Function at 0x1000026d8
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov r11d, dword [rcx]
xor ebp, ebp
mov r10d, edx
mov rsi, rcx
mov ebx, ebp
mov dword [rax + 8], ebp
mov qword [rax + 0x20], rbp
mov r9d, r11d
cmp r11d, ebp
je 0x1000028ab
lea edi, [rbp + 1]
sub r9d, edi
je 0x10000286e
sub r9d, edi
je 0x100002833
sub r9d, edi
je 0x100002821
sub r9d, edi
je 0x1000027c7
sub r9d, edi
je 0x100002786
cmp r9d, edi
je 0x10000274d
mov dword [rax - 0x38], ebp
lea r8d, [rbp + 2]
mov r9d, 0xc002010b
mov dword [rax - 0x40], r11d
jmp 0x100002976
call fcn.1000041b4
mov rcx, qword [0x100008700]
mov edx, 4
lea r8d, [rdx - 1]
mov ebx, eax
cmp eax, ebp
je 0x10000277b
mov dword [rsp + 0x30], edi
mov r9d, 0xc0020153
mov dword [rsp + 0x28], eax
jmp 0x10000297f
mov r9d, 0x40020154
jmp 0x1000029a3
call fcn.100003e10
mov ebx, eax
cmp eax, ebp
jne 0x100002798
call fcn.1000040b0
mov ebx, eax
mov rcx, qword [0x100008700]
mov r8d, 3
cmp ebx, ebp
je 0x1000027bc
mov dword [rsp + 0x30], edi
mov r9d, 0xc0020151
mov dword [rsp + 0x28], ebx
jmp 0x10000297d
mov r9d, 0x40020152
jmp 0x10000299e
cmp edx, 9
jbe 0x1000028b5
test dil, dl
jne 0x1000028b5
mov edx, 8
cmp edx, r10d
jae 0x1000027fb
lea ecx, [rdx - 8]
shr rcx, 1
cmp word [rsi + rcx*2 + 8], bp
je 0x1000027f8
add edx, 2
cmp edx, r10d
jb 0x1000027e3
cmp edx, r10d
je 0x1000028b5
mov edx, dword [rsi + 4]
mov r9, r8
lea rcx, [rsi + 8]
lea r8, [rsp + 0x70]
call fcn.100005170
cmp eax, ebp
cmove ebx, dword [rsp + 0x70]
jmp 0x1000029c1
mov rcx, qword [0x1000086f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1000029c1
or qword [rsp + 0x88], 0xffffffffffffffff
lea rdx, [rsp + 0x88]
lea rcx, [0x100001698]
call sub.FLTLIB.DLL_FilterCreate
mov rcx, qword [rsp + 0x88]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x1000029c1
call sub.FLTLIB.DLL_FilterClose
jmp 0x1000029c1
xor edx, edx
xor ecx, ecx
call fcn.100002f68
mov rcx, qword [0x100008700]
mov edx, 4
lea r8d, [rdx - 1]
mov ebx, eax
cmp eax, ebp
je 0x1000028a0
mov dword [rsp + 0x30], edi
mov r9d, 0x4002010e
mov dword [rsp + 0x28], eax
jmp 0x10000297f
mov r9d, 0xc002010f
jmp 0x1000029a3
mov edx, 8
cmp r10d, edx
jae 0x1000028bf
mov ebx, 0x80070005
jmp 0x1000029c1
mov r9d, dword [rcx + 4]
mov edi, 1
mov ecx, r9d
cmp r9d, ebp
je 0x100002924
sub ecx, edi
je 0x10000291b
sub ecx, edi
je 0x100002912
cmp ecx, edi
mov rcx, qword [0x100008700]
lea r8d, [rdi + 2]
je 0x100002909
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r9d
mov edx, edi
mov r9d, 0xc0020113
mov ebx, 0x800707d1
mov qword [rsp + 0x20], rbp
call fcn.100003ba8
jmp 0x100002962
lea rax, [0x100001680]
jmp 0x100002938
lea rax, [0x100001688]
jmp 0x10000292b
lea rax, [0x100001670]
jmp 0x10000292b
lea rax, [0x100001658]
mov rcx, qword [0x100008700]
mov r8d, 3
mov r9d, 0x40020112
mov edx, 4
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.100003b40
mov edx, dword [rsi + 4]
mov ecx, edi
call fcn.100002f68
mov ebx, eax
cmp eax, ebp
je 0x10000298b
mov dword [rsp + 0x30], edi
mov r8d, 3
mov r9d, 0xc002010c
mov dword [rsp + 0x28], ebx
mov rcx, qword [0x100008700]
mov edx, edi
mov qword [rsp + 0x20], rbp
call fcn.100003ba8
jmp 0x1000029c1
mov rcx, qword [0x100008700]
mov r8d, 3
mov r9d, 0xc002010d
mov edx, 4
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x28], bp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret