Function at 0x1400113f0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140362080]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov cl, 1
call fcn.140011120
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x218], rax
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x40], xmm1
mov r8d, Ordinal_79
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU
lea rcx, [rsp + 0x30]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x60], xmm1
mov r8d, 0x79
lea rdx, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_528540359_3514129255_1504931462_1001
lea rcx, [rsp + 0x50]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x80], xmm1
mov r8d, __WSAFDIsSet
lea rdx, str.HKEY_USERSS_1_5_21_528540359_3514129255_1504931462_1001SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
lea rcx, [rsp + 0x70]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
mov r8d, 0xaf
lea rdx, str.HKEY_USERSS_1_5_21_414359339_4101316891_2733192943_1001SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCacheC:WindowsSystem32_apds.exe.FriendlyAppName
lea rcx, [rbp - 0x70]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, 0xb4
lea rdx, str.HKEY_USERSS_1_5_21_414359339_4101316891_2733192943_1001SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched1AC14E77_02E7_4E5D_B744_2EB1AE5198B7_apds.exe
lea rcx, [rbp - 0x50]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, 0x5d
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
lea rcx, [rbp - 0x30]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, 0xa6
lea rdx, str.HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_873115073_2013695458_1355215832_1001DeviceHarddiskVolume3WindowsSystem32_apds.exe
lea rcx, [rbp - 0x10]
call fcn.14001c030
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x208], xmm0
xor esi, esi
mov qword [rbp + 0x218], rsi
mov edx, 7
lea rcx, [rbp + 0x208]
call fcn.14001c930
lea rax, [rbp + 0x208]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
mov rbx, qword [rbp + 0x208]
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], rbx
lea rax, [rbp + 0x208]
mov qword [rbp + 0x230], rax
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140019ec0
add rbx, 0x20
mov qword [rbp + 0x228], rbx
add rdi, 0x20
lea rax, [rbp + 0x10]
cmp rdi, rax
jne 0x1400115b0
lea r8, [rbp + 0x208]
mov rdx, rbx
mov rcx, rbx
call fcn.14001c1c0
mov qword [rbp + 0x210], rbx
lea r9, [fcn.140019c80]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 7
lea rcx, [rsp + 0x30]
call fcn.140121074
lea rcx, [rbp + 0x208]
call fcn.140010b50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rax
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, 0x42
lea rdx, str.C:Users_username_AppDataLocalMicrosoftCLR_v4.0UsageLogs.
lea rcx, [rbp + 0x10]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov r8d, 0x45
lea rdx, str.C:Users_username_AppDataLocalMicrosoftCLR_v4.0_32UsageLogs.
lea rcx, [rbp + 0x30]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.C:WindowsTemp.
lea rcx, [rbp + 0x50]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.C:WindowsSystem32packages.json
lea rcx, [rbp + 0x70]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.C:WindowsPanther.
lea rcx, [rbp + 0x90]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.C:WINDOWSCbsTemp.
lea rcx, [rbp + 0xb0]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, Ordinal_27
lea rdx, str.C:WindowsSystemTemp.
lea rcx, [rbp + 0xd0]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, Ordinal_27
lea rdx, str.C:WindowsLogsCBS.log
lea rcx, [rbp + 0xf0]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, Ordinal_33
lea rdx, str.C:WindowsLogsMoSetup.log
lea rcx, [rbp + 0x110]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, Ordinal_27
lea rdx, str.C:WindowsPanther.log
lea rcx, [rbp + 0x130]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.C:Windowsinf.log
lea rcx, [rbp + 0x150]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.C:Windowslogs.log
lea rcx, [rbp + 0x170]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, Ordinal_41
lea rdx, str.C:WindowsSoftwareDistribution.log
lea rcx, [rbp + 0x190]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, Ordinal_33
lea rdx, str.C:WindowsMicrosoft.NET.log
lea rcx, [rbp + 0x1b0]
call fcn.14001c030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, Ordinal_45
lea rdx, str.C:Users_username_AppDataLocalTemp.
lea rcx, [rbp + 0x1d0]
call fcn.14001c030
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rsi
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x1f0]
call fcn.14001c930
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea rdi, [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
mov rbx, qword [rbp + 0x1f0]
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], rbx
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x230], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140019ec0
add rbx, 0x20
mov qword [rbp + 0x228], rbx
add rdi, 0x20
lea rax, [rbp + 0x1f0]
cmp rdi, rax
jne 0x140011924
lea r8, [rbp + 0x1f0]
mov rdx, rbx
mov rcx, rbx
call fcn.14001c1c0
mov qword [rbp + 0x1f8], rbx
lea r9, [fcn.140019c80]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x10]
call fcn.140121074
lea rcx, [rbp + 0x1f0]
call fcn.140010ed0
call fcn.1400111c0
xor ecx, ecx
call fcn.140011120
xor edx, edx
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140011a40
lea rax, str.Application
mov qword [rbp + 0x238], rax
lea rax, str.Security
mov qword [rbp + 0x240], rax
lea rax, str.System
mov qword [rbp + 0x248], rax
lea rax, str.Setup
mov qword [rbp + 0x250], rax
lea rax, str.ForwardedEvents
mov qword [rbp + 0x258], rax
lea rbx, [rbp + 0x238]
nop
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140011a27
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rbx, 8
lea rax, [rbp + 0x260]
cmp rbx, rax
jne 0x140011a00
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x20]
call fcn.14000bb00
movabs rcx, 0x7ffffffffa0a1eff
mov rax, qword [rsp + 0x20]
cmp rax, rcx
jge 0x140011a66
add rax, 0x5f5e100
jmp 0x140011a70
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.14001cec0
nop
lea rcx, [rbp + 0x1f0]
call fcn.14001a840
nop
lea rcx, [rbp + 0x208]
call fcn.14001a840
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140120ef0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret