Function at 0x18001ba70
Capabilities:
Access the windows event log
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x200], rbx
mov rax, qword [0x1800a0238]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x78], r9
mov r12, r8
mov qword [rbp - 0x78], rdx
mov edx, ecx
mov dword [rsp + 0x44], ecx
mov rsi, qword [rbp + 0x120]
xor r10d, r10d
mov dword [rsp + 0x58], r10d
movdqa xmm0, xmmword [0x180087000]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], r10b
lea r8d, [rcx + 0x251c]
mov dword [rsp + 0x48], r8d
movzx edi, byte [rsp + 0x40]
cmp ecx, r8d
ja 0x18001c193
mov byte [rsp + 0x41], dil
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x60]
nop word [rax + rax]
cmp edx, 0x408b
ja 0x18001be02
je 0x18001bdf5
cmp edx, 0x2224
ja 0x18001bd60
je 0x18001c137
mov eax, edx
sub eax, 0xe9b
je 0x18001bd57
sub eax, 0x5f
je 0x18001bd46
sub eax, 0x5f
je 0x18001bd35
cmp eax, 0x126c
jne 0x18001c13f
mov r15d, r10d
cmp qword [rsi + 0x10], 8
jb 0x18001c13f
nop dword [rax]
mov qword [rbp - 0x58], r10
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r14d, 0x2ee1
nop word [rax + rax]
mov eax, r14d
sub eax, 0x2ee1
je 0x18001bc27
cmp eax, 0x3b
jne 0x18001bcc0
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x18001c158
mov dword [rsp + 0x50], eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x769b
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1800289b0
mov rdx, qword [r12 + 8]
cmp qword [r12 + 0x10], rdx
je 0x18001bc16
xor r10d, r10d
mov qword [rdx + 0x10], r10
mov qword [rdx + 0x18], r10
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x58], r10
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], r10b
add qword [r12 + 8], 0x20
jmp 0x18001bcc0
lea r8, [rbp - 0x68]
mov rcx, r12
call fcn.180002680
jmp 0x18001bcbd
mov ecx, r15d
mov qword [rbp - 0x38], r10
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rax, qword [rsi + 0x10]
cmp rax, rcx
jb 0x18001c1c7
sub rax, rcx
mov r8d, 8
cmp rax, r8
cmovb r8, rax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18001bc64
mov rax, qword [rsi]
lea rdx, [rax + rcx]
lea rcx, [rbp - 0x48]
call fcn.1800294c0
or dword [rsp + 0x58], 1
lea rcx, [rbp - 0x68]
call fcn.180006f30
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x58], xmm1
add r15d, 8
lea rcx, [rbp - 0x68]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rcx, rdx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.180065a80
mov dword [rsp + 0x70], eax
xor r10d, r10d
add r14d, 0x3b
cmp r14d, 0x2f1c
jbe 0x18001bb90
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x18001bd0d
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bd08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c1c1
call fcn.18005f31c
mov eax, r15d
mov rcx, qword [rsi + 0x10]
sub rcx, rax
cmp rcx, 8
mov r10d, 0
jae 0x18001bb70
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov dword [rsi + 0x30], r10d
mov qword [rsi + 0x38], r10
mov qword [rsi + 0x40], r10
jmp 0x18001c13f
mov qword [rsi + 0x18], r10
mov qword [rsi + 0x20], r10
mov qword [rsi + 0x28], r10
jmp 0x18001c13f
mov qword [rsi + 0x10], r10
jmp 0x18001c13f
mov eax, edx
sub eax, 0x2283
je 0x18001c193
sub eax, 0x1d4a
je 0x18001bdc6
cmp eax, 0x5f
jne 0x18001c13f
mov eax, dword [0x180084734]
mov dword [rbp + 0x96], eax
movzx eax, word [0x180084738]
mov word [rbp + 0x9a], ax
mov word [rbp + 0x9c], r10w
mov r8d, 3
lea rdx, [0x1800847a2]
lea rcx, [rbp + 0x9c]
call fcn.1800641b4
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov word [rbp + 0x90], r10w
mov r8d, 3
lea rdx, str.MyEr_turnaround_on_track__says_CEO_Umbers
lea rcx, [rbp + 0x90]
call fcn.18006416c
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov word [rbp + 0xa2], r10w
jmp 0x18001c13f
cmp edx, 0x4266
ja 0x18001bf25
je 0x18001bedf
mov eax, edx
sub eax, 0x40ea
je 0x18001be9a
sub eax, 0x5f
je 0x18001be65
sub eax, 0x5f
je 0x18001be3d
cmp eax, 0x5f
jne 0x18001c13f
mov dword [rsp + 0x74], 0x70
jmp 0x18001c13f
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp + 0x20]
call fcn.1800616b0
cmp qword [rsi + 8], 0
je 0x18001c190
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r10d
mov r9, rsi
lea r8, [0x18000df90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov r8d, 5
lea rdx, str.ovided:
lea rcx, [rbp + 0x90]
call fcn.18006416c
mov r8d, 1
lea rdx, [0x180084626]
lea rcx, [rbp + 0x90]
call fcn.18006416c
mov byte [rsp + 0x40], 1
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov eax, dword [rsi]
mov qword [rsp + 0x68], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x68]
mov edx, 0x3593
lea rcx, [rsp + 0x50]
call fcn.18000d570
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov eax, edx
sub eax, 0x42c5
je 0x18001c0db
sub eax, 0x5f
je 0x18001c193
cmp eax, 0x1935
jne 0x18001c13f
mov r15d, 0x7721
mov dword [rsp + 0x50], r15d
mov eax, r15d
sub eax, 0x7721
je 0x18001bf7b
sub eax, 0xb
je 0x18001bf6e
cmp eax, 0xb
je 0x18001c193
jmp 0x18001c0ba
mov dil, 1
mov byte [rsp + 0x41], dil
jmp 0x18001c0ba
test byte [r9], 2
je 0x18001c0ba
mov r14d, 0x2c9a
mov r15, qword [rsp + 0x60]
mov rdi, qword [rbp - 0x78]
nop dword [rax]
nop dword [rax + rax]
mov eax, r14d
sub eax, 0x2c9a
je 0x18001c092
sub eax, 0x16
je 0x18001c075
sub eax, 0x16
je 0x18001c016
cmp eax, 0x16
jne 0x18001c095
lea rdx, [rbp - 0x48]
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetTextMetricsW]
mov rax, qword [r12]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x7818
mov r8, rsi
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.180017170
xor r10d, r10d
test al, al
je 0x18001c010
mov rax, qword [rsi + 0x278]
mov qword [rdi + 0x10], rax
jmp 0x18001c095
mov qword [rdi + 0x10], r10
jmp 0x18001c095
lea r8, [rsi + 0x280]
lea rcx, [rsi + 0x278]
mov qword [rsp + 0x20], r10
xor edx, edx
mov r9d, 0x1bd8
call fcn.180014ca0
test r13, r13
je 0x18001c04f
mov rdx, r13
mov rcx, r15
call qword [sym.imp.USER32.dll_ReleaseDC]
xor r10d, r10d
mov r13d, r10d
jmp 0x18001c052
xor r10d, r10d
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], eax
jmp 0x18001c095
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov r15, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
xor r10d, r10d
jmp 0x18001c095
mov rbx, r10
add r14d, 0x16
cmp r14d, 0x2cdc
jbe 0x18001bfa0
mov qword [rsp + 0x60], r15
movzx edi, byte [rsp + 0x41]
mov r15d, dword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
add r15d, 0xb
mov dword [rsp + 0x50], r15d
cmp r15d, 0x7737
jbe 0x18001bf51
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
jmp 0x18001c13f
mov ecx, r10d
movzx eax, byte [rsp + 0x40]
mov r14, qword [rsp + 0x68]
test r14, r14
cmovne ecx, eax
mov byte [rsp + 0x40], cl
cmp cl, 0
je 0x18001c137
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea edx, [r8 + 9]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov dil, 1
mov byte [rsp + 0x41], dil
add edx, 0x5f
mov dword [rsp + 0x44], edx
cmp edx, r8d
ja 0x18001c193
mov r9, qword [rsp + 0x78]
xor r10d, r10d
jmp 0x18001bb10
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x18001c190
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c18b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c1cd
call fcn.18005f31c
xor dil, dil
movzx eax, dil
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.18005fbe0
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180063a04
nop
call fcn.180028990
nop
call fcn.180063a04
int3