Function at 0x18002cb30
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0xd8], rsp
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xor edx, edx
mov r8d, 0x9c
lea rcx, [rsp + 0x34]
call fcn.180056c20
nop
test rsi, rsi
je 0x18002d02f
cmp dword [rsi], 0x1234abcd
jne 0x18002d02f
mov r10, qword [rsi + 0x6290]
test r10, r10
jne 0x18002cbbe
mov dword [rsp + 0xe0], r15d
lea rdx, [0x18002cbb7]
mov rcx, rsp
call fcn.180057580
nop
nop
nop
xor eax, eax
jmp 0x18002d19f
mov ecx, dword [rdi + 8]
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x3c], rbx
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x44], eax
mov eax, dword [r14 + 0x620]
mov dword [rsp + 0x48], eax
mov rax, qword [rdi + 0x428]
mov qword [rsp + 0x50], rax
mov eax, dword [rdi + 0x640]
mov dword [rsp + 0x58], eax
lea rax, [rdi + 0x430]
mov qword [rsp + 0x60], rax
mov eax, dword [rdi + 0x63c]
mov dword [rsp + 0x68], eax
mov rax, qword [rdi + 0x648]
mov qword [rsp + 0x70], rax
mov rax, qword [rdi + 0x650]
mov qword [rsp + 0x78], rax
mov rax, qword [rdi + 0x658]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], r14
lea rax, [rdi + 0x14]
mov qword [rsp + 0x90], rax
lea rax, [r14 + 0x418]
mov qword [rsp + 0x98], rax
lea rax, [rdi + 0x660]
mov qword [rsp + 0xa0], rax
mov eax, dword [rdi + 0x638]
mov dword [rsp + 0xb8], eax
lea rax, [rdi + 0x16a4]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], ecx
cmp ecx, 0x2ee
jne 0x18002cca6
lea rax, [rdi + 0xe60]
mov qword [rsp + 0xa8], rax
cmp ecx, 0x1f5
ja 0x18002cd75
je 0x18002cd61
add ecx, 0xffffff92
cmp ecx, 0x2e
ja case.0x18002cda0.523
lea rdx, [0x180000000]
movzx eax, byte [rdx + rcx + 0x2d1e0]
mov ecx, dword [rdx + rax*4 + 0x2d1c0]
add rcx, rdx
jmp rcx
mov dword [rsp + 0x38], r15d
jmp case.0x18002cda0.523
mov dword [rsp + 0x38], 3
lea rax, str.Java_malicious_inbound_socket_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Java_malicious_outbound_socket_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Java_Metasploit_Meterpreter_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Java_Metasploit_Meterpreter_command_execution_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Web_Based_Java_command_execution_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Insecure_Java_execution_blocked_in_Internal_IP_Ranges
jmp 0x18002cffd
mov dword [rsp + 0x38], 2
lea rax, str.Exploit_code_executing_from_RW_memory_blocked
jmp 0x18002cffd
add ecx, 0xfffffe0a
cmp ecx, 0xf8
ja case.0x18002cda0.523
lea rdx, [0x180000000]
movzx eax, byte [rdx + rcx + 0x2d2a0]
mov ecx, dword [rdx + rax*4 + 0x2d210]
add rcx, rdx
jmp rcx
mov dword [rsp + 0x38], r15d
lea rax, str.Exploit_blocked_by_Anti_HeapSpray_Enforcement
jmp 0x18002cffd
mov dword [rsp + 0x38], r15d
lea rax, str.Exploit_blocked_by_DEP_Enforcement
jmp 0x18002cffd
mov dword [rsp + 0x38], r15d
lea rax, str.Exploit_blocked_by_Bottom_Up_ASLR_Enforcement
jmp 0x18002cffd
mov dword [rsp + 0x38], r15d
lea rax, str.Anti_Exploit_fingerprinting_attempt_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], r15d
lea rax, str.Exploit_blocked_by_Dynamic_Anti_HeapSpray_Enforcement
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Exploit_code_executing_from_stack_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Exploit_Stack_Pivoting_attempt_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Exploit_shellcode_copied_to_memory_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Process_Hollowing_Protection
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Exploit_attempt_to_disable_DEP_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 1
lea rax, str.Exploit_ROP_gadget_attack_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], r15d
lea rax, str.Attempt_to_execute_VBScript_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 2
lea rax, str.Exploit_code_executing_from_Heap_memory_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 2
jmp case.0x18002cda0.523
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_payload_file_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_payload_process_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_payload_macro_process_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Visual_Basic_Scripting_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Unauthorized_attempt_to_unload_protection_detected
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_payload_from_UNC_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_LoadLibrary_attempt_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_WMI_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_VBA7_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_VBE7_object_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_scripting_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_loading_points_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Office_spawning_batch_command_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Excel_macro_4.0_abuse_blocked
jmp 0x18002cffd
mov dword [rsp + 0x38], 3
lea rax, str.Exploit_Email_client_scripting_abuse_blocked
jmp 0x18002cffd
lea rax, str.APT_Attack_behaviour_detected
jmp 0x18002cff5
lea rax, str.T1003___Credential_Access
jmp 0x18002cff5
lea rax, str.T1055___Defense_Evasion
jmp 0x18002cff5
lea rax, str.T1170___Execution
jmp 0x18002cff5
lea rax, str.T1106___Execution
jmp 0x18002cff5
lea rax, str.T1059___Execution
mov dword [rsp + 0x38], 4
mov qword [rsp + 0xb0], rax
mov r9d, 0xa0
lea r8, [rsp + 0x30]
mov edx, 5
mov rcx, qword [0x1800a6d10]
mov rcx, qword [rcx + 0x6280]
call r10
nop
nop
xor eax, eax
jmp 0x18002d19f
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002d05c
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002d0ce
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002d0a8
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
lea r9, str.CreateAlertLogNA
mov edx, 0x6c7
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002d0c6
mov edx, 8
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0xd0], 8
lea rdx, [0x18002d0f0]
mov rcx, qword [rsp + 0xd8]
call fcn.180057580
nop
nop
nop
mov eax, 8
jmp 0x18002d19f
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret