Function at 0x18003c330
Capabilities:
Access the windows event log
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0x88], rax
xor r8d, r8d
mov dword [rsp + 0x50], edx
lea esi, [rdx - 0x10]
mov ebx, r8d
mov dword [rsp + 0x44], ebx
mov edi, edx
mov dword [rsp + 0x54], esi
mov r12, rcx
cmp edx, esi
jbe case.0x18003c3cd.235
mov r15d, dword [rsp + 0x54]
mov r13d, dword [rsp + 0x4c]
mov r9d, 0x16
lea eax, [rdi - 0xe2]
lea r10, [0x180000000]
movabs rdx, 0x7fffffffffffffff
lea r14d, [r9 + 0x45]
lea r11d, [r9 + 0x11]
cmp eax, 0x22
ja case.0x18003c3cd.229
mov ecx, dword [r10 + rax*4 + 0x3cb58]
add rcx, r10
jmp rcx
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r8, qword [rbp - 0x68]
mov r9d, r13d
mov rdx, qword [rbp - 0x70]
xor ecx, ecx
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ObjectPrivilegeAuditAlarmA]
cmp qword [rsp + 0x70], 0
jne case.0x18003c3cd.229
mov byte [rsp + 0x41], 0
jmp case.0x18003c3cd.229
mov qword [rbp - 0x70], r8
mov qword [rsp + 0x70], r8
mov qword [rbp - 0x68], 0xffffffffffffffff
jmp case.0x18003c3cd.229
mov dword [rbp + 0x7e], 0x27007d
mov word [rbp + 0x82], r8w
mov byte [rsp + 0x41], 1
jmp case.0x18003c3cd.229
mov rcx, qword [r12]
mov rax, qword [rcx + 0x10]
call qword [rax + 0x10]
mov rax, qword [r12]
xor r14d, r14d
cmp qword [rax + 0x48], r14
lea rcx, [rax + 0x48]
je 0x18003c495
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r14
call fcn.180059440
mov rax, qword [r12]
mov qword [rax + 0x48], r14
mov rax, qword [r12]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], r14
mov dword [rax], r14d
call fcn.180059440
jmp case.0x18003c3cd.229
mov dword [rbp + 0x64], 0x300027
mov dword [rbp + 0x68], 0x440027
mov word [rbp + 0x6c], r11w
mov dword [rbp + 0x6e], 0x27004f
jmp case.0x18003c3cd.229
cmp qword [r12], 0
jne case.0x18003c3cd.229
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.1800c0ae0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp byte [rsp + 0x41], 0
je 0x18003c564
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x74]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
lea edx, [r8 + 9]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov byte [rsp + 0x48], 0
jmp case.0x18003c3cd.229
mov r14, qword [rsp + 0x78]
mov rcx, qword [r14]
call fcn.180052730
mov rcx, qword [r14 + 8]
call fcn.180052730
jmp case.0x18003c3cd.229
mov word [rbp + 0x72], r14w
mov dword [rbp + 0x74], 0x660027
mov word [rbp + 0x78], r11w
mov dword [rbp + 0x7a], 0x270072
jmp case.0x18003c3cd.229
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x70
xor eax, eax
mov dword [rsp + 0x64], 1
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], eax
jmp case.0x18003c3cd.229
mov rcx, qword [r12]
mov edx, dword [rcx]
lea eax, [rdx - 0x7f2bb708]
cmp eax, 2
jbe 0x18003cb0f
lea eax, [rdx - 0x7f2bb76d]
cmp eax, 2
ja case.0x18003c3cd.235
lea rcx, str.that_would_be_executed
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je case.0x18003c3cd.229
mov rax, qword [r12]
lea rdx, [rsp + 0x58]
mov ecx, 0xa1
mov qword [rsp + 0x58], rax
call fcn.180088890
mov rcx, qword [r12]
mov rax, qword [rcx + 0x10]
call qword [rax + 0x70]
jmp case.0x18003c3cd.229
mov dword [rbp + 0x60], 0x240027
jmp case.0x18003c3cd.229
cmp qword [r12 + 0x10], 0x35
mov dword [rsp + 0x4c], 0x2000000
jb 0x18003cace
mov r13d, r8d
nop dword [rax]
cmp r13d, 5
ja case.default.0x18003c668
mov eax, r13d
mov ecx, dword [r10 + rax*4 + 0x3cbe4]
add rcx, r10
jmp rcx
mov esi, 0xb
mov byte [rsp + 0x40], 1
cmp qword [r12 + 0x10], rsi
mov r14, r12
mov qword [rbp - 0x40], 0xf
cmovb rsi, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0x10
mov byte [rbp - 0x58], 0
jb 0x18003c69a
mov r14, qword [r12]
cmp rsi, 0xf
ja 0x18003c6bd
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x58], 0
jmp 0x18003c74c
cmp rsi, rdx
ja 0x18003cb4f
mov rdi, rsi
or rdi, 0xf
cmp rdi, rdx
jbe 0x18003c6d7
mov rdi, rdx
jmp 0x18003c6df
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c718
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003cb49
mov rcx, rax
call fcn.1800c0594
test rax, rax
je 0x18003cb2a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18003c72a
test rcx, rcx
je 0x18003c727
call fcn.1800c0594
mov rbx, rax
jmp 0x18003c72a
mov rbx, r8
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x44]
or ebx, 1
lea rcx, [0x1800dbe18]
lea rdx, [rbp - 0x58]
mov dword [rsp + 0x44], ebx
call fcn.180033140
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18003ca99
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003c79d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003cb2a
call fcn.1800c05d0
jmp 0x18003ca99
movzx eax, byte [rsp + 0x40]
test r15d, r15d
mov ecx, r8d
cmove ecx, eax
mov byte [rsp + 0x40], cl
jmp case.default.0x18003c668
mov dword [rsp + 0x6c], r8d
mov qword [rbp - 0x80], r8
jmp case.default.0x18003c668
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
cmp rax, 0xb
jb 0x18003cb43
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x18003c806
mov rax, qword [r12]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18003c82d
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x58], 0
jmp 0x18003c8bc
cmp rsi, rdx
ja 0x18003cb4f
mov rdi, rsi
or rdi, 0xf
cmp rdi, rdx
jbe 0x18003c847
mov rdi, rdx
jmp 0x18003c84f
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c888
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003cb49
mov rcx, rax
call fcn.1800c0594
test rax, rax
je 0x18003cb2a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18003c89a
test rcx, rcx
je 0x18003c897
call fcn.1800c0594
mov rbx, rax
jmp 0x18003c89a
mov rbx, r8
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x44]
or ebx, 2
lea rdx, [rbp - 0x58]
lea rcx, [0x1800dbe38]
mov dword [rsp + 0x44], ebx
call fcn.180033140
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18003c90e
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003c909
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003cb2a
call fcn.1800c05d0
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r15d, eax
mov qword [rbp - 0x40], 0xf
xor eax, eax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x58], al
mov rax, qword [r12 + 0x10]
cmp rax, 0x11
jb 0x18003cb43
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x18003c963
mov rax, qword [r12]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18003c994
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
or ebx, 4
mov byte [rbp + rsi - 0x58], 0
lea rcx, [0x1800dbdf8]
jmp 0x18003c756
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18003cb4f
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18003c9b8
mov rdi, rax
jmp 0x18003c9c5
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18003c9fe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003cb49
mov rcx, rax
call fcn.1800c0594
test rax, rax
je 0x18003cb2a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18003ca0f
test rcx, rcx
je 0x18003ca0d
call fcn.1800c0594
mov rbx, rax
jmp 0x18003ca0f
xor ebx, ebx
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rcx, [0x1800dbdf8]
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x44]
or ebx, 4
jmp 0x18003c756
cmp byte [rsp + 0x40], 0
mov dword [rsp + 0x68], 0x44
je 0x18003ca82
mov qword [rsp + 0x58], r8
xor edx, edx
lea r8, [rsp + 0x58]
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x80]
mov r15d, eax
test rcx, rcx
je 0x18003ca73
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18003ca82
call sub.RPCRT4.dll_MesHandleFree
mov ecx, dword [rsp + 0x6c]
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
xor r8d, r8d
lea r10, [0x180000000]
movabs rdx, 0x7fffffffffffffff
lea r9d, [r8 + 0x16]
inc r13d
lea eax, [r13 + 0xa4]
cmp eax, 0xaa
jb 0x18003c650
mov edi, dword [rsp + 0x50]
mov esi, dword [rsp + 0x54]
mov r13d, dword [rsp + 0x4c]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
jmp case.0x18003c3cd.229
mov qword [rsp + 0x78], r12
dec edi
mov dword [rsp + 0x50], edi
cmp edi, esi
jbe case.0x18003c3cd.235
xor r8d, r8d
jmp 0x18003c394
mov qword [rsp + 0x78], rcx
lea r8, [rsp + 0x78]
xor ecx, ecx
mov edx, 0x105
call fcn.1800775d0
jmp case.0x18003c3cd.235
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov byte [rsp + 0x48], 1
jmp case.0x18003c3cd.235
mov eax, r8d
jmp 0x18003c4f2
call fcn.180046370
int3
call fcn.1800461f0
int3
call fcn.180046330
int3