Function at 0x4026a0
Capabilities:
Access the windows event log

Disassembly:
mov word [rsp + 0x20], r9w
mov word [rsp + 0x18], r8w
mov rax, rsp
sub rsp, 0x128
mov qword [rax - 0x18], rsi
lea r8, [0x0045e5f0]
mov qword [rax - 0x38], r14
mov rsi, rcx
call fcn.0040ebd0
test rax, rax
mov r14, rax
mov qword [rsp + 0xb8], rax
je 0x402ca1
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], r12
xor r12d, r12d
lea rax, [0x0045e618]
lea rcx, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0xf8], r13
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x88], r12d
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0x78], rax
call qword [0x0045e620]
lea rax, [0x0045e648]
lea rcx, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x58], rax
call qword [0x0045e650]
lea rax, [0x0045e628]
lea rcx, [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0xa8], r12d
mov dword [rsp + 0xb0], r12d
call qword [0x0045e630]
mov r15, qword [rsp + 0x158]
test r15, r15
je 0x402a87
lea rax, [0x0045e638]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xd0], r12d
mov dword [rsp + 0xd8], r12d
mov qword [rsp + 0xc0], rax
call qword [0x0045e640]
mov r11, qword [rsi]
mov rdx, r15
mov rcx, rsi
call qword [r11 + 0x558]
mov ebp, r12d
test eax, eax
mov r13d, eax
jle 0x402a4c
nop
nop
mov r9, qword [rsi]
mov r8d, ebp
mov rdx, r15
mov rcx, rsi
call qword [r9 + 0x568]
mov r9, qword [rsi]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
mov r12, rax
call qword [r9 + 0x528]
movsxd rbx, dword [rsp + 0xd0]
mov r8, qword [rsp + 0xc0]
mov edi, dword [rsp + 0x88]
lea edx, [rbx + 1]
lea rcx, [rsp + 0xc0]
mov r14, rax
call qword [r8 + 8]
cmp ebx, ebx
jge 0x402886
mov rcx, qword [rsp + 0xc8]
mov eax, ebx
lea rdx, [rcx + rbx*4]
sub eax, ebx
movsxd r8, eax
lea rcx, [rdx + 4]
shl r8, 2
call fcn.00446c20
mov rax, qword [rsp + 0xc8]
mov rdx, r12
mov rcx, rsi
mov dword [rax + rbx*4], edi
mov rax, qword [rsi]
call qword [rax + 0x520]
movsxd rbx, dword [rsp + 0x88]
mov r8, qword [rsp + 0x78]
movsxd rdi, eax
lea rcx, [rsp + 0x78]
lea edx, [rbx + rdi]
call qword [r8 + 8]
cmp ebx, ebx
jge 0x4028e3
mov ecx, ebx
lea rax, [rbx + rdi]
sub ecx, ebx
movsxd r8, ecx
mov rcx, qword [rsp + 0x80]
lea rdx, [rcx + rbx*2]
lea rcx, [rcx + rax*2]
add r8, r8
call fcn.00446c20
mov rax, qword [rsp + 0x80]
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rbx*2]
add r8, r8
call fcn.00446c20
movsxd rbx, dword [rsp + 0x88]
mov rax, qword [rsp + 0x78]
lea edx, [rbx + 1]
lea rcx, [rsp + 0x78]
call qword [rax + 8]
cmp ebx, ebx
jge 0x402938
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rbx*2]
mov eax, ebx
sub eax, ebx
lea rcx, [rdx + 2]
movsxd r8, eax
add r8, r8
call fcn.00446c20
mov rax, qword [rsp + 0x80]
mov r8, r14
mov rdx, r12
mov word [rax + rbx*2], 0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x530]
mov r11, qword [rsi]
mov rdx, r12
mov rcx, rsi
call qword [r11 + 0xb8]
inc ebp
cmp ebp, r13d
jl 0x402810
test r13d, r13d
jle 0x402a41
xor edi, edi
mov rbp, r13
mov rax, qword [rsp + 0x78]
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x78]
call qword [rax + 8]
mov rax, qword [rsp + 0x80]
mov r11, qword [rsp + 0xc8]
movsxd rcx, dword [r11 + rdi]
movsxd rbx, dword [rsp + 0x68]
lea r12, [rax + rcx*2]
mov rax, qword [rsp + 0x58]
lea edx, [rbx + 1]
lea rcx, [rsp + 0x58]
call qword [rax + 8]
cmp ebx, ebx
jge 0x4029e3
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rbx*8]
mov eax, ebx
sub eax, ebx
lea rcx, [rdx + 8]
movsxd r8, eax
shl r8, 3
call fcn.00446c20
mov rax, qword [rsp + 0x60]
add rdi, 4
dec rbp
mov qword [rax + rbx*8], r12
jne 0x402981
movsxd rbx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
lea edx, [rbx + 1]
call qword [rax + 8]
cmp ebx, ebx
jge 0x402a2b
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rbx*8]
mov eax, ebx
sub eax, ebx
lea rcx, [rdx + 8]
movsxd r8, eax
shl r8, 3
call fcn.00446c20
mov rax, qword [rsp + 0x60]
mov r14, qword [rsp + 0xb8]
xor r12d, r12d
mov qword [rax + rbx*8], r12
jmp 0x402a4c
mov r14, qword [rsp + 0xb8]
xor r12d, r12d
mov rcx, qword [rsp + 0xc8]
lea rax, [0x0045e638]
mov dword [rsp + 0xd0], r12d
test rcx, rcx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xd8], r12d
je 0x402a8f
call fcn.00446bf0
jmp 0x402a8f
mov r13d, dword [rsp + 0xb8]
mov rdi, qword [rsp + 0x160]
mov r15, qword [rsp + 0xe8]
test rdi, rdi
je 0x402b4b
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x558]
mov r9, qword [rsi]
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
movsxd rbp, eax
mov byte [rsp + 0x50], 1
call qword [r9 + 0x5c0]
movsxd rbx, dword [rsp + 0xa8]
mov r8, qword [rsp + 0x98]
lea rcx, [rsp + 0x98]
lea edx, [rbx + rbp]
mov r12, rax
call qword [r8 + 8]
cmp ebx, ebx
jge 0x402b19
mov rax, qword [rsp + 0xa0]
mov ecx, ebx
sub ecx, ebx
lea rdx, [rbx + rax]
movsxd r8, ecx
lea rcx, [rbx + rbp]
add rcx, rax
call fcn.00446c20
mov rcx, rbx
mov r8, rbp
mov rdx, r12
add rcx, qword [rsp + 0xa0]
call fcn.00446c20
mov r11, qword [rsi]
mov r9d, 2
mov r8, r12
mov rdx, rdi
mov rcx, rsi
call qword [r11 + 0x600]
xor r12d, r12d
mov rax, qword [rsp + 0x98]
mov edx, dword [rsp + 0xa8]
lea rcx, [rsp + 0x98]
call qword [rax + 8]
mov rax, qword [rsp + 0x58]
mov edx, dword [rsp + 0x68]
mov rbx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x58]
call qword [rax + 8]
mov rax, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x150]
movzx r8d, word [rsp + 0x148]
movzx edx, word [rsp + 0x140]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov rcx, r14
mov dword [rsp + 0x30], eax
mov word [rsp + 0x28], r13w
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xf8]
test rcx, rcx
mov rdi, qword [rsp + 0x108]
mov rbp, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x120]
lea r11, [0x0045e628]
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x98], r11
mov dword [rsp + 0xa8], r12d
mov dword [rsp + 0xb0], r12d
je 0x402c1e
call fcn.00446bf0
mov rcx, qword [rsp + 0x60]
lea rax, [0x0045e600]
mov dword [rsp + 0x68], r12d
test rcx, rcx
mov qword [rsp + 0x98], rax
lea rax, [0x0045e648]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x58], rax
je 0x402c57
call fcn.00446bf0
mov rcx, qword [rsp + 0x80]
lea rax, [0x0045e610]
mov dword [rsp + 0x88], r12d
test rcx, rcx
mov qword [rsp + 0x58], rax
lea rax, [0x0045e618]
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x90], r12d
mov r12, qword [rsp + 0x100]
mov qword [rsp + 0x78], rax
je 0x402ca1
call fcn.00446bf0
mov r14, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x110]
add rsp, 0x128
ret