Function at 0x14007f240
Capabilities:
Access the windows event log

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], 0xfffffffffffffffe
mov r14, r8
mov r15, rdx
mov rsi, rcx
lea rcx, [rbp - 0x30]
call qword [r8]
movsx rcx, byte [rbp + 0x38]
cmp rcx, 7
ja 0x14007f2b3
lea rax, [0x1401327cc]
movzx edi, word [rax + rcx*2]
lea rax, str.LOG_TRACEL3
mov rax, qword [rax + rcx*8]
movsx rdx, cl
lea rcx, [0x140132820]
mov rcx, qword [rcx + rdx*8]
lea r8, [0x140132860]
mov ebx, dword [r8 + rdx*4]
jmp 0x14007f2c8
mov ebx, 0x20000007
mov ecx, 9
lea rax, str.LOG_ERROR
mov di, 1
mov r13, qword [r15 + 8]
mov r12, qword [r15 + 0x10]
mov rdx, qword [r14 + 8]
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14007f2ee
mov rdx, qword [rdx]
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r12
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm2
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rdx
mov qword [rbp + 0xa8], r8
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0x100], 0xdddddd
lea rax, [rbp + 0x60]
mov qword [rbp + 0x108], rax
lea rax, str.MESSAGE__CODE_FILE__CODE_LINE__CODE_FUNC__SYSLOG_IDENTIFIERtrackd___PRIORITY
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 0x5e
lea r15, [rbp + 0xe0]
lea r14, [rbp + 0x120]
lea r8, [rbp + 0x100]
mov rcx, r15
mov rdx, r14
call fcn.1400b1b80
mov rax, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 0x10
jb 0x14007f38b
mov r15, qword [rbp + 0xe0]
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], rax
lea r15, [rbp + 0x60]
lea rdx, [rbp + 0xc0]
mov rcx, r15
call fcn.140080c00
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r12
lea r12, [rbp + 0x100]
lea rdx, [rbp + 0xd0]
mov rcx, r12
call fcn.140080c00
cmp qword [rbp + 0x78], 8
jb 0x14007f3db
mov r15, qword [rbp + 0x60]
mov qword [rbp + 0x120], r15
cmp qword [rbp + 0x118], 8
jb 0x14007f3f3
mov r12, qword [rbp + 0x100]
mov qword [rbp + 0x128], r12
mov rcx, qword [rsi + 0x98]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov edx, edi
xor r8d, r8d
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rax, qword [rbp + 0x118]
cmp rax, 8
jb 0x14007f481
mov rcx, qword [rbp + 0x100]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14007f47c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14007f519
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400cd44c
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x14007f4c3
mov rcx, qword [rbp + 0x60]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14007f4be
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14007f519
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400cd44c
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x14007f504
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14007f4ff
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14007f519
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400cd44c
nop
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400e193c
int3