Function at 0x140008400
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14002e2c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx esi, byte [rdx + 0x2c]
movzx ebx, byte [rdx + 0x2d]
mov r14, rcx
mov rbp, rdx
lea r8, str.CEnhanceCallerService::Update:_Message1:__d__Message2:_d
lea rcx, [rsp + 0x70]
xor r15d, r15d
mov r9d, esi
mov edx, 0x104
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x20], ebx
call fcn.14000cd5c
xorps xmm0, xmm0
mov rdx, qword [r14 - 0x30]
xor ecx, ecx
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
lea r12d, [r15 + 2]
mov rdi, rax
test rax, rax
je 0x1400084cd
mov rcx, qword [r14 - 0x30]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
lea edx, [r15 + 4]
xor r8d, r8d
xor r9d, r9d
mov rcx, rdi
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
shl ebx, 8
or ebx, esi
lea eax, [rbx - 0x1b1a]
test eax, 0xfffffeff
jne 0x140008696
movzx eax, byte [rbp + 0x30]
movzx esi, byte [rbp + 0x31]
shl esi, 8
or esi, eax
movzx eax, byte [rbp + 0x2f]
shl esi, 8
or esi, eax
movzx eax, byte [rbp + 0x2e]
shl esi, 8
or esi, eax
cmp ebx, 0x1c1a
jne 0x14000852b
movzx eax, byte [rbp + 0x34]
movzx edi, byte [rbp + 0x35]
shl edi, 8
or edi, eax
movzx eax, byte [rbp + 0x33]
shl edi, 8
or edi, eax
movzx eax, byte [rbp + 0x32]
shl edi, 8
or edi, eax
jmp 0x14000852f
mov edi, dword [rsp + 0x50]
lea r8, str.CEnhanceCallerService::Update:_SessionID:__d
lea rcx, [rsp + 0x70]
mov r9d, esi
mov edx, 0x104
call fcn.14000cd5c
mov rdx, qword [r14 - 0x30]
xor ecx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400085b3
mov rcx, qword [r14 - 0x30]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x30], r15d
lea edx, [r8 + 4]
xor r9d, r9d
mov rcx, rbx
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rax, qword [r14 + 0x250]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14000868e
cmp dword [rbx + 0x10], esi
jne 0x1400085e9
movzx eax, byte [rbp + 0x2d]
cmp al, 0x1b
je 0x140008606
cmp al, 0x1c
jne 0x1400085e9
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp edi, eax
jne 0x1400085e9
test edi, edi
jne 0x1400085fa
mov rbx, qword [rbx]
cmp rbx, qword [r14 + 0x250]
jne 0x1400085c6
jmp 0x14000868e
mov dword [rbx + 0x20], 1
jmp 0x14000868e
lea r8, str.CEnhanceCallerService::Update:_Kill_Temped
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov dword [rbx + 0x20], 1
call fcn.14000cd5c
mov rdx, qword [r14 - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000868e
mov rcx, qword [r14 - 0x30]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x30], r15d
lea edx, [r8 + 4]
xor r9d, r9d
mov rcx, rbx
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov dword [rsp + 0x68], 1
mov r9, qword [r14 + 0x248]
mov r8, qword [rbp + 0x18]
mov rax, qword [r9 + 0x20]
mov rdx, qword [r9 + 0x28]
cmp rax, rdx
je 0x1400086ff
nop
mov rcx, qword [rax]
cmp r8, qword [rcx + 0x18]
je 0x1400086c4
add rax, 8
cmp rax, rdx
jne 0x1400086b0
jmp 0x1400086ff
mov rbx, rcx
test rcx, rcx
je 0x1400086ff
mov rdx, rcx
mov rcx, r9
call fcn.140001d50
test eax, eax
je 0x1400086ff
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov r8d, 4
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000b770
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret