Function at 0x140001e70
Capabilities:
Access the windows event log

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rax, qword [0x14021e7e0]
xor rax, rsp
mov qword [rbp + 8], rax
mov rdi, r9
mov ebx, r8d
mov r12, rdx
mov qword [rbp - 0x38], rdx
movsxd r14, ecx
mov dword [rsp + 0x6c], r14d
mov qword [rbp - 0x10], rdx
mov rsi, qword [rbp + 0x80]
cmp dword [0x140229a48], 0
je 0x140001ed5
lea rcx, [0x140229a10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
mov qword [0x140228f00], r13
mov qword [0x140228f08], r13
mov qword [0x140228f10], r13
lea rdx, [0x14018c8d0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140001f2a
cmp dword [0x140229a48], r13d
je 0x140001f1d
lea rcx, [0x140229a10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [r12]
or r15d, 0xffffffff
jmp 0x140002957
mov eax, 1
mov word [rsp + 0x50], ax
lea rax, [0x140220aa0]
mov qword [0x140228f00], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.140001340
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, ebx
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140001a10
nop
mov rax, qword [rax]
mov qword [0x140228f10], rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140001fa1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12d, 3
cmp r14d, 0x3e8
jg 0x140002592
je 0x1400024f7
cmp r14d, 0x65
ja case.0x140001fdf.28
lea r13, [0x140000000]
movzx eax, byte [r13 + r14 + 0x2a10]
mov ecx, dword [r13 + rax*4 + 0x2994]
add rcx, r13
jmp rcx
lea rax, str.Unable_to_open_handle_to_Trackpad_Driver.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Unable_to_open_handle_to_Trackpad_Driver_calling_location.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Unable_to_open_handle_to_Keyboard_Driver.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea r8, str.Caught_Exception__reason_is
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
call fcn.14015e678
test rdi, rdi
je 0x140002075
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, 0xff
lea rdx, [0x1402206a0]
mov rcx, rdi
call qword [rax + 0x18]
lea r8, [0x1402206a0]
mov edx, 0x200
mov rcx, rbx
call fcn.14015e6dc
lea r8, [0x14018bcf0]
jmp 0x14000207c
call fcn.14015e678
lea r8, str.not_available.
mov edx, 0x200
mov rcx, rbx
call fcn.14015e6dc
mov qword [0x140228f08], rbx
jmp 0x1400028eb
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x1400020b5
lea r8, str.An_invocation_of_DeviceIoControl_caused_an_exception._The_reason_given_is
jmp 0x140002030
lea r8, str.An_Invocation_of_DeviceIoControl_
call fcn.14015e678
mov r9d, 0x28
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
lea r8, str.__caused_an_exception._The_reason_given_is
mov edx, 0x200
mov rcx, rbx
call fcn.14015e6dc
jmp 0x140002035
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x140002115
lea r8, str.Device_Driver_rejected_a_call_to_DeviceIoControl.
call fcn.14015e678
jmp 0x140002089
lea r8, str.Device_Driver_rejected_a_call_to_DeviceIoControl_
call fcn.14015e678
mov r9d, 0x40
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
lea r8, [0x14018c6e0]
jmp 0x14000207c
lea rax, str.Unable_to_initialize_critical_section_object.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Unable_to_initialize_the_Main_Thread.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Unable_to_initialize_the_Keyboard_Hot_Key_control_thread.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Unable_to_initialize_an_event_object.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.MainThread_timed_out_waiting_for_DoModal_process_to_initialize.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Tray_Icon_can_not_load_its_Menu.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Tray_Icon_can_not_load_its_submenu.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Tray_Icon_can_not_obtain_FG_status.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Tray_icon_failed_sending_CP_GUI_message.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Handle_to_remote_window_is_invalid.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Handle_allocation_history_list_had_overrun.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Handle_allocation_history_list_had_underrun.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Memory__malloc__allocation_history_list_had_overrun.
mov qword [0x140228f08], rax
jmp 0x1400028eb
lea rax, str.Memory__malloc__allocation_history_list_had_underrun.
mov qword [0x140228f08], rax
jmp 0x1400028eb
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x140002272
lea r8, str.Attempted_to_close_a_NULL_handle.
call fcn.14015e678
jmp 0x140002089
lea r8, str.Attempted_to_close_a_handle_identified_as
call fcn.14015e678
mov r9d, 0x40
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
lea r8, str.._This_handle_may_not_have_been_opened_or_was_already_closed.
jmp 0x14000207c
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x1400022c0
lea r8, str.Attempted_to_close_a_BAD_handle.
jmp 0x140002030
lea r8, str.Attempted_to_close_a_BAD_handle_identified_as:
call fcn.14015e678
mov r9d, 0x28
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
lea r8, str.._The_exception_description_is
jmp 0x1400020de
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x14000230e
lea r8, str.Attempted_to_close_a_registry_key_handle.
jmp 0x140002030
lea r8, str.Attempted_to_close_a_registry_handle_used_during
call fcn.14015e678
mov r9d, 0x40
jmp 0x1400022d2
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x140002353
test rdi, rdi
je 0x140002347
lea r8, str.malloc_attempt_threw_exception.
jmp 0x140002030
lea r8, str.malloc_returned_a_NULL_pointer.__Reason_is
jmp 0x140002070
test rdi, rdi
lea r8, str.malloc_attempt_had_exception:
jne 0x140002366
lea r8, str.malloc_attempt_had_error:
call fcn.14015e678
mov r9d, 0x40
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
lea r8, str.._The_error_description_is
jmp 0x1400020de
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x1400023be
test rdi, rdi
je 0x1400023b2
lea r8, str.free_attempt_of_malloc_pointer_threw_exception._Reason_is
jmp 0x140002030
lea r8, str.free_attempt_of_malloc_pointer_failed.__Reason_is
jmp 0x140002070
test rdi, rdi
lea r8, str.free_attempt_of_malloc_pointer_threw_exception:
jne 0x140002366
lea r8, str.free_attempt_of_malloc_pointer_failed:
jmp 0x140002366
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x1400023f8
lea r8, str.malloc__free_calls_are_unbalanced_or_nested_too_deep.
call fcn.14015e678
jmp 0x140002089
lea r8, str.malloc__free_calls_are_unbalanced_or_nested_too_deep_for_pointer
call fcn.14015e678
mov r9d, 0x40
mov r8, rsi
mov edx, 0x200
mov rcx, rbx
call fcn.14015e8ac
jmp 0x140002067
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x140002450
test rdi, rdi
je 0x140002444
lea r8, str.CreateFile_attempt_threw_exception._Reason_is
jmp 0x140002030
lea r8, str.CreateFile_attempt_failed.__Reason_is
jmp 0x140002070
test rdi, rdi
lea r8, str.CreateFile_attempt_threw_exception:
jne 0x140002366
lea r8, str.CreateFile_attempt_failed:
jmp 0x140002366
mov edx, 0x200
lea rbx, [0x1402208a0]
mov rcx, rbx
test rsi, rsi
jne 0x14000249d
test rdi, rdi
je 0x140002491
lea r8, str.Deleting_registry_path_threw_exception._Reason_is
jmp 0x140002030
lea r8, str.Deleting_registry_path_failed.__Reason_is
jmp 0x140002070
test rdi, rdi
lea r8, str.Deleting_registry_path_threw_exception:
jne 0x140002366
lea r8, str.Deleting_registry_path_failed:
jmp 0x140002366
mov eax, 4
lea rcx, str.Initialized_Local_User_Settings__HKCU_
mov qword [0x140228f08], rcx
lea r12d, [rax - 2]
jmp 0x1400028ef
mov r8d, 4
mov dword [rsp + 0x50], r8d
lea rax, str.Program_exit.
mov qword [0x140228f08], rax
lea r12d, [r8 - 2]
jmp 0x1400028eb
lea rax, [rbp - 0x48]
mov qword [rsp + 0x58], rax
lea rdx, str.Malloc__Free_calls_are_unbalanced._Remaining_open_count_
lea rcx, [rbp - 0x48]
call fcn.140001db0
nop
mov r8d, dword [0x1402211e8]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f08], rax
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000254e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x58], rax
lea rdx, str.Malloc__Free_calls_are_unbalanced._Audit_list_count_
lea rcx, [rbp - 0x28]
call fcn.140001db0
mov r11, rax
call fcn.140001030
mov r8d, eax
mov rdx, r11
lea rcx, [rbp - 0x60]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f10], rax
mov rdx, qword [rbp - 0x60]
jmp 0x1400028c6
mov ecx, r14d
sub ecx, 0x3e9
je 0x14000282e
dec ecx
je 0x14000273d
dec ecx
jne case.0x140001fdf.28
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
lea rdx, str.Memory_allocations__Mallocs__remained_open_at_exit._Count_
lea rcx, [rbp - 0x80]
call fcn.140001db0
nop
mov r8d, dword [0x1402211e8]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f00], rax
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140002608
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12d, 1
mov r14d, r13d
mov ecx, r13d
mov dword [rsp + 0x68], ecx
lea rax, [0x140221120]
mov qword [rsp + 0x58], rax
mov rsi, r13
lea r13, [0x140000000]
nop
cmp byte [rsi + r13 + 0x2275f0], 0
je 0x14000271e
cmp byte [rsi + r13 + 0x228270], 0
je 0x14000271e
movsxd rax, ecx
shl rax, 7
lea rdi, [rax + r13 + 0x220b20]
lea r8, str.Pointer_Name
mov edx, 0x80
mov rcx, rdi
call fcn.14015e678
movsxd rbx, r14d
shl rbx, 6
lea r8, [rbx + r13 + 0x2275f0]
mov edx, 0x80
mov rcx, rdi
call fcn.14015e6dc
lea r8, str._in_module
mov edx, 0x80
mov rcx, rdi
call fcn.14015e6dc
lea r8, [rbx + r13 + 0x228270]
mov edx, 0x80
mov rcx, rdi
call fcn.14015e6dc
lea r8, str._at_line
mov edx, 0x80
mov rcx, rdi
call fcn.14015e6dc
mov r9d, 0xa
lea r8d, [r9 + 2]
lea rdx, [rbp - 8]
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax]
call fcn.14015e84c
lea r8, [rbp - 8]
mov edx, 0x80
mov rcx, rdi
call fcn.14015e6dc
movsxd r11, r12d
lea rax, [0x140228f00]
mov qword [rax + r11*8], rdi
inc r12d
mov ecx, dword [rsp + 0x68]
inc ecx
mov dword [rsp + 0x68], ecx
cmp ecx, 0xb
jge 0x14000281b
mov rax, qword [rsp + 0x58]
inc r14d
add rsi, 0x40
add rax, 4
mov qword [rsp + 0x58], rax
cmp r14d, 0x32
jl 0x140002630
jmp 0x14000281b
lea rax, [rbp - 0x20]
mov qword [rsp + 0x58], rax
lea rdx, str.Handles_remained_open_at_exit._Count_
lea rcx, [rbp - 0x20]
call fcn.140001db0
nop
mov r8d, dword [0x1402211ec]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f08], rax
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140002794
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12d, 2
mov esi, r13d
lea r14, [0x1402211f0]
lea r13, [0x140000000]
lea r15, [0x1402211f0]
cmp byte [r14], 0
je 0x140002809
movsxd rdi, r12d
mov rax, rdi
shl rax, 7
lea rbx, [rax + r13 + 0x220b20]
lea r8, str.Handle_Name:
mov edx, 0x80
mov rcx, rbx
call fcn.14015e678
movsxd r8, esi
shl r8, 6
add r8, r15
mov edx, 0x80
mov rcx, rbx
call fcn.14015e6dc
lea rax, [0x140228f00]
mov qword [rax + rdi*8], rbx
inc r12d
cmp r12d, 0xc
jge 0x140002817
inc esi
add r14, 0x40
cmp esi, 0x190
jl 0x1400027b2
or r15d, 0xffffffff
test r12d, r12d
jle case.0x140001fdf.28
mov r14d, dword [rsp + 0x6c]
jmp 0x1400028e1
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea rdx, str.Handle_Count_is_unbalanced._Remaining_open_count_
lea rcx, [rbp - 0x78]
call fcn.140001db0
nop
mov r8d, dword [0x1402211ec]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f08], rax
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140002885
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
lea rdx, str.Handle_Count_is_unbalanced._Audit_list_count_
lea rcx, [rbp - 0x58]
call fcn.140001db0
mov r11, rax
call section..text
mov r8d, eax
mov rdx, r11
lea rcx, [rsp + 0x78]
call fcn.140001c00
nop
mov rax, qword [rax]
mov qword [0x140228f10], rax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400028e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x140228f08], 0
je case.0x140001fdf.28
mov eax, dword [rsp + 0x50]
xor ecx, ecx
lea r8d, [rcx + 1]
mov qword [rsp + 0x40], rcx
lea rdx, [0x140228f00]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], rcx
mov r9d, r14d
movzx edx, ax
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
jmp 0x140002930
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
cmp dword [0x140229a48], 0
je 0x140002950
lea rcx, [0x140229a10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r15d
dec r15d
test r15d, r15d
jg 0x140002972
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14015f240
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret