Function at 0x140003fc0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea r12, [0x140038e60]
xor r8d, r8d
mov rcx, r12
lea rdx, str._ELAN_Service____CheckWbioSrvc__pReStartSrv___d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call fcn.140001140
lea r13, str.ELAN_Service
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor r15d, r15d
mov edi, 2
mov rbx, rax
test rax, rax
je 0x140004073
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea edx, [rdi + 2]
mov dword [rsp + 0x30], r15d
xor r8d, r8d
mov word [rsp + 0x28], di
mov r9d, 0x36b0
mov rcx, rbx
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdx, [0x140030ae8]
lea rcx, str.sc_query_wbiosrvc
call fcn.14001240c
mov qword [rsp + 0x68], rax
mov r14, rax
test rax, rax
jne 0x1400040a6
lea rdx, str._ELAN_Service___Output_CMD_String_Fail___
mov ecx, edi
call fcn.140001140
jmp 0x140004377
mov qword [rsp + 0x150], rbp
mov ebp, 1
mov qword [rsp + 0x158], rsi
mov r8, r14
mov dword [rsp + 0x50], ebp
mov edx, 0x80
lea rcx, [rsp + 0x90]
call fcn.140012634
test rax, rax
jne 0x1400040e2
cmp ebp, 5
jge 0x14000435f
mov r8d, ebp
lea rdx, str._ELAN_Service__line_cnt___d_
mov ecx, edi
call fcn.140001140
cmp ebp, 4
jne 0x140004358
lea rdx, [0x140030bcc]
lea rcx, [rsp + 0x90]
lea esi, [rbp - 3]
call fcn.140011948
mov rbx, rax
lea r14d, [rsi + 1]
mov rbp, 0xffffffffffffffff
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], r15b
jne 0x140004124
inc rcx
mov rax, r14
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.140005c44
mov rdi, rax
mov r8, rbp
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], r15b
jne 0x140004150
inc r8
mov rdx, rbx
mov rcx, rdi
call fcn.140011b70
mov r8, rdi
lea rdx, [0x140030bd0]
mov ecx, r14d
call fcn.140001140
cmp esi, 4
jne 0x140004328
mov rcx, r15
lea rdx, str.STOPPED
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140004236
cmp rcx, 8
jne 0x140004190
lea rdx, str._ELAN_Service__WbioSrvc_is_stopped__try_to_start___
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call fcn.140001140
xorps xmm0, xmm0
mov rdx, r13
xor ecx, ecx
movdqu xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140004225
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r14w
mov rcx, rbx
mov qword [rsp + 0x70], r13
lea edx, [r8 + 4]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, str.sc_start_wbiosrvc
call fcn.140012414
jmp 0x140004328
mov rax, r15
lea rdx, str.RUNNING
movzx ecx, byte [rbx + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x1400042aa
cmp rax, 8
jne 0x140004240
lea rdx, str._ELAN_Service__WbioSrvc_is_RUNNING__Do_nothing...___
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call fcn.140001140
xorps xmm0, xmm0
mov rdx, r13
xor ecx, ecx
movdqu xmmword [rsp + 0x80], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140004328
mov qword [rsp + 0x80], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], r12
jmp 0x1400042ef
lea rdx, str._ELAN_Service__Other_case__do_nothing...___
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call fcn.140001140
xorps xmm0, xmm0
mov rdx, r13
xor ecx, ecx
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140004328
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov r9d, 0x36b0
mov dword [rsp + 0x30], r15d
mov rcx, rbx
mov word [rsp + 0x28], r14w
lea edx, [r8 + 4]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.1400059c0
lea rdx, [0x140030bcc]
xor ecx, ecx
inc esi
call fcn.140011948
mov rbx, rax
test rax, rax
jne 0x140004121
mov ebp, dword [rsp + 0x50]
lea edi, [rax + 2]
mov r14, qword [rsp + 0x68]
inc ebp
jmp 0x1400040bb
mov rcx, r14
call fcn.140012334
mov rsi, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400059a0
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
ret