Function at 0x18001f860
Capabilities:
Access the windows event log
Get file attributes
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rbp + 0x408], rax
movzx ebx, byte [rsp + 0x40]
mov r12, r9
imul eax, r8d, 0x7b8
mov esi, r8d
mov dword [rsp + 0x5c], r8d
mov r15, rcx
mov qword [rsp + 0x50], rdx
mov r14d, r8d
mov dword [rsp + 0x48], eax
cmp r8d, eax
ja case.0x18001fbec.0
mov r13, qword [rsp + 0x70]
xor r8d, r8d
lea ecx, [r8 + 0x4f]
lea r9d, [r8 + 0x50]
lea r10d, [r8 + 0xb]
mov edi, 2
cmp r14d, 0x1006e
ja 0x18001fb0f
je 0x18001fb02
cmp r14d, 0x66de
ja 0x18001f9f8
je 0x18001f9ca
mov eax, r14d
sub eax, 0x7e
je 0x18001f9ac
sub eax, 0xe
je 0x18001fedc
sub eax, 0x8a
je 0x18001f969
cmp eax, 0x3298
jne 0x18001fec6
mov r8d, edi
mov byte [rbp + 0x3e5], 0
lea rdx, [0x18009caf9]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, edi
lea rdx, [0x18009cb11]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
mov byte [rbp + 0x3e9], 0x70
jmp 0x18001feb3
test r15, r15
je case.0x18001fbec.0
mov rax, qword [r12]
add rax, qword [rdx]
cmp rax, qword [r15 + 8]
jbe 0x18001fec6
movzx eax, bl
mov rcx, qword [rbp + 0x408]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0x560]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [str.WSAStartup_failed_with_error_0x_x:__s.]
mov dword [rbp + 0x3e0], eax
movzx eax, byte [0x18009ca3c]
mov byte [rbp + 0x3e4], al
jmp 0x18001fec6
mov eax, dword [0x18009ca9e]
mov dword [rbp + 0x3f0], eax
movzx eax, word [0x18009caa2]
mov word [rbp + 0x3f4], ax
mov byte [rbp + 0x3ea], 0
mov word [rbp + 0x3f6], r8w
jmp 0x18001fec6
cmp r14d, 0x7206
je 0x18001fa91
cmp r14d, 0x9a0e
je 0x18001fa65
cmp r14d, 0xcd3e
je 0x18001fa31
cmp r14d, 0xe2f6
jne 0x18001fec6
mov rax, qword [r12]
sub qword [r15 + 8], rax
jmp 0x18001fec6
mov word [rbp + 0x402], r8w
lea rdx, [0x18009c9ba]
mov r8d, 1
mov dword [rbp + 0x3fe], 0x6c0064
lea rcx, [rbp + 0x402]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r8d, r8d
jmp 0x18001feb3
mov r8d, 3
lea rdx, [0x18009cb26]
lea rcx, [rbp + 0x3f6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r8d, r8d
mov dword [rbp + 0x3fc], 0x2e
jmp 0x18001feb3
cmp qword [r15 + 0x18], 0
je 0x18001fad2
cmp qword [r12], 0
mov esi, r8d
mov edi, dword [rdx]
jbe 0x18001face
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r15]
mov eax, edi
mov rcx, qword [rcx + rax*8]
call qword [r15 + 0x18]
inc esi
inc edi
mov eax, esi
cmp rax, qword [r12]
jb 0x18001fab0
mov rdx, qword [rsp + 0x50]
mov esi, dword [rsp + 0x5c]
mov r9, qword [rdx]
mov rax, qword [r12]
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
sub r8, r9
sub r8, rax
add rax, r9
shl r8, 3
lea rdx, [rcx + rax*8]
lea rcx, [rcx + r9*8]
call sub.VCRUNTIME140.dll_memmove
xor r8d, r8d
jmp 0x18001feb3
mov word [rbp + 0x404], r8w
jmp 0x18001fec6
cmp r14d, 0x2005e
ja 0x18001fce2
je 0x18001fbb3
cmp r14d, 0x1339e
je 0x18001fb71
cmp r14d, 0x166ce
je 0x18001fb67
cmp r14d, 0x199fe
je 0x18001fb55
cmp r14d, 0x1cd2e
jne 0x18001fec6
mov word [rsp + 0x58], r8w
jmp 0x18001fec6
mov qword [rsp + 0x68], r8
mov dword [rsp + 0x60], 0x20050
jmp 0x18001fec6
mov dword [rsp + 0x58], r8d
jmp 0x18001fec6
mov qword [rsp + 0x70], r8
lea rcx, [rbp + 0x140]
mov r8d, 0x280
mov byte [rsp + 0x41], 1
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x3f0]
mov ecx, 0x4f
lea rdx, [rbp + 0x3e0]
call fcn.18007c630
mov qword [rbp - 0x80], rax
xor r8d, r8d
jmp 0x18001feb3
mov ecx, 0x202
lea rdx, [rbp - 0x60]
call qword [rbp - 0x80]
test eax, eax
je 0x18001fcc6
mov edi, 8
nop dword [rax]
cmp edi, 8
ja case.0x18001fbec.3
lea rdx, [0x180000000]
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x1ff80]
add rcx, rdx
jmp rcx
mov r8d, 2
lea rdx, str.J5Kxo_1ixGU0g
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x3c2], 0x315f6f78
mov byte [rbp + 0x3c6], 0
jmp case.0x18001fbec.3
mov r8d, 1
mov byte [rbp + 0x3d3], 0
lea rdx, [0x18009c9ed]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x18001fbec.3
mov byte [rbp + 0x3c0], 0
jmp case.0x18001fbec.3
xor bl, bl
jmp case.0x18001fbec.3
mov eax, dword [0x18009ca07]
mov dword [rbp + 0x3c6], eax
movzx eax, byte [0x18009ca0b]
mov byte [rbp + 0x3ca], al
mov byte [rbp + 0x3cb], 0
jmp case.0x18001fbec.3
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp case.0x18001fbec.3
mov eax, dword [0x18009ca1a]
mov dword [rbp + 0x3cb], eax
movzx eax, byte [0x18009ca1e]
mov byte [rbp + 0x3cf], al
movzx eax, word [0x18009ca2e]
mov word [rbp + 0x3d0], ax
movzx eax, byte [0x18009ca30]
mov byte [rbp + 0x3d2], al
dec edi
lea eax, [rdi + 0x11b]
cmp eax, 0x11a
ja 0x18001fbd0
xor r8d, r8d
mov eax, 0xa
mov word [rsp + 0x5a], r8w
mov word [rsp + 0x6a], ax
mov qword [rbp - 0x70], r8
jmp 0x18001feb3
cmp r14d, 0x2338e
je 0x18001fdcb
cmp r14d, 0x266be
je 0x18001fd8e
cmp r14d, 0x299ee
je 0x18001fd17
cmp r14d, 0x2cd1e
je case.0x18001fbec.0
jmp 0x18001fec6
movzx eax, byte [rsp + 0x41]
mov ecx, r8d
mov rdi, qword [rbp - 0x78]
cmp rdi, 0xffffffffffffffff
cmovne ecx, eax
mov byte [rsp + 0x41], cl
cmp cl, 0
je 0x18001fd63
mov r9d, dword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
lea rdx, [rbp + 0x140]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov qword [rsp + 0x28], r8
xor edx, edx
mov qword [rsp + 0x20], r8
mov ecx, pe_nt_image_headers64
xor r8d, r8d
call fcn.18001c8b0
mov ebx, eax
xor r8d, r8d
jmp 0x18001feb3
mov r9d, 1
mov word [rsp + 0x6c], cx
mov qword [rsp + 0x20], r8
mov ecx, 0xc0000000
xor r8d, r8d
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x78], rax
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
xor r8d, r8d
jmp 0x18001feb3
mov word [rsp + 0x68], r8w
xor edx, edx
mov r8, r15
mov word [rsp + 0x6e], r10w
mov ecx, 0xbc
call fcn.18000ab70
xor r8d, r8d
test al, al
jne 0x18001feb3
mov edi, r8d
cmp edi, 9
ja case.default.0x18001fe11
lea r9, [0x180000000]
mov eax, edi
mov ecx, dword [r9 + rax*4 + 0x1ffa4]
add rcx, r9
jmp rcx
mov dword [rbp + 0x3c0], 0x720043
jmp case.default.0x18001fe11
mov word [rbp + 0x3da], r8w
jmp case.default.0x18001fe11
movzx eax, byte [rsp + 0x40]
test r13, r13
mov ecx, r8d
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp case.default.0x18001fe11
mov r13, r8
jmp case.default.0x18001fe11
mov dword [rbp + 0x3c4], 0x610065
mov dword [rbp + 0x3c8], 0x650074
mov dword [rbp + 0x3cc], 0x65004e
jmp case.default.0x18001fe11
lea rdx, [rbp + 0x3c0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r13, rax
xor r8d, r8d
jmp case.default.0x18001fe11
mov eax, 0x77
mov word [rbp + 0x3d0], ax
jmp case.default.0x18001fe11
mov dword [rbp + 0x3d2], 0x61004d
mov dword [rbp + 0x3d6], 0x6c0069
jmp case.default.0x18001fe11
mov byte [rsp + 0x40], 1
inc edi
lea eax, [rdi + 0x3b]
cmp eax, 0x45
jb 0x18001fdf4
mov rdx, qword [rsp + 0x50]
mov r10d, 0xb
lea r9d, [r10 + 0x45]
lea ecx, [r10 + 0x44]
imul eax, esi, 0x68
add r14d, eax
cmp r14d, dword [rsp + 0x48]
ja case.0x18001fbec.0
jmp 0x18001f8d3
cmp qword [r15 + 8], 3
jne 0x18001ff76
mov rax, qword [r15]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x48], SHSetInstanceExplorer
mov rcx, qword [rax]
lea edx, [r8 + 0x6d]
call fcn.180004070
test al, al
je 0x18001ff76
mov rax, qword [r15]
xor r8d, r8d
mov edx, 0x94
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r9, qword [rax + 8]
call fcn.18005d7c0
test al, al
je 0x18001ff76
mov rax, qword [r15]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x48], 0x87
mov rcx, qword [rax + 0x10]
lea edx, [r8 + 0x6d]
call fcn.180004070
test al, al
je 0x18001ff76
mov al, 1
jmp 0x18001f982
cmp byte [rsp + 0x40], 0
je 0x18001ff76
lea rdx, [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor al, al
jmp 0x18001f982