Function at 0x140031080
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x1400ab070]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140001100
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140031197
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x14003122c
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rbx, rax
lea rcx, [rsp + 0x50]
cmp rax, 7
ja 0x140031318
mov qword [rcx + 0x10], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx*2 + 0x50], 0
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov dword [rdi + 0x20], 0
test rsi, rsi
je 0x140031172
mov rcx, rsi
call fcn.140054b24
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140055a90
nop
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.GetRelativeBinaryPath
mov rcx, r15
mov edx, 0x8007007a
mov r8, r12
mov r9d, 0x45
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x30], 0x45
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, r13
mov r9, r15
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400312fa
mov r14, rax
lea rax, [rsp + 0x70]
jmp 0x1400312b8
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.GetRelativeBinaryPath
mov rcx, r15
mov edx, 0x8007007a
mov r8, r12
mov r9d, 0x4c
call fcn.140057a20
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140054b1c
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x30], 0x4c
mov dword [rsp + 0x20], 0x8007007a
mov rcx, rbx
mov rdx, r13
mov r9, r15
call fcn.140057aa0
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400312fa
mov r14, rax
lea rax, [rsp + 0x50]
mov qword [rax], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140054b24
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x20], 0x8007007a
jmp 0x140031165
lea r8, [rsp + 0x70]
mov rdx, rbx
call fcn.140058e00
jmp 0x14003114d