Function at 0x7ff6d8e7dbf0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x7ff6d8eee010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, r8
mov rdi, rdx
xor r14d, r14d
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r14w
call fcn.7ff6d8e6cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbx + 0x10]
lea rax, [rbp + 0x60]
cmp rax, rdx
je 0x7ff6d8e7dc72
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x7ff6d8e7dc69
mov rdx, qword [rdx]
lea rcx, [rbp + 0x60]
call fcn.7ff6d8e6d1d0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x7ff6d8eeee90]
lea rcx, [rbp - 0x28]
call fcn.7ff6d8e68b00
mov rbx, rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov r8d, 0xe
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x68]
call fcn.7ff6d8e6d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.7ff6d8e6e840
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rax, rdx
cmp rcx, rax
jbe 0x7ff6d8e7dd1f
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x7ff6d8e7dd1f
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.7ff6d8e6e840
jmp 0x7ff6d8e7dd2c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.7ff6d8e6e950
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x7ff6d8e7dd95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7dd90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e323
call fcn.7ff6d8e98b74
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x7ff6d8e7dde9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7dde4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e329
call fcn.7ff6d8e98b74
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x7ff6d8e7de3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7de35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e32f
call fcn.7ff6d8e98b74
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
lea rdx, [0x7ff6d8eeee50]
lea rcx, [rbp - 8]
call fcn.7ff6d8e68b00
mov rbx, rax
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov r8d, 0xe
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x48]
call fcn.7ff6d8e6d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.7ff6d8e6e840
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
sub rax, rdx
cmp rcx, rax
jbe 0x7ff6d8e7deea
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x7ff6d8e7deea
lea r8, [rsp + 0x78]
mov rcx, rbx
call fcn.7ff6d8e6e840
jmp 0x7ff6d8e7def7
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.7ff6d8e6e950
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x7ff6d8e7df5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7df5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e335
call fcn.7ff6d8e98b74
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r14w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x7ff6d8e7dfb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7dfac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e33b
call fcn.7ff6d8e98b74
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x7ff6d8e7e002
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7dffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e341
call fcn.7ff6d8e98b74
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov edx, 4
call fcn.7ff6d8ea5db8
test eax, eax
jne 0x7ff6d8e7e05d
lea rax, [rbp + 0x20]
cmp rdi, rax
je 0x7ff6d8e7e052
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rdi
call fcn.7ff6d8e6d1d0
xor al, al
mov byte [rsi], al
mov bl, 1
jmp 0x7ff6d8e7e215
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rcx, qword [rbp + 0x40]
mov edx, 4
call fcn.7ff6d8ea5db8
test eax, eax
jne 0x7ff6d8e7e0a8
lea rax, [rbp + 0x40]
cmp rdi, rax
je 0x7ff6d8e7e09c
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov rcx, rdi
call fcn.7ff6d8e6d1d0
mov al, 1
mov byte [rsi], al
movzx ebx, al
jmp 0x7ff6d8e7e215
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
lea rsi, [rdx + rax*2]
lea rdi, [rbp + 0x20]
cmovae rdi, qword [rbp + 0x20]
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8d, 0xf
mov qword [rsp + 0x70], r8
mov byte [rsp + 0x58], cl
mov rdx, rsi
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x7ff6d8e7e104
lea rcx, [rsp + 0x58]
call fcn.7ff6d8e691a0
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rbp + 0x18], rax
cmp rdi, rsi
je 0x7ff6d8e7e16b
movzx ebx, byte [rsp + 0x50]
movzx r9d, byte [rdi]
cmp rcx, r8
jae 0x7ff6d8e7e143
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff6d8e7e156
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.7ff6d8e67af0
add rdi, 2
mov r8, qword [rsp + 0x70]
cmp rdi, rsi
je 0x7ff6d8e7e16b
mov rcx, qword [rsp + 0x68]
jmp 0x7ff6d8e7e117
lea rdx, [rsp + 0x58]
cmp r8, 0x10
cmovae rdx, qword [rsp + 0x58]
lea rcx, str.EventManager_error:_Spooler_Applet_file_wasnt_found__or_no_read_access_at:__s_n
call fcn.7ff6d8e63170
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x7ff6d8e7e1c3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7e1be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e347
call fcn.7ff6d8e98b74
lea rdx, str.IntelDalJhi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x7ff6d8e7e213
xor r8d, r8d
lea edx, [r8 + 1]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
mov r9d, 0xc0000003
mov rcx, rax
call qword [sym.imp.ADVAPI32.DLL_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_DeregisterEventSource]
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x7ff6d8e7e255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7e250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e34d
call fcn.7ff6d8e98b74
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x7ff6d8e7e2a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7e2a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e353
call fcn.7ff6d8e98b74
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r14w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x7ff6d8e7e2f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6d8e7e2ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6d8e7e31d
call fcn.7ff6d8e98b74
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.7ff6d8e98b50
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
int3
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
nop
call fcn.7ff6d8ea5708
int3