Function at 0x140015140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0xa8
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, r8
mov rbp, r9
mov qword [rsp + 0x30], rbx
mov r15d, edx
mov rsi, rcx
cmp edx, 9
jae 0x140015183
lea rax, str.Sanity_check_failed
mov qword [r8], rax
xor eax, eax
jmp 0x140016452
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
movzx r13d, byte [rcx + 4]
cmp r13d, 1
jne 0x1400151b7
mov dword [r9 + 0xcc], edi
mov r12d, edi
jmp 0x140015251
cmp r13d, 0xf
je 0x1400151c9
mov r12d, dword [r9 + 0xcc]
jmp 0x140015251
movups xmm0, xmmword [rcx + 0x15]
movzx eax, word [rcx + 0x45]
lea rdx, [rsp + 0x40]
movups xmm1, xmmword [rcx + 0x25]
mov word [rsp + 0x70], ax
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x71], dil
movups xmm0, xmmword [rcx + 0x35]
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
call fcn.140003e50
cmp dword [rsp + 0x3c], 1
lea rax, [0x1402cabec]
movzx ecx, byte [rsp + 0x38]
lea rdx, [0x1402cabe8]
cmove rdx, rax
movzx eax, byte [rdx]
sub ecx, eax
jne 0x14001523c
movzx ecx, byte [rsp + 0x39]
movzx eax, byte [rdx + 1]
sub ecx, eax
jne 0x14001523c
movzx ecx, byte [rsp + 0x3a]
movzx eax, byte [rdx + 2]
sub ecx, eax
test ecx, ecx
jns 0x140015248
mov r12d, 0xff
jmp 0x140015251
lea eax, [r15 - 5]
movzx r12d, byte [rax + rsi]
cmp byte [rsp + 0xf0], dil
je 0x1400152c0
mov r8d, r12d
mov edx, r15d
mov rcx, rsi
call fcn.140009150
test al, al
je 0x1400152c0
lea rax, str.Event_crc_check_failed__Most_likely_there_is_event_corruption.
mov qword [rbx], rax
cmp byte [0x14049c9f0], dil
je 0x1400152b9
mov ecx, dword [0x14049c514]
mov edx, 0x78
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400152b1
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.140003b10
mov rdi, rax
mov rax, rdi
jmp 0x14001643a
xor eax, eax
jmp 0x14001643a
movzx eax, byte [rbp + 0xae]
mov qword [rsp + 0x88], r14
lea r14, vtable.Log_event.0
cmp r13d, eax
jbe 0x1400152e5
cmp r13d, 0xf
jne case.0x1400153d9.1
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x1400152f7
movzx r13d, byte [r13 + rcx]
cmp r12d, 0xff
je 0x14001530f
cmp r13d, 0xf
je 0x14001530b
test r12d, r12d
je 0x14001530f
add r15d, 0xfffffffc
test byte [rsi + 0x11], 0x80
je 0x1400153b1
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov ecx, r13d
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Ignorable_log_event.0
mov qword [rbx], rax
movzx eax, byte [rsi + 4]
mov dword [rbx + 0x70], eax
call fcn.14000aa60
mov qword [rbx + 0x78], rax
jmp 0x140016342
lea eax, [r13 - 1]
cmp eax, 0xaa
ja case.0x1400153d9.1
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x164e4]
mov ecx, dword [rdx + rax*4 + 0x1646c]
add rcx, rdx
jmp rcx
mov ecx, dword [0x14049c514]
mov edx, 0x148
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140002c30
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x150
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov dword [rsp + 0x20], 0xa5
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140002c30
mov rcx, qword [rbx + 0x98]
lea rax, vtable.Query_compressed_log_event.0
mov qword [rbx], rax
mov qword [rbx + 0x148], rdi
test rcx, rcx
je 0x140016342
call fcn.140006670
mov ebp, eax
test eax, eax
jne 0x140015498
mov qword [rbx + 0x98], rdi
jmp 0x140016342
lea edx, [rax + 1]
xor ecx, ecx
add rdx, 7
mov r8d, reloc.WS2_32.dll_recv
and rdx, 0xfffffffffffffff8
call fcn.14003b8b0
mov qword [rbx + 0x148], rax
mov r10, rax
test rax, rax
je 0x14001548c
mov r8, qword [rbx + 0x98]
mov r9d, dword [rbx + 0xb0]
movzx edx, byte [r8]
test dl, dl
jns 0x14001548c
mov ecx, edx
mov dword [rsp + 0x38], ebp
and ecx, 7
test dl, 0x70
jne 0x14001548c
mov eax, ecx
lea rdx, [rsp + 0x38]
sub r9d, ecx
inc rax
add r8, rax
dec r9d
mov rcx, r10
call fcn.1400862a0
test eax, eax
jne 0x14001548c
mov ecx, dword [rsp + 0x38]
mov rax, qword [rbx + 0x148]
mov byte [rcx + rax], dil
mov rax, qword [rbx + 0x148]
mov qword [rbx + 0x98], rax
mov dword [rbx + 0xb0], ecx
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Rotate_log_event.0
mov qword [rbx], rax
mov qword [rbx + 0x70], rdi
mov dword [rbx + 0x84], 2
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rax + 3]
lea eax, [rdx + 0x13]
cmp r15d, eax
jb 0x140016342
lea rcx, [rsi + 0x13]
test dl, dl
je 0x1400155dc
mov rax, qword [rcx]
jmp 0x1400155e1
mov eax, 4
mov qword [rbx + 0x78], rax
mov eax, r15d
sub eax, edx
add eax, 0xffffffed
mov dword [rbx + 0x80], eax
cmp eax, 0x1ff
jbe 0x140015609
mov dword [rbx + 0x80], 0x1ff
mov eax, 0x1ff
mov r8d, eax
add rdx, rcx
xor ecx, ecx
mov r9d, reloc.WS2_32.dll_recv
call fcn.14003bc10
mov qword [rbx + 0x70], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Binlog_checkpoint_log_event.0
mov qword [rbx], rax
mov qword [rbx + 0x70], rdi
mov rax, qword [rbp + 0xb0]
movzx ecx, byte [rbp + 0xad]
mov r10d, ecx
movzx r9d, byte [rax + 0xa0]
lea eax, [rcx + r9]
cmp r15d, eax
jb 0x140016342
cmp r9b, 4
jb 0x140016342
add rcx, rsi
mov eax, r15d
sub eax, r10d
sub eax, r9d
mov edx, dword [rcx]
mov dword [rbx + 0x78], edx
cmp eax, edx
jb 0x140016342
mov r8d, edx
lea rdx, [rcx + r9]
jmp 0x14001560f
mov ecx, dword [0x14049c514]
mov edx, 0x240
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400025e0
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Gtid_list_log_event.0
mov qword [rbx], rax
mov dword [rbx + 0x70], edi
mov qword [rbx + 0x78], rdi
mov qword [rbx + 0x80], rdi
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx ecx, byte [rax + 0xa2]
mov r9d, ecx
lea eax, [rdx + rcx]
cmp r15d, eax
jb 0x140016342
cmp cl, 4
jb 0x140016342
mov eax, dword [rsi + rdx]
lea r14, [rsi + rdx]
mov r8d, eax
mov ecx, r15d
and eax, 0xf0000000
and r8d, 0xfffffff
mov dword [rbx + 0x74], eax
sub ecx, edx
mov eax, r8d
mov dword [rbx + 0x70], r8d
shl eax, 4
add r14, 4
sub ecx, r9d
cmp ecx, eax
jb 0x140015896
test r8d, r8d
mov eax, r8d
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
sete dl
shl rax, 4
add rdx, rax
xor ecx, ecx
call fcn.14003b8b0
mov qword [rbx + 0x78], rax
test rax, rax
je 0x140015896
mov r8d, edi
cmp dword [rbx + 0x70], edi
jbe 0x140015896
nop word [rax + rax]
mov eax, dword [r14]
lea r14, [r14 + 0x10]
mov rcx, qword [rbx + 0x78]
mov edx, r8d
inc r8d
add rdx, rdx
mov dword [rcx + rdx*8], eax
mov eax, dword [r14 - 0xc]
mov rcx, qword [rbx + 0x78]
mov dword [rcx + rdx*8 + 4], eax
mov rax, qword [r14 - 8]
mov rcx, qword [rbx + 0x78]
mov qword [rcx + rdx*8 + 8], rax
cmp r8d, dword [rbx + 0x70]
jb 0x140015860
lea r14, vtable.Log_event.0
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140001dc0
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Delete_file_log_event.0
mov qword [rbx], rax
mov dword [rbx + 0x70], edi
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx ecx, byte [rax + 0xa]
add ecx, edx
cmp r15d, ecx
jb 0x140016342
mov ecx, dword [rdx + rsi]
mov dword [rbx + 0x70], ecx
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, reloc.WS2_32.dll_WSASetLastError
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Stop_log_event.0
mov qword [rbx], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Intvar_log_event.0
mov qword [rbx], rax
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx eax, byte [rax + 4]
add rax, rsi
add rdx, rax
movzx eax, byte [rdx]
mov byte [rbx + 0x78], al
mov rax, qword [rdx + 1]
mov qword [rbx + 0x70], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x78
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Xid_log_event.0
mov qword [rbx], rax
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx eax, byte [rax + 0xf]
add rax, rsi
mov rcx, qword [rdx + rax]
mov qword [rbx + 0x70], rcx
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x228
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.XA_prepare_log_event.0
mov qword [rbx], rax
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx eax, byte [rax + 0x25]
add rax, rsi
add rdx, rax
movzx eax, byte [rdx]
mov byte [rbx + 0x220], al
mov eax, dword [rdx + 1]
mov dword [rbx + 0x70], eax
mov ecx, dword [rdx + 5]
mov dword [rbx + 0x74], ecx
lea eax, [rcx - 1]
cmp eax, 0x3f
ja 0x140015c3a
mov eax, dword [rdx + 9]
mov dword [rbx + 0x78], eax
cmp eax, 0x40
ja 0x140015c3a
add eax, ecx
add rdx, 0xd
movsxd r8, eax
lea rcx, [rbx + 0x7c]
call fcn.140092830
mov qword [rbx + 0x218], rdi
jmp 0x140016342
mov dword [rbx + 0x70], 0xffffffff
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Rand_log_event.0
mov qword [rbx], rax
mov rax, qword [rbp + 0xb0]
movzx edx, byte [rbp + 0xad]
movzx eax, byte [rax + 0xc]
add rax, rsi
add rdx, rax
mov rax, qword [rdx]
mov qword [rbx + 0x70], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 0x78], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0xb8
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140003b80
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, pe_nt_image_headers64
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140002350
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Write_rows_log_event.0
mov qword [rbx], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Update_rows_log_event.0
mov qword [rbx], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Delete_rows_log_event.0
mov qword [rbx], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Write_rows_compressed_log_event.0
mov rcx, rbx
mov qword [rbx], rax
call fcn.140017ab0
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Update_rows_compressed_log_event.0
mov rcx, rbx
mov qword [rbx], rax
call fcn.140017ab0
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x130
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1400033a0
lea rax, vtable.Delete_rows_compressed_log_event.0
mov rcx, rbx
mov qword [rbx], rax
call fcn.140017ab0
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x80
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov ecx, r13d
call fcn.14000aa60
mov r9, rax
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.1400027b0
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0xf0
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140003750
mov rbx, rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140001dc0
lea rax, vtable.Begin_load_query_log_event.0
mov qword [rbx], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x158
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov r9, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_select
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.140002c30
lea rax, vtable.Execute_load_query_log_event.0
mov qword [rbx + 0x148], rdi
mov qword [rbx], rax
mov dword [rbx + 0x150], edi
cmp qword [rbx + 0x98], rdi
je 0x140016342
movzx ecx, byte [rbp + 0xad]
mov r8d, dword [rbx + 0xb0]
add rcx, rsi
mov eax, dword [rcx + 0x11]
mov dword [rbx + 0x14c], eax
mov edx, dword [rcx + 0x15]
mov dword [rbx + 0x150], edx
movzx r9d, byte [rcx + 0x19]
mov dword [rbx + 0x154], r9d
cmp eax, r8d
ja 0x140016342
cmp edx, r8d
ja 0x140016342
cmp r9d, 2
ja 0x140016342
mov eax, dword [rcx + 0xd]
mov dword [rbx + 0x148], eax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Incident_log_event.0
mov qword [rbx], rax
mov rax, qword [rbp + 0xb0]
movzx ecx, byte [rbp + 0xad]
mov r8d, ecx
movzx edx, byte [rax + 0x19]
mov qword [rbx + 0x78], rdi
mov qword [rbx + 0x80], rdi
movzx ecx, word [rsi + rcx]
lea eax, [rcx - 1]
test eax, eax
jne 0x1400161d0
mov dword [rbx + 0x70], ecx
add rdx, rsi
add rdx, r8
mov ecx, r15d
add rcx, rsi
movzx r14d, byte [rdx]
lea rax, [r14 + rdx]
cmp rax, rcx
jae 0x1400161c1
mov ecx, dword [0x14049c514]
lea rbp, [rdx + 1]
lea rdx, [r14 + 1]
mov r8d, reloc.WS2_32.dll_recv
call fcn.14003b8b0
mov qword [rbx + 0x78], rax
test rax, rax
je 0x1400161c1
mov r8d, r14d
mov rdx, rbp
mov rcx, rax
call fcn.140028d30
mov qword [rbx + 0x80], r14
lea r14, vtable.Log_event.0
jmp 0x140016342
mov dword [rbx + 0x70], edi
lea r14, vtable.Log_event.0
jmp 0x140016342
mov dword [rbx + 0x70], edi
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x90
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov ecx, r15d
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Annotate_rows_log_event.0
mov qword [rbx], rax
mov qword [rbx + 0x80], rdi
mov dword [rbx + 0x88], edi
mov word [rbx + 0x8c], di
movzx eax, byte [rbp + 0xad]
sub ecx, eax
mov dword [rbx + 0x78], ecx
movzx eax, byte [rbp + 0xad]
add rax, rsi
mov qword [rbx + 0x70], rax
jmp 0x140016342
mov ecx, dword [0x14049c514]
mov edx, 0x88
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14001633f
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Start_encryption_log_event.0
mov qword [rbx], rax
cmp r15d, 0x24
jne 0x140016336
movzx eax, byte [rsi + 0x13]
mov dword [rbx + 0x70], eax
mov eax, dword [rsi + 0x14]
mov dword [rbx + 0x74], eax
movsd xmm0, qword [rsi + 0x18]
movsd qword [rbx + 0x78], xmm0
mov eax, dword [rsi + 0x20]
mov dword [rbx + 0x80], eax
jmp 0x140016342
mov dword [rbx + 0x70], 0xffffffff
jmp 0x140016342
mov rbx, rdi
test rbx, rbx
je 0x14001638c
mov dword [rbx + 0x40], r12d
test r12d, r12d
je 0x140016362
cmp r12d, 0xff
je 0x140016362
mov eax, r15d
mov ecx, dword [rax + rsi]
mov dword [rbx + 0x44], ecx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x14001637e
cmp r13d, 7
jne 0x14001642f
test rbx, rbx
je 0x14001638c
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x30]
cmp byte [0x14049c9f0], dil
jne 0x1400163ab
lea rax, str.Found_invalid_event_in_binary_log
mov qword [rbx], rax
xor eax, eax
jmp 0x140016432
mov ecx, dword [0x14049c514]
mov edx, 0x78
mov r8d, 0x18
call fcn.14003b8b0
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x14001642c
mov qword [rax], r14
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x38], edi
lea rax, [0x1402d4560]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x68], edi
mov word [rbx + 0x6c], di
mov eax, dword [rsi]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x1c], 0xffffffff
mov eax, dword [rsi + 5]
mov dword [rbx + 0x30], eax
mov eax, dword [rsi + 9]
mov qword [rbx + 0x28], rax
mov eax, dword [rsi + 0xd]
mov qword [rbx + 8], rax
movzx eax, word [rsi + 0x11]
mov word [rbx + 0x34], ax
lea rax, vtable.Unknown_log_event.0
mov qword [rbx], rax
mov dword [rbx + 0x70], edi
jmp 0x14001642f
mov rbx, rdi
mov rax, rbx
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008e500
add rsp, 0xa8
pop r15
pop rsi
pop rbp
pop rbx
ret