Function at 0x1400606fc
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rdx
mov byte [rbp + 0x40], 0
xor r15d, r15d
lea rax, vtable.HModule.0
mov qword [rbp - 0x18], rax
and qword [rbp - 0x10], r15
and qword [rbp - 0x20], r15
mov ecx, 0x208
call fcn.1400312e8
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x140060b8b
lea r13, str.System
mov rdx, r13
mov rcx, r13
call fcn.140005abc
test eax, eax
jne 0x140060b41
lea r8, [rbp - 0x20]
call fcn.1400ea8c4
mov edi, eax
test eax, eax
js 0x140060c30
lea rax, str.SystemEvents.txt
mov qword [rsp + 0x28], rax
lea rax, [0x140127c20]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140128340]
mov edx, 0x104
mov rcx, qword [rbp - 0x28]
call fcn.14006244c
mov edi, eax
test eax, eax
jns 0x1400607e5
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x1400607d9
test byte [rcx + 0x1c], 1
je 0x1400607d9
lea edx, [r15 + 0x30]
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_StringCchPrintfW___failed___lx__n
jmp 0x140060c28
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r15, rax
test rax, rax
jne 0x14006083b
call fcn.1400f259c
mov edi, eax
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x14006082f
test byte [rcx + 0x1c], 1
je 0x14006082f
lea edx, [r15 + 0x32]
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_OpenEventLog_System__failed___lx__n
jmp 0x140060c28
lea r8, [rbp - 0x10]
mov rbx, qword [rbp - 0x20]
mov rdx, rbx
call fcn.140060ed4
mov edi, eax
test eax, eax
jns 0x140060895
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060882
test byte [rcx + 0x1c], 1
je 0x140060882
mov edx, 0x33
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_GetMesgFileHandle___failed___lx__n
mov edx, edi
call fcn.1400ec5f0
jmp 0x140060bca
xor r8d, r8d
mov rdx, qword [rbp - 0x28]
call fcn.1400ec718
mov edi, eax
test eax, eax
js 0x140060b00
mov byte [rbp + 0x40], 1
and dword [rbp - 0x30], 0
and dword [rbp + 0x58], 0
and dword [rbp + 0x50], 0
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
test eax, eax
jne 0x140060910
call fcn.1400f259c
mov edi, eax
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060904
test byte [rcx + 0x1c], 1
je 0x140060904
mov edx, 0x35
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_GetOldestEventLogRecord___failed___lx__n
jmp 0x140060889
lea rdx, [rbp + 0x58]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
test eax, eax
jne 0x140060965
call fcn.1400f259c
mov edi, eax
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060959
test byte [rcx + 0x1c], 1
je 0x140060959
mov edx, 0x36
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_GetNumberOfEventLogRecords___failed___lx__n
jmp 0x140060889
mov edi, dword [rbp + 0x58]
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, edi
lea rcx, str.MpSupport_EventLogNumRecsToRead
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
mov edi, eax
test eax, eax
jns 0x1400609ca
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x1400609be
test byte [rcx + 0x1c], 1
je 0x1400609be
mov edx, 0x37
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_MpConfigGetMiscDwordValue_MpSupport_EventLogRecordNum__failed___lx__n
jmp 0x140060889
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060a0d
test byte [rcx + 0x1c], 4
je 0x140060a0d
mov edx, 0x38
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0x50]
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140062640
mov rcx, qword [0x140162280]
mov eax, dword [rbp + 0x58]
test eax, eax
jne 0x140060a1b
xor edi, edi
jmp 0x140060bca
lea r14d, [rax - 1]
mov edx, dword [rbp - 0x30]
add r14d, edx
cmp r14d, edx
jb 0x140060acf
xor edi, edi
cmp r14d, edx
jb 0x140060bca
mov r9, qword [rbp - 0x10]
mov r8d, r14d
mov rdx, rbx
mov rcx, r15
call fcn.140061248
mov edi, eax
test eax, eax
jns 0x140060ab5
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060a92
test byte [rcx + 0x1c], 1
je 0x140060a92
mov edx, 0x3a
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rbx
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.1400624e0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
mov r9, rbx
mov r8, qword [rbp - 0x28]
mov rdx, r13
lea rcx, str.ERROR:_ReadAndProcessEventLogRecord__ls___ls___ls___ld__failed__lx_n
call fcn.1400ec5f0
xor edi, edi
jmp 0x140060ac3
test edi, edi
jne 0x140060ac3
add dword [rbp + 0x50], 0xffffffff
je 0x140060bca
dec r14d
cmp r14d, dword [rbp - 0x30]
jmp 0x140060a33
mov edi, 0x80070216
cmp rcx, rsi
je 0x140060af4
test byte [rcx + 0x1c], 1
je 0x140060af4
mov edx, 0x39
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.Event_log_record_number_overflow_n
jmp 0x140060bc5
mov byte [rbp + 0x40], 0
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060b35
test byte [rcx + 0x1c], 1
je 0x140060b35
mov edx, 0x34
mov r9d, edi
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_Failed_to_open_log_file___lx__n
jmp 0x140060889
mov edi, 0x80070032
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060b77
test byte [rcx + 0x1c], 1
je 0x140060b77
mov edx, 0x31
mov r9, r13
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044708
mov rdx, r13
lea rcx, str.ERROR:_Unsupported_event_log_name_in_EventLogToFile__ls__n
call fcn.1400ec5f0
jmp 0x140060c30
mov edi, 0x80070057
lea rsi, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060bbe
test byte [rcx + 0x1c], 1
je 0x140060bbe
mov edx, 0x2f
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.ERROR:_NULL_parameter_in_EventLogToFile_...__n
call fcn.1400ec5f0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140060bde
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbp - 0x10], 0
test r15, r15
je 0x140060c30
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
test eax, eax
jne 0x140060c30
call fcn.1400f259c
mov edi, eax
mov rcx, qword [0x140162280]
cmp rcx, rsi
je 0x140060c21
test byte [rcx + 0x1c], 1
je 0x140060c21
mov edx, 0x3b
mov r9d, eax
lea r8, [0x14012b4d0]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CloseEventLog___failed___lx__n
mov edx, edi
call fcn.1400ec5f0
nop
xor ecx, ecx
xchg qword [rbp - 0x28], rcx
test rcx, rcx
je 0x140060c41
call fcn.140030c60
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140060c51
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140060c61
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
cmp byte [rbp + 0x40], 0
je 0x140060c90
mov rbx, qword [0x14016b530]
and qword [0x14016b530], 0
test rbx, rbx
je 0x140060c90
mov rcx, rbx
call fcn.1400ebb64
mov edx, 0x48
mov rcx, rbx
call fcn.140030c60
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret