Function at 0x1007514
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov qword [rsp + 0x248], 0xfffffffffffffffe
mov rax, qword [0x01021130]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
mov word [rsp + 0x5c], r9w
mov rsi, r8
mov dword [rsp + 0x70], edx
mov r12, rcx
mov qword [rsp + 0x78], r8
lea rax, [r11 - 0x268]
mov qword [rsp + 0x68], rax
lea r14, [0x01004cf0]
mov qword [r11 - 0x268], r14
lea r15, [0x01004ce0]
mov qword [r11 - 0x260], r15
mov dword [rsp + 0xd0], 0x428
mov dword [rsp + 0xd4], 0x4000
xor edi, edi
mov dword [rsp + 0xd8], edi
mov word [rsp + 0x130], di
mov byte [rsp + 0x132], dil
mov byte [rsp + 0x133], 1
xor edx, edx
lea r8d, [rdi + 0x50]
lea rcx, [r11 - 0x248]
call sub.MSVCR80.dll_memset
nop
lea r8, [0x01004ed0]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x138]
call fcn.010060b0
nop
lea rcx, [0x0100c9c0]
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
nop
mov qword [rsp + 0x250], rdi
xor edx, edx
lea r8d, [rdi + 0x48]
lea rcx, [rsp + 0x258]
call sub.MSVCR80.dll_memset
mov byte [rsp + 0x2a0], dil
xor eax, eax
mov qword [rsp + 0x2a1], rax
mov qword [rsp + 0x2a9], rax
mov qword [rsp + 0x2b1], rax
mov dword [rsp + 0x2b9], eax
mov word [rsp + 0x2bd], ax
mov byte [rsp + 0x2bf], al
mov r9, qword [rsi + 8]
lea edx, [rdi + 8]
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x1c8], r9
lea r8d, [rdi + 0x20]
mov qword [rsp + 0x160], r8
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0xa8], rax
mov rcx, rdi
mov qword [rsp + 0x80], rcx
cmp r8, rdi
je 0x10076dd
cmp rdx, rdi
je 0x10076f5
mov r10b, byte [r9]
cmp r10b, dil
je 0x10076f5
mov byte [rax], r10b
add rax, 1
mov qword [rsp + 0xa8], rax
add r9, 1
mov qword [rsp + 0x1c8], r9
sub r8, 1
mov qword [rsp + 0x160], r8
sub rdx, 1
mov qword [rsp + 0x180], rdx
add rcx, 1
mov qword [rsp + 0x80], rcx
jmp 0x100768a
sub rax, 1
mov qword [rsp + 0xa8], rax
sub rcx, 1
mov qword [rsp + 0x80], rcx
mov byte [rax], dil
mov ebx, 0xa
mov r8d, ebx
lea rdx, [rsp + 0x2c0]
mov ecx, dword [rsi + 0x10]
call qword [sym.imp.MSVCR80.dll__ultoa]
lea r11d, [rbx - 2]
mov qword [rsp + 0x1a8], r11
lea r8, [rsp + 0x2c0]
mov qword [rsp + 0x178], r8
lea edx, [rbx + 0xe]
mov qword [rsp + 0x198], rdx
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x90], rax
mov rcx, rdi
mov qword [rsp + 0xb0], rcx
cmp rdx, rdi
je 0x10077a6
cmp r11, rdi
je 0x10077be
mov r9b, byte [r8]
cmp r9b, dil
je 0x10077be
mov byte [rax], r9b
add rax, 1
mov qword [rsp + 0x90], rax
add r8, 1
mov qword [rsp + 0x178], r8
sub rdx, 1
mov qword [rsp + 0x198], rdx
sub r11, 1
mov qword [rsp + 0x1a8], r11
add rcx, 1
mov qword [rsp + 0xb0], rcx
jmp 0x1007753
sub rax, 1
mov qword [rsp + 0x90], rax
sub rcx, 1
mov qword [rsp + 0xb0], rcx
mov byte [rax], dil
mov r9, qword [r12 + 0x10]
mov edx, 8
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x188], r9
lea r8d, [rdx + 8]
mov qword [rsp + 0x1b0], r8
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0xa0], rax
mov rcx, rdi
mov qword [rsp + 0xb8], rcx
cmp r8, rdi
je 0x1007855
cmp rdx, rdi
je 0x100786d
mov r10b, byte [r9]
cmp r10b, dil
je 0x100786d
mov byte [rax], r10b
add rax, 1
mov qword [rsp + 0xa0], rax
add r9, 1
mov qword [rsp + 0x188], r9
sub r8, 1
mov qword [rsp + 0x1b0], r8
sub rdx, 1
mov qword [rsp + 0x1a0], rdx
add rcx, 1
mov qword [rsp + 0xb8], rcx
jmp 0x1007802
sub rax, 1
mov qword [rsp + 0xa0], rax
sub rcx, 1
mov qword [rsp + 0xb8], rcx
mov byte [rax], dil
mov r8d, ebx
lea rdx, [rsp + 0x2c0]
mov ecx, dword [r12 + 0x18]
call qword [sym.imp.MSVCR80.dll__ultoa]
mov r11d, 8
mov qword [rsp + 0x170], r11
lea r8, [rsp + 0x2c0]
mov qword [rsp + 0x1c0], r8
mov rdx, r11
mov qword [rsp + 0x168], rdx
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x88], rax
mov rcx, rdi
mov qword [rsp + 0x98], rcx
cmp rdx, rdi
je 0x100791d
cmp r11, rdi
je 0x1007935
mov r9b, byte [r8]
cmp r9b, dil
je 0x1007935
mov byte [rax], r9b
add rax, 1
mov qword [rsp + 0x88], rax
add r8, 1
mov qword [rsp + 0x1c0], r8
sub rdx, 1
mov qword [rsp + 0x168], rdx
sub r11, 1
mov qword [rsp + 0x170], r11
add rcx, 1
mov qword [rsp + 0x98], rcx
jmp 0x10078ca
sub rax, 1
mov qword [rsp + 0x88], rax
sub rcx, 1
mov qword [rsp + 0x98], rcx
mov byte [rax], dil
movzx r13d, word [rsi + 0x70]
movzx edx, di
mov word [rsp + 0x60], dx
cmp dx, r13w
jae 0x100796b
cmp dx, bx
jae 0x1007960
movzx ecx, dx
mov rax, qword [rsi + rcx*8 + 0x20]
mov qword [rsp + rcx*8 + 0x250], rax
add dx, 1
mov word [rsp + 0x60], dx
jmp 0x1007945
lea rdx, [0x01004640]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r12, rax
cmp rax, rdi
jne 0x1007a20
lea rsi, [rsp + 0x1d0]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r15
mov dword [rsp + 0x1e0], 0x455
mov dword [rsp + 0x1e4], 0x4000
mov dword [rsp + 0x1e8], edi
mov word [rsp + 0x240], di
mov byte [rsp + 0x242], dil
mov byte [rsp + 0x243], 1
movzx ecx, di
mov word [rsp + 0x58], cx
cmp cx, bx
jae 0x10079f8
movzx eax, cx
mov qword [rsi + rax*8 + 0x20], rdi
add cx, 1
mov word [rsp + 0x58], cx
jmp 0x10079e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea r9, [0x01004f10]
mov r8d, 0x8000ffff
mov rdx, rsi
lea rcx, [rsp + 0x138]
call fcn.01007184
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov word [rsp + 0x28], r13w
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x70]
xor r8d, r8d
movzx edx, word [rsp + 0x5c]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, edi
jne 0x1007afd
lea r13, [rsp + 0x1d0]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r15
mov dword [rsp + 0x1e0], 0x465
mov dword [rsp + 0x1e4], 0x4000
mov dword [rsp + 0x1e8], edi
mov word [rsp + 0x240], di
mov byte [rsp + 0x242], dil
mov byte [rsp + 0x243], 1
movzx ecx, di
mov word [rsp + 0x50], cx
cmp cx, bx
jae 0x1007add
movzx eax, cx
mov qword [r13 + rax*8 + 0x20], rdi
add cx, 1
mov word [rsp + 0x50], cx
jmp 0x1007ac5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x01004f60]
mov rdx, r13
lea rcx, [rsp + 0x138]
call fcn.0100622c
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp eax, edi
jne 0x1007ba9
lea rsi, [rsp + 0x1d0]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r15
mov dword [rsp + 0x1e0], 0x46a
mov dword [rsp + 0x1e4], 0x4000
mov dword [rsp + 0x1e8], edi
mov word [rsp + 0x240], di
mov byte [rsp + 0x242], dil
mov byte [rsp + 0x243], 1
movzx ecx, di
mov word [rsp + 0x54], cx
cmp cx, bx
jae 0x1007b80
movzx eax, cx
mov qword [rsi + rax*8 + 0x20], rdi
add cx, 1
mov word [rsp + 0x54], cx
jmp 0x1007b68
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea r9, [0x01004fa0]
mov r8d, 0x8000ffff
mov rdx, rsi
lea rcx, [rsp + 0x138]
call fcn.01007184
nop
jmp 0x1007bcd
lea rcx, [rsp + 0x138]
call fcn.010061b0
nop
cmp byte [rsi + 0x73], dil
je 0x1007c00
add rsi, 0x20
cmp qword [rsi], rdi
je 0x1007bf6
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsi], rdi
add rsi, 8
sub rbx, 1
jne 0x1007be5
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.0100bf40
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret