Function at 0x1800ec270
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rbp - 0x39], r9
mov rdi, r8
mov qword [rbp - 0x41], rdx
mov r14d, ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
xor r8d, r8d
mov qword [rbp - 0x21], r8
add ecx, 0x331
mov dword [rbp - 0x59], ecx
cmp r14d, ecx
jae 0x1800ec6a8
lea ebx, [r8 + 0x6e]
lea esi, [rbx - 0x2c]
mov r15, qword [rbp - 0x41]
mov r12, qword [rbp - 0x41]
movzx r13d, byte [rbp - 0x49]
mov r11d, 0x53
lea r10d, [r11 - 6]
cmp r14d, 0x192
ja 0x1800ec3e4
je 0x1800ec3cc
cmp r14d, 0xca
ja 0x1800ec362
je 0x1800ec5e0
mov eax, r14d
sub eax, 0x65
je 0x1800ec354
sub eax, 0x2b
je 0x1800ec348
sub eax, 0xf
je 0x1800ec340
cmp eax, 0x1c
jne 0x1800ec5c2
mov dword [rbp - 5], 0x657365
mov dword [rbp - 2], 0x7461746e
mov eax, 0x69
mov word [rbp + 2], ax
jmp 0x1800ec5c2
mov r15, r9
jmp 0x1800ec5c2
mov dword [rbp - 8], 0x727065
jmp 0x1800ec5c2
mov eax, 0x52
mov word [rbp - 9], ax
jmp 0x1800ec5c2
mov eax, r14d
sub eax, 0xe6
je 0x1800ec3ba
sub eax, 0x2b
je 0x1800ec3ac
sub eax, 0x2b
je 0x1800ec391
cmp eax, 0x2b
jne 0x1800ec5c2
mov byte [rbp + 0xa], 0
mov eax, 0x40
mov word [rbp - 0x19], ax
jmp 0x1800ec5c2
mov word [rbp + 6], bx
mov eax, 0x64
mov word [rbp + 7], ax
mov eax, 0x7865
mov word [rbp + 8], ax
jmp 0x1800ec5c2
mov eax, 0x49
mov word [rbp + 5], ax
jmp 0x1800ec5c2
mov eax, 0x6f
mov word [rbp + 3], ax
mov word [rbp + 4], bx
jmp 0x1800ec5c2
mov eax, dword [str._0G0]
mov dword [rbp - 0x18], eax
movzx eax, byte [0x180102dec]
mov byte [rbp - 0x14], al
jmp 0x1800ec5c2
cmp r14d, 0x269
ja 0x1800ec47a
je 0x1800ec46b
mov eax, r14d
sub eax, 0x1bd
je 0x1800ec462
sub eax, 0x2b
je 0x1800ec439
sub eax, 0x2b
je 0x1800ec419
cmp eax, 0x2b
jne 0x1800ec5c2
mov byte [rbp - 0xf], 0x22
jmp 0x1800ec5c2
mov word [rbp - 0x11], si
mov r8d, 2
lea rdx, [0x180102df0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800ec5bf
lea rcx, [rbp - 0x19]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800ec440
movzx eax, word [0x180102df4]
mov word [rcx], ax
movzx eax, byte [0x180102df6]
mov byte [rcx + 2], al
jmp 0x1800ec5bf
mov word [rbp - 0x14], si
jmp 0x1800ec5c2
mov byte [rbp - 0xe], 0
mov r13b, 1
mov r12, r8
jmp 0x1800ec5c2
mov eax, r14d
sub eax, 0x294
je 0x1800ec597
sub eax, 0x2b
je 0x1800ec4dd
sub eax, 0x2b
je 0x1800ec4a0
cmp eax, 0x2b
je 0x1800ec6a8
jmp 0x1800ec5c2
test r13b, r13b
je 0x1800ec4d4
lea rdx, [rbp - 0x19]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenBackupEventLogA]
mov r12, rax
test rax, rax
jne 0x1800ec4c8
xor r13b, r13b
mov ecx, dword [rbp - 0x59]
mov byte [rbp - 0x51], r13b
jmp 0x1800ec5c2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov ecx, dword [rbp - 0x59]
mov byte [rbp - 0x51], 0
jmp 0x1800ec5c2
test r12, r12
je 0x1800ec501
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor r8d, r8d
mov r12d, r8d
mov r9, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x41]
lea r10d, [r8 + 0x4d]
lea r11d, [r8 + 0x53]
mov rbx, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x29]
cmp rbx, rsi
je 0x1800ec576
nop
mov dword [rbp + 0xf], 0x53004d
mov eax, 0x41
mov word [rbp + 0x13], ax
mov dword [rbp + 0x15], 0x440046
mov word [rbp + 0x19], r8w
mov eax, dword [r9]
cmp dword [rbx + 0x4c], eax
jne 0x1800ec566
mov eax, dword [rdx]
cmp dword [rbx + 0x58], eax
jne 0x1800ec566
lea rcx, [rbx + 0x74]
mov r8d, 5
lea rdx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1800ec609
mov r9, qword [rbp - 0x39]
xor r8d, r8d
lea r10d, [r8 + 0x4d]
lea r11d, [r8 + 0x53]
add rbx, 0x274
cmp rbx, rsi
mov rdx, qword [rbp - 0x41]
jne 0x1800ec510
lea rdx, [rbp - 0x19]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_BackupEventLogA]
mov ecx, dword [rbp - 0x59]
mov ebx, 0x6e
lea esi, [rbx - 0x2c]
test eax, eax
jne 0x1800ec5c2
xor r13b, r13b
jmp 0x1800ec5c2
mov r8d, 0x87
lea rdx, [rbp - 0x31]
xor ecx, ecx
call fcn.1800e9fc0
test al, al
je 0x1800ec6a4
lea rdx, [rbp - 9]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov r12, rax
mov ecx, dword [rbp - 0x59]
add r14d, 0x2b
cmp r14d, ecx
jae 0x1800ec6a8
mov r9, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x41]
xor r8d, r8d
jmp 0x1800ec2dd
imul ecx, dword [r15 + 0xc], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r15 + 8]
mov dword [rbp - 0x51], eax
mov r8d, 0x31
lea rdx, [rbp - 0x51]
mov rcx, qword [r15]
call fcn.1800e9e10
jmp 0x1800ec5e0
mov eax, 4
nop
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rdi + 0x60], xmm0
lea rdi, [rdi + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rdi - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rax, 1
jne 0x1800ec610
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rdi + 0x60], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rdi + 0x70], eax
mov byte [rbp - 0x51], 1
jmp 0x1800ec6a8
mov byte [rbp - 0x51], 0
mov r8, qword [rbp - 0x31]
test r8, r8
je 0x1800ec70a
mov rcx, qword [rbp - 0x21]
sub rcx, r8
movabs rax, 0x342da7f2f4960343
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x274
mov rax, r8
cmp rdx, 0x1000
jb 0x1800ec702
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ec702
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1800fe31c
mov eax, dword [rbp - 0x51]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800fe830
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret