Function at 0x14002f6e4
Capabilities:
Access the windows event log

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140109388]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [rsp + 0xe0]
mov rdi, r9
mov rbp, qword [rsp + 0xe8]
mov r13d, r8d
movzx r12d, dx
mov r15, rcx
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x14002f777
test byte [r10 + 0x1c], 1
je 0x14002f777
cmp byte [r10 + 0x19], 5
jb 0x14002f777
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r9
mov r9, rcx
mov rcx, qword [r10 + 0x10]
movzx eax, dx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.14002f154
mov r10, qword [0x140106190]
lea rax, [0x140106190]
xor ebx, ebx
test r15, r15
jne 0x14002f7c0
lea rsi, [0x1400dd920]
cmp r10, rax
je 0x14002f7af
mov dil, 2
test byte [r10 + 0x1c], dil
je 0x14002f7af
cmp byte [r10 + 0x19], dil
jb 0x14002f7af
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x14]
mov r8, rsi
call fcn.140003538
mov r10, qword [0x140106190]
mov ebx, 0x80004003
lea r15, [0x140106190]
jmp 0x14002f93f
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbp
lea rsi, [0x1400dd920]
mov dil, 2
cmp r10, rax
je 0x14002f7fc
test byte [r10 + 0x1c], dil
je 0x14002f7fc
cmp byte [r10 + 0x19], 4
jb 0x14002f7fc
mov rcx, qword [r10 + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayUnlock
mov r8, rsi
call fcn.140003538
movzx ecx, bx
movzx eax, cx
movzx edx, cx
mov r8, qword [rsp + rax*8 + 0x50]
test r8, r8
je 0x14002f818
inc cx
cmp cx, 3
jb 0x14002f7ff
lea r14d, [rdx + 1]
test r8, r8
cmove r14w, dx
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
test rax, rax
je 0x14002f8ee
mov rcx, qword [0x140106190]
lea r15, [0x140106190]
cmp rcx, r15
je 0x14002f86b
test byte [rcx + 0x1c], dil
je 0x14002f86b
cmp byte [rcx + 0x19], 4
jb 0x14002f86b
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayAccessData
mov r8, rsi
call fcn.140003538
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov r9d, r13d
mov word [rsp + 0x28], r14w
movzx edx, r12w
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x14002f8e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, r15
je 0x14002f8e3
test byte [rcx + 0x1c], dil
je 0x14002f8e3
cmp byte [rcx + 0x19], dil
jb 0x14002f8e3
mov rcx, qword [rcx + 0x10]
mov edx, DispGetParam
mov r9d, eax
mov r8, rsi
call fcn.1400035ec
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x14002f938
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov r10, qword [0x140106190]
lea r15, [0x140106190]
cmp r10, r15
je 0x14002f973
test byte [r10 + 0x1c], dil
je 0x14002f93f
cmp byte [r10 + 0x19], dil
jb 0x14002f93f
mov rcx, qword [r10 + 0x10]
mov edx, DispGetParam
mov r9d, eax
mov r8, rsi
call fcn.1400035ec
mov r10, qword [0x140106190]
cmp r10, r15
je 0x14002f973
test byte [r10 + 0x1c], 1
je 0x14002f973
movzx ecx, byte [r10 + 0x19]
mov edx, ebx
sar edx, 0x1f
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x14002f973
mov rcx, qword [r10 + 0x10]
mov edx, DispGetParam
mov r9d, ebx
mov r8, rsi
call fcn.1400035ec
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400cc8d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret