Function at 0x140031e60
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea r8, [0x1400a2e74]
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
xor r9d, r9d
call fcn.14002e710
cmp dword [r14 + 0x28], 0
je 0x140032448
mov rcx, r13
xor edx, edx
call fcn.140034640
lea rax, [rsp + 0x230]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140066030]
lea r9, [0x140066020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140032613
mov rcx, qword [rsp + 0x230]
xorps xmm0, xmm0
lea r10, [rsp + 0x1e0]
movaps xmmword [r10], xmm0
xor eax, eax
mov qword [r10 + 0x10], rax
lea r9, [rsp + 0x1c0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x1a0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], r10
call qword [0x1400af010]
test eax, eax
js 0x140032684
xor edi, edi
mov qword [rsp + 0x178], rdi
lea rcx, [0x1400a4210]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rdi
test rcx, rcx
je 0x140031f9e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x178]
mov rcx, rsi
mov rdx, r12
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x14003276c
xor ebx, ebx
mov qword [rsp + 0x170], rbx
lea rcx, [0x1400a41b4]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], rbx
test rcx, rcx
je 0x140032009
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [rdi]
mov rax, qword [rax + 0x48]
lea r8, [rsp + 0x170]
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
call qword [0x1400af010]
test eax, eax
js 0x140032037
mov dword [rsp + 0x6c], 0
jmp 0x1400320a7
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
je 0x140032065
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
xorps xmm0, xmm0
lea r8, [rsp + 0x150]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x170]
mov rcx, rsi
mov rdx, rbx
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x140032432
mov al, 1
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x230]
lea r8, [rsp + 0x148]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x14003285c
mov qword [rsp + 0x140], 0
lea rdi, [rsp + 0x280]
mov rcx, rdi
xor edx, edx
call fcn.140001280
mov r14, qword [rdi]
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp rax, 0x103
jbe 0x140032954
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_get_install_directory
lea r8, str.GetTaskDescription
mov r9d, 0x35
call fcn.14002cc90
xor edi, edi
test r14, r14
je 0x140032139
mov rcx, r14
call fcn.140056c84
mov ebp, 0x80004005
test dil, dil
je 0x140033869
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x138]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x140032a47
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov rdx, rdi
call qword [0x1400af010]
test eax, eax
js 0x140032ac2
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400af010]
test eax, eax
js 0x140032bcb
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x140032c49
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x140032cc7
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
mov dx, 0xffff
call qword [0x1400af010]
test eax, eax
js 0x140032d45
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x140032dc0
lea rcx, str.PT12H5M
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe0]
mov qword [rsp + 0x70], rdx
call qword [0x1400af010]
test eax, eax
js 0x140032ec9
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x140032fd7
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov rdx, rbx
call qword [0x1400af010]
test eax, eax
js 0x140033052
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x120]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400af010]
test eax, eax
js 0x140033160
mov rcx, qword [rsp + 0x120]
lea r8, [rsp + 0x118]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x14003326e
mov rcx, qword [rsp + 0x118]
lea r8, [rsp + 0x110]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [0x140066010]
call qword [0x1400af010]
test eax, eax
js 0x140033377
test r15, r15
jne 0x1400333f5
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add rax, 0xffffffffffffffc4
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
jne 0x14003359a
mov ecx, 0x2a
call fcn.140056c40
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x1a], xmm0
lea r8, str._Y__m__dT_H:_M:_SZ
lea r9, [rsp + 0x280]
mov edx, 0x15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
test rax, rax
je 0x140033697
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r14
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x14003395e
test r14, r14
je 0x14003241d
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call fcn.140056c84
test ebp, ebp
js 0x1400337ac
jmp 0x14003348f
cmp esi, 0x800700b7
jne 0x140033b96
mov esi, 0x800700b7
jmp 0x14003202d
lea rdi, [rsp + 0x2a8]
lea rsi, [rsp + 0x278]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, rdi
call fcn.14005b4d0
cmp byte [rsi - 8], 0
je 0x1400325e6
lea rcx, [rsp + 0x250]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.14005b1a0
lea rbx, [0x1400a2e74]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8, rbx
call fcn.14002ec90
lea rcx, [rsp + 0x200]
mov edx, 1
mov r8, rbx
xor r9d, r9d
call fcn.14002e710
cmp dword [rsp + 0x2a8], 0
jne 0x1400324dc
lea rcx, [rsp + 0x280]
call fcn.14005b250
mov eax, dword [rsp + 0x228]
mov dword [rsp + 0x2a8], eax
test eax, eax
jne 0x14003259f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
mov byte [rsp + 0x2a0], 0
mov rcx, rdi
mov rdx, rbx
call fcn.14005b4d0
cmp dword [rbx], 0
jne 0x140032532
lea rcx, [rsp + 0x200]
call fcn.14005b250
cmp dword [rsp + 0x2a8], 0
jne 0x14003259f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rbx - 0x18], xmm0
movaps xmmword [rbx - 0x28], xmm0
mov byte [rbx - 8], 0
mov rcx, rbx
mov rdx, rdi
call fcn.14005b4d0
mov bl, byte [rbx - 8]
lea rcx, [rsp + 0x200]
call fcn.14005b250
test bl, bl
jne 0x14003259f
cmp qword [rsp + 0x248], 0x10
jb 0x140032585
mov rsi, qword [rsp + 0x230]
lea rdx, [0x1400a2e74]
lea rcx, [rsp + 0x200]
mov r8, rsi
xor r9d, r9d
call fcn.14002db50
mov rax, qword [rsp + 0x248]
cmp rax, 0x10
jb 0x1400325e6
mov rcx, qword [rsp + 0x230]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400325e1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034634
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
lea rcx, [rsp + 0x250]
call fcn.14005b250
cmp dword [rsp + 0x2a8], 0
jne 0x140031eb2
lea rcx, [rsp + 0x280]
call fcn.14005b250
jmp 0x140031eb2
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x60
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x60
jmp 0x1400326f3
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x62
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x62
mov rcx, rdi
mov rdx, r13
mov r8, 0xffffffffffffffff
mov r9, r15
call fcn.140059ac0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003275f
mov rbx, rax
mov qword [rsp + 0x280], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
jmp 0x14003391e
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, esi
mov r8, rdi
mov r9d, 0x67
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x67
mov rcx, rbx
mov rdx, r13
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003284a
mov rdi, rax
mov qword [rsp + 0x280], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
mov r12, qword [rsp + 0x50]
jmp 0x1400338f6
mov ebp, eax
mov qword [rsp + 0x50], r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0x82
call fcn.140059a40
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x82
mov rcx, r15
mov rdx, rbx
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003293d
mov rdi, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
jmp 0x140033887
mov qword [rsp + 0x50], r12
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r12, str._sdefaultagent_localized.ini
mov rcx, r12
mov rdx, r14
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
mov rcx, rbp
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
lea rdi, [rsp + 0x280]
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
call fcn.14002b960
lea rdx, str.DefaultBrowserAgentTaskDescription
lea r8, [rsp + 0x140]
mov rcx, rdi
call fcn.14002ba70
mov rcx, rdi
call fcn.14002be30
test eax, eax
sete dil
je 0x140032a23
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_read_task_description:__d
lea r8, str.GetTaskDescription
mov r9d, 0x44
call fcn.14002cc90
lea rcx, [rsp + 0x280]
call fcn.140031d00
mov rcx, rbp
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
jmp 0x14003212c
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8b
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8b
jmp 0x140032b3b
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8c
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032baf
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033841
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x8f
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8f
jmp 0x140032e39
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x90
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x90
jmp 0x140032e39
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x91
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x91
jmp 0x140032e39
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x92
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x92
jmp 0x140032e39
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x93
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x93
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032ead
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033827
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9a
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9a
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032fb6
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140033819
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9d
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9d
jmp 0x1400330cb
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0x9f
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9f
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003313f
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x1400337ff
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa2
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa2
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003324d
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x1400337e5
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa5
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa5
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003335b
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400337c6
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xa9
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa9
jmp 0x14003352c
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r15
call qword [0x1400af010]
test eax, eax
jns 0x14003348f
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xac
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xac
jmp 0x14003352c
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
mov dx, 1
call qword [0x1400af010]
test eax, eax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
jns 0x140033a68
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xd9
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd9
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003368f
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
jmp 0x140033680
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov ebp, 0x8007076d
mov rcx, r12
mov edx, 0x8007076d
mov r8, r13
mov r9d, 0xc7
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xc7
mov dword [rsp + 0x20], 0x8007076d
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003368f
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007076d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
jmp 0x140033798
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov ebp, 0x8007007a
mov edx, 0x8007007a
mov r8, r13
mov r9d, 0xd1
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], 0xd1
mov dword [rsp + 0x20], 0x8007007a
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003378d
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov rcx, r15
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x1400337c6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x1400337e5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x1400337ff
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140033819
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r14, r14
je 0x140033827
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140033841
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x14003385b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test rdi, rdi
je 0x140033869
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], 0
test rcx, rcx
je 0x140033887
call fcn.140056c84
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x1400338a1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test esi, esi
setns al
mov ecx, dword [rsp + 0x6c]
xor cl, 1
or cl, al
jne 0x1400338cc
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
mov rdx, rbx
xor r8d, r8d
call qword [0x1400af010]
mov esi, ebp
test rbx, rbx
je 0x1400338dc
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x1400338f6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r12, r12
je 0x140033904
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x14003391e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x230]
test rcx, rcx
je 0x140033938
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140057bf0
mov eax, esi
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x78], rax
lea rcx, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov edx, ebp
mov r8, r12
mov r9d, 0xd6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov rcx, rax
xor edx, edx
mov r8, rbx
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd6
mov rcx, rbx
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033a4c
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14003240f
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x108]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [0x1400af010]
test eax, eax
jns 0x140033c88
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xdc
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdc
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033b7a
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400344f0
mov rbx, r12
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rbp, str.RegisterTask
mov edx, esi
mov r8, rbp
mov r9d, 0x73
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x73
mov rcx, r15
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033c73
mov rdi, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140056c84
mov r12, rbx
mov rbx, qword [rsp + 0x60]
jmp 0x1400338ce
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
xor edx, edx
call qword [0x1400af010]
test eax, eax
jns 0x140033db5
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xdf
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdf
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033d99
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400344d6
mov rcx, qword [rsp + 0x100]
lea r8, [rsp + 0xf8]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.MbLk
call qword [0x1400af010]
test eax, eax
jns 0x140033ee6
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r13, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r13
mov edx, eax
mov r8, r12
mov r9d, 0xe2
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe2
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r13
call fcn.140059ac0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033eca
mov rdi, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400344bc
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
call fcn.140001280
mov rcx, qword [r14]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
mov rcx, qword [r14]
mov qword [r14], 0
test rcx, rcx
je 0x140033f18
call fcn.140056c84
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
mov rdx, r15
call qword [0x1400af010]
test eax, eax
mov qword [rsp + 0x78], r15
jns 0x14003403a
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r15, str.RegisterTask
mov edx, eax
mov r8, r15
mov r9d, 0xe6
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe6
mov rcx, r12
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034019
mov rdi, rax
mov qword [rsp + 0x280], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x78]
jmp 0x1400344ae
xor eax, eax
lea r14, [rsp + 0x280]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r9, str.do_task__
mov edx, 9
mov rcx, r14
call fcn.14005ab20
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400340a2
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x280]
mov rdx, rax
mov r9, r13
call fcn.14005ac50
jmp 0x1400340db
mov r15, rdi
lea rdi, [rcx + rax]
mov qword [rsp + 0x290], rdi
cmp rdx, 8
jb 0x1400340bf
mov r14, qword [rsp + 0x280]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
mov rdi, r15
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
cmp rcx, rax
jne 0x140034114
mov qword [rsp + 0x20], 1
lea r9, [0x1400a4d8e]
lea rcx, [rsp + 0x280]
mov edx, 1
call fcn.14005ac50
jmp 0x140034145
lea rdx, [rax + 1]
mov qword [rsp + 0x290], rdx
cmp rcx, 8
jb 0x140034130
mov rcx, qword [rsp + 0x280]
jmp 0x140034138
lea rcx, [rsp + 0x280]
mov word [rcx + rax*2], 0x22
mov word [rcx + rax*2 + 2], 0
cmp qword [rsp + 0x298], 8
jb 0x14003415a
mov rcx, qword [rsp + 0x280]
jmp 0x140034162
lea rcx, [rsp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x80], rdx
call qword [0x1400af010]
test eax, eax
jns 0x14003428a
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r15, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, r15
mov r9d, 0xec
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xec
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140059ac0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003426e
mov rdi, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034448
mov r15, rdi
xor eax, eax
lea r14, [rsp + 0x200]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r9, [0x1400a4d92]
mov edx, 0x1e
mov rcx, r14
call fcn.14005ab20
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jb 0x140034513
lea rdi, [rcx + rax]
mov qword [rsp + 0x210], rdi
cmp rdx, 8
jb 0x1400342f9
mov r14, qword [rsp + 0x200]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
cmp qword [rsp + 0x218], 8
mov rdi, r15
jb 0x14003432a
mov rcx, qword [rsp + 0x200]
jmp 0x140034332
lea rcx, [rsp + 0x200]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rcx, qword [rsp + 0x170]
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r9, [rsp + 0xd0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r10, [rsp + 0xb0]
movaps xmmword [r10], xmm0
mov qword [r10 + 0x10], rax
lea r11, [rsp + 0x90]
movaps xmmword [r11], xmm0
mov qword [r11 + 0x10], rax
mov r8, qword [rsp + 0x148]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 3
mov rdx, r13
mov r9d, 6
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x140034530
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400343e4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r13, r13
je 0x1400343f2
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x218]
cmp rax, 8
jb 0x140034448
mov rcx, qword [rsp + 0x200]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003443b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034634
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
mov rbx, qword [rsp + 0x60]
mov rdi, r15
mov r14, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140034460
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x298]
cmp rax, 8
jb 0x1400344ae
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400344a9
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034634
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140056c84
test r14, r14
je 0x1400344bc
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400344d6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400344f0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x1400337ac
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
jmp 0x1400337ac
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x200]
mov rdx, rax
mov r9, r13
call fcn.14005ac50
jmp 0x140034312
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x88], rax
lea rcx, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov edx, ebp
mov r8, r12
mov r9d, 0xf5
call fcn.140059a40
cdqe
lea rdi, [rax + 1]
lea rbx, [rax + rax]
add rbx, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbx, rax
mov rcx, rbx
call fcn.140056c40
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xf5
mov rcx, r14
mov rdx, rdi
mov r8, 0xffffffffffffffff
lea r9, str.0x_X_in__S:_d
call fcn.140059ac0
xor ecx, ecx
mov rdx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003461a
mov rdi, rax
lea rax, [rsp + 0x250]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140056c84
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, r15
jmp 0x1400343ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3