Function at 0x140031f10
Capabilities:
Access the windows event log
Delete registry key
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov r12, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rsi, [rsp + 0xc8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [rsi]
lea rax, [rsp + 0xb0]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400592a0
mov rsi, qword [rsi]
test rsi, rsi
je 0x140032104
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140031fd0
lea rcx, [rsp + 0xd8]
add qword [rcx], 0xf4240
lea rdx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x140031fdf
xor ebp, ebp
mov rcx, rsi
call fcn.140055ae4
jmp 0x140032106
lea rbx, [rsp + 0xe0]
movupd xmm0, xmmword [rbx]
movapd xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov eax, dword [rsp + 0xd0]
mov dword [rcx + 8], eax
xor eax, eax
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x9c], eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140032089
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140032089
movq xmm0, qword [rsp + 0xe0]
movq xmm1, qword [rsp + 0xd8]
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0x50
movmskpd eax, xmm0
cmp al, 3
je 0x14003212c
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Hash_is_too_close_to_expiration__sleeping_until_next_hash.
lea r8, str.SetUserChoice
mov r9d, 0x77
call fcn.14002c3b0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r15, [rsp + 0xc8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [r15]
lea rax, [rsp + 0x70]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0xe0]
mov rcx, r15
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400592a0
mov r14, qword [r15]
mov rcx, rsi
call fcn.140055ae4
mov rsi, r14
test r14, r14
jne 0x14003212c
xor ebp, ebp
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140056a50
mov eax, ebp
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0xd8]
mov rcx, r14
mov rdx, rdi
call fcn.140059220
mov rdi, qword [r14]
test rdi, rdi
je 0x140031fd0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140032278
mov r14, qword [rsp + 0x68]
lea rdx, [0x1400a40da]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14003235e
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
lea rdx, [0x1400a40da]
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400323d3
mov r15, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
lea rdx, str.ProgID
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400324c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, str.Hash
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bpl, 1
test eax, eax
jne 0x14003253a
test r15, r15
je 0x14003225d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14003226b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140055ae4
jmp 0x140031fd2
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x8c
call fcn.1400589e0
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, r12
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003234f
mov r15, rax
mov qword [rsp + 0xe0], r14
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
xor ebp, ebp
jmp 0x14003226b
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x96
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055adc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x96
jmp 0x140032446
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xa0
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055adc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa0
mov rcx, r15
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400324b1
mov r12, rax
mov qword [rsp + 0xe0], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055ae4
xor ebp, ebp
jmp 0x14003225d
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xaa
call fcn.1400589e0
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xaa
jmp 0x1400325b2
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xb3
call fcn.1400589e0
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xb3
mov rcx, r12
mov rdx, qword [rsp + 0x58]
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003261f
mov r13, rax
mov qword [rsp + 0xe0], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140055ae4
xor ebp, ebp
jmp 0x14003224f