Function at 0x7ff64955dbf0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x7ff6495ce010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, r8
mov rdi, rdx
xor r14d, r14d
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r14w
call fcn.7ff64954cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbx + 0x10]
lea rax, [rbp + 0x60]
cmp rax, rdx
je 0x7ff64955dc72
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x7ff64955dc69
mov rdx, qword [rdx]
lea rcx, [rbp + 0x60]
call fcn.7ff64954d1d0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x7ff6495cee90]
lea rcx, [rbp - 0x28]
call fcn.7ff649548b00
mov rbx, rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov r8d, 0xe
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x68]
call fcn.7ff64954d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.7ff64954e840
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rax, rdx
cmp rcx, rax
jbe 0x7ff64955dd1f
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x7ff64955dd1f
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.7ff64954e840
jmp 0x7ff64955dd2c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.7ff64954e950
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x7ff64955dd95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955dd90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e323
call fcn.7ff649578b74
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x7ff64955dde9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955dde4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e329
call fcn.7ff649578b74
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x7ff64955de3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955de35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e32f
call fcn.7ff649578b74
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
lea rdx, [0x7ff6495cee50]
lea rcx, [rbp - 8]
call fcn.7ff649548b00
mov rbx, rax
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov r8d, 0xe
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x48]
call fcn.7ff64954d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.7ff64954e840
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
sub rax, rdx
cmp rcx, rax
jbe 0x7ff64955deea
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x7ff64955deea
lea r8, [rsp + 0x78]
mov rcx, rbx
call fcn.7ff64954e840
jmp 0x7ff64955def7
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.7ff64954e950
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x7ff64955df5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955df5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e335
call fcn.7ff649578b74
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r14w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x7ff64955dfb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955dfac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e33b
call fcn.7ff649578b74
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x7ff64955e002
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955dffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e341
call fcn.7ff649578b74
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov edx, 4
call fcn.7ff649585db8
test eax, eax
jne 0x7ff64955e05d
lea rax, [rbp + 0x20]
cmp rdi, rax
je 0x7ff64955e052
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rdi
call fcn.7ff64954d1d0
xor al, al
mov byte [rsi], al
mov bl, 1
jmp 0x7ff64955e215
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rcx, qword [rbp + 0x40]
mov edx, 4
call fcn.7ff649585db8
test eax, eax
jne 0x7ff64955e0a8
lea rax, [rbp + 0x40]
cmp rdi, rax
je 0x7ff64955e09c
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov rcx, rdi
call fcn.7ff64954d1d0
mov al, 1
mov byte [rsi], al
movzx ebx, al
jmp 0x7ff64955e215
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
lea rsi, [rdx + rax*2]
lea rdi, [rbp + 0x20]
cmovae rdi, qword [rbp + 0x20]
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8d, 0xf
mov qword [rsp + 0x70], r8
mov byte [rsp + 0x58], cl
mov rdx, rsi
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x7ff64955e104
lea rcx, [rsp + 0x58]
call fcn.7ff6495491a0
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rbp + 0x18], rax
cmp rdi, rsi
je 0x7ff64955e16b
movzx ebx, byte [rsp + 0x50]
movzx r9d, byte [rdi]
cmp rcx, r8
jae 0x7ff64955e143
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff64955e156
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.7ff649547af0
add rdi, 2
mov r8, qword [rsp + 0x70]
cmp rdi, rsi
je 0x7ff64955e16b
mov rcx, qword [rsp + 0x68]
jmp 0x7ff64955e117
lea rdx, [rsp + 0x58]
cmp r8, 0x10
cmovae rdx, qword [rsp + 0x58]
lea rcx, str.EventManager_error:_Spooler_Applet_file_wasnt_found__or_no_read_access_at:__s_n
call fcn.7ff649543170
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x7ff64955e1c3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955e1be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e347
call fcn.7ff649578b74
lea rdx, str.IntelDalJhi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x7ff64955e213
xor r8d, r8d
lea edx, [r8 + 1]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
mov r9d, 0xc0000003
mov rcx, rax
call qword [sym.imp.ADVAPI32.DLL_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_DeregisterEventSource]
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x7ff64955e255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955e250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e34d
call fcn.7ff649578b74
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x7ff64955e2a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955e2a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e353
call fcn.7ff649578b74
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r14w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x7ff64955e2f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff64955e2ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff64955e31d
call fcn.7ff649578b74
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.7ff649578b50
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
int3
call fcn.7ff649585708
nop
call fcn.7ff649585708
nop
call fcn.7ff649585708
int3