Function at 0x18003d3f0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov eax, dword [0x1800bda60]
mov r10, r9
test al, 1
jne 0x18003d472
or eax, 1
mov qword [0x1800bdeb0], 0
lea rcx, [0x180097c00]
mov dword [0x1800bda60], eax
mov qword [0x1800bdeb8], 0
mov qword [0x1800bdec0], 0
call fcn.180072c44
mov r10, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x80]
mov edi, dword [rbp + 0xa8]
lea ebx, [rdi + 0xa8]
mov dword [rbp + 0xb8], ebx
cmp edi, ebx
jae 0x18003d931
mov ebx, dword [rsp + 0x40]
mov eax, dword [rbp + 0xb8]
mov qword [rsp + 0x158], rsi
mov esi, dword [rbp + 0xa8]
mov qword [rsp + 0x150], r12
mov r12d, dword [rbp + 0xa8]
mov qword [rsp + 0x148], r13
movzx r13d, byte [rbp + 0xa8]
mov qword [rsp + 0x140], r14
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x138], r15
mov r15, qword [rbp + 0xb8]
nop
cmp edi, 0x6c
ja 0x18003d6e5
je 0x18003d6d2
cmp edi, 0x1a
je 0x18003d691
cmp edi, 0x2f
je 0x18003d685
cmp edi, 0x44
je 0x18003d6fc
cmp edi, 0x57
jne 0x18003d906
mov rax, qword [r10]
mov r14, qword [rax + 0x298]
mov qword [rsp + 0x68], r14
cmp dword [r14 + 0x48], 0
je 0x18003d5be
mov eax, dword [r14 + 0x4c]
lea r9, [rsp + 0x48]
mov ecx, dword [rdx]
lea r8d, [rdi + 4]
mov dword [rbp + 0xa8], eax
lea rdx, [rsp + 0x50]
mov rax, qword [rbp + 0xa0]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov rax, qword [rax]
lea rcx, [rax + rcx*8]
lea rax, [r14 + 0x40]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x58]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call fcn.1800053c0
mov rdx, qword [rbp + 0x88]
xor ecx, ecx
mov esi, 1
mov dword [r14 + 0x48], ecx
add dword [rdx], esi
sub dword [r14 + 0x50], esi
jmp 0x18003d900
mov edi, 0xe4
mov eax, edi
sub eax, 0xe2
je 0x18003d639
sub eax, 1
je 0x18003d5f1
cmp eax, 1
jne 0x18003d651
mov rcx, qword [rbp + 0xb0]
mov esi, 2
cmp dword [r14 + 0x50], esi
mov eax, dword [rdx]
cmovb esi, dword [r14 + 0x50]
sub dword [rcx], eax
jmp 0x18003d651
mov rax, qword [rbp + 0xb0]
mov ecx, dword [rdx]
mov eax, dword [rax]
cmp esi, eax
cmovbe eax, esi
mov esi, eax
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
mov rax, qword [rdx + rcx*8]
mov qword [rbp - 0x58], rax
cmp esi, 1
jbe 0x18003d627
lea eax, [rcx + 1]
mov rax, qword [rdx + rax*8]
mov qword [rbp - 0x50], rax
jmp 0x18003d651
mov rax, qword [r14 + 0x40]
mov qword [rbp - 0x50], rax
mov dword [r14 + 0x48], 1
jmp 0x18003d651
mov rdx, qword [rcx]
lea r9, [rbp - 0x58]
mov rcx, qword [r10]
mov r8d, dword [r8]
call qword [r14 + 0x18]
mov r10, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x88]
dec edi
mov r8, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x80]
cmp edi, 0xe1
ja 0x18003d5c3
add dword [rdx], esi
sub dword [r14 + 0x50], esi
mov edi, dword [rbp + 0xa8]
jmp 0x18003d900
mov ebx, r12d
mov dword [rsp + 0x40], ebx
jmp 0x18003d906
mov rcx, r10
call fcn.18007b4a0
mov r12d, eax
cmp eax, 0x23
jne 0x18003d8f9
nop word [rax + rax]
mov rcx, qword [rbp + 0x98]
call fcn.18007b4a0
mov r12d, eax
cmp eax, 0xa
je 0x18003d8f9
cmp eax, 0xffffffff
jne 0x18003d6b0
jmp 0x18003d8f9
cmp dword [r14 + 0x48], 0
jne 0x18003d906
inc dword [r8]
jmp 0x18003d906
mov eax, edi
sub eax, 0x113
je 0x18003d754
sub eax, 0x15
je 0x18003d731
cmp eax, 0x15
jne 0x18003d900
mov r14, qword [rsp + 0x140]
mov eax, ebx
mov r13, qword [rsp + 0x148]
mov r12, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x158]
mov r15, qword [rsp + 0x138]
add rsp, 0x160
pop rdi
pop rbx
pop rbp
ret
lea rcx, [r10 + 0x68]
mov r8d, 0x64
lea rdx, [0x1800bdeb0]
call fcn.18004fd60
mov byte [rsp + 0x40], al
mov ebx, dword [rsp + 0x40]
jmp 0x18003d8f9
mov rax, qword [0x1800bdeb8]
cmp qword [0x1800bdeb0], rax
jne 0x18003d8c8
mov r14d, dword [rsp + 0x60]
mov edi, 0xa4
mov eax, edi
sub eax, 0xa4
je 0x18003d861
sub eax, 0x13
je 0x18003d83e
sub eax, 0x13
je 0x18003d836
sub eax, 0x13
je 0x18003d7ff
cmp eax, 0x13
jne 0x18003d8a9
xor ecx, ecx
movzx eax, r13b
test r15, r15
cmovne ecx, eax
movzx r13d, cl
test cl, cl
je 0x18003d7e7
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x6c]
mov rcx, r15
mov qword [rsp + 0x28], rax
lea edx, [r8 + 9]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor r8d, r8d
lea rdx, [0x1800bdeb0]
lea ecx, [r8 + 0x5a]
call fcn.180065850
jmp 0x18003d8a9
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
xor ecx, ecx
mov r14d, 0x70
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r15, rax
jmp 0x18003d8a9
mov r13b, 1
xor r15d, r15d
jmp 0x18003d8a9
mov eax, dword [0x1800aec50]
movsd xmm0, qword [str.ider]
mov dword [rbp - 0x7e], eax
movzx eax, word [0x1800aec60]
mov word [rbp - 0x72], ax
movsd qword [rbp - 0x7a], xmm0
jmp 0x18003d8a9
lea rdx, str.yEve
mov dword [rsp + 0x70], 0x4d
lea rcx, [rsp + 0x72]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r8d, 2
lea rdx, [0x1800aec74]
lea rcx, [rsp + 0x70]
call fcn.180076a10
mov r8d, 2
lea rdx, [0x1800aec7c]
lea rcx, [rsp + 0x70]
call fcn.180076a10
add edi, 0x13
cmp edi, 0x103
jb 0x18003d772
mov edi, dword [rbp + 0xa8]
mov dword [rsp + 0x60], r14d
mov r14, qword [rsp + 0x68]
mov rax, qword [rbp + 0x98]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
add rax, 0x68
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x1a
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18004ba90
mov rdx, qword [rbp + 0x88]
mov eax, dword [rbp + 0xb8]
add edi, 0x15
mov dword [rbp + 0xa8], edi
cmp edi, eax
jae 0x18003d6fc
mov r10, qword [rbp + 0x98]
mov r8, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x80]
jmp 0x18003d4e0
mov eax, dword [rsp + 0x40]
add rsp, 0x160
pop rdi
pop rbx
pop rbp
ret