Function at 0x140012f08
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14005f650]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rcx
mov r13, qword [rcx + 0x78]
mov r15, qword [rcx + 8]
mov r14, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x90]
mov ecx, 0x71ad8
call fcn.1400282e8
test rax, rax
je 0x140012f7a
mov rcx, rax
call fcn.140019444
mov rsi, rax
jmp 0x140012f7c
xor esi, esi
test rsi, rsi
je 0x1400131d4
mov rcx, rsi
call fcn.14001a4c8
mov r12d, 1
mov r9d, r12d
mov r8, r13
lea rdx, str.minidumpZip
call fcn.14001a0b8
lea r8d, [r12 + 4]
mov rdx, rbx
mov rcx, rsi
call fcn.140019a40
test eax, eax
je 0x1400131c2
mov rcx, rsi
call fcn.14001a734
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000d080
nop
mov r8, rbx
lea rdx, str.HTTPS_PUT_response:
mov rcx, rdi
call fcn.140013e18
mov rbx, qword [rsp + 0x68]
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.140013e18
lea r8, str._____________________________
xor edx, edx
mov rcx, rdi
call fcn.140013e18
nop
lea rcx, [rbx - 0xc]
lea rax, [0x140060bd0]
cmp rcx, rax
je 0x140013024
lock add dword [rcx], 0xffffffff
jg 0x140013024
call fcn.140029150
mov rcx, rdi
call fcn.140012820
cmp eax, r12d
jne 0x1400131d4
lea r8, [rsp + 0x50]
lea rdx, str.EventLogging
lea rcx, [0x1400513b8]
call fcn.14001d3c8
mov ecx, dword [rsp + 0x50]
test eax, eax
cmove ecx, r12d
mov dword [rsp + 0x50], ecx
cmp ecx, r12d
jne 0x1400131a9
lea rdx, str.BugSplat_
lea rcx, [rsp + 0x58]
call fcn.14000d080
nop
test r15, r15
jne 0x14001307f
xor eax, eax
jmp 0x140013088
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, r15
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140018170
lea rdx, [0x140052194]
lea rcx, [rsp + 0x60]
call fcn.1400186f4
nop
mov rbx, qword [rsp + 0x60]
mov r8, rbx
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x58]
call fcn.140018170
nop
lea rcx, [rbx - 0xc]
lea rax, [0x140060bd0]
cmp rcx, rax
je 0x1400130da
lock add dword [rcx], 0xffffffff
jg 0x1400130da
call fcn.140029150
test r14, r14
jne 0x1400130e3
xor eax, eax
jmp 0x1400130ec
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, r14
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140018170
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.14001d660
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r12, rax
test rax, rax
je 0x140013188
mov r9d, dword [rdi + 0x98]
lea r8, [0x14005261c]
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.14002933c
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r14
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
mov ecx, 3
xor r8d, r8d
lea r9d, [rcx - 2]
mov edx, r9d
and qword [rsp + 0x40], r8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r8d
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], r8
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
lea rcx, [rbx - 0xc]
lea rax, [0x140060bd0]
cmp rcx, rax
je 0x1400131a3
lock add dword [rcx], 0xffffffff
jg 0x1400131a3
call fcn.140029150
mov r12d, 1
mov rcx, r13
call fcn.140029390
mov r8, qword [rsi]
mov edx, r12d
mov rcx, rsi
call qword [r8]
mov eax, r12d
jmp 0x1400131d9
mov r8, rbx
lea rdx, str.HTTPS_PUT_response_failed:
mov rcx, rdi
call fcn.140013e18
mov eax, 2
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140027b60
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret