Function at 0x1401717ec
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Empty recycle bin quietly
Empty the recycle bin

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor esi, esi
lea rdx, str.Application
mov qword [rbp + 0x50], rdx
lea rax, str.Security
mov qword [rbp + 0x58], rax
lea rax, str.System
mov qword [rbp + 0x60], rax
lea rdi, [rbp + 0x50]
lea r13d, [rsi + 0xf]
mov r14d, 0x1000
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
test eax, eax
je 0x140171923
mov r8d, 0x18
lea rdx, str.___Cleared__event_log
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rbp - 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov r8d, 2
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.14017446c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x1401719d6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x1401719d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017227c
jmp 0x1401719d1
mov r8d, 0x1c
lea rdx, str.Failed_to_clear__event_log
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x60]
mov r8d, 3
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.14017446c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x1401719d6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x1401719d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140172288
call fcn.140cd8948
add rdi, 8
lea rax, [rbp + 0x68]
cmp rdi, rax
je 0x1401719eb
mov rdx, qword [rdi]
jmp 0x14017183d
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.___Emptied_Recycle_Bin
lea rcx, [rbp - 0x50]
call fcn.140159cd4
nop
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14016b958
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x140171a69
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x140171a64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017228e
call fcn.140cd8948
lea rcx, str.net_stop_FontCache__net_start_FontCache
call fcn.140cf72fc
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, reloc.WS2_32.dll_shutdown
lea rdx, str.___Font_cache_cleared
lea rcx, [rsp + 0x30]
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
lea r9, [rbp - 0x60]
mov r8d, 2
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.140162f7c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140171b41
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171b3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140172294
call fcn.140cd8948
lea rcx, str.LOCALAPPDATA
call fcn.140cf5f10
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
or rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], sil
jne 0x140171b63
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140159cd4
nop
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.IconCache.db
lea rcx, [rbp - 0x30]
call fcn.140155eac
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x140171bee
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171be9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017229a
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], sil
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], r13
cmova rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
test eax, eax
je 0x140171cee
mov r8d, reloc.WS2_32.dll_shutdown
lea rdx, str.___Icon_cache_cleared
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
lea r9, [rbp - 0x60]
mov r8d, 2
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.140162f7c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140171d9c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171d97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140172282
jmp 0x140171d97
mov r8d, 0x1a
lea rdx, str.Failed_to_clear_icon_cache
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
lea r9, [rbp - 0x60]
mov r8d, 3
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.140162f7c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140171d9c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171d97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722a0
call fcn.140cd8948
lea rcx, str.LOCALAPPDATA
call fcn.140cf5f10
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8, rdi
inc r8
cmp byte [rax + r8], sil
jne 0x140171dba
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140159cd4
nop
mov r8, r13
lea rdx, str.NVIDIADXCache
lea rcx, [rbp - 0x50]
call fcn.140155eac
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x140171e42
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x140171e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722a6
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_accept]
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x30], 0x2a
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x10]
call fcn.14016fc10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140171eb7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171eb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722c4
call fcn.140cd8948
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, 0x20
lea rdx, str.___DirectX_Shader_cache_cleared
lea rcx, [rsp + 0x30]
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
lea r9, [rbp - 0x60]
mov r8d, 2
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.140162f7c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140171f83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140171f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722ac
call fcn.140cd8948
lea rcx, str.LOCALAPPDATA
call fcn.140cf5f10
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
inc rdi
cmp byte [rax + rdi], sil
jne 0x140171f9e
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140159cd4
nop
mov edi, 0x1b
mov r8d, edi
lea rdx, str.MicrosoftWindowsExplorer
lea rcx, [rbp - 0x80]
call fcn.140155eac
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r13
mov byte [rax], sil
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jbe 0x14017202e
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r14
jb 0x140172029
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722b2
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ntohs]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.thumbcache_.db]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140fc7be8]
mov dword [rsp + 0x38], eax
movzx eax, word [0x140fc7bec]
mov word [rsp + 0x3c], ax
mov al, byte [0x140fc7bee]
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], sil
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x10]
call fcn.14016fc10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x1401720cf
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x1401720ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722b8
call fcn.140cd8948
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8, rdi
lea rdx, str.___Thumbnail_cache_cleared
lea rcx, [rsp + 0x30]
call fcn.140159cd4
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x70], xmm0
lea r9, [rbp - 0x60]
mov r8d, 2
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.140162f7c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140172199
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140172193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722be
call fcn.140cd8948
nop
mov rdx, qword [rbp + 8]
cmp rdx, r13
jbe 0x1401721cf
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, r14
jb 0x1401721ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722c4
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], sil
mov rdx, qword [rbp + 0x28]
cmp rdx, r13
jbe 0x14017221e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, r14
jb 0x140172211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401722ca
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], sil
mov rdx, qword [rbp + 0x48]
cmp rdx, r13
jbe 0x140172259
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140172254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140172276
call fcn.140cd8948
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3