Function at 0x140031590
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm8
movaps xmmword [rsp + 0x120], xmm7
movaps xmmword [rsp + 0x110], xmm6
mov rax, qword [0x1400ab080]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea r8, str.DefaultAgentLastRemoteDisabled
lea rsi, [rsp + 0xd8]
mov rcx, rsi
xor edx, edx
call fcn.140030d10
cmp dword [rsi + 4], 0
setne al
movzx ecx, word [rsi]
cmp ecx, 0x100
setae bl
or bl, al
test cl, cl
setne cl
xor bl, al
and bl, cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_Last_remote_disabled:
call fcn.14005b310
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea r8, str.ServicesSettingsServer
lea rsi, [rsp + 0xd8]
mov rcx, rsi
xor edx, edx
xor r9d, r9d
call fcn.14002e620
mov ecx, 0x40
call fcn.140056c48
movups xmm6, xmmword [str.https:__firefox.settings.services.mozilla.com_v1]
movups xmmword [rax], xmm6
movups xmm7, xmmword [0x1400a2466]
movups xmmword [rax + 0x10], xmm7
movups xmm8, xmmword [0x1400a2476]
movups xmmword [rax + 0x20], xmm8
mov byte [rax + 0x30], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], 0x3f
mov byte [rsp + 0x78], 1
cmp dword [rsi + 0x28], 0
jne 0x140031bfb
lea rdx, [rsp + 0x100]
lea rdi, [rsp + 0xa8]
xorps xmm0, xmm0
movaps xmmword [rdi - 0x18], xmm0
movaps xmmword [rdi - 0x28], xmm0
xor ebp, ebp
mov byte [rdi - 8], bpl
mov rcx, rdi
call fcn.14005b4d0
lea rcx, [rsp + 0x58]
call fcn.14005b250
mov ecx, 0x40
call fcn.140056c48
mov rsi, rax
movups xmmword [rax + 0x20], xmm8
movups xmmword [rax + 0x10], xmm7
movups xmmword [rax], xmm6
mov byte [rax + 0x30], bpl
cmp byte [rdi - 8], bpl
jne 0x140031756
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], 0x3f
lea rcx, [rsp + 0x80]
call fcn.14005b250
mov r14d, 0x30
cmp byte [rsi + 0x2f], 0x2f
jne 0x140031844
jmp 0x140031857
mov r14, qword [rsp + 0x90]
cmp qword [rsp + 0x98], 0x10
jb 0x140031773
mov rdi, qword [rsp + 0x80]
jmp 0x14003177b
lea rdi, [rsp + 0x80]
cmp r14, 0xf
ja 0x140031794
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0xb0], xmm0
mov r15d, 0xf
jmp 0x1400317ec
mov r15, r14
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmovae r15, rax
cmp r15, 0xfff
jb 0x1400317cc
lea rcx, [r15 + 0x28]
call fcn.140056c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400317d8
lea rcx, [r15 + 1]
call fcn.140056c48
mov rcx, rax
mov qword [rsp + 0xb0], rcx
lea r8, [r14 + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], r15
mov edx, 0x40
mov rcx, rsi
call fcn.140056c84
lea rcx, [rsp + 0x80]
call fcn.14005b250
test r14, r14
je 0x140031857
cmp r15, 0x10
jb 0x14003182b
mov rsi, qword [rsp + 0xb0]
jmp 0x140031833
lea rsi, [rsp + 0xb0]
cmp byte [r14 + rsi - 1], 0x2f
je 0x140031857
cmp r14, r15
jae 0x140031a79
lea rax, [r14 + 1]
mov qword [rsp + 0xc0], rax
mov word [rsi + r14], 0x2f
mov rsi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc8]
mov rcx, rax
sub rcx, rsi
cmp rcx, 0x44
jae 0x140031897
mov qword [rsp + 0x20], 0x44
lea r9, str.buckets_main_collections_windows_default_browser_agent_records_state
lea rcx, [rsp + 0xb0]
mov edx, 0x44
call fcn.1400043b0
jmp 0x1400318d6
lea rcx, [rsi + 0x44]
mov qword [rsp + 0xc0], rcx
cmp rax, 0x10
jb 0x1400318b3
mov rdi, qword [rsp + 0xb0]
jmp 0x1400318bb
lea rdi, [rsp + 0xb0]
lea rcx, [rdi + rsi]
lea rdx, str.buckets_main_collections_windows_default_browser_agent_records_state
mov r8d, 0x44
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi + 0x44], 0
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_Remote_service_disabled_state_URL:_
mov rcx, rdi
call fcn.14005b310
lea rsi, [rsp + 0xb0]
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x14003190a
mov rdx, qword [rsp + 0xb0]
mov rcx, rax
call fcn.140003430
lea rdx, [0x1400a278b]
mov rcx, rax
call fcn.14005b310
mov r14, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r14
mov r15, qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov dl, 0xa
call r15
mov r12, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, r14
mov edx, eax
call r12
mov r13, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rcx, r14
call r13
cmp qword [rsp + 0xc8], 0x10
jb 0x140031969
mov rsi, qword [rsp + 0xb0]
lea rdx, [rsp + 0x54]
mov rcx, rsi
call fcn.140044000
mov esi, eax
lea rdx, str.default_browser_agent:_HRESULT:_0x
mov rcx, rdi
call fcn.14005b310
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call r15
mov rcx, rdi
mov edx, eax
call r12
mov rcx, rdi
call r13
test esi, esi
js 0x140031a93
cmp dword [rsp + 0x54], 0
setne dil
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jb 0x140031a24
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140031a1f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140031c08
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056c84
cmp dword [rsp + 0x100], 0
je 0x140031b7e
test esi, esi
jns 0x140031b90
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140057bf0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x110]
movaps xmm7, xmmword [rsp + 0x120]
movaps xmm8, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xb0]
mov edx, 1
mov r9b, 0x2f
call fcn.14005cb70
jmp 0x140031857
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.IsAgentRemoteDisabledInternal
mov rcx, r15
mov edx, esi
mov r8, r12
mov r9d, 0x46
call fcn.140059a40
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.140056c40
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x46
mov rcx, rdi
mov rdx, r13
mov r8, 0xffffffffffffffff
mov r9, r15
call fcn.140059ac0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140031b6f
mov r14, rax
lea rax, [rsp + 0x80]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140056c84
xor edi, edi
jmp 0x1400319dd
lea rcx, [rsp + 0xd8]
call fcn.14005b250
jmp 0x140031a32
test dil, dil
setne bl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_Next_remote_disabled:
call fcn.14005b310
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea r8, str.DefaultAgentLastRemoteDisabled
lea rcx, [rsp + 0xd8]
xor edx, edx
mov r9d, edi
call fcn.140030ff0
jmp 0x140031a3a
lea rdx, [rsp + 0x80]
jmp 0x1400316c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3