Function at 0x140031330
Capabilities:
Access the windows event log
Delete registry key
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov r12, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1400ab070]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rsi, [rsp + 0xc8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [rsi]
lea rax, [rsp + 0xb0]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400582e0
mov rsi, qword [rsi]
test rsi, rsi
je 0x140031524
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1400313f0
lea rcx, [rsp + 0xd8]
add qword [rcx], 0xf4240
lea rdx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x1400313ff
xor ebp, ebp
mov rcx, rsi
call fcn.140054b24
jmp 0x140031526
lea rbx, [rsp + 0xe0]
movupd xmm0, xmmword [rbx]
movapd xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov eax, dword [rsp + 0xd0]
mov dword [rcx + 8], eax
xor eax, eax
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x9c], eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1400314a9
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1400314a9
movq xmm0, qword [rsp + 0xe0]
movq xmm1, qword [rsp + 0xd8]
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0x50
movmskpd eax, xmm0
cmp al, 3
je 0x14003154c
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Hash_is_too_close_to_expiration__sleeping_until_next_hash.
lea r8, str.SetUserChoice
mov r9d, 0x77
call fcn.14002b7d0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r15, [rsp + 0xc8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [r15]
lea rax, [rsp + 0x70]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0xe0]
mov rcx, r15
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400582e0
mov r14, qword [r15]
mov rcx, rsi
call fcn.140054b24
mov rsi, r14
test r14, r14
jne 0x14003154c
xor ebp, ebp
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140055a90
mov eax, ebp
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0xd8]
mov rcx, r14
mov rdx, rdi
call fcn.140058260
mov rdi, qword [r14]
test rdi, rdi
je 0x1400313f0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031698
mov r14, qword [rsp + 0x68]
lea rdx, [0x1400a305e]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14003177e
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
lea rdx, [0x1400a305e]
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400317f3
mov r15, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
lea rdx, str.ProgID
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400318e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, str.Hash
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bpl, 1
test eax, eax
jne 0x14003195a
test r15, r15
je 0x14003167d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14003168b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140054b24
jmp 0x1400313f2
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x8c
call fcn.140057a20
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, r12
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003176f
mov r15, rax
mov qword [rsp + 0xe0], r14
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
xor ebp, ebp
jmp 0x14003168b
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x96
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140054b1c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x96
jmp 0x140031866
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xa0
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140054b1c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa0
mov rcx, r15
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400318d1
mov r12, rax
mov qword [rsp + 0xe0], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140054b24
xor ebp, ebp
jmp 0x14003167d
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xaa
call fcn.140057a20
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xaa
jmp 0x1400319d2
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xb3
call fcn.140057a20
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xb3
mov rcx, r12
mov rdx, qword [rsp + 0x58]
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140031a3f
mov r13, rax
mov qword [rsp + 0xe0], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140054b24
xor ebp, ebp
jmp 0x14003166f