Function at 0x140031e90
Capabilities:
Access the windows event log
Delete registry key
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov r12, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rsi, [rsp + 0xc8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [rsi]
lea rax, [rsp + 0xb0]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400591d0
mov rsi, qword [rsi]
test rsi, rsi
je 0x140032084
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140031f50
lea rcx, [rsp + 0xd8]
add qword [rcx], 0xf4240
lea rdx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x140031f5f
xor ebp, ebp
mov rcx, rsi
call fcn.140055a14
jmp 0x140032086
lea rbx, [rsp + 0xe0]
movupd xmm0, xmmword [rbx]
movapd xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov eax, dword [rsp + 0xd0]
mov dword [rcx + 8], eax
xor eax, eax
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x9c], eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140032009
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140032009
movq xmm0, qword [rsp + 0xe0]
movq xmm1, qword [rsp + 0xd8]
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0x50
movmskpd eax, xmm0
cmp al, 3
je 0x1400320ac
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Hash_is_too_close_to_expiration__sleeping_until_next_hash.
lea r8, str.SetUserChoice
mov r9d, 0x77
call fcn.14002c330
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r15, [rsp + 0xc8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movupd xmm0, xmmword [r15]
lea rax, [rsp + 0x70]
movapd xmmword [rax], xmm0
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0xe0]
mov rcx, r15
mov rdx, rdi
mov r8, r14
mov r9, r12
call fcn.1400591d0
mov r14, qword [r15]
mov rcx, rsi
call fcn.140055a14
mov rsi, r14
test r14, r14
jne 0x1400320ac
xor ebp, ebp
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140056980
mov eax, ebp
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0xd8]
mov rcx, r14
mov rdx, rdi
call fcn.140059150
mov rdi, qword [r14]
test rdi, rdi
je 0x140031f50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400321f8
mov r14, qword [rsp + 0x68]
lea rdx, [0x1400a40de]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400322de
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
lea rdx, [0x1400a40de]
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140032353
mov r15, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
lea rdx, str.ProgID
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140032440
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, str.Hash
mov rcx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bpl, 1
test eax, eax
jne 0x1400324ba
test r15, r15
je 0x1400321dd
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x1400321eb
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140055a14
jmp 0x140031f52
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x8c
call fcn.140058910
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, r12
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400322cf
mov r15, rax
mov qword [rsp + 0xe0], r14
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
xor ebp, ebp
jmp 0x1400321eb
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0x96
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055a0c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x96
jmp 0x1400323c6
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xa0
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055a0c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa0
mov rcx, r15
mov rdx, r13
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032431
mov r12, rax
mov qword [rsp + 0xe0], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055a14
xor ebp, ebp
jmp 0x1400321dd
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xaa
call fcn.140058910
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xaa
jmp 0x140032532
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x50], rax
lea rcx, str.0x_X_in__S:_d
lea r8, str.SetUserChoice
mov edx, ebp
mov r9d, 0xb3
call fcn.140058910
cdqe
lea rcx, [rax + 1]
mov qword [rsp + 0x58], rcx
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
lea rax, str.SetUserChoice
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xb3
mov rcx, r12
mov rdx, qword [rsp + 0x58]
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003259f
mov r13, rax
mov qword [rsp + 0xe0], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r13
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140055a14
xor ebp, ebp
jmp 0x1400321cf