Function at 0x1800151c0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
lea eax, [rcx - 0x1240]
mov qword [rsp + 0x20], r15
mov esi, edx
mov edi, ecx
cmp eax, 2
jbe 0x1800151ef
lea eax, [rcx - 0x11fc]
cmp eax, 1
jbe 0x1800151ef
cmp ecx, 0xffffff9d
jne 0x1800151f5
or dword [0x18009cadc], edx
lea eax, [rcx - 0x1250]
cmp eax, 3
jbe 0x180015205
cmp ecx, 0xffffff9d
jne 0x18001520b
or dword [0x18009cae0], edx
lea eax, [rcx - 0x1200]
cmp eax, 6
jbe 0x18001521b
cmp ecx, 0xffffff9d
jne 0x180015221
or dword [0x18009cad0], edx
lea eax, [rcx - 0x1210]
cmp eax, 0x13
jbe 0x18001523c
lea eax, [rcx - 0x12a9]
cmp eax, 1
jbe 0x18001523c
cmp ecx, 0xffffff9d
jne 0x180015242
or dword [0x18009cad4], edx
lea eax, [rcx - 0x12a0]
cmp eax, 0xb
ja 0x180015257
mov ecx, 0xf7f
bt ecx, eax
jb 0x18001525c
cmp edi, 0xffffff9d
jne 0x180015262
or dword [0x18009caf0], edx
lea eax, [rdi - 0x1270]
cmp eax, 0x2f
ja 0x18001527d
movabs rcx, 0xfffffff7ffff
bt rcx, rax
jb 0x180015282
cmp edi, 0xffffff9d
jne 0x180015288
or dword [0x18009cae8], edx
lea eax, [rdi - 0x1230]
xor r15d, r15d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], r14
cmp eax, 7
jbe 0x1800152a9
cmp edi, 0xffffff9d
jne 0x18001562c
mov rcx, qword [0x18009d1e8]
lea rdx, str.AuditEnumerateSubCategories
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800152da
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x38]
lea rcx, [0x18009d160]
xor edx, edx
call rax
mov r12d, r15d
cmp dword [rbp + 0x20], r15d
jbe 0x180015605
nop word [rax + rax]
mov rbx, qword [rbp + 0x38]
mov rcx, qword [0x18009d1e8]
mov r14d, r12d
lea rdx, str.AuditLookupSubCategoryNameA
shl r14, 4
add rbx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015320
lea rdx, [rbp + 0x30]
mov rcx, rbx
call rax
mov rcx, qword [rbp + 0x30]
lea rdx, str.File_System
mov r8d, FreeADsMem
call fcn.18002a3c0
test eax, eax
jne 0x18001536e
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cb10]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movaps xmmword [0x18009cb00], xmm0
call fcn.18002a5b4
or dword [0x18009cb90], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Registry
mov r8d, 9
call fcn.18002a3c0
test eax, eax
jne 0x1800153bc
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cba4]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009cb94], xmm0
call fcn.18002a5b4
or dword [0x18009cc24], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Kernel_Object
mov r8d, FreeADsMem
call fcn.18002a3c0
test eax, eax
jne 0x18001540a
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cc38]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009cc28], xmm0
call fcn.18002a5b4
or dword [0x18009ccb8], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, [0x18006c56c]
mov r8d, 4
call fcn.18002a3c0
test eax, eax
jne 0x180015458
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cccc]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009ccbc], xmm0
call fcn.18002a5b4
or dword [0x18009cd4c], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Certification_Services
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnaccessData
call fcn.18002a3c0
test eax, eax
jne 0x1800154a6
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cd60]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movaps xmmword [0x18009cd50], xmm0
call fcn.18002a5b4
or dword [0x18009cde0], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Application_Generated
mov r8d, SafeArrayGetElement
call fcn.18002a3c0
test eax, eax
jne 0x1800154f4
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cdf4]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009cde4], xmm0
call fcn.18002a5b4
or dword [0x18009ce74], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Handle_Manipulation
mov r8d, SafeArrayGetElement
call fcn.18002a3c0
test eax, eax
jne 0x180015542
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009ce88]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009ce78], xmm0
call fcn.18002a5b4
or dword [0x18009cf08], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.File_Share
mov r8d, FreeADsMem
call fcn.18002a3c0
test eax, eax
jne 0x18001558d
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cf1c]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009cf0c], xmm0
call fcn.18002a5b4
or dword [0x18009cf9c], esi
jmp 0x1800155d6
mov rcx, qword [rbp + 0x30]
lea rdx, str.Other_Object_Access_Events
mov r8d, 0x1b
call fcn.18002a3c0
test eax, eax
jne 0x1800155d6
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009d0d8]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [r14 + rax]
movups xmmword [0x18009d0c8], xmm0
call fcn.18002a5b4
or dword [0x18009d158], esi
mov rcx, qword [0x18009d1e8]
mov rbx, qword [rbp + 0x30]
lea rdx, str.AuditFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800155f8
mov rcx, rbx
call rax
inc r12d
cmp r12d, dword [rbp + 0x20]
jb 0x1800152f0
mov rcx, qword [0x18009d1e8]
mov rbx, qword [rbp + 0x38]
lea rdx, str.AuditFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, qword [rsp + 0x30]
test rax, rax
je 0x18001562c
mov rcx, rbx
call rax
lea eax, [rdi - 0x1420]
cmp eax, 7
jbe 0x180015648
cmp edi, 0x1547
je 0x180015648
cmp edi, 0xffffff9d
jne 0x180015793
mov rcx, qword [0x18009d1e8]
lea rdx, str.AuditEnumerateSubCategories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015674
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x38]
lea rcx, [0x18009d160]
xor edx, edx
call rax
cmp dword [rbp + 0x20], r15d
jbe 0x180015771
nop
mov r14, qword [rbp + 0x38]
mov rcx, qword [0x18009d1e8]
mov ebx, r15d
lea rdx, str.AuditLookupSubCategoryNameA
shl rbx, 4
add r14, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800156b0
lea rdx, [rbp + 0x30]
mov rcx, r14
call rax
mov rcx, qword [rbp + 0x30]
lea rdx, str.Filtering_Platform_Packet_Drop
mov r8d, 0x1f
call fcn.18002a3c0
test eax, eax
jne 0x1800156fa
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009cfb0]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [rbx + rax]
movaps xmmword [0x18009cfa0], xmm0
call fcn.18002a5b4
or dword [0x18009d030], esi
jmp 0x180015742
mov rcx, qword [rbp + 0x30]
lea rdx, str.Filtering_Platform_Connection
mov r8d, 0x1e
call fcn.18002a3c0
test eax, eax
jne 0x180015742
mov rax, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
lea rcx, [0x18009d044]
or r9, 0xffffffffffffffff
mov edx, 0x80
movups xmm0, xmmword [rbx + rax]
movups xmmword [0x18009d034], xmm0
call fcn.18002a5b4
or dword [0x18009d0c4], esi
mov rcx, qword [0x18009d1e8]
mov rbx, qword [rbp + 0x30]
lea rdx, str.AuditFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015764
mov rcx, rbx
call rax
inc r15d
cmp r15d, dword [rbp + 0x20]
jb 0x180015680
mov rcx, qword [0x18009d1e8]
mov rbx, qword [rbp + 0x38]
lea rdx, str.AuditFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015793
mov rcx, rbx
call rax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
lea eax, [rdi - 0x1260]
cmp eax, 0xc
ja 0x1800157b7
mov ecx, 0x1ff7
bt ecx, eax
jb 0x1800157c4
cmp edi, 0x1300
je 0x1800157c4
cmp edi, 0xffffff9d
jne 0x1800157ca
or dword [0x18009cae4], esi
cmp edi, 0x1235
je 0x1800157d7
cmp edi, 0xffffff9d
jne 0x1800157dd
or dword [0x18009caec], esi
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret