Function at 0x140017d44
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
lea rdi, [rcx + 0x38]
mov rsi, rcx
mov rcx, qword [rdi]
test rcx, rcx
je 0x140017d76
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rdi], 0
lea rdx, str.wevtapi.dll
mov rcx, rdi
call fcn.14002da5c
mov ebx, eax
lfence
test eax, eax
jns 0x140017da3
mov edx, eax
lea rcx, str.UtilLoadSystemLibrary_wevtapi.dll__failed___X_
call fcn.140003cb0
mov eax, ebx
jmp 0x140017fd8
mov rcx, qword [rdi]
lea rbp, str.EvtQuery
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
jne 0x140017dcc
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017dce
xor ebx, ebx
lea r14, str.ERROR:_UtilGetProcAddress__S__failed___X__n
test ebx, ebx
jns 0x140017dec
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017dee
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtCreateRenderContext
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x140017e1f
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017e21
xor ebx, ebx
test ebx, ebx
jns 0x140017e38
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017e3a
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtRender
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
test rax, rax
jne 0x140017e6f
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017e71
xor ebx, ebx
test ebx, ebx
jns 0x140017e88
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017e8a
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtNext
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
test rax, rax
jne 0x140017ebf
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017ec1
xor ebx, ebx
test ebx, ebx
jns 0x140017ed8
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017eda
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtClose
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x140017f0f
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017f11
xor ebx, ebx
test ebx, ebx
jns 0x140017f28
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017f2a
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtOpenPublisherMetadata
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
test rax, rax
jne 0x140017f5f
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017f61
xor ebx, ebx
test ebx, ebx
jns 0x140017f78
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017f7a
xor ebx, ebx
lfence
test ebx, ebx
js 0x140017d9c
mov rcx, qword [rdi]
lea rbp, str.EvtFormatMessage
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x140017faf
mov dl, 1
mov rcx, rbp
call fcn.140030534
mov ebx, eax
jmp 0x140017fb1
xor ebx, ebx
test ebx, ebx
jns 0x140017fc8
lfence
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.140003cb0
jmp 0x140017fca
xor ebx, ebx
test ebx, ebx
jns 0x140017fd6
lfence
jmp 0x140017d9c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret