Function at 0x140002780
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, edx
mov rsi, rcx
mov rcx, qword [0x140078970]
lea rbp, [0x140078970]
cmp rcx, rbp
je 0x1400027de
test dword [rcx + 0x1c], 0x8000000
je 0x1400027de
cmp byte [rcx + 0x19], 5
jb 0x1400027de
mov rcx, qword [rcx + 0x10]
lea r8, [0x140069098]
mov edx, 0x2b
call fcn.1400017a0
mov rcx, qword [0x140078970]
mov edi, 2
cmp ebx, edi
jne 0x140002803
cmp rcx, rbp
je 0x140002866
test dword [rcx + 0x1c], 0x8000000
je 0x14000283d
cmp byte [rcx + 0x19], 5
jb 0x14000283d
lea edx, [rdi + 0x2a]
mov r9d, edi
jmp 0x140002826
cmp ebx, 1
jne 0x14000298b
cmp rcx, rbp
je 0x140002866
test dword [rcx + 0x1c], 0x8000000
je 0x14000283d
cmp byte [rcx + 0x19], 5
jb 0x14000283d
lea edx, [rbx + 0x2c]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x140069098]
call fcn.1400017d0
mov rcx, qword [0x140078970]
cmp rcx, rbp
je 0x140002866
test dword [rcx + 0x1c], 0x8000000
je 0x140002866
cmp byte [rcx + 0x19], 5
jb 0x140002866
mov rcx, qword [rcx + 0x10]
lea r8, [0x140069098]
mov edx, 0x2f
call fcn.1400017a0
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400028cb
mov rcx, qword [rsi + 8]
lea rax, str.Siva_hard_reset
mov qword [rsp + 0x50], rcx
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
lea edx, [r8 + 4]
mov word [rsp + 0x28], di
lea r9d, [r8 + 0x65]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [0x140078970]
cmp rcx, rbp
je 0x1400028fb
test dword [rcx + 0x1c], 0x100000
je 0x1400028fb
cmp byte [rcx + 0x19], 5
jb 0x1400028fb
mov rcx, qword [rcx + 0x10]
lea r8, [0x14006a120]
mov edx, 0xe
call fcn.1400017a0
call fcn.14000fc20
mov ebx, eax
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x140078970]
cmp rcx, rbp
je 0x140002a1a
test dword [rcx + 0x1c], 0x100000
je 0x14000294e
cmp byte [rcx + 0x19], 5
jb 0x14000294e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14006a120]
mov edx, 0xf
mov r9d, eax
call fcn.1400017d0
mov rcx, qword [0x140078970]
cmp rcx, rbp
je 0x140002a1a
test dword [rcx + 0x1c], 0x8000000
je 0x140002a1a
cmp byte [rcx + 0x19], 5
jb 0x140002a1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140069098]
mov edx, 0x30
mov r9d, ebx
call fcn.1400017d0
jmp 0x140002a1a
cmp rcx, rbp
je 0x1400029b7
test dword [rcx + 0x1c], 0x8000000
je 0x1400029b7
cmp byte [rcx + 0x19], 5
jb 0x1400029b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140069098]
mov edx, 0x2e
mov r9d, ebx
call fcn.1400017d0
mov rdx, qword [rsi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140002a1a
mov rcx, qword [rsi + 8]
lea rax, str.Siva_unhandled_reset_case
mov qword [rsp + 0x50], rcx
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov edx, edi
mov dword [rsp + 0x30], ecx
lea r9d, [r8 + 0x63]
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400117b0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret