Function at 0x1008060
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
mov qword [rsp + 0x250], 0xfffffffffffffffe
mov rax, qword [0x01023178]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov word [rsp + 0x60], r9w
mov r14, r8
mov dword [rsp + 0x110], edx
mov r13, rcx
mov qword [r11 - 0x220], r8
lea rax, [rsp + 0x70]
mov qword [r11 - 0x1e8], rax
lea r15, [0x01002280]
mov qword [rsp + 0x70], r15
lea rax, [0x01002270]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0x426
mov dword [rsp + 0x84], 0x4000
xor ebx, ebx
mov dword [rsp + 0x88], ebx
mov word [rsp + 0xe0], bx
mov byte [rsp + 0xe2], bl
mov byte [rsp + 0xe3], 1
mov qword [r11 - 0x2a8], rbx
mov qword [r11 - 0x2a0], rbx
mov qword [r11 - 0x298], rbx
mov qword [r11 - 0x290], rbx
mov qword [r11 - 0x288], rbx
mov qword [r11 - 0x280], rbx
mov qword [r11 - 0x278], rbx
mov qword [r11 - 0x270], rbx
mov qword [r11 - 0x268], rbx
mov qword [r11 - 0x260], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xe8], ebx
lea rcx, [0x01002230]
mov qword [r11 - 0x248], rcx
mov rax, qword [rsp + 0x78]
mov qword [r11 - 0x240], rax
mov r8d, dword [r11 - 0x2b8]
mov dword [r11 - 0x238], r8d
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x104], eax
mov edi, dword [rsp + 0x88]
mov dword [rsp + 0x150], edi
mov dword [rsp + 0x108], edi
cmp dword [0x010237e0], ebx
je 0x1008200
cmp dword [0x01023800], ebx
je 0x1008200
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9d, edi
mov rdx, qword [rsp + 0x70]
lea rcx, [0x010237e0]
call fcn.0100f6a0
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, edi
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp byte [rsp + 0xe3], 0
je 0x100823d
lea rdi, [rsp + 0x90]
mov r12d, 0xa
mov rsi, r12
nop
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1008231
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rdi], rbx
add rdi, 8
sub rsi, 1
jne 0x1008220
jmp 0x1008243
mov r12d, 0xa
lea rcx, [0x0100e930]
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
nop
mov byte [rsp + 0x2b0], 0
xor eax, eax
mov qword [rsp + 0x2b1], rax
mov qword [rsp + 0x2b9], rax
mov qword [rsp + 0x2c1], rax
mov dword [rsp + 0x2c9], eax
mov word [rsp + 0x2cd], ax
mov byte [rsp + 0x2cf], al
mov r9, qword [r14 + 8]
mov edi, 8
mov rdx, rdi
mov qword [rsp + 0x188], rdx
mov qword [rsp + 0x168], r9
mov r8d, 0x20
mov qword [rsp + 0x198], r8
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x140], rax
mov r10, rbx
mov qword [rsp + 0x120], rbx
nop
test r8, r8
je 0x1008322
test rdx, rdx
je 0x100833a
movzx ecx, byte [r9]
test cl, cl
je 0x100833a
mov byte [rax], cl
add rax, 1
mov qword [rsp + 0x140], rax
add r9, 1
mov qword [rsp + 0x168], r9
sub r8, 1
mov qword [rsp + 0x198], r8
sub rdx, 1
mov qword [rsp + 0x188], rdx
add r10, 1
mov qword [rsp + 0x120], r10
jmp 0x10082d0
sub rax, 1
mov qword [rsp + 0x140], rax
sub r10, 1
mov qword [rsp + 0x120], r10
mov byte [rax], 0
mov r8d, r12d
lea rdx, [rsp + 0x2d0]
mov ecx, dword [r14 + 0x10]
call qword [sym.imp.MSVCR80.dll__ultoa]
mov r11, rdi
mov qword [rsp + 0x1b0], rdi
lea r8, [rsp + 0x2d0]
mov qword [rsp + 0x180], r8
mov edx, 0x18
mov qword [rsp + 0x1a0], rdx
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x160], rax
mov r9, rbx
mov qword [rsp + 0x148], rbx
test rdx, rdx
je 0x10083e7
test r11, r11
je 0x10083ff
movzx ecx, byte [r8]
test cl, cl
je 0x10083ff
mov byte [rax], cl
add rax, 1
mov qword [rsp + 0x160], rax
add r8, 1
mov qword [rsp + 0x180], r8
sub rdx, 1
mov qword [rsp + 0x1a0], rdx
sub r11, 1
mov qword [rsp + 0x1b0], r11
add r9, 1
mov qword [rsp + 0x148], r9
jmp 0x1008395
sub rax, 1
mov qword [rsp + 0x160], rax
sub r9, 1
mov qword [rsp + 0x148], r9
mov byte [rax], 0
mov r9, qword [r13 + 0x10]
mov rdx, rdi
mov qword [rsp + 0x1a8], rdx
mov qword [rsp + 0x190], r9
mov r8d, 0x10
mov qword [rsp + 0x1b8], r8
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x138], rax
mov r10, rbx
mov qword [rsp + 0x158], rbx
test r8, r8
je 0x1008494
test rdx, rdx
je 0x10084ac
movzx ecx, byte [r9]
test cl, cl
je 0x10084ac
mov byte [rax], cl
add rax, 1
mov qword [rsp + 0x138], rax
add r9, 1
mov qword [rsp + 0x190], r9
sub r8, 1
mov qword [rsp + 0x1b8], r8
sub rdx, 1
mov qword [rsp + 0x1a8], rdx
add r10, 1
mov qword [rsp + 0x158], r10
jmp 0x1008442
sub rax, 1
mov qword [rsp + 0x138], rax
sub r10, 1
mov qword [rsp + 0x158], r10
mov byte [rax], 0
mov r8d, r12d
lea rdx, [rsp + 0x2d0]
mov ecx, dword [r13 + 0x18]
call qword [sym.imp.MSVCR80.dll__ultoa]
mov qword [rsp + 0x178], rdi
lea r8, [rsp + 0x2d0]
mov qword [rsp + 0x1c8], r8
mov rdx, rdi
mov qword [rsp + 0x170], rdx
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x128], rax
mov r9, rbx
mov qword [rsp + 0x130], rbx
test rdx, rdx
je 0x1008554
test rdi, rdi
je 0x100856c
movzx ecx, byte [r8]
test cl, cl
je 0x100856c
mov byte [rax], cl
add rax, 1
mov qword [rsp + 0x128], rax
add r8, 1
mov qword [rsp + 0x1c8], r8
sub rdx, 1
mov qword [rsp + 0x170], rdx
sub rdi, 1
mov qword [rsp + 0x178], rdi
add r9, 1
mov qword [rsp + 0x130], r9
jmp 0x1008502
sub rax, 1
mov qword [rsp + 0x128], rax
sub r9, 1
mov qword [rsp + 0x130], r9
mov byte [rax], 0
movzx edi, word [r14 + 0x70]
xor dx, dx
mov word [rsp + 0x58], dx
nop
cmp dx, di
jae 0x10085a6
cmp dx, 0xa
jae 0x100859b
movzx ecx, dx
mov rax, qword [r14 + rcx*8 + 0x20]
mov qword [rsp + rcx*8 + 0x260], rax
add dx, 1
mov word [rsp + 0x58], dx
jmp 0x1008580
lea rdx, [0x01001ac0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
jne 0x1008662
lea rsi, [rsp + 0x1d8]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x1d8], r15
lea rdi, [0x01002270]
mov qword [rsp + 0x1e0], rdi
mov dword [rsp + 0x1e8], 0x451
mov dword [rsp + 0x1ec], 0x4000
mov dword [rsp + 0x1f0], ebx
mov word [rsp + 0x248], ax
mov byte [rsp + 0x24a], al
mov byte [rsp + 0x24b], 1
xor cx, cx
mov word [rsp + 0x5c], cx
cmp cx, 0xa
jae 0x100863a
movzx eax, cx
mov qword [rsi + rax*8 + 0x20], rbx
add cx, 1
mov word [rsp + 0x5c], cx
jmp 0x1008621
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea r9, [0x010021e0]
mov r8d, 0x8000ffff
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.01007cc0
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x110]
xor r8d, r8d
movzx edx, word [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x100874b
lea r13, [rsp + 0x1d8]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x1d8], r15
lea rdi, [0x01002270]
mov qword [rsp + 0x1e0], rdi
mov dword [rsp + 0x1e8], 0x461
mov dword [rsp + 0x1ec], 0x4000
mov dword [rsp + 0x1f0], ebx
mov word [rsp + 0x248], ax
mov byte [rsp + 0x24a], al
mov byte [rsp + 0x24b], 1
xor cx, cx
mov word [rsp + 0x54], cx
nop
cmp cx, 0xa
jae 0x1008729
movzx eax, cx
mov qword [r13 + rax*8 + 0x20], rbx
add cx, 1
mov word [rsp + 0x54], cx
jmp 0x1008710
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x010021a0]
mov rdx, r13
lea rcx, [rsp + 0xe8]
call fcn.010062d0
jmp 0x1008752
lea rdi, [0x01002270]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test eax, eax
jne 0x1008802
lea rsi, [rsp + 0x1d8]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x1d8], r15
mov qword [rsp + 0x1e0], rdi
mov dword [rsp + 0x1e8], 0x466
mov dword [rsp + 0x1ec], 0x4000
mov dword [rsp + 0x1f0], ebx
mov word [rsp + 0x248], ax
mov byte [rsp + 0x24a], al
mov byte [rsp + 0x24b], 1
xor cx, cx
mov word [rsp + 0x50], cx
nop
cmp cx, 0xa
jae 0x10087d9
movzx eax, cx
mov qword [rsi + rax*8 + 0x20], rbx
add cx, 1
mov word [rsp + 0x50], cx
jmp 0x10087c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea r9, [0x01002150]
mov r8d, 0x8000ffff
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.01007cc0
nop
mov edi, dword [rsp + 0x150]
jmp 0x100884e
cmp dword [0x010237e0], 0
je 0x10088bf
cmp dword [0x01023800], 0
je 0x10088bf
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0x20], eax
mov r9d, edi
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
mov r8d, dword [rsp + 0xe8]
lea rdx, [0x01001578]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, edi
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp byte [r14 + 0x73], 0
je 0x10088eb
lea rdi, [r14 + 0x20]
nop
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x10088e1
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rdi], rbx
add rdi, 8
sub r12, 1
jne 0x10088d0
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.0100db20
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret