r10
call qword [0x1400af010]
test eax, eax
js 0x140032594
xor edi, edi
mov qword [rsp + 0x178], rdi
lea rcx, [0x1400a420e]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rdi
test rcx, rcx
je 0x140031eae
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x178]
mov rcx, rsi
mov rdx, r12
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x14003267c
xor ebx, ebx
mov qword [rsp + 0x170], rbx
lea rcx, [0x1400a41b2]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], rbx
test rcx, rcx
je 0x140031f19
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [rdi]
mov rax, qword [rax + 0x48]
lea r8, [rsp + 0x170]
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
call qword [0x1400af010]
test eax, eax
js 0x140031f47
mov dword [rsp + 0x6c], 0
jmp 0x140031fb7
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
je 0x140031f75
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
xorps xmm0, xmm0
lea r8, [rsp + 0x150]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x170]
mov rcx, rsi
mov rdx, rbx
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x140032342
mov al, 1
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x230]
lea r8, [rsp + 0x148]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x14003276c
mov qword [rsp + 0x140], 0
lea rdi, [rsp + 0x280]
mov rcx, rdi
xor edx, edx
call section..text
mov r14, qword [rdi]
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp rax, 0x103
jbe 0x140032864
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_get_install_directory
lea r8, str.GetTaskDescription
mov r9d, 0x35
call fcn.14002cba0
xor edi, edi
test r14, r14
je 0x140032049
mov rcx, r14
call fcn.140056c84
mov ebp, 0x80004005
test dil, dil
je 0x140033779
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x138]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x140032957
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov rdx, rdi
call qword [0x1400af010]
test eax, eax
js 0x1400329d2
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400af010]
test eax, eax
js 0x140032adb
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x140032b59
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x140032bd7
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
mov dx, 0xffff
call qword [0x1400af010]
test eax, eax
js 0x140032c55
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x140032cd0
lea rcx, str.PT12H5M
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe0]
mov qword [rsp + 0x70], rdx
call qword [0x1400af010]
test eax, eax
js 0x140032dd9
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x140032ee7
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov rdx, rbx
call qword [0x1400af010]
test eax, eax
js 0x140032f62
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x120]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400af010]
test eax, eax
js 0x140033070
mov rcx, qword [rsp + 0x120]
lea r8, [rsp + 0x118]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x14003317e
mov rcx, qword [rsp + 0x118]
lea r8, [rsp + 0x110]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [0x140066010]
call qword [0x1400af010]
test eax, eax
js 0x140033287
test r15, r15
jne 0x140033305
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add rax, 0xffffffffffffffc4
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
jne 0x1400334aa
mov ecx, 0x2a
call fcn.140056c40
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x1a], xmm0
lea r8, str._Y__m__dT_H:_M:_SZ
lea r9, [rsp + 0x280]
mov edx, 0x15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
test rax, rax
je 0x1400335a7
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r14
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x14003386e
test r14, r14
je 0x14003232d
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call fcn.140056c84
test ebp, ebp
js 0x1400336bc
jmp 0x14003339f
cmp esi, 0x800700b7
jne 0x140033aa6
mov esi, 0x800700b7
jmp 0x140031f3d
lea rdi, [rsp + 0x2a8]
lea rsi, [rsp + 0x278]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, rdi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
je 0x1400324f6
lea rcx, [rsp + 0x250]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.14005b1a0
lea rbx, [0x1400a2e72]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8, rbx
call fcn.14002eba0
lea rcx, [rsp + 0x200]
mov edx, 1
mov r8, rbx
xor r9d, r9d
call fcn.14002e620
cmp dword [rsp + 0x2a8], 0
jne 0x1400323ec
lea rcx, [rsp + 0x280]
call fcn.14005b250
mov eax, dword [rsp + 0x228]
mov dword [rsp + 0x2a8], eax
test eax, eax
jne 0x1400324af
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
mov byte [rsp + 0x2a0], 0
mov rcx, rdi
mov rdx, rbx
call fcn.14005b4d0
cmp dword [rbx], 0
jne 0x140032442
lea rcx, [rsp + 0x200]
call fcn.14005b250
cmp dword [rsp + 0x2a8], 0
jne 0x1400324af
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rbx - 0x18], xmm0
movaps xmmword [rbx - 0x28], xmm0
mov byte [rbx - 8], 0
mov rcx, rbx
mov rdx, rdi
call fcn.14005b4d0
mov bl, byte [rbx - 8]
lea rcx, [rsp + 0x200]
call fcn.14005b250
test bl, bl
jne 0x1400324af
cmp qword [rsp + 0x248], 0x10
jb 0x140032495
mov rsi, qword [rsp + 0x230]
lea rdx, [0x1400a2e72]
lea rcx, [rsp + 0x200]
mov r8, rsi
xor r9d, r9d
call fcn.14002da60
mov rax, qword [rsp + 0x248]
cmp rax, 0x10
jb 0x1400324f6
mov rcx, qword [rsp + 0x230]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400324f1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034544
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rcx, [rsp + 0x250]
call fcn.14005b250
cmp dword [rsp + 0x2a8], 0
jne 0x140031dc2
lea rcx, [rsp + 0x280]
call fcn.14005b250
jmp 0x140031dc2
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x60
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x60
jmp 0x140032603
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x62
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x62
mov rcx, rdi
mov rdx, r13
mov r8, 0xffffffffffffffff
mov r9, r15
call fcn.140059ac0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003266f
mov rbx, rax
mov qword [rsp + 0x280], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
jmp 0x14003382e
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, esi
mov r8, rdi
mov r9d, 0x67
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x67
mov rcx, rbx
mov rdx, r13
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003275a
mov rdi, rax
mov qword [rsp + 0x280], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
mov r12, qword [rsp + 0x50]
jmp 0x140033806
mov ebp, eax
mov qword [rsp + 0x50], r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0x82
call fcn.140059a40
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x82
mov rcx, r15
mov rdx, rbx
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003284d
mov rdi, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
jmp 0x140033797
mov qword [rsp + 0x50], r12
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r12, str._sdefaultagent_localized.ini
mov rcx, r12
mov rdx, r14
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
mov rcx, rbp
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
lea rdi, [rsp + 0x280]
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
call fcn.14002b870
lea rdx, str.DefaultBrowserAgentTaskDescription
lea r8, [rsp + 0x140]
mov rcx, rdi
call fcn.14002b980
mov rcx, rdi
call fcn.14002bd40
test eax, eax
sete dil
je 0x140032933
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_read_task_description:__d
lea r8, str.GetTaskDescription
mov r9d, 0x44
call fcn.14002cba0
lea rcx, [rsp + 0x280]
call fcn.140031c10
mov rcx, rbp
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
jmp 0x14003203c
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8b
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8b
jmp 0x140032a4b
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8c
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032abf
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033751
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8f
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8f
jmp 0x140032d49
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x90
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x90
jmp 0x140032d49
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x91
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x91
jmp 0x140032d49
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x92
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x92
jmp 0x140032d49
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x93
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x93
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032dbd
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033737
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9a
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9a
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032ec6
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140033729
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9d
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9d
jmp 0x140032fdb
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9f
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9f
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003304f
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x14003370f
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa2
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa2
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003315d
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x1400336f5
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa5
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa5
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003326b
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400336d6
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa9
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa9
jmp 0x14003343c
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r15
call qword [0x1400af010]
test eax, eax
jns 0x14003339f
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xac
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xac
jmp 0x14003343c
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
mov dx, 1
call qword [0x1400af010]
test eax, eax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
jns 0x140033978
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xd9
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd9
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003359f
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
jmp 0x140033590
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov ebp, 0x8007076d
mov rcx, r12
mov edx, 0x8007076d
mov r8, r13
mov r9d, 0xc7
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xc7
mov dword [rsp + 0x20], 0x8007076d
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003359f
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007076d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
jmp 0x1400336a8
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov ebp, 0x8007007a
mov edx, 0x8007007a
mov r8, r13
mov r9d, 0xd1
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xd1
mov dword [rsp + 0x20], 0x8007007a
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003369d
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov rcx, r15
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x1400336d6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x1400336f5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x14003370f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140033729
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r14, r14
je 0x140033737
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140033751
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x14003376b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test rdi, rdi
je 0x140033779
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], 0
test rcx, rcx
je 0x140033797
call fcn.140056c84
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x1400337b1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test esi, esi
setns al
mov ecx, dword [rsp + 0x6c]
xor cl, 1
or cl, al
jne 0x1400337dc
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
mov rdx, rbx
xor r8d, r8d
call qword [0x1400af010]
mov esi, ebp
test rbx, rbx
je 0x1400337ec
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140033806
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r12, r12
je 0x140033814
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x14003382e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x230]
test rcx, rcx
je 0x140033848
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140057bf0
mov eax, esi
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x78], rax
lea rcx, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov edx, ebp
mov r8, r12
mov r9d, 0xd6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rcx, rax
xor edx, edx
mov r8, rbx
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd6
mov rcx, rbx
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003395c
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14003231f
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x108]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [0x1400af010]
test eax, eax
jns 0x140033b98
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xdc
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdc
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033a8a
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034400
mov rbx, r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rbp, str.RegisterTask
mov edx, esi
mov r8, rbp
mov r9d, 0x73
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x73
mov rcx, r15
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033b83
mov rdi, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
mov r12, rbx
mov rbx, qword [rsp + 0x60]
jmp 0x1400337de
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
xor edx, edx
call qword [0x1400af010]
test eax, eax
jns 0x140033cc5
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xdf
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdf
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033ca9
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400343e6
mov rcx, qword [rsp + 0x100]
lea r8, [rsp + 0xf8]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.MbLk
call qword [0x1400af010]
test eax, eax
jns 0x140033df6
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xe2
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe2
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033dda
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400343cc
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
call section..text
mov rcx, qword [r14]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
je 0x140033e28
call fcn.140056c84
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
mov rdx, r15
call qword [0x1400af010]
test eax, eax
mov qword [rsp + 0x78], r15
jns 0x140033f4a
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r15, str.RegisterTask
mov edx, eax
mov r8, r15
mov r9d, 0xe6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe6
mov rcx, r12
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033f29
mov rdi, rax
mov qword [rsp + 0x280], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x78]
jmp 0x1400343be
xor eax, eax
lea r14, [rsp + 0x280]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r9, str.do_task__
mov edx, 9
mov rcx, r14
call fcn.14005ab20
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x140033fb2
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x280]
mov rdx, rax
mov r9, r13
call fcn.14005ac50
jmp 0x140033feb
mov r15, rdi
lea rdi, [rcx + rax]
mov qword [rsp + 0x290], rdi
cmp rdx, 8
jb 0x140033fcf
mov r14, qword [rsp + 0x280]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
mov rdi, r15
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
cmp rcx, rax
jne 0x140034024
mov qword [rsp + 0x20], 1
lea r9, [0x1400a4d8c]
lea rcx, [rsp + 0x280]
mov edx, 1
call fcn.14005ac50
jmp 0x140034055
lea rdx, [rax + 1]
mov qword [rsp + 0x290], rdx
cmp rcx, 8
jb 0x140034040
mov rcx, qword [rsp + 0x280]
jmp 0x140034048
lea rcx, [rsp + 0x280]
mov word [rcx + rax*2], 0x22
mov word [rcx + rax*2 + 2], 0
cmp qword [rsp + 0x298], 8
jb 0x14003406a
mov rcx, qword [rsp + 0x280]
jmp 0x140034072
lea rcx, [rsp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x80], rdx
call qword [0x1400af010]
test eax, eax
jns 0x14003419a
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r15, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, r15
mov r9d, 0xec
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xec
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003417e
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034358
mov r15, rdi
xor eax, eax
lea r14, [rsp + 0x200]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r9, [0x1400a4d90]
mov edx, 0x1e
mov rcx, r14
call fcn.14005ab20
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jb 0x140034423
lea rdi, [rcx + rax]
mov qword [rsp + 0x210], rdi
cmp rdx, 8
jb 0x140034209
mov r14, qword [rsp + 0x200]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
cmp qword [rsp + 0x218], 8
mov rdi, r15
jb 0x14003423a
mov rcx, qword [rsp + 0x200]
jmp 0x140034242
lea rcx, [rsp + 0x200]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rcx, qword [rsp + 0x170]
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r9, [rsp + 0xd0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r10, [rsp + 0xb0]
movaps xmmword [r10], xmm0
mov qword [r10 + 0x10], rax
lea r11, [rsp + 0x90]
movaps xmmword [r11], xmm0
mov qword [r11 + 0x10], rax
mov r8, qword [rsp + 0x148]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 3
mov rdx, r13
mov r9d, 6
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x140034440
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400342f4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r13, r13
je 0x140034302
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x218]
cmp rax, 8
jb 0x140034358
mov rcx, qword [rsp + 0x200]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003434b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034544
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rbx, qword [rsp + 0x60]
mov rdi, r15
mov r14, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140034370
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x298]
cmp rax, 8
jb 0x1400343be
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400343b9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034544
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
test r14, r14
je 0x1400343cc
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400343e6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140034400
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x1400336bc
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
jmp 0x1400336bc
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x200]
mov rdx, rax
mov r9, r13
call fcn.14005ac50
jmp 0x140034222
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x88], rax
lea rcx, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov edx, ebp
mov r8, r12
mov r9d, 0xf5
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xf5
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003452a
mov rdi, rax
lea rax, [rsp + 0x250]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, r15
jmp 0x1400342da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3