Function at 0x140012ee8
Capabilities:
Access the windows event log
Create process on windows
Move file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4d8]
sub rsp, 0x5b0
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14005f660]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov r14, rcx
mov rax, qword [rcx + 0x78]
mov qword [rbp - 0x58], rax
mov r12, qword [rcx + 8]
mov r13, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov qword [rbp + 0x18], rbx
mov rax, qword [rcx + 0x30]
mov qword [rbp + 0x50], rax
mov r15b, byte [rcx + 0x82]
mov edi, 1
mov ecx, 0x65ad8
call fcn.140027078
test rax, rax
je 0x140012f72
mov rcx, rax
call fcn.140017e84
mov rsi, rax
jmp 0x140012f74
xor esi, esi
mov qword [rbp - 0x70], rsi
test rsi, rsi
je 0x140013dc1
mov rcx, rsi
call fcn.14001928c
xor r9d, r9d
mov r8, r12
lea rdx, str.database
call fcn.140019098
xor r9d, r9d
mov r8, r13
lea rdx, str.appName
mov rcx, rsi
call fcn.140019098
xor r9d, r9d
mov r8, rbx
lea rdx, str.appVersion
mov rcx, rsi
call fcn.140019098
mov r9d, edi
mov r8, qword [rbp - 0x58]
lea rdx, str.minidumpZip
mov rcx, rsi
call fcn.140019098
mov rcx, qword [rbp - 0x58]
call fcn.140019cf8
mov r8, rax
xor r9d, r9d
lea rdx, [0x140050e80]
mov rcx, rsi
call fcn.140019098
mov rax, qword [0x140060c00]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, r12
lea rdx, str._s_s_s
lea rcx, [rbp - 0x48]
call fcn.140016fd8
mov rax, qword [0x140060c00]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, str.post_post_action.php
mov qword [rsp + 0x20], rax
lea r9, [0x140050478]
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.14001c858
mov dword [rsp + 0x20], 0x1bb
mov r8d, 3
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
call fcn.140018488
or ebx, 0xffffffff
test eax, eax
jne 0x140013095
mov dword [rsp + 0x20], 0x50
lea r8d, [rbx + 4]
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
call fcn.140018488
test eax, eax
je 0x140013d6f
mov rcx, rsi
call fcn.14001998c
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001738c
nop
mov r8, qword [rbp - 0x80]
lea rdx, str.HTTP_post_response:
mov rcx, r14
call fcn.140014d1c
mov rbx, qword [rsp + 0x50]
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.140014d1c
lea r8, str._____________________________
xor edx, edx
mov rcx, r14
call fcn.140014d1c
mov rax, qword [0x140060c00]
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x50]
lea rdx, str.LogPostResponse
mov rcx, qword [rbp - 0x48]
call fcn.14001c080
lea rdx, str.True
mov rcx, qword [rbp - 0x50]
call fcn.1400270e4
test eax, eax
jne 0x14001314a
and qword [rbp - 0x60], 0
lea r8, [0x140050f4c]
lea rdx, str.BugSplatPost.log
lea rcx, [rbp - 0x60]
call fcn.140028728
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14001314a
mov rdx, rbx
call fcn.140029a00
mov rcx, qword [rbp - 0x60]
call fcn.1400288d8
mov dword [rbp - 0x68], 2
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x140013d03
lea rdx, str.:::::_DB_UPDATED_
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x140013d03
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x140013d03
xor eax, eax
mov dword [rbp - 0x68], eax
mov rax, qword [0x140060c00]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x60], rax
lea rcx, str.:::::_DB_UPDATED_
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x18]
add rcx, 0xfffffffffffffff4
lea rax, [0x140060bf0]
cmp rcx, rax
je 0x140013201
lock add dword [rcx], 0xffffffff
jg 0x140013201
mov rcx, qword [rbp - 0x18]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x1400135fc
lea rdx, [0x140051030]
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x1400135fc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x1400135fc
mov r8d, edi
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x50]
call fcn.1400168c4
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140017414
nop
mov rcx, qword [rbp + 8]
add rcx, 0xfffffffffffffff4
lea rbx, [0x140060bf0]
cmp rcx, rbx
je 0x140013280
lock add dword [rcx], 0xffffffff
jg 0x140013280
mov rcx, qword [rbp + 8]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
lea rcx, [0x140051030]
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x1400132cd
lock add dword [rcx], 0xffffffff
jg 0x1400132cd
mov rcx, qword [rbp - 0x28]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x1400135fc
lea rdx, [0x140051030]
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x1400135fc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x1400135fc
mov r8d, edi
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x50]
call fcn.1400168c4
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140017414
nop
mov rcx, qword [rbp - 8]
add rcx, 0xfffffffffffffff4
lea rbx, [0x140060bf0]
cmp rcx, rbx
je 0x14001334c
lock add dword [rcx], 0xffffffff
jg 0x14001334c
mov rcx, qword [rbp - 8]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
lea rcx, [0x140051030]
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x140013399
lock add dword [rcx], 0xffffffff
jg 0x140013399
mov rcx, qword [rbp - 0x40]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x1400135fc
lea rdx, [0x140051030]
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x1400135fc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x1400135fc
mov r8d, edi
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x50]
call fcn.1400168c4
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff4
lea rbx, [0x140060bf0]
cmp rcx, rbx
je 0x140013418
lock add dword [rcx], 0xffffffff
jg 0x140013418
mov rcx, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
lea rcx, [0x140051030]
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x140013465
lock add dword [rcx], 0xffffffff
jg 0x140013465
mov rcx, qword [rbp - 0x30]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x1400135fc
lea rdx, [0x140051030]
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x1400135fc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x1400135fc
mov r8d, edi
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400168c4
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x20]
add rcx, 0xfffffffffffffff4
lea rbx, [0x140060bf0]
cmp rcx, rbx
je 0x1400134e3
lock add dword [rcx], 0xffffffff
jg 0x1400134e3
mov rcx, qword [rbp - 0x20]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
lea rcx, [0x140051030]
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp - 0x10]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x140013530
lock add dword [rcx], 0xffffffff
jg 0x140013530
mov rcx, qword [rbp - 0x10]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 8], 0
jl 0x1400135fc
lea rdx, [0x140051030]
mov rcx, rbx
call fcn.140027c5c
mov rdi, rax
test rax, rax
je 0x1400135fc
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x1400135fc
mov r8d, edi
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.1400168c4
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140017414
nop
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
lea rbx, [0x140060bf0]
cmp rcx, rbx
je 0x1400135af
lock add dword [rcx], 0xffffffff
jg 0x1400135af
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
lea rcx, [0x140051030]
call fcn.14002733c
lea r8d, [rdi + rax]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140016a0c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140017414
nop
mov rcx, qword [rbp + 0x10]
add rcx, 0xfffffffffffffff4
cmp rcx, rbx
je 0x1400135fc
lock add dword [rcx], 0xffffffff
jg 0x1400135fc
mov rcx, qword [rbp + 0x10]
add rcx, 0xfffffffffffffff4
call fcn.140027ee0
mov r8, qword [rsp + 0x70]
lea rdx, str.HTTP_request_succeeded
mov rcx, r14
call fcn.140014d1c
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, r14
call fcn.140014d1c
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, r14
call fcn.140014d1c
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, r14
call fcn.140014d1c
mov rdi, qword [rbp - 0x78]
mov r8, rdi
xor edx, edx
mov rcx, r14
call fcn.140014d1c
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, r14
call fcn.140014d1c
cmp dword [rdi - 8], 0
jle 0x140013b5e
mov rcx, rdi
call fcn.1400297d4
test eax, eax
js 0x140013a61
test r15b, r15b
jne 0x140013a61
lea rcx, [rsp + 0x60]
call fcn.140017204
mov rbx, qword [rsp + 0x60]
mov r15, rbx
movzx ecx, word [rbx]
jmp 0x1400136a6
mov rcx, r15
call qword [sym.imp.USER32.dll_CharNextW]
mov r15, rax
movzx ecx, word [rax]
call fcn.1400297c8
test eax, eax
jne 0x140013697
mov rax, r15
sub rax, rbx
sar rax, 1
mov esi, dword [rbx - 8]
sub esi, eax
lea eax, [rsi + 1]
movsxd r8, eax
add r8, r8
mov rdx, r15
mov rcx, rbx
call fcn.140026b10
mov dword [rbx - 8], esi
lea rcx, [rsp + 0x60]
call fcn.140017204
mov rbx, qword [rsp + 0x60]
xor r15d, r15d
mov esi, r15d
cmp word [rbx], r15w
je 0x140013731
movzx ecx, word [rbx]
call fcn.1400297c8
test eax, eax
je 0x140013705
test rsi, rsi
jne 0x140013708
mov rsi, rbx
jmp 0x140013708
mov rsi, r15
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp word [rax], r15w
jne 0x1400136ef
test rsi, rsi
je 0x140013731
mov word [rsi], r15w
mov rbx, qword [rsp + 0x60]
sub rsi, rbx
sar rsi, 1
mov dword [rbx - 8], esi
mov rbx, qword [rsp + 0x60]
cmp dword [rbx - 8], r15d
je 0x140013767
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rsi, qword [rbp - 0x70]
jmp 0x140013a64
mov rax, qword [0x140060c00]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x58]
mov rsi, qword [rbp + 0x18]
mov r8, rsi
mov rdx, r13
mov rcx, r12
call fcn.14001c5dc
test al, al
jne 0x1400137b9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.browse_crashinfo.php
mov qword [rsp + 0x20], rax
lea r9, str.http:__
mov r8, rsi
mov rdx, r13
mov rcx, r12
call fcn.14001c858
lea rdx, str._vendor
lea rcx, [rbp + 0x28]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x28]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
lea rax, [0x140060bf0]
cmp rcx, rax
je 0x1400137fa
lock add dword [rcx], 0xffffffff
jg 0x1400137fa
call fcn.140027ee0
test r12, r12
jne 0x140013804
mov eax, r15d
jmp 0x14001380d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, r12
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140016b14
lea rdx, str.app
lea rcx, [rbp + 0x40]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x40]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
lea rax, [0x140060bf0]
or r12d, 0xffffffff
cmp rcx, rax
je 0x140013869
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x140013869
call fcn.140027ee0
test r13, r13
jne 0x140013873
mov eax, r15d
jmp 0x14001387c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, r13
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140016b14
lea rdx, [0x1400510c0]
lea rcx, [rbp + 0x38]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x38]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
lea r13, [0x140060bf0]
cmp rcx, r13
je 0x1400138d4
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x1400138d4
call fcn.140027ee0
test rsi, rsi
jne 0x1400138de
mov eax, r15d
jmp 0x1400138e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rsi
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140016b14
mov rsi, qword [rbp + 0x50]
test rsi, rsi
je 0x140013966
mov rcx, rsi
call fcn.14002733c
test rax, rax
je 0x140013966
lea rdx, str.key
lea rcx, [rbp + 0x48]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x48]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
cmp rcx, r13
je 0x14001394e
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x14001394e
call fcn.140027ee0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rsi
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140016b14
lea rdx, str.id
lea rcx, [rbp + 0x20]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x20]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
cmp rcx, r13
je 0x1400139a8
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x1400139a8
call fcn.140027ee0
mov r8, qword [rbp - 0x78]
mov edx, dword [rdi - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
lea rdx, str.row
lea rcx, [rbp + 0x30]
call fcn.140017098
nop
mov rbx, qword [rbp + 0x30]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
nop
lea rcx, [rbx - 0xc]
cmp rcx, r13
je 0x1400139fb
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x1400139fb
call fcn.140027ee0
mov rbx, qword [rsp + 0x68]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140016b14
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rbx, qword [rsp + 0x58]
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbx - 0xc]
cmp rcx, r13
je 0x14001375e
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x14001375e
call fcn.140027ee0
jmp 0x14001375e
xor r15d, r15d
mov rax, qword [r14 + 0x70]
cmp dword [rax - 8], r15d
jle 0x140013b61
mov rax, qword [r14 + 0x90]
cmp dword [rax - 8], r15d
jle 0x140013b61
mov r8, qword [rsp + 0x70]
mov edi, 0x104
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029a94
lea rbx, [0x1400510e4]
mov r8, rbx
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, qword [rsp + 0x78]
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, rbx
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, qword [rbp - 0x78]
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, rbx
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, qword [rsp + 0x68]
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
lea r8, [0x1400510e8]
mov edx, edi
lea rcx, [rbp + 0x80]
call fcn.140029b00
mov r8, qword [r14 + 0x70]
mov edx, edi
lea rcx, [rbp + 0x290]
call fcn.140029a94
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x290]
mov rcx, qword [r14 + 0x90]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x140013b61
xor r15d, r15d
call fcn.14001c460
lea rdx, str.BugSplat
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140013c59
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140017184
mov qword [rbp + 0x60], rax
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140017184
mov qword [rbp + 0x68], rax
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140017184
mov qword [rbp + 0x70], rax
xor r8d, r8d
lea ecx, [r8 + 1]
mov edx, ecx
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
lea eax, [rcx + 2]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r15
mov r9d, ecx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
lea rcx, [rsp + 0x70]
call fcn.140017204
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbx - 8], eax
movsxd rcx, eax
mov word [rbx + rcx*2], r15w
lea rcx, [rsp + 0x78]
call fcn.140017204
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbx - 8], eax
movsxd rcx, eax
mov word [rbx + rcx*2], r15w
lea rcx, [rsp + 0x68]
call fcn.140017204
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbx - 8], eax
movsxd rcx, eax
mov word [rbx + rcx*2], r15w
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
lea r14, [0x140060bf0]
or ebx, 0xffffffff
cmp rcx, r14
je 0x140013c83
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013c83
call fcn.140027ee0
nop
mov rcx, qword [rbp - 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013ca2
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013ca2
call fcn.140027ee0
nop
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013cc2
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013cc2
call fcn.140027ee0
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013ce2
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013ce2
call fcn.140027ee0
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013d1c
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013d1c
call fcn.140027ee0
jmp 0x140013d1c
xor r8d, r8d
lea rdx, str.Server_error._HTTP_request_succeeded__but_report_failed_to_post
mov rcx, r14
call fcn.140014d1c
lea r14, [0x140060bf0]
mov rcx, qword [rbp - 0x50]
add rcx, 0xfffffffffffffff4
or ebx, 0xffffffff
cmp rcx, r14
je 0x140013d3e
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013d3e
call fcn.140027ee0
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013d5d
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013d5d
call fcn.140027ee0
mov edi, dword [rbp - 0x68]
test edi, edi
jne 0x140013d76
mov rcx, qword [rbp - 0x58]
call fcn.140028114
jmp 0x140013d76
lea r14, [0x140060bf0]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
mov rcx, qword [rbp - 0x80]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013da3
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x140013da3
call fcn.140027ee0
nop
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, r14
je 0x140013dc1
mov edx, ebx
lock xadd dword [rcx], edx
add edx, ebx
test edx, edx
jg 0x140013dc1
call fcn.140027ee0
mov eax, edi
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.1400268f0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret