Function at 0x14012f8a0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, reloc.WS2_32.dll_accept
call fcn.14027ddb0
mov cl, 3
mov word [rbp - 0x40], 3
movsx edx, cl
xorps xmm0, xmm0
movzx eax, dx
movzx ecx, dx
xor ax, 0x42
xor cx, 0x6a
mov word [rbp - 0x3e], ax
mov rbx, 0xffffffffffffffff
movzx eax, dx
mov word [rbp - 0x36], cx
xor ax, 0x73
mov word [rbp - 0x2e], cx
mov word [rbp - 0x3c], ax
mov r8, rbx
mov word [rbp - 0x3a], ax
movzx eax, dx
xor ax, 0x6f
mov word [rbp - 0x38], ax
movzx eax, dx
xor ax, 0x60
mov word [rbp - 0x34], ax
movzx eax, dx
xor ax, 0x62
mov word [rbp - 0x32], ax
movzx eax, dx
xor ax, 0x77
mov word [rbp - 0x30], ax
movzx eax, dx
xor ax, 0x6c
xor dx, 0x6d
xor esi, esi
mov word [rbp - 0x2c], ax
mov word [rbp - 0x28], si
lea rax, [rbp - 0x3e]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov word [rbp - 0x2a], dx
movups xmmword [rbp - 0x20], xmm0
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14012f960
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400ce230
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14012f9a9
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400cdb20
mov cl, 0x7a
mov word [rbp - 0x40], 0x7a
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x32], si
xor ax, 0x29
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
mov r8, rbx
movzx eax, cx
mov qword [rbp - 8], rsi
xor ax, 3
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 9
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 0xe
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 0x1f
xor cx, 0x17
mov word [rbp - 0x36], ax
mov word [rbp - 0x34], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
inc r8
cmp word [rax + r8*2], si
jne 0x14012fa16
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400ce230
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x14012fa5f
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400cdb20
mov cl, 0x76
mov word [rbp - 0x40], 0x76
movsx ecx, cl
xorps xmm0, xmm0
movzx eax, cx
mov word [rbp - 0x2e], si
xor ax, 0x25
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x3e], ax
movzx eax, cx
xor ax, 0x13
mov qword [rbp - 8], rsi
mov word [rbp - 0x3c], ax
movzx eax, cx
xor ax, 0x15
mov word [rbp - 0x3a], ax
movzx eax, cx
xor ax, 3
mov word [rbp - 0x38], ax
movzx eax, cx
xor ax, 4
mov word [rbp - 0x36], ax
movzx eax, cx
xor ax, 0x1f
mov word [rbp - 0x34], ax
movzx eax, cx
xor ax, 2
xor cx, 0xf
mov word [rbp - 0x32], ax
mov word [rbp - 0x30], cx
lea rax, [rbp - 0x3e]
movups xmmword [rbp - 0x20], xmm0
nop
inc rbx
cmp word [rax + rbx*2], si
jne 0x14012fae0
mov r8, rbx
lea rdx, [rbp - 0x3e]
lea rcx, [rbp - 0x20]
call fcn.1400ce230
cmp qword [rbp - 8], 7
lea rdx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x14012fb2b
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rcx, [rbp - 0x20]
call fcn.1400cdb20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret