Function at 0x1800151b0
Capabilities:
Access the windows event log
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180183c70]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov qword [rbp - 0x58], r9
mov dword [rsp + 0x54], eax
mov edi, eax
mov dword [rsp + 0x5c], eax
mov rbx, r8
lea eax, [rdx - 0x12]
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x7c], edx
mov r15d, edx
mov qword [rbp - 0x78], rcx
mov dword [rsp + 0x54], eax
cmp edx, eax
jbe case.0x1800152c0.242
movzx ecx, byte [rsp + 0x53]
movzx r9d, byte [rsp + 0x53]
movzx r11d, byte [rsp + 0x53]
movzx r10d, byte [rsp + 0x53]
mov eax, dword [rsp + 0x54]
mov r14, qword [rbp - 0x78]
mov edx, dword [rsp + 0x54]
mov esi, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x54]
mov r13, qword [rbp - 0x78]
mov r12, qword [rbp - 0x78]
mov byte [rsp + 0x53], cl
mov rcx, qword [rbp - 0x78]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x54]
mov qword [rbp - 0x40], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x80], ecx
mov byte [rsp + 0x51], r9b
mov dword [rsp + 0x64], edx
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], r8d
mov byte [rsp + 0x52], r11b
mov qword [rbp - 0x60], r14
mov byte [rsp + 0x50], r10b
mov dword [rsp + 0x7c], eax
nop dword [rax + rax]
lea eax, [r15 - 0xdb]
cmp eax, 0x36
ja case.0x1800152c0.220
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x15d08]
mov ecx, dword [rcx + rax*4 + 0x15cc0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov byte [rsp + 0x68], 0
jmp case.0x1800152c0.220
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
movzx r10d, byte [rsp + 0x50]
jmp case.0x1800152c0.220
cmp qword [rbx + 0x10], 0x35
jb 0x18001566c
mov r15d, 0xce
mov dword [rsp + 0x78], r15d
cmp r15d, 0x2bce2
ja 0x18001568a
je 0x180015681
cmp r15d, 0xce
je 0x180015677
cmp r15d, 0x8cd2
je 0x1800154e9
cmp r15d, 0x118d6
je 0x1800154ce
cmp r15d, 0x1a4da
je 0x1800154c0
cmp r15d, 0x230de
jne 0x18001563d
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
cmp rax, 0xb
jb 0x180015cae
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x18001538e
mov rax, qword [rbx]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x1800153b5
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x10], 0
jmp 0x180015452
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x180015cba
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1800153d9
mov rdi, rax
jmp 0x1800153e6
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001541f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015cb4
mov rcx, rax
call fcn.18015bcd4
test rax, rax
je 0x180015ca0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180015430
test rcx, rcx
je 0x18001542e
call fcn.18015bcd4
mov rbx, rax
jmp 0x180015430
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
mov qword [rbp + 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x5c]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x10], rbx
or edi, 2
lea rdx, [rbp + 0x10]
lea rcx, [0x180182be8]
mov dword [rsp + 0x5c], edi
call fcn.180004b80
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x1800154a5
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800154a0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015ca0
call fcn.18015bd10
movzx eax, byte [rsp + 0x51]
xor ecx, ecx
cmp dword [rsp + 0x6c], ecx
cmovne ecx, eax
movzx r9d, cl
mov byte [rsp + 0x51], cl
jmp 0x18001562e
xor eax, eax
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], eax
jmp 0x18001563d
xor esi, esi
mov dword [rsp + 0x60], esi
call qword [sym.imp.WINMM.dll_waveInGetNumDevs]
movzx r9d, byte [rsp + 0x51]
mov dword [rsp + 0x6c], eax
jmp 0x180015632
mov esi, 0xb
mov byte [rsp + 0x51], 1
cmp qword [rbx + 0x10], rsi
mov r14, rbx
mov qword [rbp + 0x28], 0xf
cmovb rsi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
mov byte [rbp + 0x10], 0
jb 0x180015515
mov r14, qword [rbx]
cmp rsi, 0xf
ja 0x180015538
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x10], 0
jmp 0x1800155d5
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x180015cba
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18001555c
mov rdi, rax
jmp 0x180015569
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800155a2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015cb4
mov rcx, rax
call fcn.18015bcd4
test rax, rax
je 0x180015ca0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800155b3
test rcx, rcx
je 0x1800155b1
call fcn.18015bcd4
mov rbx, rax
jmp 0x1800155b3
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
mov qword [rbp + 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x5c]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x10], rbx
or edi, 4
lea rdx, [rbp + 0x10]
lea rcx, [0x180182bc8]
mov dword [rsp + 0x5c], edi
call fcn.180004b80
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x180015628
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015623
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015ca0
call fcn.18015bd10
movzx r9d, byte [rsp + 0x51]
mov esi, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
movzx r11d, byte [rsp + 0x52]
mov edx, dword [rsp + 0x64]
add r15d, 0x8c04
mov rbx, qword [rbp - 0x50]
mov dword [rsp + 0x78], r15d
cmp r15d, 0x57828
jbe 0x180015303
movzx r10d, byte [rsp + 0x50]
mov r14, qword [rbp - 0x60]
mov r15d, dword [rbp - 0x7c]
xor eax, eax
mov qword [rbp - 0x70], rax
jmp case.0x1800152c0.220
mov r11b, 1
mov byte [rsp + 0x52], r11b
jmp 0x18001563d
mov dword [rbp - 0x68], 0x44
jmp 0x18001563d
cmp r15d, 0x348e6
je 0x180015800
cmp r15d, 0x3d4ea
je 0x180015718
cmp r15d, 0x460ee
je 0x1800156e5
cmp r15d, 0x4ecf2
jne 0x18001563d
mov byte [rsp + 0x68], 1
mov eax, dword [rsp + 0x68]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18015c4c0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
movzx eax, r11b
test r8d, r8d
cmovne ecx, eax
mov byte [rsp + 0x52], cl
movzx r11d, cl
test cl, cl
je 0x18001563d
mov edx, esi
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
movzx r9d, byte [rsp + 0x51]
jmp 0x180015632
test r9b, r9b
je 0x18001563d
mov r15d, dword [rsp + 0x70]
mov edi, 0x5c
mov dword [rsp + 0x74], edi
nop
cmp edi, 0x5c
je 0x1800157d5
cmp edi, 0x27e4
je 0x1800157bb
cmp edi, 0x4f6c
je 0x1800157a6
cmp edi, 0x76f4
jne 0x1800157dc
test r9b, r9b
je 0x1800157dc
mov edi, dword [rsp + 0x64]
mov ebx, 1
mov eax, ebx
sub eax, 1
je 0x180015784
cmp eax, 1
jne 0x18001578a
mov r8d, r15d
lea rdx, [rbp + 0x60]
mov ecx, edi
call qword [sym.imp.WINMM.dll_waveInGetErrorTextA]
jmp 0x18001578a
mov r15d, 0x104
inc ebx
cmp ebx, 3
jb 0x180015767
mov edi, dword [rsp + 0x74]
mov edx, dword [rsp + 0x64]
movzx r9d, byte [rsp + 0x51]
mov dword [rsp + 0x70], r15d
jmp 0x1800157dc
xor ecx, ecx
movzx eax, r9b
test edx, edx
cmovne ecx, eax
movzx r9d, cl
mov byte [rsp + 0x51], cl
jmp 0x1800157dc
lea rdx, [rbp - 0x48]
xor ecx, ecx
call qword [sym.imp.WINMM.dll_waveInGetID]
movzx r9d, byte [rsp + 0x51]
mov edx, eax
mov dword [rsp + 0x64], eax
jmp 0x1800157dc
mov dword [rbp - 0x48], 0
add edi, 0x2788
mov dword [rsp + 0x74], edi
cmp edi, 0x9e20
jbe 0x180015730
mov r15d, dword [rsp + 0x78]
mov edi, dword [rsp + 0x5c]
jmp 0x180015632
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
cmp rax, 0x11
jb 0x180015cae
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x180015837
mov rax, qword [rbx]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18001585e
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x10], 0
jmp 0x1800158fb
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x180015cba
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x180015882
mov rdi, rax
jmp 0x18001588f
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800158c8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015cb4
mov rcx, rax
call fcn.18015bcd4
test rax, rax
je 0x180015ca0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800158d9
test rcx, rcx
je 0x1800158d7
call fcn.18015bcd4
mov rbx, rax
jmp 0x1800158d9
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 0x20], rsi
mov rdx, r14
mov qword [rbp + 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x5c]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x10], rbx
or edi, 1
lea rdx, [rbp + 0x10]
lea rcx, [0x180182ba8]
mov dword [rsp + 0x5c], edi
call fcn.180004b80
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x18001594e
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015949
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015ca0
call fcn.18015bd10
mov esi, dword [rsp + 0x60]
lea r9, [rbp - 0x68]
mov ecx, esi
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
movzx r9d, byte [rsp + 0x51]
mov r8d, eax
mov dword [rsp + 0x58], eax
jmp 0x180015637
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x60], rax
jmp case.0x1800152c0.220
test r10b, r10b
je case.0x1800152c0.220
mov ebx, 0x11e
mov eax, ebx
sub eax, 0x11e
je 0x1800159c4
cmp eax, 1
jne 0x1800159da
cmp qword [rbp - 0x70], 0xffffffffffffffff
jne 0x1800159b3
xor r10b, r10b
mov byte [rsp + 0x50], r10b
jmp 0x1800159da
test r10b, r10b
je 0x1800159da
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800159d4
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
movzx r10d, byte [rsp + 0x50]
inc ebx
cmp ebx, 0x120
jb 0x180015994
jmp case.0x1800152c0.220
xor eax, eax
mov esi, eax
nop dword [rax]
mov edi, 0x104
mov eax, edi
sub eax, 0x103
je 0x180015a09
cmp eax, 1
jne 0x180015a74
mov r13, qword [rbx + rsi*8]
jmp 0x180015a74
test r13, r13
je 0x180015a74
nop
mov ebx, 0x9d
mov eax, ebx
sub eax, 0x9d
je 0x180015a3c
sub eax, 0x68
je 0x180015a36
cmp eax, 0x68
jne 0x180015a60
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, r12
jmp 0x180015a60
mov rax, qword [r13 + 0x10]
jmp 0x180015a44
mov r12, qword [r13 + 0x18]
mov rax, qword [r13 + 8]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xc2
xor edx, edx
xor ecx, ecx
call fcn.1800a1ac0
add ebx, 0x68
cmp ebx, 0x1d5
jb 0x180015a15
test r13, r13
jne 0x180015a10
mov rbx, qword [rbp - 0x50]
dec edi
cmp edi, 0x102
ja 0x1800159f5
inc rsi
cmp rsi, 8
jb 0x1800159f0
movzx r10d, byte [rsp + 0x50]
jmp case.0x1800152c0.220
cmp byte [rsp + 0x53], 0
je case.0x1800152c0.220
mov ebx, 0x100
nop word [rax + rax]
mov eax, ebx
sub eax, 0x100
je 0x180015ac9
cmp eax, 0x1d
jne 0x180015af4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x180015af4
xor edi, edi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
xor edx, edx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
mov rcx, r14
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
add ebx, 0x1d
cmp ebx, 0x13a
jb 0x180015ab0
movzx r10d, byte [rsp + 0x50]
jmp case.0x1800152c0.220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx r10d, byte [rsp + 0x50]
jmp case.0x1800152c0.220
movzx eax, byte [rsp + 0x53]
xor edx, edx
test r14, r14
mov ecx, edx
cmovne ecx, eax
cmp dword [rsp + 0x7c], edx
mov byte [rsp + 0x53], cl
mov ecx, edx
movzx eax, r10b
cmovne ecx, eax
movzx r10d, cl
mov byte [rsp + 0x50], cl
jmp case.0x1800152c0.220
mov qword [rbp - 0x40], 0xffffffffffffffff
jmp case.0x1800152c0.220
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edx, dword [rbp - 0x80]
lea r8, [rbp - 0x70]
mov rcx, qword [rbp - 0x40]
mov r14, rax
mov qword [rbp - 0x60], rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
movzx r10d, byte [rsp + 0x50]
mov dword [rsp + 0x7c], eax
jmp case.0x1800152c0.220
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1800aa6a0
cmp al, 7
jne 0x180015ba7
mov rax, qword [rbx]
jmp 0x180015c03
mov rax, qword [rbp - 0x78]
cmp dword [rax], 0
je 0x180015bd6
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1800aa6a0
cmp al, 8
jne 0x180015bd6
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rax + 0x18]
call qword [rdx + 0x78]
jmp 0x180015c03
mov rax, qword [rbp + 0x1e0]
cmp dword [rax], 0
je 0x180015ca7
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1800aa6a0
cmp al, 1
jne 0x180015ca7
xor eax, eax
mov rcx, qword [rbp - 0x58]
movzx r10d, byte [rsp + 0x50]
mov dword [rsp + 0x68], 1
mov qword [rcx], rax
jmp case.0x1800152c0.220
mov dword [rbp - 0x80], 0x20008
jmp case.0x1800152c0.220
movups xmm0, xmmword [str.containsNoMD]
movzx eax, word [0x180173140]
movsd xmm1, qword [0x180173138]
movups xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x58], ax
movsd qword [rbp + 0x50], xmm1
jmp case.0x1800152c0.220
xorps xmm0, xmm0
mov byte [rsp + 0x53], 1
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp - 8], xmm0
jmp case.0x1800152c0.220
mov r10b, 1
mov byte [rsp + 0x50], r10b
dec r15d
mov dword [rbp - 0x7c], r15d
cmp r15d, dword [rsp + 0x54]
jbe case.0x1800152c0.242
mov edx, dword [rsp + 0x64]
mov rbx, qword [rbp - 0x50]
mov r8d, dword [rsp + 0x58]
movzx r9d, byte [rsp + 0x51]
mov edi, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x60]
movzx r11d, byte [rsp + 0x52]
jmp 0x180015290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor eax, eax
jmp 0x1800156bb
call fcn.18001bc20
int3
call fcn.18001baa0
int3
call fcn.18001bbe0
int3