Function at 0x140033120
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea r8, [0x1400a3082]
lea r14, [rsp + 0x280]
mov rcx, r14
xor edx, edx
xor r9d, r9d
call fcn.14002dab0
cmp dword [r14 + 0x28], 0
je 0x140033708
mov rcx, r13
xor edx, edx
call fcn.140035710
lea rax, [rsp + 0x230]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140066030]
lea r9, [0x140066020]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400338d3
mov rcx, qword [rsp + 0x230]
xorps xmm0, xmm0
lea r10, [rsp + 0x1e0]
movaps xmmword [r10], xmm0
xor eax, eax
mov qword [r10 + 0x10], rax
lea r9, [rsp + 0x1c0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x1a0]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x20], r10
call qword [0x1400b0010]
test eax, eax
js 0x140033936
xor edi, edi
mov qword [rsp + 0x178], rdi
lea rcx, [0x1400a4566]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rdi
test rcx, rcx
je 0x14003325e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
lea r8, [rsp + 0x178]
mov rcx, rsi
mov rdx, rbx
call qword [0x1400b0010]
mov esi, eax
test eax, eax
js 0x140033a09
xor edi, edi
mov qword [rsp + 0x170], rdi
lea rcx, [0x1400a450a]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], rdi
test rcx, rcx
je 0x1400332c9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rax, qword [r12]
mov rax, qword [rax + 0x48]
lea r8, [rsp + 0x170]
mov rcx, r12
mov r12, qword [rsp + 0x60]
mov rdx, r12
call qword [0x1400b0010]
test eax, eax
js 0x1400332f8
mov dword [rsp + 0x6c], 0
jmp 0x140033368
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x170], 0
test rcx, rcx
je 0x140033326
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
xorps xmm0, xmm0
lea r8, [rsp + 0x150]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
lea r9, [rsp + 0x170]
mov rcx, rsi
mov rdx, r12
call qword [0x1400b0010]
mov esi, eax
test eax, eax
js 0x1400336f2
mov al, 1
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x230]
lea r8, [rsp + 0x148]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x140033ae4
mov qword [rsp + 0x140], 0
lea rdi, [rsp + 0x280]
mov rcx, rdi
call fcn.1400010c0
mov r14, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 0x103
jbe 0x140033bc7
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rdx, str.Failed_to_get_install_directory
lea r8, str.GetTaskDescription
mov r9d, 0x35
call fcn.14002c3b0
xor edi, edi
test r14, r14
je 0x1400333f9
mov rcx, r14
call fcn.140055ae4
mov ebp, 0x80004005
test dil, dil
je 0x140034a03
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x138]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400b0010]
test eax, eax
js 0x140033d0e
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov rdx, rdi
call qword [0x1400b0010]
test eax, eax
js 0x140033d7b
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400b0010]
test eax, eax
js 0x140033e6f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x140033edf
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
mov edx, 2
call qword [0x1400b0010]
test eax, eax
js 0x140033f4f
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
mov dx, 0xffff
call qword [0x1400b0010]
test eax, eax
js 0x140033fbf
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
js 0x14003402c
lea rcx, str.PT12H5M
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe0]
mov qword [rsp + 0x70], rdx
call qword [0x1400b0010]
test eax, eax
js 0x140034120
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x1400b0010]
test eax, eax
js 0x140034219
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov rdx, r12
call qword [0x1400b0010]
test eax, eax
js 0x140034286
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x120]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400b0010]
test eax, eax
js 0x14003437f
mov rcx, qword [rsp + 0x120]
lea r8, [rsp + 0x118]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
mov edx, 2
call qword [0x1400b0010]
test eax, eax
js 0x140034478
mov rcx, qword [rsp + 0x118]
lea r8, [rsp + 0x110]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, [0x140066010]
call qword [0x1400b0010]
test eax, eax
js 0x14003456c
test r15, r15
jne 0x1400345dc
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add rax, 0xffffffffffffffc4
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64_s]
test eax, eax
jne 0x14003475e
mov ecx, 0x2a
call fcn.140055adc
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x1a], xmm0
lea r8, str._Y__m__dT_H:_M:_SZ
lea r9, [rsp + 0x280]
mov edx, 0x15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
test rax, rax
je 0x140034846
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r14
call qword [0x1400b0010]
mov ebp, eax
test eax, eax
js 0x140034af8
test r14, r14
je 0x1400336dd
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call fcn.140055ae4
test ebp, ebp
js 0x140034946
jmp 0x140034668
cmp esi, 0x800700b7
jne 0x140034d03
mov esi, 0x800700b7
jmp 0x1400332ee
lea rdi, [rsp + 0x2a8]
lea rsi, [rsp + 0x278]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x18], xmm0
movaps xmmword [rsi - 0x28], xmm0
mov byte [rsi - 8], 0
mov rcx, rsi
mov rdx, rdi
call fcn.14005a430
cmp byte [rsi - 8], 0
je 0x1400338a6
lea rcx, [rsp + 0x250]
lea rsi, [rsp + 0x230]
mov rdx, rsi
call fcn.14005a4a0
lea rbx, [0x1400a3082]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8, rbx
call fcn.14002d830
lea rcx, [rsp + 0x200]
mov edx, 1
mov r8, rbx
xor r9d, r9d
call fcn.14002dab0
cmp dword [rsp + 0x2a8], 0
jne 0x14003379c
lea rcx, [rsp + 0x280]
call fcn.14005a550
mov eax, dword [rsp + 0x228]
mov dword [rsp + 0x2a8], eax
test eax, eax
jne 0x14003385f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
mov byte [rsp + 0x2a0], 0
mov rcx, rdi
mov rdx, rbx
call fcn.14005a430
cmp dword [rbx], 0
jne 0x1400337f2
lea rcx, [rsp + 0x200]
call fcn.14005a550
cmp dword [rsp + 0x2a8], 0
jne 0x14003385f
lea rbx, [rsp + 0x228]
xorps xmm0, xmm0
movaps xmmword [rbx - 0x18], xmm0
movaps xmmword [rbx - 0x28], xmm0
mov byte [rbx - 8], 0
mov rcx, rbx
mov rdx, rdi
call fcn.14005a430
mov bl, byte [rbx - 8]
lea rcx, [rsp + 0x200]
call fcn.14005a550
test bl, bl
jne 0x14003385f
cmp qword [rsp + 0x248], 0x10
jb 0x140033845
mov rsi, qword [rsp + 0x230]
lea rdx, [0x1400a3082]
lea rcx, [rsp + 0x200]
mov r8, rsi
xor r9d, r9d
call fcn.14002d1b0
mov rax, qword [rsp + 0x248]
cmp rax, 0x10
jb 0x1400338a6
mov rcx, qword [rsp + 0x230]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400338a1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035704
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
lea rcx, [rsp + 0x250]
call fcn.14005a550
cmp dword [rsp + 0x2a8], 0
jne 0x140033172
lea rcx, [rsp + 0x280]
call fcn.14005a550
jmp 0x140033172
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x60
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x60
jmp 0x140033997
mov esi, eax
mov rbx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.RegisterTask
mov rcx, r15
mov edx, eax
mov r8, r12
mov r9d, 0x62
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x62
mov rcx, rdi
mov rdx, r13
mov r9, r15
call fcn.140058a60
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400339fc
mov rbx, rax
mov qword [rsp + 0x280], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140055ae4
jmp 0x140034ab8
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea r13, str.RegisterTask
mov rcx, r12
mov edx, esi
mov r8, r13
mov r9d, 0x67
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x67
mov rcx, rbx
mov rdx, rbp
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033ad2
mov r15, rax
mov qword [rsp + 0x280], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
jmp 0x140034a90
mov ebp, eax
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0x82
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x82
mov rcx, r15
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033bb0
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x140034a21
mov qword [rsp + 0x50], rbx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdi, str._sdefaultagent_localized.ini
mov rcx, rdi
mov rdx, r14
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055adc
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
mov rcx, rbp
mov rdx, rbx
mov r9, rdi
call fcn.140058a60
lea r12, [rsp + 0x280]
mov byte [r12 + 0x5c], 0
xorps xmm0, xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x49], xmm0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rax + rax]
add rcx, 2
inc rax
mov rdi, 0xffffffffffffffff
cmovns rdi, rcx
mov rcx, rdi
call fcn.140055adc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [r12], rbx
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov qword [r12 + 8], 0
lea rdx, str.DefaultBrowserAgentTaskDescription
lea r8, [rsp + 0x140]
mov rcx, r12
call fcn.14002ab90
mov rcx, r12
call fcn.14002af50
test eax, eax
sete dil
je 0x140033cea
mov rcx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov dword [rsp + 0x20], eax
lea rdx, str.Failed_to_read_task_description:__d
lea r8, str.GetTaskDescription
mov r9d, 0x44
call fcn.14002c3b0
lea rcx, [rsp + 0x280]
call fcn.140030ea0
mov rcx, rbp
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
jmp 0x1400333ec
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8b
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8b
jmp 0x140033de6
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8c
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8c
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033e53
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349db
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x8f
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x8f
jmp 0x140034097
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x90
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x90
jmp 0x140034097
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x91
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x91
jmp 0x140034097
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x92
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x92
jmp 0x140034097
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x93
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x93
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034104
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400349c1
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9a
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9a
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400341f8
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x1400349b3
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9d
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9d
jmp 0x1400342f1
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0x9f
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0x9f
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003435e
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x140034999
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa2
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034457
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
jmp 0x14003497f
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa5
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa5
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034550
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140034960
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xa9
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xa9
jmp 0x1400346f7
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0x78]
mov rdx, r15
call qword [0x1400b0010]
test eax, eax
jns 0x140034668
mov ebp, eax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xac
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xac
jmp 0x1400346f7
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa8]
mov dx, 1
call qword [0x1400b0010]
test eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
jns 0x140034bea
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xd9
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd9
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003483e
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
jmp 0x14003482f
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007076d
mov rcx, r12
mov edx, 0x8007076d
mov r8, rdi
mov r9d, 0xc7
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xc7
mov dword [rsp + 0x20], 0x8007076d
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14003483e
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007076d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
jmp 0x140034932
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov ebp, 0x8007007a
mov edx, 0x8007007a
mov r8, rdi
mov r9d, 0xd1
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xd1
mov dword [rsp + 0x20], 0x8007007a
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034927
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, 0x8007007a
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rcx, r15
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x140034960
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14003497f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x140034999
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x1400349b3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test r14, r14
je 0x1400349c1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x1400349db
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x1400349f5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test rdi, rdi
je 0x140034a03
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x140], 0
test rcx, rcx
je 0x140034a21
call fcn.140055ae4
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x140034a3b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test esi, esi
setns al
mov ecx, dword [rsp + 0x6c]
xor cl, 1
or cl, al
jne 0x140034a66
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
mov rdx, r12
xor r8d, r8d
call qword [0x1400b0010]
mov esi, ebp
test r12, r12
je 0x140034a76
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140034a90
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test rbx, rbx
je 0x140034a9e
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x140034ab8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x230]
test rcx, rcx
je 0x140034ad2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140056a50
mov eax, esi
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea r8, str.RegisterTask
mov edx, ebp
mov r9d, 0xd6
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea rdi, [rax + rax]
add rdi, 2
mov rcx, rdi
call fcn.140055adc
mov rcx, rax
xor edx, edx
mov r8, rdi
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, str.RegisterTask
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xd6
mov rcx, rdi
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034bce
mov r12, rax
lea rax, [rsp + 0x200]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400336cf
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x108]
mov qword [rdx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [0x1400b0010]
test eax, eax
jns 0x140034dda
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdc
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdc
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034ce7
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400355d7
mov r12, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, esi
mov r8, rdi
mov r9d, 0x73
call fcn.1400589e0
cdqe
lea rbp, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 0x73
mov rcx, r15
mov rdx, rbp
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034dc8
mov r12, rax
mov qword [rsp + 0x280], r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r12
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r15
call fcn.140055ae4
mov r12, qword [rsp + 0x60]
jmp 0x140034a68
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
xor edx, edx
call qword [0x1400b0010]
test eax, eax
jns 0x140034ef2
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xdf
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xdf
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034ed6
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400355bd
mov rcx, qword [rsp + 0x100]
lea r8, [rsp + 0xf8]
mov qword [r8], 0
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.MbLk
call qword [0x1400b0010]
test eax, eax
jns 0x14003500e
mov ebp, eax
mov r15, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xe2
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r13, [rax + rax]
add r13, 2
mov rcx, r13
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe2
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140034ff2
mov r15, rax
mov qword [rsp + 0x280], r14
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x1400355a3
lea r14, [rsp + 0x280]
mov rcx, r14
call fcn.1400010c0
mov r15, qword [r14]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
test r15, r15
je 0x14003503a
mov rcx, r15
call fcn.140055ae4
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x88], rbp
mov rdx, rbp
call qword [0x1400b0010]
test eax, eax
jns 0x140035145
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, eax
mov r8, rdi
mov r9d, 0xe6
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055adc
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xe6
mov rcx, r12
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140035129
mov r15, rax
mov qword [rsp + 0x280], r12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r12
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140035590
xor eax, eax
lea r14, [rsp + 0x280]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.do_task__
mov edx, 9
mov rcx, r14
call fcn.140059dc0
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400351ac
lea rcx, [rsp + 0x280]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.14005a2a0
jmp 0x1400351e5
mov r15, rdi
lea rdi, [rcx + rax]
mov qword [rsp + 0x290], rdi
cmp rdx, 8
jb 0x1400351c9
mov r14, qword [rsp + 0x280]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
mov rdi, r15
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
cmp rcx, rax
jne 0x14003521b
lea r8, [0x1400a50f6]
lea rcx, [rsp + 0x280]
mov edx, 1
mov r9d, 1
call fcn.14005a2a0
jmp 0x140035246
lea rdx, [rax + 1]
mov qword [rsp + 0x290], rdx
cmp rcx, 8
jb 0x140035237
mov rcx, qword [rsp + 0x280]
jmp 0x14003523f
lea rcx, [rsp + 0x280]
mov dword [rcx + rax*2], 0x22
cmp qword [rsp + 0x298], 8
jb 0x14003525b
mov rcx, qword [rsp + 0x280]
jmp 0x140035263
lea rcx, [rsp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdx, rax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x78], rdx
call qword [0x1400b0010]
test eax, eax
jns 0x140035373
mov ebp, eax
mov r13, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r12, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov rcx, r12
mov edx, eax
mov r8, rdi
mov r9d, 0xec
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r15, [rax + rax]
add r15, 2
mov rcx, r15
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xec
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.140058a60
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140035357
mov r15, rax
lea rax, [rsp + 0x200]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140035532
mov r15, rdi
xor eax, eax
lea r14, [rsp + 0x200]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, [0x1400a50fa]
mov edx, 0x1e
mov rcx, r14
call fcn.140059dc0
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jb 0x1400355fa
lea rdi, [rcx + rax]
mov qword [rsp + 0x210], rdi
cmp rdx, 8
jb 0x1400353e3
mov r14, qword [rsp + 0x200]
lea rcx, [r14 + rcx*2]
add rax, rax
mov rdx, r13
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [r14 + rdi*2], 0
cmp qword [rsp + 0x218], 8
mov rdi, r15
jb 0x140035414
mov rcx, qword [rsp + 0x200]
jmp 0x14003541c
lea rcx, [rsp + 0x200]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rcx, qword [rsp + 0x170]
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r9, [rsp + 0xd0]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
lea r10, [rsp + 0xb0]
movaps xmmword [r10], xmm0
mov qword [r10 + 0x10], rax
lea r11, [rsp + 0x90]
movaps xmmword [r11], xmm0
mov qword [r11 + 0x10], rax
mov r8, qword [rsp + 0x148]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 3
mov rdx, r13
mov r9d, 6
call qword [0x1400b0010]
mov ebp, eax
test eax, eax
js 0x140035615
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400354ce
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
test r13, r13
je 0x1400354dc
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x218]
cmp rax, 8
jb 0x140035532
mov rcx, qword [rsp + 0x200]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140035525
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035704
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov r12, qword [rsp + 0x60]
mov rdi, r15
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140035542
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x298]
cmp rax, 8
jb 0x140035590
mov rcx, qword [rsp + 0x280]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003558b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140035704
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400355a3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400355bd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400355d7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x140034946
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400b0010]
jmp 0x140034946
lea rcx, [rsp + 0x200]
mov rdx, rax
mov r8, r13
mov r9, rax
call fcn.14005a2a0
jmp 0x1400353fc
mov rax, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
mov qword [rsp + 0x80], rax
lea rcx, str.0x_X_in__S:_d
lea rdi, str.RegisterTask
mov edx, ebp
mov r8, rdi
mov r9d, 0xf5
call fcn.1400589e0
cdqe
lea rbx, [rax + 1]
lea r12, [rax + rax]
add r12, 2
mov rcx, r12
call fcn.140055adc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 0xf5
mov rcx, r14
mov rdx, rbx
lea r9, str.0x_X_in__S:_d
call fcn.140058a60
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400356ea
mov rdi, rax
lea rax, [rsp + 0x250]
mov qword [rax], r14
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, r14
call fcn.140055ae4
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, r15
jmp 0x1400354b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3