Function at 0x140056a88
Capabilities:
Access the windows event log
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov esi, ecx
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
mov r12b, 4
cmp rcx, r14
je 0x140056add
test byte [rcx + 0x1c], r12b
je 0x140056add
cmp byte [rcx + 0x19], 5
jb 0x140056add
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f08]
mov edx, 0x39
call fcn.14000ffa8
xor r9d, r9d
mov r8d, 0xffffffff
xor ecx, ecx
lea edx, [r9 + 0x14]
call fcn.1400666f8
xor ebp, ebp
lea r13, [0x140009838]
lea r15d, [rbp + 2]
cmp eax, ebp
jne 0x140056b3d
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056b66
test byte [rcx + 0x1c], r12b
je 0x140056b44
cmp byte [rcx + 0x19], r15b
jb 0x140056b44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [rbp + 0x3a]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f08]
mov r9d, eax
call fcn.1400100e0
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056b66
test byte [rcx + 0x1c], r12b
je 0x140056b66
cmp byte [rcx + 0x19], 5
jb 0x140056b66
mov rcx, qword [rcx + 0x10]
mov edx, 0x67
mov r8, r13
call fcn.14000ffa8
xor ecx, ecx
mov edi, ebp
call qword [sym.imp.RPCRT4.dll_RpcMgmtStopServerListening]
mov ebx, eax
cmp eax, ebp
je 0x140056ba4
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056ba2
test byte [rcx + 0x1c], r12b
je 0x140056ba2
cmp byte [rcx + 0x19], r15b
jb 0x140056ba2
mov rcx, qword [rcx + 0x10]
mov edx, 0x68
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov edi, ebx
mov rcx, qword [0x1400a3ee8]
cmp rcx, rbp
je 0x140056c4e
lea rdx, [0x14000a3d0]
call fcn.1400572c8
cmp eax, ebp
jne 0x140056bfd
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056bfd
test byte [rax + 0x1c], r12b
je 0x140056bfd
cmp byte [rax + 0x19], r15b
jb 0x140056bfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov edx, 0x69
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov rcx, qword [0x1400a3ee8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebp
jne 0x140056c47
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056c47
test byte [rax + 0x1c], r12b
je 0x140056c47
cmp byte [rax + 0x19], r15b
jb 0x140056c47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov edx, 0x6a
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov qword [0x1400a3ee8], rbp
lea rcx, [0x140008bf0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIfEx]
mov ebx, eax
cmp eax, ebp
je 0x140056c92
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056c99
test byte [rcx + 0x1c], r12b
je 0x140056c99
cmp byte [rcx + 0x19], r15b
jb 0x140056c99
mov rcx, qword [rcx + 0x10]
mov edx, 0x6b
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov rcx, qword [str.P5_n_]
cmp edi, ebp
cmove edi, ebx
cmp edi, ebp
je 0x140056cd2
cmp rcx, r14
je 0x140056cd2
test byte [rcx + 0x1c], r12b
je 0x140056cd2
cmp byte [rcx + 0x19], r15b
jb 0x140056cd2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f08]
mov edx, 0x3b
mov r9d, edi
call fcn.1400100e0
mov rcx, qword [str.P5_n_]
mov ebx, ebp
mov r13d, 0x3d
cmp rcx, r14
je 0x140056cfe
test byte [rcx + 0x1c], r12b
je 0x140056cfe
cmp byte [rcx + 0x19], 5
jb 0x140056cfe
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov edx, r13d
call fcn.14000ffa8
lea r8, [0x14003227c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, rbp
jne 0x140056d59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056dee
test byte [rcx + 0x1c], r12b
je 0x140056dee
cmp byte [rcx + 0x19], r15b
jb 0x140056dee
mov edx, 0x3e
jmp 0x140056ddb
lea rdx, [0x14000a300]
mov rcx, rax
call fcn.1400572c8
cmp eax, ebp
jne 0x140056da4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056da4
test byte [rcx + 0x1c], r12b
je 0x140056da4
cmp byte [rcx + 0x19], r15b
jb 0x140056da4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov edx, 0x3f
mov r9d, eax
call fcn.1400100e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebp
jne 0x140056dee
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056dee
test byte [rax + 0x1c], r12b
je 0x140056dee
cmp byte [rax + 0x19], r15b
jb 0x140056dee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov edx, 0x40
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov r9d, eax
call fcn.1400100e0
cmp ebx, ebp
je 0x140056e37
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056e37
test byte [rax + 0x1c], r12b
je 0x140056e37
cmp byte [rax + 0x19], r15b
jb 0x140056e37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008f08]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x3c
call fcn.1400100e0
call fcn.1400566ac
cmp eax, ebp
jne 0x140056e6b
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056e6b
test byte [rcx + 0x1c], r12b
je 0x140056e6b
cmp byte [rcx + 0x19], r15b
jb 0x140056e6b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f08]
mov edx, r13d
call fcn.14000ffa8
call fcn.140057440
cmp eax, ebp
jne 0x140056ea1
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140056ea1
test byte [rcx + 0x1c], r12b
je 0x140056ea1
cmp byte [rcx + 0x19], r15b
jb 0x140056ea1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f08]
mov edx, 0x3e
call fcn.14000ffa8
mov rcx, qword [0x1400a3f00]
cmp rcx, rbp
je 0x140056f24
lea rdx, [0x14000ac30]
call fcn.1400572c8
cmp eax, ebp
jne 0x140056efa
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056efa
test byte [rax + 0x1c], r12b
je 0x140056efa
cmp byte [rax + 0x19], r15b
jb 0x140056efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008f08]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x3f
call fcn.1400100e0
xor edx, edx
mov r8d, 0x1770
lea ecx, [rdx + 3]
call fcn.1400325d8
lea rcx, [0x1400a3f10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400a3f10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1400a40b0]
cmp rcx, rbp
je 0x140056f9a
xor eax, eax
lea r9, [rsp + 0x30]
xor edx, edx
mov r8d, 0xffffffff
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
cmp eax, ebp
jne 0x140056f9a
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056f9a
test byte [rax + 0x1c], r12b
je 0x140056f9a
cmp byte [rax + 0x19], r15b
jb 0x140056f9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008f08]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x40
call fcn.1400100e0
mov rcx, qword [0x1400a40a8]
cmp rcx, rbp
je 0x140056ff3
lea rdx, [0x14000acb0]
call fcn.1400572c8
cmp eax, ebp
jne 0x140056ff3
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140056ff3
test byte [rax + 0x1c], r12b
je 0x140056ff3
cmp byte [rax + 0x19], r15b
jb 0x140056ff3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008f08]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x41
call fcn.1400100e0
call fcn.1400568d4
cmp eax, ebp
jne 0x140057039
mov rax, qword [str.P5_n_]
cmp rax, r14
je 0x140057039
test byte [rax + 0x1c], r12b
je 0x140057039
cmp byte [rax + 0x19], r15b
jb 0x140057039
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008f08]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x42
call fcn.1400100e0
mov rdi, qword [0x1400a3c48]
lea r13, [0x1400a3c48]
jmp 0x1400570c2
mov rbx, rdi
mov rdi, qword [rdi]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140057091
test byte [rcx + 0x1c], r12b
je 0x140057091
cmp byte [rcx + 0x19], 5
jb 0x140057091
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009c40]
mov edx, 0xa
call fcn.14000ffa8
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x1400570a0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x868]
cmp rcx, rbp
je 0x1400570ba
cmp dword [rbx + 0x8c8], ebp
jne 0x1400570ba
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov rcx, rbx
call fcn.140076afc
cmp rdi, r13
jne 0x140057049
mov rdi, qword [0x1400a3e98]
lea r13, [0x1400a3e98]
jmp 0x140057115
lea rbx, [rdi - 0x10]
mov rax, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x10]
mov qword [rax], rdi
mov qword [rdi + 8], rax
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
call fcn.140076afc
mov rcx, qword [rbx + 0x38]
call fcn.140076afc
mov rcx, qword [rbx + 0x48]
call fcn.140076afc
mov rcx, rbx
call fcn.140076afc
cmp rdi, r13
jne 0x1400570d7
mov rdi, qword [0x1400a3ea8]
lea r13, [0x1400a3ea8]
jmp 0x1400571a3
mov rbx, rdi
mov rdi, qword [rdi]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140057172
test byte [rcx + 0x1c], r12b
je 0x140057172
cmp byte [rcx + 0x19], 5
jb 0x140057172
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f48]
mov edx, 0xb
call fcn.14000ffa8
mov rcx, qword [rbx + 0x10]
cmp rcx, rbp
je 0x140057181
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x650]
cmp rcx, rbp
je 0x14005719b
cmp dword [rbx + 0x658], ebp
jne 0x14005719b
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov rcx, rbx
call fcn.140076afc
cmp rdi, r13
jne 0x14005712a
mov rbx, qword [0x1400a3db0]
lea rdi, [0x1400a3db0]
jmp 0x1400571c3
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14003b350
cmp rbx, rdi
jne 0x1400571b8
mov rbx, qword [0x1400a4068]
lea rdi, [0x1400a4068]
jmp 0x1400571f8
mov rcx, rbx
mov rbx, qword [rbx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
call fcn.14005859c
cmp rbx, rdi
jne 0x1400571d8
mov rbx, qword [0x1400a4058]
lea rdi, [0x1400a4058]
jmp 0x14005722d
mov rcx, rbx
mov rbx, qword [rbx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
call fcn.14005859c
cmp rbx, rdi
jne 0x14005720d
mov rbx, qword [0x1400a3e58]
lea r12, [0x1400a3e58]
mov edi, 1
jmp 0x14005728d
mov rcx, rbx
mov rbx, qword [rbx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rdx + 8], rax
cmp dword [rcx + 0x24], 0x20
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
jne 0x140057271
mov edx, edi
call fcn.14004ab8c
jmp 0x14005728d
cmp dword [rcx + 0x24], r15d
jne 0x140057280
mov edx, edi
call fcn.14004aca8
jmp 0x14005728d
cmp dword [rcx + 0x24], 8
jne 0x14005728d
mov edx, edi
call fcn.14004b130
cmp rbx, r12
jne 0x140057247
mov r9d, 0x40007d12
xor r8d, r8d
mov edx, esi
mov ecx, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140077054