Function at 0x14000fe10
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x320
mov rax, qword [0x140081030]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rdi, r8
mov rsi, qword [0x140085bf0]
mov qword [rsp + 0x50], rsi
cmp edx, 0x12
jne 0x14000ff00
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMRESUMEAUTOMATIC
nop word [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x14000fe70
lea r8, str.Service_receive_PBT_APMRESUMEAUTOMATIC
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000fee7
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fee2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001082f
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
cmp edx, 1
jne 0x14000ffb0
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMQUERYSTANDBY
nop
add r9, 2
cmp word [r9], 0
jne 0x14000ff20
lea r8, str.Service_receive_PBT_APMQUERYSTANDBY
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000ff97
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010835
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
test edx, edx
jne 0x1400100bb
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r14, rax
lea rdi, str.Service_receive_PBT_APMQUERYSUSPEND
xor ebx, ebx
test rax, rax
je 0x14001001e
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
lea eax, [rbx + 2]
xor r8d, r8d
lea edx, [rbx + 4]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
mov r9, rdi
nop
add r9, 2
cmp word [r9], 0
jne 0x140010030
mov r8, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400100a3
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001009e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001083b
call fcn.14003a290
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
jmp 0x1400107ec
cmp edx, 4
jne 0x140010186
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMSUSPEND
nop dword [rax]
add r9, 2
cmp word [r9], 0
jne 0x1400100e0
lea r8, str.Service_receive_PBT_APMSUSPEND
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010157
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010152
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010841
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
lea rcx, [rsp + 0x80]
call fcn.14000ef10
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x58]
jmp 0x1400107f9
cmp edx, 7
jne 0x14001024a
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMRESUMESUSPEND
add r9, 2
cmp word [r9], 0
jne 0x1400101a4
lea r8, str.Service_receive_PBT_APMRESUMESUSPEND
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14001021b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010847
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
lea rcx, [rsp + 0x80]
call fcn.14000ef10
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
jmp 0x1400107f9
cmp edx, 6
jne 0x140010300
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMRESUMECRITICAL
nop dword [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x140010270
lea r8, str.Service_receive_PBT_APMRESUMECRITICAL
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400102e7
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400102e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001084d
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
cmp edx, 0xa
jne 0x1400103b0
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PBT_APMPOWERSTATUSCHANGE
nop
add r9, 2
cmp word [r9], 0
jne 0x140010320
lea r8, str.Service_receive_PBT_APMPOWERSTATUSCHANGE
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010397
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010853
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
cmp edx, 0x8013
jne 0x140010730
mov rdx, qword [0x1400645e0]
mov rcx, qword [0x1400645e8]
cmp rdx, qword [r8]
jne 0x140010482
cmp rcx, qword [r8 + 8]
jne 0x140010482
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.GUID_CONSOLE_DISPLAY_STATE_Receive_monitors_display_change
add r9, 2
cmp word [r9], 0
jne 0x1400103f2
lea r8, str.GUID_CONSOLE_DISPLAY_STATE_Receive_monitors_display_change
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010469
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010464
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010859
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
mov rax, qword [0x1400645b0]
cmp rax, qword [r8]
jne 0x1400104bc
mov rax, qword [0x1400645b8]
cmp rax, qword [r8 + 8]
jne 0x1400104bc
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x1400107f9
lea rax, str.GUID_VIDEO_ADAPTIVE_DISPLAY_BRIGHTNESS_Receive_monitors_display_brightness_change.
jmp 0x140010520
mov rax, qword [0x1400645d0]
cmp rax, qword [r8]
jne 0x1400104f6
mov rax, qword [0x1400645d8]
cmp rax, qword [r8 + 8]
jne 0x1400104f6
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x1400107f9
lea rax, str.GUID_BATTERY_PERCENTAGE_REMAINING_The_power_source_for_the_system.
jmp 0x140010520
cmp rdx, qword [r8]
jne 0x140010572
cmp rcx, qword [r8 + 8]
jne 0x140010572
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x1400107f9
lea rax, str.GUID_CONSOLE_DISPLAY_STATE.
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov eax, 2
xor r8d, r8d
lea edx, [rax + 2]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1400107f9
mov rax, qword [0x1400645a0]
cmp rax, qword [r8]
jne 0x140010664
mov rax, qword [0x1400645a8]
cmp rax, qword [r8 + 8]
jne 0x140010664
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_GUID_MONITOR_POWER_ON
nop dword [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x1400105b0
lea r8, str.Service_receive_GUID_MONITOR_POWER_ON
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010627
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010622
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001085f
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
lea rcx, [rsp + 0x80]
call fcn.14000ef10
mov rax, qword [rsi]
mov rcx, rsi
cmp byte [rdi + 0x14], 1
jne 0x14001065c
call qword [rax + 0x38]
jmp 0x1400107f9
call qword [rax + 0x40]
jmp 0x1400107f9
mov rax, qword [0x1400645c0]
cmp rax, qword [r8]
jne 0x1400107f9
mov rax, qword [0x1400645c8]
cmp rax, qword [r8 + 8]
jne 0x1400107f9
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_GUID_SYSTEM_AWAYMODE
nop word [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x1400106a0
lea r8, str.Service_receive_GUID_SYSTEM_AWAYMODE
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140010717
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010712
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010865
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
jmp 0x1400107ec
mov r9d, edx
lea r8, str.Service_receivePowerEvent_0x_08x
mov edx, 0x104
lea rcx, [rsp + 0x100]
call fcn.14000cb40
lea rcx, [rsp + 0x80]
call fcn.14000f000
nop
lea r9, str.Service_receive_PowerEvent
add r9, 2
cmp word [r9], 0
jne 0x140010761
lea r8, str.Service_receive_PowerEvent
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14000f380
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
call fcn.14000bc80
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400107d8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001086b
call fcn.14003a290
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
lea rcx, [rsp + 0x80]
call fcn.14000ef10
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x68]
nop
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14003a270
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
nop
call fcn.1400443d0
int3