Function at 0x1800064ec
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
jmp 0x180086ee0
mov dword [rsp + 0x20], edi
push r12
push r13
push r14
push r15
mov r10, qword [rdx]
mov r12, rdx
mov r9, qword [r8]
mov r15, r8
mov r11d, r10d
mov r13, rcx
shr r10, 0x20
movabs rbp, 0x100000000
mov rax, r10
mov ebx, r9d
imul rax, rbx
shr r9, 0x20
mov r8d, r11d
imul r8, r9
imul r10, r9
add r8, rax
cmp r8, rax
mov rax, r8
lea rdx, [r10 + rbp]
cmovae rdx, r10
shr rax, 0x20
add rdx, rax
shl r8, 0x20
imul r11, rbx
lea rdi, [rdx + 1]
lea rax, [r11 + r8]
cmp rax, r8
mov qword [rcx], rax
mov rcx, qword [r15 + 8]
cmovae rdi, rdx
mov r9d, ecx
mov rdx, qword [r12]
mov r10d, edx
shr rdx, 0x20
mov r8d, r10d
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
mov rcx, qword [r15]
imul r10, r9
lea rax, [rdx + 1]
mov r9d, ecx
add r10, r8
cmp r10, r8
cmovae rax, rdx
mov rdx, qword [r12 + 8]
add rdi, r10
cmp rdi, r10
mov r10d, edx
mov r8d, r10d
lea rsi, [rax + 1]
cmovae rsi, rax
shr rdx, 0x20
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
imul r10, r9
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rax, [rdx + 1]
cmovae rax, rdx
add rdi, r10
lea rbx, [rax + 1]
cmp rdi, r10
mov qword [r13 + 8], rdi
mov rdx, qword [r12 + 0x10]
mov rdi, rbp
cmovae rbx, rax
mov rcx, qword [r15]
mov r9d, ecx
add rsi, rbx
shr rcx, 0x20
mov r11, rsi
mov r10d, edx
shr rdx, 0x20
mov r8d, r10d
imul r8, rcx
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rax, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rax, rdx
mov rdx, qword [r12 + 8]
add rsi, r10
cmp rsi, r10
mov r10d, edx
mov r8d, r10d
lea rcx, [rax + 1]
cmovae rcx, rax
cmp r11, rbx
mov rbp, rcx
adc rbp, 0
xor r14d, r14d
cmp rbp, rcx
mov r11d, r14d
mov rcx, qword [r15 + 8]
setb r11b
mov r9d, ecx
shr rcx, 0x20
imul r8, rcx
shr rdx, 0x20
lea rbx, [r11 + 1]
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rdi]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
imul r10, r9
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rcx, [rdx + 1]
cmovae rcx, rdx
mov rdx, qword [r12]
add rsi, r10
cmp rsi, r10
mov r10d, edx
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x10]
add rbp, rax
mov r9d, ecx
cmp rbp, rax
cmovae rbx, r11
shr rcx, 0x20
shr rdx, 0x20
mov rax, rdx
lea r11, [rbx + 1]
imul rdx, rcx
imul rax, r9
mov r8d, r10d
imul r8, rcx
lea rcx, [rdx + rdi]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
add rsi, r10
cmp rsi, r10
mov qword [r13 + 0x10], rsi
mov rdx, qword [r12]
mov r10d, edx
lea rax, [rcx + 1]
mov r8d, r10d
cmovae rax, rcx
mov rcx, qword [r15 + 0x18]
add rbp, rax
mov r9d, ecx
cmp rbp, rax
cmovae r11, rbx
shr rdx, 0x20
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rdi]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
mov rdx, qword [r12 + 8]
add rbp, r10
cmp rbp, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x10]
mov r9d, ecx
lea rsi, [r11 + rax]
mov r11d, r14d
cmp rsi, rax
setb r11b
shr rdx, 0x20
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rdi]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
lea rbx, [r11 + 1]
cmovae rcx, rdx
mov rdx, qword [r12 + 0x10]
add rbp, r10
cmp rbp, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 8]
add rsi, rax
mov r9d, ecx
cmp rsi, rax
cmovae rbx, r11
shr rcx, 0x20
imul r8, rcx
shr rdx, 0x20
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rdi]
lea rdi, [rbx + 1]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
mov rdx, qword [r12 + 0x18]
add rbp, r10
cmp rbp, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15]
add rsi, rax
mov r9d, ecx
cmp rsi, rax
cmovae rdi, rbx
shr rcx, 0x20
imul r8, rcx
shr rdx, 0x20
lea r11, [rdi + 1]
mov rax, rdx
imul rdx, rcx
imul rax, r9
movabs rcx, 0x100000000
add rcx, rdx
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
imul r10, r9
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rcx, [rdx + 1]
cmovae rcx, rdx
add rbp, r10
cmp rbp, r10
mov qword [r13 + 0x18], rbp
mov rdx, qword [r12 + 0x18]
mov r10d, edx
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 8]
add rsi, rax
mov r9d, ecx
cmp rsi, rax
cmovae r11, rdi
shr rcx, 0x20
shr rdx, 0x20
mov r8d, r10d
imul r8, rcx
mov rax, rdx
movabs rbp, 0x100000000
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
mov rdx, qword [r12 + 0x10]
add rsi, r10
cmp rsi, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x10]
mov r9d, ecx
lea rdi, [r11 + rax]
mov r11d, r14d
cmp rdi, rax
setb r11b
shr rdx, 0x20
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rbp]
lea rbx, [r11 + 1]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
mov rdx, qword [r12 + 8]
add rsi, r10
cmp rsi, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x18]
add rdi, rax
mov r9d, ecx
cmp rdi, rax
cmovae rbx, r11
shr rdx, 0x20
shr rcx, 0x20
mov rax, rdx
imul rdx, rcx
imul r8, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
imul r10, r9
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rcx, [rdx + 1]
lea r11, [rbx + 1]
cmovae rcx, rdx
add rsi, r10
cmp rsi, r10
mov qword [r13 + 0x20], rsi
mov rdx, qword [r12 + 0x10]
mov r10d, edx
lea rax, [rcx + 1]
mov r8d, r10d
cmovae rax, rcx
mov rcx, qword [r15 + 0x18]
add rdi, rax
mov r9d, ecx
cmp rdi, rax
cmovae r11, rbx
shr rcx, 0x20
imul r8, rcx
shr rdx, 0x20
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
imul r10, r9
lea rcx, [rdx + 1]
add r10, r8
cmp r10, r8
cmovae rcx, rdx
mov rdx, qword [r12 + 0x18]
add rdi, r10
cmp rdi, r10
mov r10d, edx
mov r8d, r10d
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x10]
mov r9d, ecx
lea rbx, [r11 + rax]
cmp rbx, rax
setb r14b
shr rcx, 0x20
imul r8, rcx
shr rdx, 0x20
lea r11, [r14 + 1]
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rbp]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
imul r10, r9
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rcx, [rdx + 1]
cmovae rcx, rdx
add rdi, r10
cmp rdi, r10
mov qword [r13 + 0x28], rdi
mov rdx, qword [r12 + 0x18]
mov r10d, edx
lea rax, [rcx + 1]
cmovae rax, rcx
mov rcx, qword [r15 + 0x18]
add rbx, rax
mov r9d, ecx
cmp rbx, rax
cmovae r11, r14
shr rcx, 0x20
mov rsi, qword [rsp + 0x38]
mov r8d, r10d
mov rdi, qword [rsp + 0x40]
imul r8, rcx
shr rdx, 0x20
mov rax, rdx
imul rdx, rcx
imul rax, r9
lea rcx, [rdx + rbp]
mov rbp, qword [rsp + 0x30]
add r8, rax
cmp r8, rax
cmovae rcx, rdx
mov rdx, r8
imul r10, r9
shr rdx, 0x20
add rdx, rcx
shl r8, 0x20
add r10, r8
cmp r10, r8
lea rcx, [rdx + 1]
cmovae rcx, rdx
add rbx, r10
cmp rbx, r10
mov qword [r13 + 0x30], rbx
mov rbx, qword [rsp + 0x28]
lea rax, [rcx + 1]
cmovae rax, rcx
add rax, r11
mov qword [r13 + 0x38], rax
pop r15
pop r14
pop r13
pop r12
ret
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x278
call fcn.180001055
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x1802946b8]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x180086fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x180086fa4
lea rdi, [rbp + 0x268]
call fcn.1800064ab
mov r9, qword [rbp + 0x260]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov edi, 0x200
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
mov r8d, edi
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, 0xffffffff
mov qword [rsp + 0x20], rsi
test eax, eax
lea r9, [rbp]
lea rdx, [rbp + 0x10]
cmovs eax, ecx
mov rcx, rbx
test eax, eax
cmovs eax, edi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18008720e
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.180087390
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov ebx, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180086fd1
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180001055
sub rsp, rcx
xor esi, esi
lea rdi, [rsp + 0x50]
test rdi, rdi
jne 0x180086ff8
lea rdi, str.no_stack_
jmp 0x18008715b
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800870d8
mov rdx, rsi
test rbx, rbx
je 0x1800870d8
cmp rbx, 0x20
jb 0x1800870bc
mov rcx, qword [rbp + 0x260]
lea r8, [rbx - 1]
lea r8, [rdi + r8*2]
lea rax, [rcx - 1]
add rax, rbx
cmp rdi, rax
ja 0x18008704a
cmp r8, rcx
jae 0x1800870bc
mov r8, rbx
and r8, 0xffffffffffffffe0
mov rax, qword [rbp + 0x260]
lea rcx, [rdi + 0x20]
nop dword [rax]
movq xmm0, qword [rax + rdx]
lea rcx, [rcx + 0x40]
movq xmm1, qword [rax + rdx + 8]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rcx - 0x60], xmm0
movq xmm0, qword [rax + rdx + 0x10]
psraw xmm1, 8
movdqu xmmword [rcx - 0x50], xmm1
movq xmm1, qword [rax + rdx + 0x18]
add rdx, 0x20
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rcx - 0x40], xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp rdx, r8
jb 0x180087060
cmp rdx, rbx
jae 0x1800870d8
mov rax, qword [rbp + 0x260]
movsx ecx, byte [rdx + rax]
mov word [rdi + rdx*2], cx
inc rdx
cmp rdx, rbx
jb 0x1800870c1
mov r8, rsi
test rbx, rbx
je 0x18008715b
mov r10d, 0x53
lea r9, [0x180000000]
lea r11d, [r10 + 0x20]
lea r14d, [r10 - 0x10]
lea r15d, [r10 + 0x10]
nop dword [rax]
cmp word [rdi + r8*2], 0x25
jne case.0x180087132.47
lea rdx, [rdi + 2]
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x180087132.47
movsxd rcx, eax
movzx eax, byte [r9 + rcx + 0x87248]
mov ecx, dword [r9 + rax*4 + 0x87230]
add rcx, r9
jmp rcx
inc r8
add rdx, 2
jmp 0x180087110
mov word [rdx], r10w
jmp case.0x180087132.47
mov word [rdx], r11w
jmp case.0x180087132.47
mov word [rdx], r14w
jmp case.0x180087132.47
mov word [rdx], r15w
inc r8
cmp r8, rbx
jb 0x180087100
lea rbx, [rbp + 0x268]
call fcn.1800064ab
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 0x10]
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8d, 0xff
mov rcx, qword [rax]
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov word [rbp + 0x20e], si
call sym.libcrypto_1_1_x64.dll_OPENSSL_isservice
xor ecx, ecx
test eax, eax
jle 0x1800871f7
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x18008720e
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x10]
mov ecx, 1
mov qword [rbp], rax
lea rax, [rbp]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x18008720e
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.1800028c4
lea rsp, [rbp + 0x228]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret