Function at 0x14001dbf0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, r8
mov rdi, rdx
xor r14d, r14d
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r14w
call fcn.14000cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbx + 0x10]
lea rax, [rbp + 0x60]
cmp rax, rdx
je 0x14001dc72
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001dc69
mov rdx, qword [rdx]
lea rcx, [rbp + 0x60]
call fcn.14000d1d0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x14008ee90]
lea rcx, [rbp - 0x28]
call fcn.140008b00
mov rbx, rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov r8d, recv
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x68]
call fcn.14000d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.14000e840
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rax, rdx
cmp rcx, rax
jbe 0x14001dd1f
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x14001dd1f
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.14000e840
jmp 0x14001dd2c
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14000e950
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14001dd95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dd90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e323
call fcn.140038b74
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14001dde9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dde4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e329
call fcn.140038b74
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001de3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001de35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e32f
call fcn.140038b74
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
lea rdx, [0x14008ee50]
lea rcx, [rbp - 8]
call fcn.140008b00
mov rbx, rax
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov r8d, recv
lea rdx, str._SpoolerApplet
lea rcx, [rbp - 0x48]
call fcn.14000d1d0
nop
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.14000e840
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
sub rax, rdx
cmp rcx, rax
jbe 0x14001deea
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, rdx
jb 0x14001deea
lea r8, [rsp + 0x78]
mov rcx, rbx
call fcn.14000e840
jmp 0x14001def7
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14000e950
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov word [rax], r14w
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r14
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x14001df5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001df5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e335
call fcn.140038b74
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r14w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001dfb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dfac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e33b
call fcn.140038b74
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x14001e002
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e341
call fcn.140038b74
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov edx, 4
call fcn.140045db8
test eax, eax
jne 0x14001e05d
lea rax, [rbp + 0x20]
cmp rdi, rax
je 0x14001e052
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rdi
call fcn.14000d1d0
xor al, al
mov byte [rsi], al
mov bl, 1
jmp 0x14001e215
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rcx, qword [rbp + 0x40]
mov edx, 4
call fcn.140045db8
test eax, eax
jne 0x14001e0a8
lea rax, [rbp + 0x40]
cmp rdi, rax
je 0x14001e09c
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov rcx, rdi
call fcn.14000d1d0
mov al, 1
mov byte [rsi], al
movzx ebx, al
jmp 0x14001e215
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
lea rsi, [rdx + rax*2]
lea rdi, [rbp + 0x20]
cmovae rdi, qword [rbp + 0x20]
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r8
mov byte [rsp + 0x58], cl
mov rdx, rsi
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x14001e104
lea rcx, [rsp + 0x58]
call fcn.1400091a0
mov rcx, r14
mov qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rbp + 0x18], rax
cmp rdi, rsi
je 0x14001e16b
movzx ebx, byte [rsp + 0x50]
movzx r9d, byte [rdi]
cmp rcx, r8
jae 0x14001e143
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001e156
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140007af0
add rdi, 2
mov r8, qword [rsp + 0x70]
cmp rdi, rsi
je 0x14001e16b
mov rcx, qword [rsp + 0x68]
jmp 0x14001e117
lea rdx, [rsp + 0x58]
cmp r8, 0x10
cmovae rdx, qword [rsp + 0x58]
lea rcx, str.EventManager_error:_Spooler_Applet_file_wasnt_found__or_no_read_access_at:__s_n
call fcn.140003170
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14001e1c3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e1be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e347
call fcn.140038b74
lea rdx, str.IntelDalJhi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14001e213
xor r8d, r8d
lea edx, [r8 + 1]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
mov r9d, 0xc0000003
mov rcx, rax
call qword [sym.imp.ADVAPI32.DLL_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_DeregisterEventSource]
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x14001e255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e34d
call fcn.140038b74
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14001e2a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e2a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e353
call fcn.140038b74
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r14w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14001e2f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e2ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e31d
call fcn.140038b74
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140038b50
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
int3
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
int3