Function at 0x100005170
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r15d, edx
xor ebx, ebx
mov qword [rax - 0x48], rbx
mov rsi, rbx
mov qword [rax - 0x50], rbx
mov dword [rax - 0x60], ebx
mov r13d, 0x10000
mov dword [rax - 0x64], ebx
mov edi, ebx
mov r12d, ebx
lea rdx, [0x100001ae0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r14, rax
mov qword [rsp + 0x70], rax
cmp rax, rbx
jne 0x100005200
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x50], eax
lea edx, [rbx + 1]
lea r8d, [rbx + 5]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov r9d, 0xc0020129
mov rcx, qword [0x100008700]
call fcn.100003ddc
jmp 0x100005385
mov rcx, r13
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp rax, rbx
jne 0x100005258
mov edx, 1
lea r8d, [rdx + 4]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], bx
mov qword [rsp + 0x20], rbx
mov r9d, 0xc002012a
mov rcx, qword [0x100008700]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov edi, 8
mov dword [rsp + 0x50], edi
jmp 0x100005385
cmp edi, ebx
jne 0x100005385
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
xor r8d, r8d
lea edx, [r8 + 9]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReadEventLogW]
cmp eax, ebx
jne 0x100005339
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x50], eax
cmp eax, 0x7a
jne 0x100005306
mov edi, ebx
mov dword [rsp + 0x50], ebx
mov edx, dword [rsp + 0x54]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_realloc]
cmp rax, rbx
jne 0x1000052f2
mov edx, 1
lea r8d, [rdx + 4]
mov dword [rsp + 0x28], ebx
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
mov r9d, 0xc002012b
mov rcx, qword [0x100008700]
call fcn.100003ddc
mov edi, 8
mov dword [rsp + 0x50], edi
jmp 0x100005385
mov rsi, rax
mov qword [rsp + 0x68], rax
mov r13d, dword [rsp + 0x54]
mov dword [rsp + 0x5c], r13d
jmp 0x100005380
cmp eax, 0x26
cmove edi, ebx
mov dword [rsp + 0x50], edi
cmp edi, ebx
je 0x100005385
mov edx, 1
lea r8d, [rdx + 4]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
mov r9d, 0xc002012c
mov rcx, qword [0x100008700]
call fcn.100003ddc
jmp 0x100005385
cmp r12d, ebx
jne 0x100005347
mov r12d, dword [rsi + 0x10]
mov dword [rsp + 0x60], r12d
cmp r15d, ebx
je 0x100005385
cmp dword [rsi + 0x10], r15d
jb 0x100005385
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, qword [rsp + 0xc0]
mov edx, dword [rsp + 0x58]
mov rcx, rsi
call fcn.100004f9c
mov edi, eax
mov dword [rsp + 0x50], eax
cmp eax, ebx
jne 0x100005385
jmp 0x100005258
cmp r14, rbx
je 0x100005393
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
cmp rsi, rbx
je 0x1000053a1
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
cmp edi, ebx
jne 0x1000053b0
mov rax, qword [rsp + 0xd0]
mov dword [rax], r12d
mov eax, edi
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret