Function at 0x1000026ec
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov r11d, dword [rcx]
xor ebp, ebp
mov r10d, edx
mov rsi, rcx
mov ebx, ebp
mov dword [rax + 8], ebp
mov qword [rax + 0x20], rbp
mov r9d, r11d
cmp r11d, ebp
je 0x1000028bf
lea edi, [rbp + 1]
sub r9d, edi
je 0x100002882
sub r9d, edi
je 0x100002847
sub r9d, edi
je 0x100002835
sub r9d, edi
je 0x1000027db
sub r9d, edi
je 0x10000279a
cmp r9d, edi
je 0x100002761
mov dword [rax - 0x38], ebp
lea r8d, [rbp + 2]
mov r9d, 0xc002010b
mov dword [rax - 0x40], r11d
jmp 0x10000298a
call fcn.10000416c
mov rcx, qword [0x100008700]
mov edx, 4
lea r8d, [rdx - 1]
mov ebx, eax
cmp eax, ebp
je 0x10000278f
mov dword [rsp + 0x30], edi
mov r9d, 0xc0020153
mov dword [rsp + 0x28], eax
jmp 0x100002993
mov r9d, 0x40020154
jmp 0x1000029b7
call fcn.100003dc8
mov ebx, eax
cmp eax, ebp
jne 0x1000027ac
call fcn.100004068
mov ebx, eax
mov rcx, qword [0x100008700]
mov r8d, 3
cmp ebx, ebp
je 0x1000027d0
mov dword [rsp + 0x30], edi
mov r9d, 0xc0020151
mov dword [rsp + 0x28], ebx
jmp 0x100002991
mov r9d, 0x40020152
jmp 0x1000029b2
cmp edx, 9
jbe 0x1000028c9
test dil, dl
jne 0x1000028c9
mov edx, 8
cmp edx, r10d
jae 0x10000280f
lea ecx, [rdx - 8]
shr rcx, 1
cmp word [rsi + rcx*2 + 8], bp
je 0x10000280c
add edx, 2
cmp edx, r10d
jb 0x1000027f7
cmp edx, r10d
je 0x1000028c9
mov edx, dword [rsi + 4]
mov r9, r8
lea rcx, [rsi + 8]
lea r8, [rsp + 0x70]
call fcn.100005124
cmp eax, ebp
cmove ebx, dword [rsp + 0x70]
jmp 0x1000029d5
mov rcx, qword [0x1000086f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1000029d5
or qword [rsp + 0x88], 0xffffffffffffffff
lea rdx, [rsp + 0x88]
lea rcx, [0x1000016a8]
call sub.FLTLIB.DLL_FilterCreate
mov rcx, qword [rsp + 0x88]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x1000029d5
call sub.FLTLIB.DLL_FilterClose
jmp 0x1000029d5
xor edx, edx
xor ecx, ecx
call fcn.100002f74
mov rcx, qword [0x100008700]
mov edx, 4
lea r8d, [rdx - 1]
mov ebx, eax
cmp eax, ebp
je 0x1000028b4
mov dword [rsp + 0x30], edi
mov r9d, 0x4002010e
mov dword [rsp + 0x28], eax
jmp 0x100002993
mov r9d, 0xc002010f
jmp 0x1000029b7
mov edx, 8
cmp r10d, edx
jae 0x1000028d3
mov ebx, 0x80070005
jmp 0x1000029d5
mov r9d, dword [rcx + 4]
mov edi, 1
mov ecx, r9d
cmp r9d, ebp
je 0x100002938
sub ecx, edi
je 0x10000292f
sub ecx, edi
je 0x100002926
cmp ecx, edi
mov rcx, qword [0x100008700]
lea r8d, [rdi + 2]
je 0x10000291d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r9d
mov edx, edi
mov r9d, 0xc0020113
mov ebx, 0x800707d1
mov qword [rsp + 0x20], rbp
call fcn.100003b60
jmp 0x100002976
lea rax, [0x100001690]
jmp 0x10000294c
lea rax, [0x100001698]
jmp 0x10000293f
lea rax, [0x100001680]
jmp 0x10000293f
lea rax, [0x100001668]
mov rcx, qword [0x100008700]
mov r8d, 3
mov r9d, 0x40020112
mov edx, 4
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.100003af8
mov edx, dword [rsi + 4]
mov ecx, edi
call fcn.100002f74
mov ebx, eax
cmp eax, ebp
je 0x10000299f
mov dword [rsp + 0x30], edi
mov r8d, 3
mov r9d, 0xc002010c
mov dword [rsp + 0x28], ebx
mov rcx, qword [0x100008700]
mov edx, edi
mov qword [rsp + 0x20], rbp
call fcn.100003b60
jmp 0x1000029d5
mov rcx, qword [0x100008700]
mov r8d, 3
mov r9d, 0xc002010d
mov edx, 4
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x28], bp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret