Function at 0x14003ad80
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rbx, [rsp + 0x48]
mov rcx, rbx
xor edx, edx
call fcn.140001280
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14003aea2
lea rbx, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
mov r8, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003af4c
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
lea rcx, [rsp + 0x50]
cmp rax, 7
ja 0x14003b04d
mov qword [rcx + 0x10], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rdi*2 + 0x50], 0
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov dword [rsi + 0x20], 0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14003ae7c
call fcn.140056c84
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140057bf0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.GetRelativeBinaryPath
mov rcx, r14
mov edx, 0x8007007a
mov r8, r15
mov r9d, 0x45
call fcn.140059a40
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0x45
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rdi
mov rdx, r12
mov r8, 0xffffffffffffffff
mov r9, r14
call fcn.140059ac0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003b02f
mov rbx, rax
lea rax, [rsp + 0x70]
jmp 0x14003afed
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r14, str.0x_X_in__S:_d
lea r15, str.GetRelativeBinaryPath
mov rcx, r14
mov edx, 0x8007007a
mov r8, r15
mov r9d, 0x4c
call fcn.140059a40
cdqe
lea r12, [rax + 1]
lea r13, [rax + rax]
add r13, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl r13, rax
mov rcx, r13
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0x4c
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rdi
mov rdx, r12
mov r8, 0xffffffffffffffff
mov r9, r14
call fcn.140059ac0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003b02f
mov rbx, rax
lea rax, [rsp + 0x50]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov dword [rsi + 0x20], 0x8007007a
jmp 0x14003ae64
lea r9, [rsp + 0x70]
mov rdx, rdi
call fcn.14005ab20
jmp 0x14003ae4c