Function at 0x1400315b0
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x148
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov rax, qword [0x140048dc0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0xb0], 0
xor eax, eax
mov word [rsp + 0x50], ax
mov qword [rsp + 0x60], 0
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov dword [rsp + 0xb8], 0
mov byte [rsp + 0x54], 1
mov rcx, qword [rsp + 0x160]
call fcn.1400023d0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
jne 0x140031670
mov byte [rsp + 0x100], 0
mov rcx, qword [rsp + 0x170]
call fcn.140002510
mov al, byte [rsp + 0x100]
jmp 0x14003194f
mov rcx, qword [rsp + 0x170]
call fcn.140031d40
movzx eax, al
test eax, eax
jne 0x140031804
lea rdx, [0x14003d4ef]
lea rcx, [rsp + 0xc8]
call fcn.140002340
nop
mov rcx, qword [rsp + 0x170]
call fcn.140002750
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0xf0], 0
jmp 0x1400316d3
mov rax, qword [rsp + 0xf0]
add rax, 1
mov qword [rsp + 0xf0], rax
movsxd rax, dword [rsp + 0xb8]
cmp qword [rsp + 0xf0], rax
jae 0x1400317f7
cmp qword [rsp + 0xf0], 0xa
jae 0x1400317f7
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x170]
call fcn.140031d80
mov rcx, rax
call fcn.1400023f0
mov rcx, rax
add rcx, 1
call fcn.1400062dc
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x108]
mov qword [rsp + rcx*8 + 0x60], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x170]
call fcn.140031d80
mov rcx, rax
call fcn.1400023f0
mov r8, rax
add r8, 1
xor edx, edx
mov rcx, qword [rsp + 0xf0]
mov rcx, qword [rsp + rcx*8 + 0x60]
call fcn.140015b00
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x170]
call fcn.140031d80
mov rcx, rax
call fcn.1400023f0
mov rbx, rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x170]
call fcn.140031d80
mov rcx, rax
call fcn.1400023d0
mov rdi, rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x170]
call fcn.140031d80
mov rcx, rax
call fcn.1400023f0
mov rdx, rax
add rdx, 1
mov r9, rbx
mov r8, rdi
mov rcx, qword [rsp + 0xf0]
mov rcx, qword [rsp + rcx*8 + 0x60]
call fcn.140016c08
jmp 0x1400316bf
lea rcx, [rsp + 0xc8]
call fcn.140001260
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0x128], eax
cmp dword [rsp + 0x128], 0
je 0x140031832
cmp dword [rsp + 0x128], 1
je 0x14003183e
cmp dword [rsp + 0x128], 2
je 0x14003184a
jmp 0x140031856
mov eax, 1
mov word [rsp + 0x50], ax
jmp 0x140031860
mov eax, 4
mov word [rsp + 0x50], ax
jmp 0x140031860
mov eax, 2
mov word [rsp + 0x50], ax
jmp 0x140031860
mov eax, 1
mov word [rsp + 0x50], ax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
movzx eax, word [rsp + 0xb8]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x168]
xor r8d, r8d
movzx edx, word [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x1400318c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xf8], eax
mov byte [rsp + 0x54], 0
mov dword [rsp + 0xfc], 0
jmp 0x1400318e3
mov eax, dword [rsp + 0xfc]
add eax, 1
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0xfc], 0xa
jge 0x140031921
movsxd rax, dword [rsp + 0xfc]
cmp qword [rsp + rax*8 + 0x60], 0
je 0x14003191f
movsxd rax, dword [rsp + 0xfc]
mov rax, qword [rsp + rax*8 + 0x60]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1400062d4
jmp 0x1400318d2
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
movzx eax, byte [rsp + 0x54]
mov byte [rsp + 0x118], al
mov rcx, qword [rsp + 0x170]
call fcn.140002510
mov al, byte [rsp + 0x118]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400144f0
add rsp, 0x148
pop rdi
pop rbx
ret