Function at 0x18000c400
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x278
call fcn.1801c83e0
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x1802d1460]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x18000c4a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x18000c4a3
mov r8, qword [rbp + 0x260]
mov edi, 0x200
lea r9, [rbp + 0x268]
lea rcx, [rbp + 0x10]
mov edx, edi
call fcn.180149670
test eax, eax
js 0x18000c483
mov edi, eax
xor esi, esi
lea r9, [rbp]
lea rdx, [rbp + 0x10]
mov r8d, edi
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18000c66d
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.180005380
inc eax
mov edi, eax
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000c4cc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1801c83e0
sub rsp, rcx
xor esi, esi
lea rbx, [rsp + 0x50]
test rbx, rbx
jne 0x18000c4f3
lea rbx, str.no_stack_
jmp 0x18000c5c3
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18000c539
mov rdx, rsi
test rdi, rdi
je 0x18000c539
nop word [rax + rax]
mov rax, qword [rbp + 0x260]
inc rdx
movsx ecx, byte [rdx + rax - 1]
mov word [rbx + rdx*2 - 2], cx
cmp rdx, rdi
jb 0x18000c520
mov rdx, rsi
test rdi, rdi
je 0x18000c5c3
mov r10d, 0x53
lea r9, sym.AliAuthSDK.dll_CB9L_7.qqAbQQMYOd__cGhb1_j__94QEyzIa__9fXt
lea r11d, [r10 + 0x20]
lea r12d, [r10 - 0x10]
lea r13d, [r10 + 0x10]
nop
cmp word [rbx + rdx*2], 0x25
jne case.0x18000c592.47
lea r8, [rbx + rdx*2 + 2]
nop dword [rax]
movzx eax, word [r8]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x18000c592.47
cdqe
movzx eax, byte [r9 + rax + 0xc6a4]
mov ecx, dword [r9 + rax*4 + 0xc68c]
add rcx, r9
jmp rcx
inc rdx
add r8, 2
jmp 0x18000c570
mov word [rbx + rdx*2 + 2], r10w
jmp case.0x18000c592.47
mov word [rbx + rdx*2 + 2], r11w
jmp case.0x18000c592.47
mov word [rbx + rdx*2 + 2], r12w
jmp case.0x18000c592.47
mov word [rbx + rdx*2 + 2], r13w
inc rdx
cmp rdx, rdi
jb 0x18000c560
lea r9, [rbp + 0x268]
lea rcx, [rbp + 0x10]
mov r8, rbx
mov edx, 0xff
call fcn.18016bf40
mov word [rbp + 0x20e], si
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x18000c654
call fcn.18000c280
test eax, eax
jle 0x18000c654
lea rdx, str.OpenSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x18000c66d
mov qword [rsp + 0x40], rsi
mov ecx, 1
lea rax, [rbp + 0x10]
mov qword [rbp], rax
lea rax, [rbp]
mov edx, ecx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x18000c66d
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.1801c74b0
lea rsp, [rbp + 0x228]
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp rcx, rbx
jae 0x180050b87
mov r8d, dword [rbp + 0x5f]
lea r9, [rbp - 0x11]
lea rdx, [rbp - 0x31]
mov dword [rsp + 0x20], r8d
lea rcx, [rbp - 0x29]
lea r8, [rbp - 0xd]
mov rsi, rbx
mov qword [rbp - 9], rbx
call fcn.180020340
mov ebx, eax
test al, al
js 0x180050b61
mov rax, qword [rbp + 0x57]
mov edi, dword [rbp - 0x29]
mov r8d, esi
sub r8d, dword [rax]
sub edi, esi
mov rsi, qword [rbp + 0x4f]
add r8d, dword [rbp + 0x67]
sub dword [rbp + 0x5f], edi
lea rdx, str._5ld:
mov rcx, rsi
call fcn.180015f00
test eax, eax
jle 0x180050698
mov r8d, dword [rbp + 0x6f]
mov r9d, edi
mov rcx, rsi
cmp ebx, 0x21
je 0x18005044d
mov eax, dword [rbp - 0x31]
lea rdx, str.d__2d_hl_ld_l_4ld
mov dword [rsp + 0x20], eax
call fcn.180015f00
jmp 0x180050459
lea rdx, str.d__2d_hl_ld_linf
call fcn.180015f00
test eax, eax
jle 0x180050698
mov r8d, dword [rbp - 0x11]
mov edx, dword [rbp - 0xd]
xor eax, eax
cmp dword [rbp + 0x77], eax
mov r9d, ebx
mov rcx, rsi
cmovne eax, dword [rbp + 0x6f]
mov dword [rsp + 0x20], eax
call fcn.180050220
test eax, eax
je 0x180050698
test bl, 0x20
je 0x1800505a2
movsxd rsi, dword [rbp - 0x31]
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8a14]
add rsi, qword [rbp - 0x29]
mov r8d, 1
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov edi, dword [rbp - 0x31]
mov r8d, dword [rbp + 0x5f]
cmp edi, r8d
jg 0x180050b42
cmp ebx, 0x21
jne 0x180050539
test edi, edi
jne 0x180050539
mov rbx, qword [rbp - 0x29]
mov edi, dword [rbp + 0x6f]
mov rax, qword [rbp + 7]
mov rsi, rbx
inc edi
mov rcx, qword [rbp + 0x57]
mov r8d, eax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x77]
mov r9d, ebx
sub r9d, dword [rcx]
mov rcx, qword [rbp + 0x4f]
mov dword [rsp + 0x28], eax
add r9d, dword [rbp + 0x67]
add ecx, dword [rbp + 0x67]
add ecx, dword [rbp + 0x67]
lea rdx, [rbp - 0x29]
sub r8d, ebx
mov dword [rsp + 0x20], edi
call fcn.180050340
mov rbx, qword [rbp - 0x29]
test eax, eax
je 0x18005069c
cmp eax, 2
je 0x18005052d
mov rax, qword [rbp + 7]
cmp rbx, rax
jb 0x1800504e0
mov edi, ebx
sub edi, esi
mov dword [rbp - 0x31], edi
jmp 0x180050b2b
mov rbx, qword [rbp - 0x29]
cmp rbx, rsi
jae 0x180050b2b
mov eax, dword [rbp + 0x6f]
inc eax
mov dword [rbp - 1], eax
nop
mov rcx, qword [rbp + 0x57]
mov r9d, ebx
lea rdx, [rbp - 0x29]
sub r9d, dword [rcx]
mov ecx, dword [rbp + 0x7f]
mov r8d, edi
add r9d, dword [rbp + 0x67]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbp + 0x77]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x4f]
mov dword [rsp + 0x20], eax
call fcn.180050340
test eax, eax
je 0x180050b7f
mov eax, ebx
mov rbx, qword [rbp - 0x29]
sub eax, ebx
add edi, eax
mov eax, dword [rbp - 1]
cmp rbx, rsi
jb 0x180050550
mov edi, dword [rbp - 0x31]
jmp 0x180050b2b
cmp dword [rbp - 0x11], 0
je 0x1800505d9
movsxd rax, dword [rbp - 0x31]
lea rdx, [0x1802b8a24]
mov r8d, 1
add qword [rbp - 0x29], rax
mov rcx, rsi
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rbx, qword [rbp - 0x29]
mov edi, dword [rbp - 0x31]
jmp 0x180050b2b
mov eax, dword [rbp - 0xd]
xor ebx, ebx
mov esi, ebx
cmp eax, 0x13
je 0x180050ab3
cmp eax, 0x14
je 0x180050ab3
cmp eax, 0x16
je 0x180050ab3
cmp eax, 0x1a
je 0x180050ab3
cmp eax, 0x12
je 0x180050ab3
cmp eax, 0xc
je 0x180050ab3
cmp eax, 0x17
je 0x180050ab3
cmp eax, 0x18
je 0x180050ab3
cmp eax, 6
jne 0x1800506a3
mov rax, qword [rbp - 9]
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
mov qword [rbp - 0x21], rax
mov eax, dword [rbp - 0x31]
lea r8d, [rdi + rax]
call fcn.180028040
test rax, rax
je 0x18005067a
lea r8d, [rbx + 1]
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8a6c]
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rdx, qword [rbp + 0xf]
mov rcx, rbx
call fcn.180027c00
jmp 0x180050af2
mov rcx, qword [rbp + 0x4f]
lea rdx, str.:BAD_OBJECT
mov r8d, ntohs
call fcn.1800019a0
test eax, eax
jg 0x180050af2
mov rbx, qword [rbp - 0x29]
xor edi, edi
jmp 0x180050b8c
cmp eax, 1
jne 0x1800506fa
mov rax, qword [rbp - 9]
lea rdx, [rbp - 0x21]
xor ecx, ecx
mov qword [rbp - 0x21], rax
mov eax, dword [rbp - 0x31]
lea r8d, [rdi + rax]
call fcn.18006b4f0
mov ebx, eax
test eax, eax
jns 0x1800506e2
mov rcx, qword [rbp + 0x4f]
lea rdx, str.Bad_boolean_n
mov r8d, InitCommonControls
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8abc]
mov r8d, ebx
call fcn.180015f00
jmp 0x180050af2
cmp eax, 0x1e
je 0x180050af2
cmp eax, 4
jne 0x18005087f
mov rax, qword [rbp - 9]
lea rdx, [rbp - 0x21]
xor ecx, ecx
mov qword [rbp - 0x21], rax
mov eax, dword [rbp - 0x31]
lea r8d, [rdi + rax]
call fcn.180016130
mov rdi, rax
mov qword [rbp - 0x19], rax
test rax, rax
je 0x180050af2
cmp dword [rax], ebx
jle 0x180050811
mov rcx, qword [rax + 8]
mov edx, ebx
mov qword [rbp - 0x21], rcx
mov r8d, dword [rax]
test r8d, r8d
jle 0x180050771
movzx eax, byte [rcx]
cmp al, 0x20
jae 0x180050763
cmp al, 0xa
je 0x180050763
cmp al, 0xd
je 0x180050763
cmp al, 9
jne 0x1800507ab
cmp al, 0x7e
ja 0x1800507ab
inc edx
inc rcx
cmp edx, r8d
jl 0x180050750
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8acc]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov r8d, dword [rdi]
mov rdx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
jmp 0x180050811
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
jne 0x18005082e
mov rcx, qword [rbp + 0x4f]
lea r8d, [rbx + 0xb]
lea rdx, str._HEX_DUMP_:
call fcn.1800019a0
test eax, eax
jle 0x180050698
xor eax, eax
mov ebx, eax
mov edi, eax
mov rax, qword [rbp - 0x19]
cmp dword [rax], ebx
jle 0x18005080e
nop dword [rax]
mov rax, qword [rbp - 0x21]
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8aec]
movzx r8d, byte [rbx + rax]
call fcn.180015f00
test eax, eax
jle 0x180050698
mov rax, qword [rbp - 0x19]
inc edi
inc rbx
cmp edi, dword [rax]
jl 0x1800507e0
mov rdi, rax
mov rcx, rdi
call fcn.1800201d0
mov qword [rbp - 0x19], 0
test esi, esi
jne 0x180050b10
jmp 0x180050af2
mov rsi, qword [rbp + 0x4f]
lea rdx, [0x1802b8af4]
mov r8d, 1
mov rcx, rsi
call fcn.1800019a0
test eax, eax
jle 0x180050698
cmp ebx, 0xffffffff
je 0x18005085b
mov r8d, ebx
cmp ebx, dword [rdi]
jle 0x18005085e
mov r8d, dword [rdi]
mov rdx, qword [rbp - 0x21]
mov r9d, 6
mov rcx, rsi
call fcn.1800500b0
test eax, eax
jle 0x180050698
mov esi, 1
jmp 0x180050811
cmp eax, 2
jne 0x180050969
mov rax, qword [rbp - 9]
lea rdx, [rbp - 0x21]
xor ecx, ecx
mov qword [rbp - 0x21], rax
mov eax, dword [rbp - 0x31]
lea r8d, [rdi + rax]
call fcn.180015fe0
mov rsi, rax
test rax, rax
je 0x18005093e
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8af8]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
cmp dword [rsi + 4], 0x102
jne 0x1800508f5
lea rdx, [0x1802b8afc]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
xor eax, eax
mov edi, eax
mov ebx, eax
cmp dword [rsi], eax
jle 0x18005092a
nop
mov rax, qword [rsi + 8]
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8b00]
movzx r8d, byte [rax + rbx]
call fcn.180015f00
test eax, eax
jle 0x180050698
inc edi
inc rbx
cmp edi, dword [rsi]
jl 0x180050900
cmp dword [rsi], 0
jne 0x18005095c
mov r8d, 2
lea rdx, [0x1802b8b08]
jmp 0x18005094b
mov r8d, ntohs
lea rdx, str.BAD_INTEGER
mov rcx, qword [rbp + 0x4f]
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rcx, rsi
call fcn.1800201d0
jmp 0x180050af2
cmp eax, 0xa
jne 0x180050a59
mov rax, qword [rbp - 9]
lea rdx, [rbp - 0x21]
xor ecx, ecx
mov qword [rbp - 0x21], rax
mov eax, dword [rbp - 0x31]
lea r8d, [rdi + rax]
call fcn.180016070
mov rsi, rax
test rax, rax
je 0x180050a2e
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8b0c]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
cmp dword [rsi + 4], 0x10a
jne 0x1800509df
lea rdx, [0x1802b8b1c]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
xor eax, eax
mov edi, eax
mov ebx, eax
cmp dword [rsi], eax
jle 0x180050a1a
nop dword [rax]
mov rax, qword [rsi + 8]
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8b20]
movzx r8d, byte [rbx + rax]
call fcn.180015f00
test eax, eax
jle 0x180050698
inc edi
inc rbx
cmp edi, dword [rsi]
jl 0x1800509f0
cmp dword [rsi], 0
jne 0x180050a4c
mov r8d, 2
lea rdx, [0x1802b8b28]
jmp 0x180050a3b
mov r8d, InitCommonControls
lea rdx, str.BAD_ENUMERATED
mov rcx, qword [rbp + 0x4f]
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rcx, rsi
call fcn.1800201d0
jmp 0x180050af2
cmp dword [rbp - 0x31], ebx
jle 0x180050af2
mov edi, dword [rbp + 0x7f]
test edi, edi
je 0x180050af2
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8b2c]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov r8d, dword [rbp - 0x31]
cmp edi, 0xffffffff
je 0x180050a9f
cmp edi, r8d
jg 0x180050a9f
mov r8d, edi
mov rdx, qword [rbp - 0x29]
mov r9d, 6
mov rcx, rbx
call fcn.1800500b0
jmp 0x180050b08
mov rbx, qword [rbp + 0x4f]
lea rdx, [0x1802b8a34]
mov r8d, 1
mov rcx, rbx
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov r8d, dword [rbp - 0x31]
test r8d, r8d
jle 0x180050af2
mov rdx, qword [rbp - 0x29]
mov rcx, rbx
call fcn.1800019a0
cmp eax, dword [rbp - 0x31]
jne 0x180050698
mov rcx, qword [rbp + 0x4f]
lea rdx, [0x1802b8b40]
mov r8d, 1
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rbx, qword [rbp - 0x29]
movsxd rdi, dword [rbp - 0x31]
add rbx, rdi
cmp dword [rbp - 0xd], 0
mov qword [rbp - 0x29], rbx
jne 0x180050b2b
cmp dword [rbp - 0x11], 0
je 0x180050b5a
mov esi, dword [rbp + 0x5f]
sub esi, edi
mov dword [rbp + 0x5f], esi
cmp rbx, qword [rbp + 7]
jae 0x180050b87
mov rcx, qword [rbp - 9]
jmp 0x1800503c0
mov rcx, qword [rbp + 0x4f]
lea rdx, str.length_is_greater_than__ld_n
call fcn.180015f00
mov rbx, qword [rbp - 0x29]
xor edi, edi
jmp 0x180050b8c
mov edi, 2
jmp 0x180050b8c
mov rcx, qword [rbp + 0x4f]
lea rdx, str.Error_in_encoding_n
mov r8d, reloc.WS2_32.dll_select
call fcn.1800019a0
test eax, eax
jle 0x180050698
mov rbx, qword [rbp - 0x29]
xor edi, edi
jmp 0x180050b8c
mov edi, 1
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x180050b9e
call fcn.180027d90
mov rbx, qword [rbp - 0x29]
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x180050bb3
mov rcx, rax
call fcn.1800201d0
mov rbx, qword [rbp - 0x29]
mov rax, qword [rbp + 0x57]
mov qword [rax], rbx
mov rbx, qword [rsp + 0x98]
mov eax, edi
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret