Function at 0x180024340
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1800b43d8]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov r12, r9
mov edi, r8d
mov dword [rsp + 0x70], r8d
mov r9, rdx
mov qword [rsp + 0x78], rdx
mov rbx, rcx
mov qword [rbp - 0x78], rcx
mov r10, qword [rbp + 0xe0]
mov qword [rbp - 0x70], r10
mov dword [rsp + 0x68], r8d
lea edx, [r8 + 0xd]
mov dword [rsp + 0x50], edx
xor esi, esi
mov r11d, dword [rsp + 0x64]
mov dword [rsp + 0x54], r11d
cmp r8d, edx
jae 0x18002489d
lea edx, [r8 - 0x45]
mov dword [rsp + 0x60], edx
lea rdi, [0x180000000]
lea r15, [0x1800a9369]
mov r13d, 0x7269
mov r14d, dword [rsp + 0x64]
mov eax, dword [rsp + 0x50]
cmp edx, 0x27
ja case.default.0x1800243f1
movzx eax, byte [rdi + rdx + 0x24c7c]
mov ecx, dword [rdi + rax*4 + 0x24c44]
add rcx, rdi
jmp rcx
mov eax, dword [r12]
mov dword [rsp + 0x58], eax
xor r9d, r9d
lea r8, [rsp + 0x64]
mov edx, 0x99
lea rcx, [rsp + 0x58]
call fcn.180027520
test eax, eax
jne 0x180024c17
mov eax, dword [rsp + 0x64]
mov r9, qword [rsp + 0x78]
cmp eax, dword [r9]
ja 0x18002488c
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
jmp case.0x1800243f1.13
test r10, r10
jne 0x180024494
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str._u:_u:_u._u
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
mov r9, qword [rsp + 0x78]
test r9, r9
jne case.0x1800243f1.13
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r8, str.reserved_range
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
mov r9, qword [rsp + 0x78]
jmp case.0x1800243f1.13
test rbx, rbx
jne case.0x1800243f1.13
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.GPU_CYCLES
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
mov r9, qword [rsp + 0x78]
jmp case.0x1800243f1.13
mov word [rbp + 0x6e], r13w
jmp case.0x1800243f1.13
mov eax, 0x65
mov word [rbp + 0x70], ax
jmp case.0x1800243f1.13
mov r11d, esi
mov dword [rsp + 0x54], esi
mov eax, dword [r12]
test al, 7
mov r14d, esi
setne r14b
inc r14d
shr eax, 3
add r14d, eax
jmp case.0x1800243f1.13
mov rdi, qword [rbx]
mov r13, qword [rbx + 8]
cmp rdi, r13
je 0x1800246a3
nop word [rax + rax]
mov r15, qword [r12]
mov rbx, qword [r15 + 8]
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x48], esi
mov rsi, r15
cmp byte [rbx + 0x19], 0
jne 0x1800245f7
nop dword [rax + rax]
mov qword [rbp - 0x50], rbx
lea rcx, [rbx + 0x20]
mov rdx, rdi
call fcn.180022050
shr eax, 0x1f
test al, al
je 0x1800245e4
mov dword [rbp - 0x48], 0
mov rbx, qword [rbx + 0x10]
jmp 0x1800245f1
mov dword [rbp - 0x48], 1
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1800245c0
cmp byte [rsi + 0x19], 0
jne 0x180024610
lea rdx, [rsi + 0x20]
mov rcx, rdi
call fcn.180022050
shr eax, 0x1f
test al, al
je 0x180024676
movabs rax, 0x3ffffffffffffff
cmp qword [r12 + 8], rax
je 0x180024c3e
mov qword [rbp - 0x68], r12
xor esi, esi
mov qword [rbp - 0x60], rsi
lea ecx, [rsi + 0x40]
call fcn.18005fd8c
mov rbx, rax
mov qword [rbp - 0x60], rax
lea rcx, [rax + 0x20]
mov rdx, rdi
call fcn.1800044e0
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov word [rbx + 0x18], si
mov qword [rbp - 0x60], rsi
movups xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp - 0x50], xmm0
mov r8, rbx
lea rdx, [rbp - 0x50]
mov rcx, r12
call fcn.180017670
jmp 0x180024678
xor esi, esi
add rdi, 0x28
cmp rdi, r13
jne 0x1800245a0
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
mov rbx, qword [rbp - 0x78]
mov r9, qword [rsp + 0x78]
lea r15, [0x1800a9369]
mov r13d, 0x7269
lea rdi, [0x180000000]
mov eax, dword [rsp + 0x50]
inc r8d
mov dword [rsp + 0x68], r8d
inc edx
mov dword [rsp + 0x60], edx
cmp r8d, eax
jae 0x180024899
mov r10, qword [rbp - 0x70]
jmp 0x1800243d6
movzx ecx, byte [r12]
neg cl
and cl, 7
mov eax, r11d
mov byte [rax + r10], cl
inc r11d
mov dword [rsp + 0x54], r11d
xor r9b, r9b
mov r14d, esi
mov eax, dword [r12]
test eax, eax
je 0x180024748
nop dword [rax + rax]
mov r8d, r14d
and r8d, 7
mov eax, r14d
cmp byte [rax + rbx], 0
setne dl
mov ecx, 7
sub ecx, r8d
shl dl, cl
or r9b, dl
cmp r8d, 7
jne 0x18002472e
mov byte [r11 + r10], r9b
inc r11d
xor r9b, r9b
inc r14d
mov eax, dword [r12]
cmp r14d, eax
jb 0x180024700
mov dword [rsp + 0x54], r11d
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
test al, 7
mov eax, dword [rsp + 0x50]
je 0x18002475c
mov byte [r11 + r10], r9b
inc r11d
mov dword [rsp + 0x54], r11d
mov r9, qword [rsp + 0x78]
jmp case.default.0x1800243f1
mov dword [rbp + 0x67], 0x726f74
mov dword [rbp + 0x6a], 0x6f433b
mov eax, 0x64
mov word [rbp + 0x6d], ax
jmp case.0x1800243f1.13
mov eax, r11d
mov byte [rax + r10], 3
inc r11d
mov dword [rsp + 0x54], r11d
cmp r14d, 0x80
jae 0x1800247ac
mov byte [r11 + r10], r14b
inc r11d
mov dword [rsp + 0x54], r11d
jmp case.0x1800243f1.13
cmp r14d, 0x100
jae 0x1800247ce
mov byte [r11 + r10], 0x81
inc r11d
mov byte [r11 + r10], r14b
inc r11d
mov dword [rsp + 0x54], r11d
jmp case.0x1800243f1.13
mov eax, dword [rsp + 0x50]
cmp r14d, 0x10000
jae case.default.0x1800243f1
mov byte [r11 + r10], 0x82
inc r11d
mov ecx, r14d
shr ecx, 8
mov byte [r11 + r10], cl
inc r11d
mov byte [r11 + r10], r14b
inc r11d
mov dword [rsp + 0x54], r11d
jmp case.default.0x1800243f1
test rbx, rbx
jne 0x180024847
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.a___NULL
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
mov qword [rsp + 0x20], rsi
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov ecx, 0x80
call fcn.18003a7b0
mov dword [rbp - 0x80], eax
mov edx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x54]
mov r9, qword [rsp + 0x78]
jmp case.0x1800243f1.13
mov dword [rbp + 0x60], 0x446f43
mov dword [rbp + 0x63], 0x63657269
jmp case.0x1800243f1.13
mov dword [r9], eax
mov eax, 6
jmp 0x180024c17
mov edi, dword [rsp + 0x70]
mov r15d, edi
imul esi, edi, 0x41
mov dword [rsp + 0x60], esi
cmp edi, esi
ja case.0x1800243f1.11
mov edx, 0x30
lea eax, [rdx - 0xd]
lea r8d, [rdx + 0x42]
lea r10d, [rdx + 0x4d]
movzx r13d, word [rsp + 0x50]
movzx r12d, byte [rsp + 0x50]
mov r14, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x68]
movzx ebx, byte [rsp + 0x50]
mov ecx, dword [rsp + 0x70]
nop dword [rax]
cmp r15d, 0x5a9
ja 0x1800249a2
je 0x180024993
cmp r15d, 0x1ec
ja 0x180024952
je case.0x1800243f1.11
cmp r15d, 0x45
je 0x18002493a
cmp r15d, 0x52
je 0x18002492b
cmp r15d, 0x19e
jne 0x180024bf9
mov word [rbp + 0x53], dx
mov dword [rbp + 0x54], 0x234023
jmp 0x180024bf9
mov dword [r9], r11d
mov dword [rbp - 0x80], 0
jmp 0x180024bf9
mov dword [rbp + 0x71], 0x6f7463
mov word [rbp + 0x74], r8w
mov dword [rbp + 0x50], 0x232523
jmp 0x180024bf9
cmp r15d, 0x2f7
je 0x180024978
cmp r15d, 0x450
jne 0x180024bf9
mov word [rbp + 0x5d], r10w
mov word [rbp + 0x5e], ax
mov bl, 1
jmp 0x180024bf9
mov r9d, 0x4f
mov word [rbp + 0x57], r9w
mov word [rbp + 0x58], ax
mov dword [rbp + 0x59], 0x236f235c
jmp 0x180024bf9
mov r12b, 1
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x180024bf9
cmp r15d, 0xb0d
ja 0x180024bd8
je 0x180024a61
cmp r15d, 0x702
je 0x180024a56
cmp r15d, 0x85b
je 0x180024a1d
cmp r15d, 0x9b4
jne 0x180024bf9
mov dword [rsp + 0x64], 0x70
movsx eax, r13w
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov qword [rsp + 0x68], rax
jmp 0x180024bc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, qword [rbp - 0x78]
mov qword [rcx + 0x40], rax
jmp 0x180024bc0
mov r13d, 0x100
jmp 0x180024bf9
xor edx, edx
mov ecx, edx
movzx eax, bl
mov rbx, qword [rsp + 0x68]
test rbx, rbx
cmovne ecx, eax
mov byte [rsp + 0x50], cl
mov ecx, edx
movzx eax, r12b
test r14, r14
cmovne ecx, eax
movzx r12d, cl
cmp byte [rsp + 0x50], dl
je 0x180024ac6
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x20]
xor r8d, r8d
lea edx, [r8 + 9]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor edx, edx
test r12b, r12b
je 0x180024bbb
mov esi, 0xe7
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
sub eax, 0xe7
je 0x180024b72
cmp eax, 0x43
jne 0x180024ba3
test r12b, r12b
je 0x180024ba3
mov ebx, 0xc4
cmp ebx, 0xc4
je 0x180024b32
cmp ebx, 0x5ca4
je 0x180024b27
cmp ebx, 0xb884
jne 0x180024b5d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180024b5d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x180024b5d
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], rdx
mov dword [rsp + 0x58], edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x68]
mov edx, 4
mov rcx, rdi
call sub.dbghelp.dll_MiniDumpReadDumpStream
add ebx, 0x5be0
cmp ebx, 0x113a0
mov edx, 0
jbe 0x180024b04
jmp 0x180024ba3
movsx rax, r13w
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x180024ba3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12b, r12b
add esi, 0x43
cmp esi, 0x16d
mov edx, 0
jb 0x180024ae0
mov esi, dword [rsp + 0x60]
movzx ebx, byte [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x70]
mov edx, 0x30
lea r8d, [rdx + 0x42]
lea r10d, [rdx + 0x4d]
jmp 0x180024bf9
cmp r15d, 0xc66
je 0x180024bec
cmp r15d, 0xdbf
je case.0x1800243f1.11
jmp 0x180024bf9
mov rax, qword [rbp - 0x78]
cmp qword [rax + 0x40], 0
setne byte [rbp - 0x80]
lea eax, [r15 + rcx]
lea r15d, [rax + rcx*4]
cmp r15d, esi
mov r9, qword [rsp + 0x78]
mov eax, 0x23
jbe 0x1800248e0
mov eax, dword [rbp - 0x80]
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1800602e0
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800179a0
int3