Function at 0x1401f8190
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
movsd dword [rdi], dword [rsi]
and byte [rbx - 0x2e], dh
xor al, 0x62
rcr dword [rbp + 0x34d37320], 1
vpsrlq ymm29, ymm12, 0x34
valignq ymm29, ymm29, ymm28, 3
valignq ymm28, ymm28, ymm27, 3
valignq ymm27, ymm27, ymm26, 3
valignq ymm26, ymm26, ymm25, 3
valignq ymm25, ymm25, ymm24, 3
valignq ymm24, ymm24, ymm23, 3
valignq ymm23, ymm23, ymm2, 3
valignq ymm2, ymm2, ymm1, 3
valignq ymm1, ymm1, ymm0, 3
valignq ymm0, ymm0, ymmword [0x14044c580], 3
vpandq ymm3, ymm3, ymmword [0x14044c540]
vpandq ymm4, ymm4, ymmword [0x14044c540]
vpandq ymm5, ymm5, ymmword [0x14044c540]
vpandq ymm6, ymm6, ymmword [0x14044c540]
vpandq ymm7, ymm7, ymmword [0x14044c540]
vpandq ymm8, ymm8, ymmword [0x14044c540]
vpandq ymm9, ymm9, ymmword [0x14044c540]
vpandq ymm10, ymm10, ymmword [0x14044c540]
vpandq ymm11, ymm11, ymmword [0x14044c540]
vpandq ymm12, ymm12, ymmword [0x14044c540]
vpaddq ymm3, ymm3, ymm0
vpaddq ymm4, ymm4, ymm1
vpaddq ymm5, ymm5, ymm2
vpaddq ymm6, ymm6, ymm23
vpaddq ymm7, ymm7, ymm24
vpaddq ymm8, ymm8, ymm25
vpaddq ymm9, ymm9, ymm26
vpaddq ymm10, ymm10, ymm27
vpaddq ymm11, ymm11, ymm28
vpaddq ymm12, ymm12, ymm29
vpcmpnleuq k1, ymm3, ymmword [0x14044c540]
vpcmpnleuq k2, ymm4, ymmword [0x14044c540]
kmovb r14d, k1
kmovb r13d, k2
shl r13b, 4
or r14b, r13b
vpcmpnleuq k1, ymm5, ymmword [0x14044c540]
vpcmpnleuq k2, ymm6, ymmword [0x14044c540]
kmovb r13d, k1
kmovb r12d, k2
shl r12b, 4
or r13b, r12b
vpcmpnleuq k1, ymm7, ymmword [0x14044c540]
vpcmpnleuq k2, ymm8, ymmword [0x14044c540]
kmovb r12d, k1
kmovb r11d, k2
shl r11b, 4
or r12b, r11b
vpcmpnleuq k1, ymm9, ymmword [0x14044c540]
vpcmpnleuq k2, ymm10, ymmword [0x14044c540]
kmovb r11d, k1
kmovb r10d, k2
shl r10b, 4
or r11b, r10b
vpcmpnleuq k1, ymm11, ymmword [0x14044c540]
vpcmpnleuq k2, ymm12, ymmword [0x14044c540]
kmovb r10d, k1
kmovb r9d, k2
shl r9b, 4
or r10b, r9b
add r14b, r14b
adc r13b, r13b
adc r12b, r12b
adc r11b, r11b
adc r10b, r10b
vpcmpequq k1, ymm3, ymmword [0x14044c540]
vpcmpequq k2, ymm4, ymmword [0x14044c540]
kmovb r9d, k1
kmovb r8d, k2
shl r8b, 4
or r9b, r8b
vpcmpequq k1, ymm5, ymmword [0x14044c540]
vpcmpequq k2, ymm6, ymmword [0x14044c540]
kmovb r8d, k1
kmovb edx, k2
shl dl, 4
or r8b, dl
vpcmpequq k1, ymm7, ymmword [0x14044c540]
vpcmpequq k2, ymm8, ymmword [0x14044c540]
kmovb edx, k1
kmovb ecx, k2
shl cl, 4
or dl, cl
vpcmpequq k1, ymm9, ymmword [0x14044c540]
vpcmpequq k2, ymm10, ymmword [0x14044c540]
kmovb ecx, k1
kmovb ebx, k2
shl bl, 4
or cl, bl
vpcmpequq k1, ymm11, ymmword [0x14044c540]
vpcmpequq k2, ymm12, ymmword [0x14044c540]
kmovb ebx, k1
kmovb eax, k2
shl al, 4
or bl, al
add r14b, r9b
adc r13b, r8b
adc r12b, dl
adc r11b, cl
adc r10b, bl
xor r14b, r9b
xor r13b, r8b
xor r12b, dl
xor r11b, cl
xor r10b, bl
kmovb k1, r14d
shr r14b, 4
kmovb k2, r14d
kmovb k3, r13d
shr r13b, 4
kmovb k4, r13d
kmovb k5, r12d
shr r12b, 4
kmovb k6, r12d
kmovb k7, r11d
vpsubq ymm3 {k1}, ymm3, ymmword [0x14044c540]
vpsubq ymm4 {k2}, ymm4, ymmword [0x14044c540]
vpsubq ymm5 {k3}, ymm5, ymmword [0x14044c540]
vpsubq ymm6 {k4}, ymm6, ymmword [0x14044c540]
vpsubq ymm7 {k5}, ymm7, ymmword [0x14044c540]
vpsubq ymm8 {k6}, ymm8, ymmword [0x14044c540]
vpsubq ymm9 {k7}, ymm9, ymmword [0x14044c540]
vpandq ymm3, ymm3, ymmword [0x14044c540]
vpandq ymm4, ymm4, ymmword [0x14044c540]
vpandq ymm5, ymm5, ymmword [0x14044c540]
vpandq ymm6, ymm6, ymmword [0x14044c540]
vpandq ymm7, ymm7, ymmword [0x14044c540]
vpandq ymm8, ymm8, ymmword [0x14044c540]
vpandq ymm9, ymm9, ymmword [0x14044c540]
shr r11b, 4
kmovb k1, r11d
kmovb k2, r10d
shr r10b, 4
kmovb k3, r10d
vpsubq ymm10 {k1}, ymm10, ymmword [0x14044c540]
vpsubq ymm11 {k2}, ymm11, ymmword [0x14044c540]
vpsubq ymm12 {k3}, ymm12, ymmword [0x14044c540]
vpandq ymm10, ymm10, ymmword [0x14044c540]
vpandq ymm11, ymm11, ymmword [0x14044c540]
vpandq ymm12, ymm12, ymmword [0x14044c540]
vmovdqu64 ymmword [rdi], ymm3
vmovdqu64 ymmword [rdi + 0x20], ymm4
vmovdqu64 ymmword [rdi + 0x40], ymm5
vmovdqu64 ymmword [rdi + 0x60], ymm6
vmovdqu64 ymmword [rdi + 0x80], ymm7
vmovdqu64 ymmword [rdi + 0xa0], ymm8
vmovdqu64 ymmword [rdi + 0xc0], ymm9
vmovdqu64 ymmword [rdi + 0xe0], ymm10
vmovdqu64 ymmword [rdi + 0x100], ymm11
vmovdqu64 ymmword [rdi + 0x120], ymm12
vzeroupper
lea rax, [rsp]
vmovdqa64 xmm6, xmmword [rax]
vmovdqa64 xmm7, xmmword [rax + 0x10]
vmovdqa64 xmm8, xmmword [rax + 0x20]
vmovdqa64 xmm9, xmmword [rax + 0x30]
vmovdqa64 xmm10, xmmword [rax + 0x40]
vmovdqa64 xmm11, xmmword [rax + 0x50]
vmovdqa64 xmm12, xmmword [rax + 0x60]
vmovdqa64 xmm13, xmmword [rax + 0x70]
vmovdqa64 xmm14, xmmword [rax + 0x80]
vmovdqa64 xmm15, xmmword [rax + 0x90]
lea rax, [rsp + 0xa8]
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov rbp, qword [rax + 0x20]
mov rbx, qword [rax + 0x28]
lea rsp, [rax + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x278
call fcn.140337720
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x14044d780]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x1401f8253
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1401f8253
lea rdi, [rbp + 0x268]
call fcn.1400fcb40
mov r9, qword [rbp + 0x260]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov edi, 0x200
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
mov r8d, edi
or rcx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
test eax, eax
mov qword [rsp + 0x20], rsi
mov ecx, 0xffffffff
lea r9, [rbp]
cmovs eax, ecx
lea rdx, [rbp + 0x10]
test eax, eax
mov rcx, rbx
cmovs eax, edi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401f8501
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.14012fc50
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov ebx, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1401f8280
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140337720
sub rsp, rcx
xor esi, esi
lea rdi, [rsp + 0x50]
test rdi, rdi
jne 0x1401f82a7
lea rdi, str.no_stack_
jmp 0x1401f844f
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1401f83dd
mov rcx, rsi
test rbx, rbx
je 0x1401f83bc
cmp rbx, 4
jb 0x1401f83c1
mov rdx, qword [rbp + 0x260]
lea r8, [rbx - 1]
lea r8, [rdi + r8*2]
lea rax, [rdx - 1]
add rax, rbx
cmp rdi, rax
ja 0x1401f82fd
cmp r8, rdx
jae 0x1401f83d0
cmp rbx, 0x20
jb 0x1401f8389
mov rdx, rbx
mov r9, rbx
and edx, 0x1f
sub r9, rdx
mov rax, qword [rbp + 0x260]
lea r8, [rdi + 0x20]
add rax, 0x10
movq xmm0, qword [rax - 0x10]
lea r8, [r8 + 0x40]
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [r8 - 0x60], xmm0
movq xmm0, qword [rax - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 - 0x50], xmm1
movq xmm1, qword [rax - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [r8 - 0x40], xmm0
movdqu xmmword [r8 - 0x30], xmm1
cmp rcx, r9
jb 0x1401f8322
cmp rdx, 4
jb 0x1401f83bc
mov rax, rbx
and rax, 0xfffffffffffffffc
mov rdx, qword [rbp + 0x260]
nop word [rax + rax]
movd xmm0, dword [rcx + rdx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rdi + rcx*2], xmm0
add rcx, 4
cmp rcx, rax
jb 0x1401f83a0
cmp rcx, rbx
jae 0x1401f83dd
mov rdx, qword [rbp + 0x260]
nop dword [rax + rax]
movsx eax, byte [rcx + rdx]
mov word [rdi + rcx*2], ax
inc rcx
jmp 0x1401f83bc
mov r8, rsi
test rbx, rbx
je 0x1401f844f
lea r9, [0x140000000]
nop dword [rax]
cmp word [rdi + r8*2], 0x25
jne case.0x1401f8422.47
lea rdx, [rdi + 2]
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x1401f8422.47
movsxd rcx, eax
movzx eax, byte [r9 + rcx + 0x1f8538]
mov ecx, dword [r9 + rax*4 + 0x1f8520]
add rcx, r9
jmp rcx
inc r8
add rdx, 2
jmp 0x1401f8400
mov word [rdx], 0x53
jmp case.0x1401f8422.47
mov word [rdx], reloc.WS2_32.dll_WSAStartup
jmp case.0x1401f8422.47
mov word [rdx], 0x43
jmp case.0x1401f8422.47
mov word [rdx], 0x63
inc r8
cmp r8, rbx
jb 0x1401f83f0
lea rbx, [rbp + 0x268]
call fcn.1400fcb40
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 0x10]
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8d, 0xff
mov rcx, qword [rax]
or rcx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf
mov word [rbp + 0x20e], si
call fcn.1401f8020
xor ecx, ecx
test eax, eax
jle 0x1401f84ea
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1401f8501
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x10]
mov ecx, 1
mov qword [rbp], rax
lea rax, [rbp]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1401f8501
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.140336f90
lea rsp, [rbp + 0x228]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret