Function at 0x18000c740
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
lea rbp, [rsp + 0x50]
mov rax, qword [0x18008ab58]
xor rax, rbp
mov qword [rbp + 0x38], rax
mov r12d, edx
mov rdi, rcx
xor ebx, ebx
mov qword [rbp + 8], rbx
cmp qword [0x18008b8c0], rbx
jne 0x18000c7a2
cmp word [0x18008b8d0], bx
je 0x18000c7bc
lea rcx, [0x18008b8d0]
call fcn.18000c6d0
test eax, eax
je 0x18000c7bc
mov edx, dword [rbp + 0xa8]
test edx, edx
je 0x18000c7cb
lea r8, [rbp + 8]
mov rcx, rdi
call fcn.1800109d4
test eax, eax
jne 0x18000c7c5
or rax, 0xffffffffffffffff
jmp 0x18000ca02
mov r14, qword [rbp + 8]
jmp 0x18000c812
mov edx, 6
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
je 0x18000c7ff
mov ecx, dword [0x18007aafc]
mov dword [rax], ecx
movzx ecx, word [0x18007ab00]
mov word [rax + 4], cx
jmp 0x18000c812
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x18000c7bc
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], bx
jne 0x18000c816
mov dword [rbp + 0x14], esi
lea eax, [rsi + 0x230]
mov dword [rbp + 0x10], eax
mov rdi, rbx
mov qword [rbp], rbx
cdqe
mov qword [rbp + 0x18], rax
lea r15, [rax + rax]
test r15, r15
je 0x18000c8a2
cmp r15, qword [0x18008b2d8]
ja 0x18000c8a2
lea r13, [r15 + 8]
mov rcx, qword [0x18008b2e8]
add rcx, r13
cmp rcx, r15
jb 0x18000c8a2
call fcn.1800019b0
test eax, eax
je 0x18000c88f
lea rax, [r13 + 0xf]
cmp rax, r13
ja 0x18000c87a
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18000b5b0
sub rsp, rax
lea rdi, [rsp + 0x50]
mov qword [rbp], rdi
test rdi, rdi
je 0x18000c8a7
mov dword [rdi], 0x6b637453
add rdi, 8
mov qword [rbp], rdi
test rdi, rdi
jne 0x18000c8d7
lea rcx, [r15 + 8]
cmp rcx, r15
jb 0x18000c8d7
mov rax, qword [0x18008b2e0]
call qword [0x180071c20]
mov rdi, rax
mov qword [rbp], rax
test rax, rax
je 0x18000c8d7
mov dword [rax], 0x70616548
add rdi, 8
mov qword [rbp], rdi
mov r15, rdi
mov qword [rbp + 0x20], rdi
test rdi, rdi
je 0x18000c9e0
mov word [rdi], bx
lea rcx, [rbp + 0xb0]
mov eax, dword [rbp + 0x10]
dec eax
movsxd r8, eax
mov qword [rsp + 0x20], rcx
mov r9, r14
mov rdx, qword [rbp + 0x18]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__vsnwprintf_s]
nop dword [rax + rax]
jmp 0x18000c92e
movsxd rax, esi
mov word [rdi + rax*2 + 0x45e], bx
mov qword [rbp + 0x28], rdi
mov eax, 2
sub r12d, eax
lea edi, [rax - 1]
je 0x18000c957
cmp r12d, edi
je 0x18000c954
lea eax, [rdi + 3]
jmp 0x18000c957
movzx eax, di
lea rsi, [r15 - 8]
xor r8d, r8d
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0xa0]
movzx edx, ax
mov rcx, qword [0x18008b8c0]
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_ReportEventW]
nop dword [rax + rax]
test eax, eax
je 0x18000c9c6
cmp dword [rsi], 0x70616548
jne 0x18000c9b3
mov rcx, rsi
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, edi
jmp 0x18000ca02
cmp dword [rsi], 0x70616548
jne 0x18000c9f1
mov rcx, rsi
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
jmp 0x18000c9f1
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rbp
call fcn.180002a90
lea rsp, [rbp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret