Function at 0x1401480d0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
shl rax, 7
sub rax, 0x60
sub rsp, rax
mov rax, rsp
mov rcx, r15
mov r10d, edx
call fcn.14004f9c0
pxor xmm7, xmm6
movdqa xmmword [rax], xmm7
and r14, 0xfffffffffffffff0
sub rsp, 0x80
movdqa xmm6, xmmword [rbp + 0x20]
pxor xmm14, xmm14
movdqa xmm12, xmmword [0x140051730]
pcmpgtd xmm14, xmm6
sub r14, 0x80
jb 0x1400507a0
jmp 0x140050560
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm15, xmm6
movdqa xmmword [rsp], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm0, xmm6
movdqa xmmword [rsp + 0x10], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm7, xmmword [r12]
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm1, xmm6
movdqa xmmword [rsp + 0x20], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm8, xmmword [r12 + 0x10]
pxor xmm15, xmm7
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm2, xmm6
movdqa xmmword [rsp + 0x30], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm9, xmmword [r12 + 0x20]
pxor xmm0, xmm8
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm3, xmm6
movdqa xmmword [rsp + 0x40], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm10, xmmword [r12 + 0x30]
pxor xmm1, xmm9
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm4, xmm6
movdqa xmmword [rsp + 0x50], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm11, xmmword [r12 + 0x40]
pxor xmm2, xmm10
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm5, xmm6
movdqa xmmword [rsp + 0x60], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm12, xmmword [r12 + 0x50]
pxor xmm3, xmm11
movdqu xmm13, xmmword [r12 + 0x60]
pxor xmm4, xmm12
movdqu xmm14, xmmword [r12 + 0x70]
lea r12, [r12 + 0x80]
movdqa xmmword [rsp + 0x70], xmm6
pxor xmm5, xmm13
lea rax, [rsp + 0x80]
pxor xmm6, xmm14
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
pxor xmm5, xmmword [rsp + 0x30]
movdqu xmmword [r13 + 0x20], xmm3
pxor xmm2, xmmword [rsp + 0x40]
movdqu xmmword [r13 + 0x30], xmm5
pxor xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r13 + 0x40], xmm2
pxor xmm1, xmmword [rsp + 0x60]
movdqu xmmword [r13 + 0x50], xmm6
pxor xmm4, xmmword [rsp + 0x70]
movdqu xmmword [r13 + 0x60], xmm1
movdqu xmmword [r13 + 0x70], xmm4
lea r13, [r13 + 0x80]
movdqa xmm6, xmmword [rsp + 0x70]
pxor xmm14, xmm14
movdqa xmm12, xmmword [0x140051730]
pcmpgtd xmm14, xmm6
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
sub r14, 0x80
jae 0x140050560
add r14, 0x80
je 0x140050c15
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm15, xmm6
movdqa xmmword [rsp], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm0, xmm6
movdqa xmmword [rsp + 0x10], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm7, xmmword [r12]
cmp r14, 0x10
je 0x140050be0
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm1, xmm6
movdqa xmmword [rsp + 0x20], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm8, xmmword [r12 + 0x10]
cmp r14, 0x20
je 0x140050b90
pxor xmm15, xmm7
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm2, xmm6
movdqa xmmword [rsp + 0x30], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm9, xmmword [r12 + 0x20]
cmp r14, 0x30
je 0x140050b30
pxor xmm0, xmm8
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm3, xmm6
movdqa xmmword [rsp + 0x40], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm10, xmmword [r12 + 0x30]
cmp r14, 0x40
je 0x140050ad0
pxor xmm1, xmm9
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm4, xmm6
movdqa xmmword [rsp + 0x50], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm11, xmmword [r12 + 0x40]
cmp r14, 0x50
je 0x140050a60
pxor xmm2, xmm10
pshufd xmm13, xmm14, 0x13
pxor xmm14, xmm14
movdqa xmm5, xmm6
movdqa xmmword [rsp + 0x60], xmm6
paddq xmm6, xmm6
pand xmm13, xmm12
pcmpgtd xmm14, xmm6
pxor xmm6, xmm13
movdqu xmm12, xmmword [r12 + 0x50]
cmp r14, 0x60
je 0x1400509e0
pxor xmm3, xmm11
movdqu xmm13, xmmword [r12 + 0x60]
pxor xmm4, xmm12
movdqa xmmword [rsp + 0x70], xmm6
lea r12, [r12 + 0x70]
pxor xmm5, xmm13
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
pxor xmm5, xmmword [rsp + 0x30]
movdqu xmmword [r13 + 0x20], xmm3
pxor xmm2, xmmword [rsp + 0x40]
movdqu xmmword [r13 + 0x30], xmm5
pxor xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r13 + 0x40], xmm2
pxor xmm1, xmmword [rsp + 0x60]
movdqu xmmword [r13 + 0x50], xmm6
movdqu xmmword [r13 + 0x60], xmm1
lea r13, [r13 + 0x70]
movdqa xmm6, xmmword [rsp + 0x70]
jmp 0x140050c15
pxor xmm3, xmm11
lea r12, [r12 + 0x60]
pxor xmm4, xmm12
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
pxor xmm5, xmmword [rsp + 0x30]
movdqu xmmword [r13 + 0x20], xmm3
pxor xmm2, xmmword [rsp + 0x40]
movdqu xmmword [r13 + 0x30], xmm5
pxor xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r13 + 0x40], xmm2
movdqu xmmword [r13 + 0x50], xmm6
lea r13, [r13 + 0x60]
movdqa xmm6, xmmword [rsp + 0x60]
jmp 0x140050c15
pxor xmm2, xmm10
lea r12, [r12 + 0x50]
pxor xmm3, xmm11
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
pxor xmm5, xmmword [rsp + 0x30]
movdqu xmmword [r13 + 0x20], xmm3
pxor xmm2, xmmword [rsp + 0x40]
movdqu xmmword [r13 + 0x30], xmm5
movdqu xmmword [r13 + 0x40], xmm2
lea r13, [r13 + 0x50]
movdqa xmm6, xmmword [rsp + 0x50]
jmp 0x140050c15
pxor xmm1, xmm9
lea r12, [r12 + 0x40]
pxor xmm2, xmm10
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
pxor xmm5, xmmword [rsp + 0x30]
movdqu xmmword [r13 + 0x20], xmm3
movdqu xmmword [r13 + 0x30], xmm5
lea r13, [r13 + 0x40]
movdqa xmm6, xmmword [rsp + 0x40]
jmp 0x140050c15
pxor xmm0, xmm8
lea r12, [r12 + 0x30]
pxor xmm1, xmm9
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
pxor xmm3, xmmword [rsp + 0x20]
movdqu xmmword [r13 + 0x10], xmm0
movdqu xmmword [r13 + 0x20], xmm3
lea r13, [r13 + 0x30]
movdqa xmm6, xmmword [rsp + 0x30]
jmp 0x140050c15
pxor xmm15, xmm7
lea r12, [r12 + 0x20]
pxor xmm0, xmm8
lea rax, [rsp + 0x80]
mov r10d, edx
call fcn.14004e840
pxor xmm15, xmmword [rsp]
pxor xmm0, xmmword [rsp + 0x10]
movdqu xmmword [r13], xmm15
movdqu xmmword [r13 + 0x10], xmm0
lea r13, [r13 + 0x20]
movdqa xmm6, xmmword [rsp + 0x20]
jmp 0x140050c15
pxor xmm7, xmm15
lea r12, [r12 + 0x10]
movdqa xmmword [rbp + 0x20], xmm7
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0x20]
lea r8, [r15]
call fcn.140042720
pxor xmm15, xmmword [rbp + 0x20]
movdqu xmmword [r13], xmm15
lea r13, [r13 + 0x10]
movdqa xmm6, xmmword [rsp + 0x10]
and ebx, 0xf
je 0x140050c65
mov rdx, r13
movzx eax, byte [r12]
movzx ecx, byte [rdx - 0x10]
lea r12, [r12 + 1]
mov byte [rdx - 0x10], al
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub ebx, 1
jne 0x140050c1d
movdqu xmm15, xmmword [r13 - 0x10]
lea rcx, [rbp + 0x20]
pxor xmm15, xmm6
lea rdx, [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm15
lea r8, [r15]
call fcn.140042720
pxor xmm6, xmmword [rbp + 0x20]
movdqu xmmword [r13 - 0x10], xmm6
lea rax, [rsp]
pxor xmm0, xmm0
movdqa xmmword [rax], xmm0
movdqa xmmword [rax + 0x10], xmm0
lea rax, [rax + 0x20]
cmp rbp, rax
ja 0x140050c6d
lea rax, [rbp + 0x78]
movaps xmm6, xmmword [rbp + 0x40]
movaps xmm7, xmmword [rbp + 0x50]
movaps xmm8, xmmword [rbp + 0x60]
movaps xmm9, xmmword [rbp + 0x70]
movaps xmm10, xmmword [rbp + 0x80]
movaps xmm11, xmmword [rbp + 0x90]
movaps xmm12, xmmword [rbp + 0xa0]
movaps xmm13, xmmword [rbp + 0xb0]
movaps xmm14, xmmword [rbp + 0xc0]
movaps xmm15, xmmword [rbp + 0xd0]
lea rax, [rax + 0xa0]
mov r15, qword [rax - 0x30]
mov r14, qword [rax - 0x28]
mov r13, qword [rax - 0x20]
mov r12, qword [rax - 0x18]
mov rbx, qword [rax - 0x10]
mov rbp, qword [rax - 8]
lea rsp, [rax]
repz ret
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x278
call fcn.140261900
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x1403dc468]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x140148194
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x140148194
lea rdi, [rbp + 0x268]
call fcn.14007bd60
mov r9, qword [rbp + 0x260]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov edi, 0x200
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
mov r8d, edi
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, 0xffffffff
mov qword [rsp + 0x20], rsi
test eax, eax
lea r9, [rbp]
lea rdx, [rbp + 0x10]
cmovs eax, ecx
mov rcx, rbx
test eax, eax
cmovs eax, edi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401483fe
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.140148490
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov ebx, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1401481c1
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140261900
sub rsp, rcx
xor esi, esi
lea rdi, [rsp + 0x50]
test rdi, rdi
jne 0x1401481e8
lea rdi, str.no_stack_
jmp 0x14014834b
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1401482c8
mov rdx, rsi
test rbx, rbx
je 0x1401482c8
cmp rbx, 0x20
jb 0x1401482ac
mov rcx, qword [rbp + 0x260]
lea r8, [rbx - 1]
lea r8, [rdi + r8*2]
lea rax, [rcx - 1]
add rax, rbx
cmp rdi, rax
ja 0x14014823a
cmp r8, rcx
jae 0x1401482ac
mov r8, rbx
and r8, 0xffffffffffffffe0
mov rax, qword [rbp + 0x260]
lea rcx, [rdi + 0x20]
nop dword [rax]
movq xmm0, qword [rax + rdx]
lea rcx, [rcx + 0x40]
movq xmm1, qword [rax + rdx + 8]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rcx - 0x60], xmm0
movq xmm0, qword [rax + rdx + 0x10]
psraw xmm1, 8
movdqu xmmword [rcx - 0x50], xmm1
movq xmm1, qword [rax + rdx + 0x18]
add rdx, 0x20
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rcx - 0x40], xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp rdx, r8
jb 0x140148250
cmp rdx, rbx
jae 0x1401482c8
mov rax, qword [rbp + 0x260]
movsx ecx, byte [rdx + rax]
mov word [rdi + rdx*2], cx
inc rdx
cmp rdx, rbx
jb 0x1401482b1
mov r8, rsi
test rbx, rbx
je 0x14014834b
mov r10d, 0x53
lea r9, [0x140000000]
lea r11d, [r10 + 0x20]
lea r14d, [r10 - 0x10]
lea r15d, [r10 + 0x10]
nop dword [rax]
cmp word [rdi + r8*2], 0x25
jne case.0x140148322.47
lea rdx, [rdi + 2]
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x140148322.47
movsxd rcx, eax
movzx eax, byte [r9 + rcx + 0x148438]
mov ecx, dword [r9 + rax*4 + 0x148420]
add rcx, r9
jmp rcx
inc r8
add rdx, 2
jmp 0x140148300
mov word [rdx], r10w
jmp case.0x140148322.47
mov word [rdx], r11w
jmp case.0x140148322.47
mov word [rdx], r14w
jmp case.0x140148322.47
mov word [rdx], r15w
inc r8
cmp r8, rbx
jb 0x1401482f0
lea rbx, [rbp + 0x268]
call fcn.14007bd60
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 0x10]
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8d, 0xff
mov rcx, qword [rax]
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov word [rbp + 0x20e], si
call fcn.140147f60
xor ecx, ecx
test eax, eax
jle 0x1401483e7
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1401483fe
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x10]
mov ecx, 1
mov qword [rbp], rax
lea rax, [rbp]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1401483fe
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.140260d10
lea rsp, [rbp + 0x228]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret