Function at 0x14015ca50
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, [0x1404b98c7]
call fcn.1402b13b0
mov cl, reloc.WLDAP32.dll_Ordinal_27
mov word [rbp - 0x40], reloc.WLDAP32.dll_Ordinal_27
movsx edx, cl
xorps xmm0, xmm0
movzx eax, dx
movzx ecx, dx
xor ax, 0x5a
xor cx, 0x72
mov word [rbp - 0x3e], ax
mov rbx, 0xffffffffffffffff
movzx eax, dx
mov word [rbp - 0x36], cx
xor ax, 0x6b
mov word [rbp - 0x2e], cx
mov word [rbp - 0x3c], ax
mov r8, rbx
mov word [rbp - 0x3a], ax
movzx eax, dx
xor ax, 0x77
mov word [rbp - 0x38], ax
movzx eax, dx
xor ax, 0x78
mov word [rbp - 0x34], ax
movzx eax, dx
xor ax, 0x7a
mov word [rbp - 0x32], ax
movzx eax, dx
xor ax, 0x6f
mov word [rbp - 0x30], ax
movzx eax, dx
xor ax, 0x74
xor dx, 0x75
xor esi, esi
mov word [rbp - 0x2c], ax
mov word [rbp - 0x28], si
lea rax, [rbp - 0x3e]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov word [rbp - 0x2a], dx
movups xmmword [rbp - 0x20], xmm0
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14015cb10
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d4f50
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14015cb59
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d4840
mov cl, 6
mov word [rbp - 0x40], 6
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x32], si
xor ax, 0x55
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
mov r8, rbx
movzx eax, cx
mov qword [rbp - 8], rsi
xor ax, 0x7f
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 0x75
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 0x72
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 0x63
xor cx, 0x6b
mov word [rbp - 0x36], ax
mov word [rbp - 0x34], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
inc r8
cmp word [rax + r8*2], si
jne 0x14015cbc6
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d4f50
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14015cc0f
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d4840
mov cl, 0x5c
mov word [rbp - 0x40], 0x5c
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x2e], si
xor ax, 0xf
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
movzx eax, cx
xor ax, 0x39
mov qword [rbp - 8], rsi
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 0x3f
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 0x29
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 0x2e
mov word [rbp - 0x36], ax
movzx eax, cx
xor ax, 0x35
mov word [rbp - 0x34], ax
movzx eax, cx
xor ax, 0x28
xor cx, 0x25
mov word [rbp - 0x32], ax
mov word [rbp - 0x30], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
nop
inc rbx
cmp word [rax + rbx*2], si
jne 0x14015cc90
mov r8, rbx
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400d4f50
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x14015ccdb
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400d4840
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret