Function at 0x14007ee50
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14022b0c0]
xor rax, rsp
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x30], xmm1
lea r8d, [rax + 0xb]
lea rdx, str.Application
lea rcx, [rsp + 0x20]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x50], xmm1
mov r8d, 8
lea rdx, str.Security
lea rcx, [rsp + 0x40]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
mov r8d, 5
lea rdx, str.Setup
lea rcx, [rsp + 0x60]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
mov r8d, 6
lea rdx, str.System
lea rcx, [rbp - 0x80]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, 0xf
lea rdx, str.ForwardedEvents
lea rcx, [rbp - 0x60]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8d, 0x11
lea rdx, str.Internet_Explorer
lea rcx, [rbp - 0x40]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
mov r8d, 0x16
lea rdx, str.Key_Management_Service
lea rcx, [rbp - 0x20]
call fcn.140008960
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
mov r8d, 0xc
lea rdx, str.Media_Center
lea rcx, [rbp]
call fcn.140008960
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.1400261b0
nop
lea r9, [fcn.14000ac30]
mov edx, 0x20
lea r8d, [rdx - 0x18]
lea rcx, [rsp + 0x20]
call fcn.140046d88
mov rdi, qword [rbp + 0x40]
mov r15, qword [rbp + 0x48]
cmp rdi, r15
je 0x14007f17a
xor r13d, r13d
movabs r12, 0x7fffffffffffffff
movabs rax, 0x8000000000000000
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov rsi, qword [rdi + 0x10]
mov r14, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14007f044
mov r14, qword [rdi]
cmp rsi, r12
ja 0x14007f1ec
mov qword [rbp + 0x38], 0xf
cmp rsi, 0xf
ja 0x14007f070
mov qword [rbp + 0x30], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
jmp 0x14007f106
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14007f085
mov rbx, r12
add rax, 0x27
jmp 0x14007f0ac
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14007f0ce
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007f1f8
mov rcx, rax
call fcn.1400469b8
mov rcx, rax
test rax, rax
je 0x14007f1fe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14007f0dd
test rcx, rcx
je 0x14007f0da
call fcn.1400469b8
jmp 0x14007f0dd
mov rax, r13
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.1400e0e50
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rbx, rax
test rax, rax
je 0x14007f12a
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14007f165
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f160
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007f1fe
call fcn.1400469b0
add rdi, 0x20
cmp rdi, r15
jne 0x14007f01a
mov r15, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x14007f1bf
mov rdx, r15
mov rcx, rdi
call fcn.140027690
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f1ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007f1f2
call fcn.1400469b0
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140046990
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003850
nop
call fcn.14005a5f0
nop
call fcn.1400037b0
int3
call fcn.14005a5f0
int3