Function at 0x1400325b0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400660a0]
lea r9, str._n_vSN
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003271a
xor r8d, r8d
cmp word [rdi], 0x2e
setne r8b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov rdx, rdi
mov r9d, 2
call qword [0x1400b0010]
test eax, eax
js 0x1400326a8
mov r14, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
mov rcx, r14
mov edx, 0xffffffff
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
sete bl
je 0x140032698
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, str.Default_was__s_after_writing_ProgID__s_to_UserChoice_for__s
lea r8, str.VerifyUserDefault
mov r9d, 0xda
call fcn.14002c330
test r14, r14
je 0x1400326e4
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400326e4
mov ebx, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
cmp eax, 0x80070483
jne 0x140032790
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea rdx, str.UserChoice_ProgID__s_for__s_was_rejected
lea r8, str.VerifyUserDefault
mov rcx, r14
mov r9d, 0xcd
call fcn.14002c330
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400326fb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140056980
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, eax
mov rdi, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.VerifyUserDefault
mov rcx, r14
mov edx, eax
mov r8, r15
mov r9d, 0xc0
call fcn.140058910
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 0xc0
mov rcx, rsi
mov rdx, r12
mov r9, r14
call fcn.140058990
xor ecx, ecx
mov rdx, rdi
jmp 0x1400327fb
lea rdi, str.0x_X_in__S:_d
lea r15, str.VerifyUserDefault
mov rcx, rdi
mov edx, ebx
mov r8, r15
mov r9d, 0xcf
call fcn.140058910
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 0xcf
mov rcx, rsi
mov rdx, r12
mov r9, rdi
call fcn.140058990
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003284d
mov rdi, rax
lea rax, [rsp + 0x60]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140055a14
jmp 0x1400326e2