Function at 0x140061e3c
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rdx
mov byte [rbp + 0x40], 0
xor r15d, r15d
lea rax, vtable.HModule.0
mov qword [rbp - 0x18], rax
and qword [rbp - 0x10], r15
and qword [rbp - 0x20], r15
mov ecx, 0x208
call fcn.140031228
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x1400622d1
lea r13, str.System
mov rdx, r13
mov rcx, r13
call fcn.1400059ec
test eax, eax
jne 0x140062287
lea r8, [rbp - 0x20]
call fcn.1400f37a0
mov edi, eax
test eax, eax
js 0x140062376
lea rax, str.SystemEvents.txt
mov qword [rsp + 0x28], rax
lea rax, [0x140131120]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140131840]
mov edx, 0x104
mov rcx, qword [rbp - 0x28]
call fcn.140063b90
mov edi, eax
test eax, eax
jns 0x140061f25
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140061f19
test byte [rcx + 0x1c], 1
je 0x140061f19
lea edx, [r15 + 0x30]
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_StringCchPrintfW___failed___lx__n
jmp 0x14006236e
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r15, rax
test rax, rax
jne 0x140061f7b
call fcn.1400fb4fc
mov edi, eax
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140061f6f
test byte [rcx + 0x1c], 1
je 0x140061f6f
lea edx, [r15 + 0x32]
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_OpenEventLog_System__failed___lx__n
jmp 0x14006236e
lea r8, [rbp - 0x10]
mov rbx, qword [rbp - 0x20]
mov rdx, rbx
call fcn.140062618
mov edi, eax
test eax, eax
jns 0x140061fd5
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140061fc2
test byte [rcx + 0x1c], 1
je 0x140061fc2
mov edx, 0x33
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_GetMesgFileHandle___failed___lx__n
mov edx, edi
call fcn.1400f5500
jmp 0x140062310
xor r8d, r8d
mov rdx, qword [rbp - 0x28]
call fcn.1400f5628
mov edi, eax
test eax, eax
js 0x140062246
mov byte [rbp + 0x40], 1
and dword [rbp - 0x30], 0
and dword [rbp + 0x58], 0
and dword [rbp + 0x50], 0
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
test eax, eax
jne 0x140062050
call fcn.1400fb4fc
mov edi, eax
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140062044
test byte [rcx + 0x1c], 1
je 0x140062044
mov edx, 0x35
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_GetOldestEventLogRecord___failed___lx__n
jmp 0x140061fc9
lea rdx, [rbp + 0x58]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
test eax, eax
jne 0x1400620a5
call fcn.1400fb4fc
mov edi, eax
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140062099
test byte [rcx + 0x1c], 1
je 0x140062099
mov edx, 0x36
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_GetNumberOfEventLogRecords___failed___lx__n
jmp 0x140061fc9
mov edi, dword [rbp + 0x58]
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp + 0x50]
mov edx, edi
lea rcx, str.MpSupport_EventLogNumRecsToRead
mov rax, qword [rax + 0xa0]
call fcn.140107c30
mov edi, eax
test eax, eax
jns 0x14006210a
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x1400620fe
test byte [rcx + 0x1c], 1
je 0x1400620fe
mov edx, 0x37
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_MpConfigGetMiscDwordValue_MpSupport_EventLogRecordNum__failed___lx__n
jmp 0x140061fc9
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x14006214d
test byte [rcx + 0x1c], 4
je 0x14006214d
mov edx, 0x38
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0x50]
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140063d84
mov rcx, qword [0x14016d280]
mov eax, dword [rbp + 0x58]
test eax, eax
jne 0x14006215b
xor edi, edi
jmp 0x140062310
lea r14d, [rax - 1]
mov edx, dword [rbp - 0x30]
add r14d, edx
cmp r14d, edx
jb 0x140062215
xor edi, edi
cmp r14d, edx
jb 0x140062310
mov r9, qword [rbp - 0x10]
mov r8d, r14d
mov rdx, rbx
mov rcx, r15
call fcn.14006298c
mov edi, eax
test eax, eax
jns 0x1400621f5
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x1400621d2
test byte [rcx + 0x1c], 1
je 0x1400621d2
mov edx, 0x3a
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rbx
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140063c24
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
mov r9, rbx
mov r8, qword [rbp - 0x28]
mov rdx, r13
lea rcx, str.ERROR:_ReadAndProcessEventLogRecord__ls___ls___ls___ld__failed__lx_n
call fcn.1400f5500
xor edi, edi
jmp 0x140062203
test edi, edi
jne 0x140062203
add dword [rbp + 0x50], 0xffffffff
je 0x140062310
dec r14d
cmp r14d, dword [rbp - 0x30]
jae 0x140062179
jmp 0x140062310
mov edi, 0x80070216
cmp rcx, rsi
je 0x14006223a
test byte [rcx + 0x1c], 1
je 0x14006223a
mov edx, 0x39
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.Event_log_record_number_overflow_n
jmp 0x14006230b
mov byte [rbp + 0x40], 0
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x14006227b
test byte [rcx + 0x1c], 1
je 0x14006227b
mov edx, 0x34
mov r9d, edi
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_Failed_to_open_log_file___lx__n
jmp 0x140061fc9
mov edi, 0x80070032
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x1400622bd
test byte [rcx + 0x1c], 1
je 0x1400622bd
mov edx, 0x31
mov r9, r13
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044638
mov rdx, r13
lea rcx, str.ERROR:_Unsupported_event_log_name_in_EventLogToFile__ls__n
call fcn.1400f5500
jmp 0x140062376
mov edi, 0x80070057
lea rsi, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140062304
test byte [rcx + 0x1c], 1
je 0x140062304
mov edx, 0x2f
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.ERROR:_NULL_parameter_in_EventLogToFile_...__n
call fcn.1400f5500
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140062324
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbp - 0x10], 0
test r15, r15
je 0x140062376
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
test eax, eax
jne 0x140062376
call fcn.1400fb4fc
mov edi, eax
mov rcx, qword [0x14016d280]
cmp rcx, rsi
je 0x140062367
test byte [rcx + 0x1c], 1
je 0x140062367
mov edx, 0x3b
mov r9d, eax
lea r8, [0x140134c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CloseEventLog___failed___lx__n
mov edx, edi
call fcn.1400f5500
nop
xor ecx, ecx
xchg qword [rbp - 0x28], rcx
test rcx, rcx
je 0x140062387
call fcn.140030ba0
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140062397
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400623a7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
cmp byte [rbp + 0x40], 0
je 0x1400623d6
mov rbx, qword [0x1401765d0]
and qword [0x1401765d0], 0
test rbx, rbx
je 0x1400623d6
mov rcx, rbx
call fcn.1400f4a54
mov edx, 0x48
mov rcx, rbx
call fcn.140030ba0
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret