Function at 0x1403eeb00
Capabilities:
Access the windows event log

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rsi, qword [str.Pgj_]
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbx, rdx
cmp ecx, 4
ja case.default.0x1403ee863
lea rdx, [0x14061ae00]
mov ecx, ecx
movsxd rax, dword [rdx + rcx*4]
add rax, rdx
jmp rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x38]
lea r9, [rsp + 0x48]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
je case.default.0x1403ee863
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x48]
movabs rax, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
mov qword [rbx], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [rbx + 8], ecx
xor eax, eax
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rsi]
jne 0x1403eea21
add rsp, 0x68
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x38]
jmp 0x1403ee8a2
mov rax, qword [0x1406a7170]
test rax, rax
je 0x1403ee9e0
lea rcx, [rsp + 0x38]
call rax
jmp 0x1403ee8eb
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je case.default.0x1403ee863
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je case.default.0x1403ee863
mov rax, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cqo
idiv r8
mov qword [rbx], rax
mov rcx, rax
imul rax, rdx, 0x3b9aca00
mov rdx, r8
sar rdx, 1
add rax, rdx
cqo
idiv r8
mov dword [rbx + 8], eax
cmp eax, 0x3b9ac9ff
jle 0x1403ee8c6
add rcx, 1
sub eax, 0x3b9aca00
mov qword [rbx], rcx
mov dword [rbx + 8], eax
jmp 0x1403ee8c6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x38]
lea r9, [rsp + 0x48]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x1403ee898
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x1403ee8c8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1403eea18
lea rdx, str.GetSystemTimePreciseAsFileTime
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1403eea18
mov qword [0x1406a7170], rax
jmp 0x1403ee910
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x1403eea07
call fcn.1403e4f90
nop
nop word [rax + rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [str.Pgj_]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, r8
mov rdi, r9
test ecx, ecx
jne 0x1403eeadd
test edx, edx
je 0x1403eeac0
lea rbp, [rsp + 0x20]
xor ecx, ecx
mov rdx, rbp
call fcn.1403ee830
mov rdx, qword [rbx]
sub rdx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdx
mov eax, dword [rbx + 8]
sub eax, dword [rsp + 0x28]
js 0x1403eeaa8
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov rcx, rbp
call fcn.1403cbf50
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rsi]
jne 0x1403eeaf0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
add eax, 0x3b9aca00
sub rdx, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
jmp 0x1403eea84
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x1403eeaf0
mov rdx, r9
mov rcx, r8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1403cbf50
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x1403eea8f
call fcn.1403e4f90
nop
nop word cs:[rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [str.Pgj_]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov ebx, ecx
test ecx, ecx
jne 0x1403eeb90
movsxd rax, dword [rdx + 8]
imul rcx, qword [rdx], 0x989680
lea rdi, [rsp + 0x30]
mov rdx, rax
imul rax, rax, 0x51eb851f
sar edx, 0x1f
sar rax, 0x25
sub eax, edx
movabs rdx, 0x19db1ded53e8000
cdqe
add rax, rcx
lea rcx, [rsp + 0x28]
add rax, rdx
mov rdx, rdi
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x1403eeb90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
test eax, eax
je 0x1403eeba3
mov rax, qword [rsp + 0x48]
sub rax, qword [rsi]
jne 0x1403eebb1
mov eax, ebx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov ebx, 0xffffffff
jmp 0x1403eeb77
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 1
jmp 0x1403eeb9c
call fcn.1403e4f90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp qword [sym.imp.ADVAPI32.dll_ReportEventW]