Function at 0x140032540
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ab070]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea r8, [0x1400a2006]
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
xor r9d, r9d
call fcn.14002ced0
cmp dword [r14 + 0x28], 0
je 0x140032b28
mov rcx, r13
xor edx, edx
call fcn.140034b30
lea rax, [rsp + 0x230]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140065030]
lea r9, [0x140065020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140032cf3
mov rcx, qword [rsp + 0x230]
xorps xmm0, xmm0
lea r10, [rsp + 0x1e0]
movaps xmmword [r10], xmm0
xor eax, eax
mov qword [r10 + 0x10], rax
lea r9, [rsp + 0x1c0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x1a0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], r10
call qword [0x1400af010]
test eax, eax
js 0x140032d56
xor edi, edi
mov qword [rsp + 0x178], rdi
lea rcx, [0x1400a34ea]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rdi
test rcx, rcx
je 0x14003267e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x178]
mov rcx, rsi
mov rdx, rbx
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x140032e29
xor edi, edi
mov qword [rsp + 0x170], rdi
lea rcx, [0x1400a348e]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], rdi
test rcx, rcx
je 0x1400326e9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rax, qword [r12]
mov rax, qword [rax + 0x48]
lea r8, [rsp + 0x170]
mov rcx, r12
mov r12, qword [rsp + 0x60]
mov rdx, r12
call qword [0x1400af010]
test eax, eax
js 0x140032718
mov dword [rsp + 0x6c], 0
jmp 0x140032788
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
je 0x140032746
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
xorps xmm0, xmm0
lea r8, [rsp + 0x150]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x170]
mov rcx, rsi
mov rdx, r12
call qword [0x1400af010]
mov esi, eax
test eax, eax
js 0x140032b12
mov al, 1
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x230]
lea r8, [rsp + 0x148]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x140032f04
mov qword [rsp + 0x140], 0
lea rdi, [rsp + 0x280]
mov rcx, rdi
call fcn.140001100
mov r14, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 0x103
jbe 0x140032fe7
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_get_install_directory
lea r8, str.GetTaskDescription
mov r9d, 0x35
call fcn.14002b7d0
xor edi, edi
test r14, r14
je 0x140032819
mov rcx, r14
call fcn.140054b24
mov ebp, 0x80004005
test dil, dil
je 0x140033e23
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x138]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x14003312e
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov rdx, rdi
call qword [0x1400af010]
test eax, eax
js 0x14003319b
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400af010]
test eax, eax
js 0x14003328f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x1400332ff
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x14003336f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
mov dx, 0xffff
call qword [0x1400af010]
test eax, eax
js 0x1400333df
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
call qword [0x1400af010]
test eax, eax
js 0x14003344c
lea rcx, str.PT12H5M
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe0]
mov qword [rsp + 0x70], rdx
call qword [0x1400af010]
test eax, eax
js 0x140033540
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400af010]
test eax, eax
js 0x140033639
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov rdx, r12
call qword [0x1400af010]
test eax, eax
js 0x1400336a6
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x120]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400af010]
test eax, eax
js 0x14003379f
mov rcx, qword [rsp + 0x120]
lea r8, [rsp + 0x118]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov edx, 2
call qword [0x1400af010]
test eax, eax
js 0x140033898
mov rcx, qword [rsp + 0x118]
lea r8, [rsp + 0x110]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [0x140065010]
call qword [0x1400af010]
test eax, eax
js 0x14003398c
test r15, r15
jne 0x1400339fc
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add rax, 0xffffffffffffffc4
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
jne 0x140033b7e
mov ecx, 0x2a
call fcn.140054b1c
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x1a], xmm0
lea r8, str._Y__m__dT_H:_M:_SZ
lea r9, [rsp + 0x280]
mov edx, 0x15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
test rax, rax
je 0x140033c66
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r14
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x140033f18
test r14, r14
je 0x140032afd
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call fcn.140054b24
test ebp, ebp
js 0x140033d66
jmp 0x140033a88
cmp esi, 0x800700b7
jne 0x140034123
mov esi, 0x800700b7
jmp 0x14003270e
lea rdi, [rsp + 0x2a8]
lea rsi, [rsp + 0x278]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, rdi
call fcn.140059470
cmp byte [rsi - 8], 0
je 0x140032cc6
lea rcx, [rsp + 0x250]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.1400594e0
lea rbx, [0x1400a2006]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8, rbx
call fcn.14002cc50
lea rcx, [rsp + 0x200]
mov edx, 1
mov r8, rbx
xor r9d, r9d
call fcn.14002ced0
cmp dword [rsp + 0x2a8], 0
jne 0x140032bbc
lea rcx, [rsp + 0x280]
call fcn.140059590
mov eax, dword [rsp + 0x228]
mov dword [rsp + 0x2a8], eax
test eax, eax
jne 0x140032c7f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
mov byte [rsp + 0x2a0], 0
mov rcx, rdi
mov rdx, rbx
call fcn.140059470
cmp dword [rbx], 0
jne 0x140032c12
lea rcx, [rsp + 0x200]
call fcn.140059590
cmp dword [rsp + 0x2a8], 0
jne 0x140032c7f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rbx - 0x18], xmm0
movaps xmmword [rbx - 0x28], xmm0
mov byte [rbx - 8], 0
mov rcx, rbx
mov rdx, rdi
call fcn.140059470
mov bl, byte [rbx - 8]
lea rcx, [rsp + 0x200]
call fcn.140059590
test bl, bl
jne 0x140032c7f
cmp qword [rsp + 0x248], 0x10
jb 0x140032c65
mov rsi, qword [rsp + 0x230]
lea rdx, [0x1400a2006]
lea rcx, [rsp + 0x200]
mov r8, rsi
xor r9d, r9d
call fcn.14002c5d0
mov rax, qword [rsp + 0x248]
cmp rax, 0x10
jb 0x140032cc6
mov rcx, qword [rsp + 0x230]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140032cc1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034b24
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140054b24
lea rcx, [rsp + 0x250]
call fcn.140059590
cmp dword [rsp + 0x2a8], 0
jne 0x140032592
lea rcx, [rsp + 0x280]
call fcn.140059590
jmp 0x140032592
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x60
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x60
jmp 0x140032db7
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x62
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x62
mov rcx, rdi
mov rdx, r13
mov r9, r15
call fcn.140057aa0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032e1c
mov rbx, rax
mov qword [rsp + 0x280], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140054b24
jmp 0x140033ed8
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov rcx, r12
mov edx, esi
mov r8, r13
mov r9d, 0x67
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x67
mov rcx, rbx
mov rdx, rbp
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032ef2
mov r15, rax
mov qword [rsp + 0x280], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
jmp 0x140033eb0
mov ebp, eax
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0x82
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x82
mov rcx, r15
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140032fd0
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x140033e41
mov qword [rsp + 0x50], rbx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdi, str._sdefaultagent_localized.ini
mov rcx, rdi
mov rdx, r14
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140054b1c
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
mov rcx, rbp
mov rdx, rbx
mov r9, rdi
call fcn.140057aa0
lea r12, [rsp + 0x280]
mov byte [r12 + 0x5c], 0
xorps xmm0, xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x49], xmm0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rax + rax]
add rcx, 2
inc rax
mov rdi, 0xffffffffffffffff
cmovns rdi, rcx
mov rcx, rdi
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [r12], rbx
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov qword [r12 + 8], 0
lea rdx, str.DefaultBrowserAgentTaskDescription
lea r8, [rsp + 0x140]
mov rcx, r12
call fcn.140029fb0
mov rcx, r12
call fcn.14002a370
test eax, eax
sete dil
je 0x14003310a
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_read_task_description:__d
lea r8, str.GetTaskDescription
mov r9d, 0x44
call fcn.14002b7d0
lea rcx, [rsp + 0x280]
call fcn.1400302c0
mov rcx, rbp
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x14003280c
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8b
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8b
jmp 0x140033206
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8c
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033273
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033dfb
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8f
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8f
jmp 0x1400334b7
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x90
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x90
jmp 0x1400334b7
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x91
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x91
jmp 0x1400334b7
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x92
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x92
jmp 0x1400334b7
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x93
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x93
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033524
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033de1
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9a
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9a
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033618
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140033dd3
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9d
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9d
jmp 0x140033711
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9f
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9f
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003377e
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140033db9
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa2
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033877
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140033d9f
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa5
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa5
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033970
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140033d80
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa9
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa9
jmp 0x140033b17
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r15
call qword [0x1400af010]
test eax, eax
jns 0x140033a88
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xac
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xac
jmp 0x140033b17
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
mov dx, 1
call qword [0x1400af010]
test eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
jns 0x14003400a
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xd9
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd9
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033c5e
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
jmp 0x140033c4f
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007076d
mov rcx, r12
mov edx, 0x8007076d
mov r8, rdi
mov r9d, 0xc7
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xc7
mov dword [rsp + 0x20], 0x8007076d
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033c5e
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007076d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
jmp 0x140033d52
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007007a
mov edx, 0x8007007a
mov r8, rdi
mov r9d, 0xd1
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xd1
mov dword [rsp + 0x20], 0x8007007a
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033d47
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rcx, r15
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x140033d80
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x140033d9f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x140033db9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140033dd3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r14, r14
je 0x140033de1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140033dfb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x140033e15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test rdi, rdi
je 0x140033e23
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], 0
test rcx, rcx
je 0x140033e41
call fcn.140054b24
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x140033e5b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test esi, esi
setns al
mov ecx, dword [rsp + 0x6c]
xor cl, 1
or cl, al
jne 0x140033e86
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
mov rdx, r12
xor r8d, r8d
call qword [0x1400af010]
mov esi, ebp
test r12, r12
je 0x140033e96
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140033eb0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test rbx, rbx
je 0x140033ebe
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x140033ed8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x230]
test rcx, rcx
je 0x140033ef2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140055a90
mov eax, esi
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegisterTask
mov edx, ebp
mov r9d, 0xd6
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140054b1c
mov rcx, rax
xor edx, edx
mov r8, rdi
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegisterTask
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd6
mov rcx, rdi
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033fee
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140032aef
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x108]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [0x1400af010]
test eax, eax
jns 0x1400341fa
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdc
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdc
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034107
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349f7
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, esi
mov r8, rdi
mov r9d, 0x73
call fcn.140057a20
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x73
mov rcx, r15
mov rdx, rbp
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400341e8
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140054b24
mov r12, qword [rsp + 0x60]
jmp 0x140033e88
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
xor edx, edx
call qword [0x1400af010]
test eax, eax
jns 0x140034312
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdf
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdf
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400342f6
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349dd
mov rcx, qword [rsp + 0x100]
lea r8, [rsp + 0xf8]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.MbLk
call qword [0x1400af010]
test eax, eax
jns 0x14003442e
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xe2
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034412
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349c3
lea r14, [rsp + 0x280]
mov rcx, r14
call fcn.140001100
mov r15, qword [r14]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
test r15, r15
je 0x14003445a
mov rcx, r15
call fcn.140054b24
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x88], rbp
mov rdx, rbp
call qword [0x1400af010]
test eax, eax
jns 0x140034565
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0xe6
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140054b1c
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe6
mov rcx, r12
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034549
mov r15, rax
mov qword [rsp + 0x280], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349b0
xor eax, eax
lea r14, [rsp + 0x280]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.do_task__
mov edx, 9
mov rcx, r14
call fcn.140058e00
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400345cc
lea rcx, [rsp + 0x280]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.1400592e0
jmp 0x140034605
mov r15, rdi
lea rdi, [rcx + rax]
mov qword [rsp + 0x290], rdi
cmp rdx, 8
jb 0x1400345e9
mov r14, qword [rsp + 0x280]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
mov rdi, r15
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
cmp rcx, rax
jne 0x14003463b
lea r8, [0x1400a407a]
lea rcx, [rsp + 0x280]
mov edx, 1
mov r9d, 1
call fcn.1400592e0
jmp 0x140034666
lea rdx, [rax + 1]
mov qword [rsp + 0x290], rdx
cmp rcx, 8
jb 0x140034657
mov rcx, qword [rsp + 0x280]
jmp 0x14003465f
lea rcx, [rsp + 0x280]
mov dword [rcx + rax*2], 0x22
cmp qword [rsp + 0x298], 8
jb 0x14003467b
mov rcx, qword [rsp + 0x280]
jmp 0x140034683
lea rcx, [rsp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x78], rdx
call qword [0x1400af010]
test eax, eax
jns 0x140034793
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xec
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xec
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140057aa0
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034777
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034952
mov r15, rdi
xor eax, eax
lea r14, [rsp + 0x200]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, [0x1400a407e]
mov edx, 0x1e
mov rcx, r14
call fcn.140058e00
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jb 0x140034a1a
lea rdi, [rcx + rax]
mov qword [rsp + 0x210], rdi
cmp rdx, 8
jb 0x140034803
mov r14, qword [rsp + 0x200]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
cmp qword [rsp + 0x218], 8
mov rdi, r15
jb 0x140034834
mov rcx, qword [rsp + 0x200]
jmp 0x14003483c
lea rcx, [rsp + 0x200]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rcx, qword [rsp + 0x170]
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r9, [rsp + 0xd0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r10, [rsp + 0xb0]
movaps xmmword [r10], xmm0
mov qword [r10 + 0x10], rax
lea r11, [rsp + 0x90]
movaps xmmword [r11], xmm0
mov qword [r11 + 0x10], rax
mov r8, qword [rsp + 0x148]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 3
mov rdx, r13
mov r9d, 6
call qword [0x1400af010]
mov ebp, eax
test eax, eax
js 0x140034a35
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400348ee
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
test r13, r13
je 0x1400348fc
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x218]
cmp rax, 8
jb 0x140034952
mov rcx, qword [rsp + 0x200]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140034945
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034b24
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov r12, qword [rsp + 0x60]
mov rdi, r15
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140034962
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x298]
cmp rax, 8
jb 0x1400349b0
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400349ab
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140034b24
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140054b24
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400349c3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400349dd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400349f7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x140033d66
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400af010]
jmp 0x140033d66
lea rcx, [rsp + 0x200]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.1400592e0
jmp 0x14003481c
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x80], rax
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, ebp
mov r8, rdi
mov r9d, 0xf5
call fcn.140057a20
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140054b1c
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xf5
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140057aa0
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034b0a
mov rdi, rax
lea rax, [rsp + 0x250]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140054b24
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, r15
jmp 0x1400348d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3