Function at 0x180076810
Capabilities:
Access the windows event log

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov edi, dword [rbp + 0x90]
mov r13, r9
mov rsi, rcx
xor r9d, r9d
mov rcx, qword [rbp + 0x98]
mov r12, r8
mov r15, rdx
mov qword [rsp + 0x50], rcx
lea r14d, [rdi + 0x549]
mov ebx, edi
cmp edi, r14d
jae 0x180076b71
mov edi, dword [rsp + 0x48]
lea edx, [r9 + 0x65]
movabs r8, 0x6f006c006c
nop dword [rax]
cmp ebx, 0x1ee
ja 0x180076a1d
je 0x180076e73
mov eax, ebx
sub eax, 0xc9
je 0x1800769e1
sub eax, 0x2f
je 0x1800769ad
sub eax, 0x4c
je 0x180076975
sub eax, 0x2f
je 0x1800768d9
cmp eax, 0x4c
jne 0x180076b5f
lea r8d, [rax - 0x4b]
lea rdx, [0x1800d1340]
lea rcx, [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180076b08
test edi, edi
jne 0x180076c04
mov eax, dword [r12]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov dword [rsp + 0x68], eax
mov eax, dword [rcx]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov eax, dword [r13]
mov dword [rsp + 0x48], eax
mov rax, qword [rsi]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x60], r9d
lea r9d, [rdi + 0x1f]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.180092840
mov edi, eax
lea rcx, [rsp + 0x78]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0xc7
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.180059440
mov dword [rsp + 0x60], edi
jmp 0x180076b08
lea rcx, [rbp - 0x48]
mov word [rbp - 0x3a], r9w
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180076982
mov eax, dword [0x1800d2cd0]
mov dword [rcx], eax
movzx eax, word [0x1800d2cd4]
mov word [rcx + 4], ax
mov rcx, qword [rsp + 0x50]
mov dword [rbp - 0x36], edx
jmp 0x180076b5f
mov rax, qword [rsi]
cmp dword [rax], 0x7f2bb701
jne 0x180076c0b
mov eax, dword [rax + 0x28]
lea r9, [rsp + 0x48]
mov r8d, 0x28
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x78]
xor ecx, ecx
call fcn.1800a5750
mov edi, eax
jmp 0x180076b08
mov r8d, 6
lea rdx, str.Zc:si
lea rcx, [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 1
lea rdx, [0x1800d2cfc]
lea rcx, [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, 0x65
mov word [rbp - 0x3c], dx
jmp 0x180076b0d
mov eax, ebx
sub eax, 0x23a
je 0x180076b5b
sub eax, 0x7b
je 0x180076b21
sub eax, 0x7b
je 0x180076ac8
sub eax, 0x7b
je 0x180076a8b
cmp eax, 0x7b
jne 0x180076b5f
lea r8d, [rax - 0x7a]
lea rdx, [0x1800d2cd8]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 5
lea rdx, str.eLef
lea rcx, [rbp + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x73
mov dword [rbp + 0xc], 0x74
mov word [rbp - 0x68], ax
jmp 0x180076b08
lea rcx, [rbp - 0x20]
mov dword [rbp - 4], 0x41
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180076aa0
mov eax, dword [0x1800d2d00]
mov dword [rcx], eax
movzx eax, word [0x1800d2d04]
mov word [rcx + 4], ax
mov rcx, qword [rsp + 0x50]
jmp 0x180076b5f
mov r8d, 0xa
lea rdx, [rbp - 0x1a]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov r8d, 7
mov dword [rbp - 0x18], 0x5f
lea rdx, str.Neighb
lea rcx, [rbp - 0x16]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rax, 0x720075006f
mov qword [rbp - 0xa], rax
mov edx, 0x65
mov rcx, qword [rsp + 0x50]
movabs r8, 0x6f006c006c
xor r9d, r9d
jmp 0x180076b5f
mov eax, dword [0x1800d2d08]
mov dword [rbp - 0x2c], eax
movzx eax, word [0x1800d2d0c]
mov word [rbp - 0x28], ax
lea rax, [rbp - 0x20]
sub rax, 2
mov word [rbp - 0x20], r9w
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180076b42
movsd xmm0, qword [0x1800d2d10]
movsd qword [rax], xmm0
jmp 0x180076b5f
mov qword [rbp - 0x32], r8
add ebx, 0x7b
cmp ebx, r14d
jb 0x180076880
mov edi, dword [rbp + 0x90]
imul ebx, dword [rbp + 0x90], 0x4b0
mov dword [rsp + 0x48], ebx
cmp dword [rbp + 0x90], ebx
ja 0x180076e73
mov r14d, dword [rsp + 0x48]
mov edx, 0x64
movzx r12d, byte [rsp + 0x40]
movzx r13d, byte [rsp + 0x40]
mov rsi, qword [rbp - 0x70]
movzx r15d, byte [rsp + 0x40]
lea r8d, [rdx - 0x31]
mov eax, dword [rbp + 0x90]
lea r10d, [rdx - 0x32]
lea r11d, [rdx - 0x36]
nop dword [rax]
cmp edi, 0x1d7e1
ja 0x180076cbf
je 0x180076c7c
cmp edi, 0xec55
ja 0x180076c54
je 0x180076c42
cmp edi, 0xc9
je 0x180076c2d
cmp edi, 0x4f4d
je 0x180076c15
cmp edi, 0x9dd1
jne 0x180076e66
mov dword [rbp - 0x56], 0x6c0064
jmp 0x180076e66
mov eax, edi
jmp 0x180076e77
mov eax, 0x7f2bb701
jmp 0x180076e77
mov dword [rbp - 0x60], 0x790061
mov dword [rbp - 0x5c], 0x320033
mov word [rbp - 0x58], r11w
jmp 0x180076e66
mov ecx, 0x73
mov dword [rbp - 0x64], 0x65006c
mov word [rbp - 0x66], cx
jmp 0x180076e66
mov dword [rbp - 0x52], 0x6c
mov r15b, 1
mov rsi, r9
jmp 0x180076e66
cmp edi, 0x13ad9
je 0x180076c74
cmp edi, 0x1895d
jne 0x180076e66
mov r13b, 1
mov qword [rbp - 0x80], r9
jmp 0x180076e66
mov r12b, 1
jmp 0x180076e66
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x78], r9
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rsi, rax
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r14d, eax
test rsi, rsi
je 0x180076e4b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor r9d, r9d
mov esi, r9d
jmp 0x180076e4e
cmp edi, 0x22665
je 0x180076e0e
cmp edi, 0x274e9
je 0x180076de8
cmp edi, 0x2c36d
je 0x180076d08
cmp edi, 0x311f1
je 0x180076cf8
cmp edi, 0x36075
je 0x180076e73
jmp 0x180076e66
call qword [rbp - 0x70]
cmp eax, 1
sete byte [rsp + 0x60]
jmp 0x180076e4b
cmp dword [rsp + 0x68], 0
mov ecx, r9d
movzx eax, r15b
cmovne ecx, eax
movzx r15d, cl
test cl, cl
je 0x180076d44
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenBackupEventLogW]
mov rsi, rax
test rax, rax
jne 0x180076d38
xor r15b, r15b
jmp 0x180076d41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor r9d, r9d
test r12b, r12b
je 0x180076da7
mov ebx, 0xb1
nop
mov eax, ebx
sub eax, 0xb0
je 0x180076d76
cmp eax, 1
jne 0x180076d93
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], r9
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r14d, eax
jmp 0x180076d93
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180076d84
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180076d93
call sub.RPCRT4.dll_MesHandleFree
dec ebx
mov r9d, 0
cmp ebx, 0xaf
ja 0x180076d50
mov ebx, dword [rsp + 0x48]
test r13b, r13b
je 0x180076e4b
xor eax, eax
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x70], rax
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x78]
mov dword [rsp + 0x58], eax
test rcx, rcx
je 0x180076dd7
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180076e4b
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180076e4b
movzx eax, r12b
test r14d, r14d
mov ecx, r9d
cmove ecx, eax
cmp dword [rsp + 0x58], 0
movzx r12d, cl
movzx eax, r13b
mov ecx, r9d
cmove ecx, eax
movzx r13d, cl
jmp 0x180076e60
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edx, 0xb7
mov dword [rsp + 0x58], eax
lea r9, [rbp - 0x68]
xor r8d, r8d
lea ecx, [rdx - 0x5e]
call fcn.18009e510
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x70], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_BackupEventLogW]
mov dword [rsp + 0x68], eax
xor r9d, r9d
mov r11d, 0x2e
lea r10d, [r11 + 4]
lea r8d, [r11 + 5]
lea edx, [r11 + 0x36]
mov eax, dword [rbp + 0x90]
imul ecx, eax, 0x64
add edi, ecx
cmp edi, ebx
jbe 0x180076bc0
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1800c0ae0
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret