Function at 0x140035d20
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1400660a0]
lea r9, str._n_vSN
xor edx, edx
mov r8d, 3
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140035e8b
xor r8d, r8d
cmp word [rbx], 0x2e
setne r8b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r9d, 2
call qword [0x1400af010]
test eax, eax
js 0x140035e19
mov r14, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
mov rcx, r14
mov edx, 0xffffffff
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
sete sil
je 0x140035e09
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
lea rdx, str.Default_was__s_after_writing_ProgID__s_to_UserChoice_for__s
lea r8, str.VerifyUserDefault
mov r9d, 0xda
call fcn.14002cc90
test r14, r14
je 0x140035e55
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140035e55
mov esi, eax
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
cmp eax, 0x80070483
jne 0x140035f19
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea rdx, str.UserChoice_ProgID__s_for__s_was_rejected
lea r8, str.VerifyUserDefault
mov rcx, r14
mov r9d, 0xcd
call fcn.14002cc90
xor esi, esi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140035e6c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140057bf0
mov eax, esi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.VerifyUserDefault
mov rcx, r14
mov edx, eax
mov r8, r15
mov r9d, 0xc0
call fcn.140059a40
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0xc0
mov rcx, rdi
mov rdx, r12
mov r8, 0xffffffffffffffff
mov r9, r14
call fcn.140059ac0
xor ecx, ecx
mov rdx, rbx
jmp 0x140035f99
lea rbx, str.0x_X_in__S:_d
lea r15, str.VerifyUserDefault
mov rcx, rbx
mov edx, esi
mov r8, r15
mov r9d, 0xcf
call fcn.140059a40
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0xcf
mov rcx, rdi
mov rdx, r12
mov r8, 0xffffffffffffffff
mov r9, rbx
call fcn.140059ac0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140035feb
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
jmp 0x140035e53