Function at 0x140032ab0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm8
movaps xmmword [rsp + 0x120], xmm7
movaps xmmword [rsp + 0x110], xmm6
mov rax, qword [0x1400ac070]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea r8, str.DefaultAgentLastRemoteDisabled
lea rsi, [rsp + 0xd8]
mov rcx, rsi
xor edx, edx
call fcn.14002ebb0
cmp dword [rsi + 4], 0
setne al
movzx ecx, word [rsi]
cmp ecx, 0x100
setae bl
or bl, al
test cl, cl
setne cl
xor bl, al
and bl, cl
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_Last_remote_disabled:
mov rcx, rsi
call fcn.14005aac0
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea r8, str.ServicesSettingsServer
lea rdi, [rsp + 0xd8]
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call fcn.14002dab0
mov ecx, 0x40
call fcn.140055aa0
movups xmm6, xmmword [str.https:__firefox.settings.services.mozilla.com_v1]
movups xmmword [rax], xmm6
movups xmm7, xmmword [0x1400a2678]
movups xmmword [rax + 0x10], xmm7
movups xmm8, xmmword [0x1400a2688]
movups xmmword [rax + 0x20], xmm8
mov byte [rax + 0x30], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], 0x3f
mov byte [rsp + 0x78], 1
cmp dword [rdi + 0x28], 0
jne 0x140033100
lea rdx, [rsp + 0x100]
lea r14, [rsp + 0xa8]
xorps xmm0, xmm0
movaps xmmword [r14 - 0x18], xmm0
movaps xmmword [r14 - 0x28], xmm0
xor ebp, ebp
mov byte [r14 - 8], bpl
mov rcx, r14
call fcn.14005a430
lea rcx, [rsp + 0x58]
call fcn.14005a550
mov ecx, 0x40
call fcn.140055aa0
mov rdi, rax
movups xmmword [rax + 0x20], xmm8
movups xmmword [rax + 0x10], xmm7
movups xmmword [rax], xmm6
mov byte [rax + 0x30], bpl
cmp byte [r14 - 8], bpl
jne 0x140032c7b
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], 0x3f
lea rcx, [rsp + 0x80]
call fcn.14005a550
mov r15d, 0x30
cmp byte [rdi + 0x2f], 0x2f
jne 0x140032d6d
jmp 0x140032d80
mov r15, qword [rsp + 0x90]
cmp qword [rsp + 0x98], 0x10
jb 0x140032c98
mov r14, qword [rsp + 0x80]
jmp 0x140032ca0
lea r14, [rsp + 0x80]
cmp r15, 0xf
ja 0x140032cba
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0xb0], xmm0
mov r12d, 0xf
jmp 0x140032d14
mov r12, r15
or r12, 0xf
movabs rax, 0x7fffffffffffffff
cmp r12, rax
cmovae r12, rax
cmp r12, 0xfff
jb 0x140032cf3
lea rcx, [r12 + 0x28]
call fcn.140055aa0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140032d00
lea rcx, [r12 + 1]
call fcn.140055aa0
mov rcx, rax
mov qword [rsp + 0xb0], rcx
lea r8, [r15 + 1]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], r12
mov edx, 0x40
mov rcx, rdi
call fcn.140055ae4
lea rcx, [rsp + 0x80]
call fcn.14005a550
test r15, r15
je 0x140032d80
cmp r12, 0x10
mov eax, 0xf
lea rdi, [rsp + 0xb0]
cmovae rdi, qword [rdi]
cmovae rax, r12
cmp byte [r15 + rdi - 1], 0x2f
je 0x140032d80
cmp r15, rax
jae 0x140032f96
lea rax, [r15 + 1]
mov qword [rsp + 0xc0], rax
mov word [rdi + r15], 0x2f
mov rdi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc8]
mov rcx, rax
sub rcx, rdi
cmp rcx, 0x44
jae 0x140032dbd
lea r8, str.buckets_main_collections_windows_default_browser_agent_records_state
lea rcx, [rsp + 0xb0]
mov edx, 0x44
mov r9d, 0x44
call fcn.140003dd0
jmp 0x140032dfd
lea rcx, [rdi + 0x44]
mov qword [rsp + 0xc0], rcx
cmp rax, 0x10
jb 0x140032dd9
mov r14, qword [rsp + 0xb0]
jmp 0x140032de1
lea r14, [rsp + 0xb0]
lea rcx, [r14 + rdi]
lea rdx, str.buckets_main_collections_windows_default_browser_agent_records_state
mov r8d, 0x44
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi + 0x44], 0
lea rdx, str.default_browser_agent:_Remote_service_disabled_state_URL:_
mov rcx, rsi
call fcn.14005aac0
lea rdi, [rsp + 0xb0]
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140032e2a
mov rdx, qword [rsp + 0xb0]
mov rcx, rsi
call fcn.140002f00
lea rdx, [0x1400a299a]
mov rcx, rsi
call fcn.14005aac0
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov r14, qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov dl, 0xa
call r14
mov r15, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
mov edx, eax
call r15
mov r12, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rcx, rsi
call r12
cmp qword [rsp + 0xc8], 0x10
jb 0x140032e86
mov rdi, qword [rsp + 0xb0]
lea rdx, [rsp + 0x54]
mov rcx, rdi
call fcn.1400434d0
mov edi, eax
lea rdx, str.default_browser_agent:_HRESULT:_0x
mov rcx, rsi
call fcn.14005aac0
mov rax, qword [rsi]
movsxd rax, dword [rax + 4]
mov ecx, 0xfffff1ff
and ecx, dword [rsi + rax + 0x18]
or ecx, 0x800
mov dword [rsi + rax + 0x18], ecx
mov rcx, rsi
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call r14
mov rcx, rsi
mov edx, eax
call r15
mov rcx, rsi
call r12
test edi, edi
js 0x140032faa
cmp dword [rsp + 0x54], 0
setne sil
mov rax, qword [rsp + 0xc8]
cmp rax, 0x10
jb 0x140032f41
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140032f3c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14003310d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055ae4
cmp dword [rsp + 0x100], 0
je 0x140033080
test edi, edi
jns 0x140033092
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140056a50
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x110]
movaps xmm7, xmmword [rsp + 0x120]
movaps xmm8, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xb0]
mov dl, 0x2f
call fcn.14005ac60
jmp 0x140032d80
mov r14, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
lea r15, str.0x_X_in__S:_d
lea r12, str.IsAgentRemoteDisabledInternal
mov rcx, r15
mov edx, edi
mov r8, r12
mov r9d, 0x46
call fcn.1400589e0
cdqe
lea r13, [rax + 1]
lea rbp, [rax + rax]
add rbp, 2
mov rcx, rbp
call fcn.140055adc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 0x46
mov rcx, rsi
mov rdx, r13
mov r9, r15
call fcn.140058a60
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140033071
mov r14, rax
lea rax, [rsp + 0x80]
mov qword [rax], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, edi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140055ae4
xor esi, esi
jmp 0x140032efa
lea rcx, [rsp + 0xd8]
call fcn.14005a550
jmp 0x140032f4f
test sil, sil
setne bl
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.default_browser_agent:_Next_remote_disabled:
mov rcx, rdi
call fcn.14005aac0
mov rcx, rdi
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea r8, str.DefaultAgentLastRemoteDisabled
lea rcx, [rsp + 0xd8]
xor edx, edx
mov r9d, esi
call fcn.140030c00
jmp 0x140032f57
lea rdx, [rsp + 0x80]
jmp 0x140032be9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3