Function at 0x14013afd0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, [0x14048d6c2]
call fcn.140289ea0
mov cl, 0x6c
mov word [rbp - 0x40], WSAGetLastError
movsx edx, cl
xorps xmm0, xmm0
movzx eax, dx
mov word [rbp - 0x38], dx
xor ax, 0x2d
movzx ecx, dx
mov word [rbp - 0x3e], ax
xor cx, 5
movzx eax, dx
mov word [rbp - 0x36], cx
xor ax, 0x1c
mov word [rbp - 0x2e], cx
mov word [rbp - 0x3c], ax
mov rbx, 0xffffffffffffffff
mov word [rbp - 0x3a], ax
mov r8, rbx
movzx eax, dx
xor ax, 0xf
mov word [rbp - 0x34], ax
movzx eax, dx
xor ax, 0xd
mov word [rbp - 0x32], ax
movzx eax, dx
xor ax, 0x18
mov word [rbp - 0x30], ax
movzx eax, dx
xor ax, 3
xor dx, 2
xor esi, esi
mov word [rbp - 0x2c], ax
mov word [rbp - 0x28], si
lea rax, [rbp - 0x3e]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov word [rbp - 0x2a], dx
movups xmmword [rbp - 0x20], xmm0
inc r8
cmp word [rax + r8*2], si
jne 0x14013b082
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d1870
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14013b0cb
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d1160
mov cl, 4
mov word [rbp - 0x40], 4
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x32], si
xor ax, 0x57
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
mov r8, rbx
movzx eax, cx
mov qword [rbp - 8], rsi
xor ax, 0x7d
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 0x77
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 0x70
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 0x61
xor cx, 0x69
mov word [rbp - 0x36], ax
mov word [rbp - 0x34], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14013b140
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d1870
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14013b189
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d1160
mov cl, 0x78
mov word [rbp - 0x40], 0x78
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x2e], si
xor ax, 0x2b
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
movzx eax, cx
xor ax, 0x1d
mov qword [rbp - 8], rsi
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 0x1b
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 0xd
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 0xa
mov word [rbp - 0x36], ax
movzx eax, cx
xor ax, 0x11
mov word [rbp - 0x34], ax
movzx eax, cx
xor ax, 0xc
xor cx, 1
mov word [rbp - 0x32], ax
mov word [rbp - 0x30], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x14013b210
mov r8, rbx
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d1870
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x14013b25b
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d1160
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret