Function at 0x14005a940
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov rax, qword [0x1400d2070]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xf0]
add rax, 0x90
mov rcx, rax
call fcn.14003be70
movzx eax, al
test eax, eax
je 0x14005a99f
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax + 0x78]
test eax, eax
je 0x14005a99a
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.14005da90
jmp 0x14005ac8a
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_
lea rcx, [rsp + 0xb0]
call fcn.140002040
nop
mov rax, qword [rsp + 0xf0]
add rax, 0x90
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.140001d80
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.14001ec10
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.140001d80
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call fcn.14001ebe0
jmp 0x14005aa0f
lea rcx, [rsp + 0x60]
call fcn.14001e760
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.140001ea0
movzx eax, al
test eax, eax
je 0x14005ac06
lea rcx, [rsp + 0x60]
call fcn.14001e780
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140002d80
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.140052480
nop
lea rcx, [rsp + 0x70]
call fcn.140003970
mov r8b, 1
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140038040
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14005aaa5
lea rcx, [rsp + 0x70]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x90]
call fcn.140003bf0
jmp 0x14005aa05
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax + 0x78]
test eax, eax
je 0x14005aaf0
mov dl, 1
mov rcx, qword [rsp + 0xf0]
call fcn.14005da90
nop
lea rcx, [rsp + 0x70]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x90]
call fcn.140003bf0
nop
lea rcx, [rsp + 0xb0]
call fcn.140003bf0
jmp 0x14005ac8a
lea rcx, [rsp + 0x90]
call fcn.140003970
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14005ab75
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x48]
inc eax
mov rcx, qword [rsp + 0xf0]
mov dword [rcx + 0x48], eax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
test eax, eax
je 0x14005ab48
mov dword [rsp + 0x24], 1
jmp 0x14005ab50
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x4c]
add eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0xf0]
mov dword [rcx + 0x4c], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x48]
inc eax
mov rcx, qword [rsp + 0xf0]
mov dword [rcx + 0x48], eax
lea rcx, [rsp + 0x70]
call fcn.140003970
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002040
nop
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call fcn.14005edc0
movzx eax, al
test eax, eax
je 0x14005abc7
mov dword [rsp + 0x28], 1
jmp 0x14005abcf
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xf0]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x4c], ecx
lea rcx, [rsp + 0x40]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x70]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x90]
call fcn.140003bf0
jmp 0x14005aa05
mov rax, qword [rsp + 0xf0]
movzx eax, byte [rax + 0x78]
test eax, eax
je 0x14005ac35
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.14005da90
nop
lea rcx, [rsp + 0xb0]
call fcn.140003bf0
jmp 0x14005ac8a
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf0]
mov ecx, dword [rcx + 0x4c]
cmp dword [rax + 0x48], ecx
jle 0x14005ac57
mov dword [rsp + 0x2c], 1
jmp 0x14005ac5f
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0xf0]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0x50], cl
mov rcx, qword [rsp + 0xf0]
call fcn.14005dc70
nop
lea rcx, [rsp + 0xb0]
call fcn.140003bf0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140069a00
add rsp, 0xe8
ret