Function at 0x1400330a0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea r8, [0x1400a3086]
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
xor r9d, r9d
call fcn.14002da30
cmp dword [r14 + 0x28], 0
je 0x140033688
mov rcx, r13
xor edx, edx
call fcn.140035690
lea rax, [rsp + 0x230]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140066030]
lea r9, [0x140066020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140033853
mov rcx, qword [rsp + 0x230]
xorps xmm0, xmm0
lea r10, [rsp + 0x1e0]
movaps xmmword [r10], xmm0
xor eax, eax
mov qword [r10 + 0x10], rax
lea r9, [rsp + 0x1c0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x1a0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], r10
call qword [0x1400b0010]
test eax, eax
js 0x1400338b6
xor edi, edi
mov qword [rsp + 0x178], rdi
lea rcx, [0x1400a456a]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rdi
test rcx, rcx
je 0x1400331de
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x178]
mov rcx, rsi
mov rdx, rbx
call qword [0x1400b0010]
mov esi, eax
test eax, eax
js 0x140033989
xor edi, edi
mov qword [rsp + 0x170], rdi
lea rcx, [0x1400a450e]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], rdi
test rcx, rcx
je 0x140033249
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rax, qword [r12]
mov rax, qword [rax + 0x48]
lea r8, [rsp + 0x170]
mov rcx, r12
mov r12, qword [rsp + 0x60]
mov rdx, r12
call qword [0x1400b0010]
test eax, eax
js 0x140033278
mov dword [rsp + 0x6c], 0
jmp 0x1400332e8
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
je 0x1400332a6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
xorps xmm0, xmm0
lea r8, [rsp + 0x150]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x170]
mov rcx, rsi
mov rdx, r12
call qword [0x1400b0010]
mov esi, eax
test eax, eax
js 0x140033672
mov al, 1
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x230]
lea r8, [rsp + 0x148]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x140033a64
mov qword [rsp + 0x140], 0
lea rdi, [rsp + 0x280]
mov rcx, rdi
call fcn.1400010c0
mov r14, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 0x103
jbe 0x140033b47
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_get_install_directory
lea r8, str.GetTaskDescription
mov r9d, 0x35
call fcn.14002c330
xor edi, edi
test r14, r14
je 0x140033379
mov rcx, r14
call fcn.140055a14
mov ebp, 0x80004005
test dil, dil
je 0x140034983
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x138]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400b0010]
test eax, eax
js 0x140033c8e
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov rdx, rdi
call qword [0x1400b0010]
test eax, eax
js 0x140033cfb
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400b0010]
test eax, eax
js 0x140033def
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x140033e5f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
mov edx, 2
call qword [0x1400b0010]
test eax, eax
js 0x140033ecf
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
mov dx, 0xffff
call qword [0x1400b0010]
test eax, eax
js 0x140033f3f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x140033fac
lea rcx, str.PT12H5M
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe0]
mov qword [rsp + 0x70], rdx
call qword [0x1400b0010]
test eax, eax
js 0x1400340a0
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400b0010]
test eax, eax
js 0x140034199
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov rdx, r12
call qword [0x1400b0010]
test eax, eax
js 0x140034206
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x120]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400b0010]
test eax, eax
js 0x1400342ff
mov rcx, qword [rsp + 0x120]
lea r8, [rsp + 0x118]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov edx, 2
call qword [0x1400b0010]
test eax, eax
js 0x1400343f8
mov rcx, qword [rsp + 0x118]
lea r8, [rsp + 0x110]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [0x140066010]
call qword [0x1400b0010]
test eax, eax
js 0x1400344ec
test r15, r15
jne 0x14003455c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add rax, 0xffffffffffffffc4
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
jne 0x1400346de
mov ecx, 0x2a
call fcn.140055a0c
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x1a], xmm0
lea r8, str._Y__m__dT_H:_M:_SZ
lea r9, [rsp + 0x280]
mov edx, 0x15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
test rax, rax
je 0x1400347c6
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r14
call qword [0x1400b0010]
mov ebp, eax
test eax, eax
js 0x140034a78
test r14, r14
je 0x14003365d
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call fcn.140055a14
test ebp, ebp
js 0x1400348c6
jmp 0x1400345e8
cmp esi, 0x800700b7
jne 0x140034c83
mov esi, 0x800700b7
jmp 0x14003326e
lea rdi, [rsp + 0x2a8]
lea rsi, [rsp + 0x278]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, rdi
call fcn.14005a360
cmp byte [rsi - 8], 0
je 0x140033826
lea rcx, [rsp + 0x250]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.14005a3d0
lea rbx, [0x1400a3086]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8, rbx
call fcn.14002d7b0
lea rcx, [rsp + 0x200]
mov edx, 1
mov r8, rbx
xor r9d, r9d
call fcn.14002da30
cmp dword [rsp + 0x2a8], 0
jne 0x14003371c
lea rcx, [rsp + 0x280]
call fcn.14005a480
mov eax, dword [rsp + 0x228]
mov dword [rsp + 0x2a8], eax
test eax, eax
jne 0x1400337df
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
mov byte [rsp + 0x2a0], 0
mov rcx, rdi
mov rdx, rbx
call fcn.14005a360
cmp dword [rbx], 0
jne 0x140033772
lea rcx, [rsp + 0x200]
call fcn.14005a480
cmp dword [rsp + 0x2a8], 0
jne 0x1400337df
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rbx - 0x18], xmm0
movaps xmmword [rbx - 0x28], xmm0
mov byte [rbx - 8], 0
mov rcx, rbx
mov rdx, rdi
call fcn.14005a360
mov bl, byte [rbx - 8]
lea rcx, [rsp + 0x200]
call fcn.14005a480
test bl, bl
jne 0x1400337df
cmp qword [rsp + 0x248], 0x10
jb 0x1400337c5
mov rsi, qword [rsp + 0x230]
lea rdx, [0x1400a3086]
lea rcx, [rsp + 0x200]
mov r8, rsi
xor r9d, r9d
call fcn.14002d130
mov rax, qword [rsp + 0x248]
cmp rax, 0x10
jb 0x140033826
mov rcx, qword [rsp + 0x230]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140033821
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035684
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055a14
lea rcx, [rsp + 0x250]
call fcn.14005a480
cmp dword [rsp + 0x2a8], 0
jne 0x1400330f2
lea rcx, [rsp + 0x280]
call fcn.14005a480
jmp 0x1400330f2
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x60
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x60
jmp 0x140033917
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x62
call fcn.140058910
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055a0c
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x62
mov rcx, rdi
mov rdx, r13
mov r9, r15
call fcn.140058990
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003397c
mov rbx, rax
mov qword [rsp + 0x280], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140055a14
jmp 0x140034a38
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov rcx, r12
mov edx, esi
mov r8, r13
mov r9d, 0x67
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x67
mov rcx, rbx
mov rdx, rbp
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033a52
mov r15, rax
mov qword [rsp + 0x280], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
jmp 0x140034a10
mov ebp, eax
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0x82
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x82
mov rcx, r15
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033b30
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x1400349a1
mov qword [rsp + 0x50], rbx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdi, str._sdefaultagent_localized.ini
mov rcx, rdi
mov rdx, r14
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055a0c
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
mov rcx, rbp
mov rdx, rbx
mov r9, rdi
call fcn.140058990
lea r12, [rsp + 0x280]
mov byte [r12 + 0x5c], 0
xorps xmm0, xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x49], xmm0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rax + rax]
add rcx, 2
inc rax
mov rdi, 0xffffffffffffffff
cmovns rdi, rcx
mov rcx, rdi
call fcn.140055a0c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [r12], rbx
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov qword [r12 + 8], 0
lea rdx, str.DefaultBrowserAgentTaskDescription
lea r8, [rsp + 0x140]
mov rcx, r12
call fcn.14002ab10
mov rcx, r12
call fcn.14002aed0
test eax, eax
sete dil
je 0x140033c6a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_read_task_description:__d
lea r8, str.GetTaskDescription
mov r9d, 0x44
call fcn.14002c330
lea rcx, [rsp + 0x280]
call fcn.140030e20
mov rcx, rbp
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x14003336c
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8b
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8b
jmp 0x140033d66
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8c
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033dd3
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14003495b
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8f
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8f
jmp 0x140034017
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x90
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x90
jmp 0x140034017
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x91
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x91
jmp 0x140034017
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x92
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x92
jmp 0x140034017
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x93
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x93
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034084
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034941
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9a
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9a
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034178
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140034933
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9d
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9d
jmp 0x140034271
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9f
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9f
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400342de
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140034919
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa2
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400343d7
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x1400348ff
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa5
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa5
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400344d0
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400348e0
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa9
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa9
jmp 0x140034677
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r15
call qword [0x1400b0010]
test eax, eax
jns 0x1400345e8
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xac
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xac
jmp 0x140034677
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
mov dx, 1
call qword [0x1400b0010]
test eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
jns 0x140034b6a
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xd9
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd9
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400347be
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
jmp 0x1400347af
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007076d
mov rcx, r12
mov edx, 0x8007076d
mov r8, rdi
mov r9d, 0xc7
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xc7
mov dword [rsp + 0x20], 0x8007076d
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400347be
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007076d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
jmp 0x1400348b2
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007007a
mov edx, 0x8007007a
mov r8, rdi
mov r9d, 0xd1
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xd1
mov dword [rsp + 0x20], 0x8007007a
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400348a7
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rcx, r15
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x1400348e0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x1400348ff
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x140034919
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140034933
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test r14, r14
je 0x140034941
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x14003495b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x140034975
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test rdi, rdi
je 0x140034983
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], 0
test rcx, rcx
je 0x1400349a1
call fcn.140055a14
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x1400349bb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test esi, esi
setns al
mov ecx, dword [rsp + 0x6c]
xor cl, 1
or cl, al
jne 0x1400349e6
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
mov rdx, r12
xor r8d, r8d
call qword [0x1400b0010]
mov esi, ebp
test r12, r12
je 0x1400349f6
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140034a10
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test rbx, rbx
je 0x140034a1e
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x140034a38
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x230]
test rcx, rcx
je 0x140034a52
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140056980
mov eax, esi
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegisterTask
mov edx, ebp
mov r9d, 0xd6
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055a0c
mov rcx, rax
xor edx, edx
mov r8, rdi
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegisterTask
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd6
mov rcx, rdi
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034b4e
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14003364f
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x108]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [0x1400b0010]
test eax, eax
jns 0x140034d5a
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdc
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdc
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034c67
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140035557
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, esi
mov r8, rdi
mov r9d, 0x73
call fcn.140058910
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x73
mov rcx, r15
mov rdx, rbp
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034d48
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055a14
mov r12, qword [rsp + 0x60]
jmp 0x1400349e8
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
jns 0x140034e72
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdf
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdf
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034e56
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14003553d
mov rcx, qword [rsp + 0x100]
lea r8, [rsp + 0xf8]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.MbLk
call qword [0x1400b0010]
test eax, eax
jns 0x140034f8e
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xe2
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034f72
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140035523
lea r14, [rsp + 0x280]
mov rcx, r14
call fcn.1400010c0
mov r15, qword [r14]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
test r15, r15
je 0x140034fba
mov rcx, r15
call fcn.140055a14
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x88], rbp
mov rdx, rbp
call qword [0x1400b0010]
test eax, eax
jns 0x1400350c5
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0xe6
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055a0c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe6
mov rcx, r12
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400350a9
mov r15, rax
mov qword [rsp + 0x280], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140035510
xor eax, eax
lea r14, [rsp + 0x280]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.do_task__
mov edx, 9
mov rcx, r14
call fcn.140059cf0
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x14003512c
lea rcx, [rsp + 0x280]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.14005a1d0
jmp 0x140035165
mov r15, rdi
lea rdi, [rcx + rax]
mov qword [rsp + 0x290], rdi
cmp rdx, 8
jb 0x140035149
mov r14, qword [rsp + 0x280]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
mov rdi, r15
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
cmp rcx, rax
jne 0x14003519b
lea r8, [0x1400a50fa]
lea rcx, [rsp + 0x280]
mov edx, 1
mov r9d, 1
call fcn.14005a1d0
jmp 0x1400351c6
lea rdx, [rax + 1]
mov qword [rsp + 0x290], rdx
cmp rcx, 8
jb 0x1400351b7
mov rcx, qword [rsp + 0x280]
jmp 0x1400351bf
lea rcx, [rsp + 0x280]
mov dword [rcx + rax*2], 0x22
cmp qword [rsp + 0x298], 8
jb 0x1400351db
mov rcx, qword [rsp + 0x280]
jmp 0x1400351e3
lea rcx, [rsp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x78], rdx
call qword [0x1400b0010]
test eax, eax
jns 0x1400352f3
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xec
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xec
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058990
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400352d7
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400354b2
mov r15, rdi
xor eax, eax
lea r14, [rsp + 0x200]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, [0x1400a50fe]
mov edx, 0x1e
mov rcx, r14
call fcn.140059cf0
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jb 0x14003557a
lea rdi, [rcx + rax]
mov qword [rsp + 0x210], rdi
cmp rdx, 8
jb 0x140035363
mov r14, qword [rsp + 0x200]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
cmp qword [rsp + 0x218], 8
mov rdi, r15
jb 0x140035394
mov rcx, qword [rsp + 0x200]
jmp 0x14003539c
lea rcx, [rsp + 0x200]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rcx, qword [rsp + 0x170]
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r9, [rsp + 0xd0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r10, [rsp + 0xb0]
movaps xmmword [r10], xmm0
mov qword [r10 + 0x10], rax
lea r11, [rsp + 0x90]
movaps xmmword [r11], xmm0
mov qword [r11 + 0x10], rax
mov r8, qword [rsp + 0x148]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 3
mov rdx, r13
mov r9d, 6
call qword [0x1400b0010]
mov ebp, eax
test eax, eax
js 0x140035595
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x14003544e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test r13, r13
je 0x14003545c
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x218]
cmp rax, 8
jb 0x1400354b2
mov rcx, qword [rsp + 0x200]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400354a5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035684
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov r12, qword [rsp + 0x60]
mov rdi, r15
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400354c2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x298]
cmp rax, 8
jb 0x140035510
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003550b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035684
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055a14
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140035523
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14003553d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140035557
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x1400348c6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
jmp 0x1400348c6
lea rcx, [rsp + 0x200]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.14005a1d0
jmp 0x14003537c
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x80], rax
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, ebp
mov r8, rdi
mov r9d, 0xf5
call fcn.140058910
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055a0c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xf5
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058990
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003566a
mov rdi, rax
lea rax, [rsp + 0x250]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055a14
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, r15
jmp 0x140035434
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3