Function at 0x18001e080
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r9
mov r14, r8
mov qword [rbp - 0x69], rdx
mov r8, qword [rbp + 0x7f]
mov qword [rsp + 0x50], r8
xor edi, edi
mov qword [rbp - 0x51], rdi
mov eax, 0xf
mov qword [rbp - 0x49], rax
mov byte [rbp - 0x61], dil
lea r12d, [rcx - 0x12]
mov ebx, dword [rsp + 0x44]
cmp ecx, r12d
jbe 0x18001e45b
lea esi, [rcx - 0x5f]
lea r9, [0x180000000]
lea r10d, [rdi + 0x6f]
lea r11d, [rdi + 0x6e]
mov r13, qword [rbp - 0x69]
cmp esi, 0x1d
ja case.0x18001e107.12
mov ecx, dword [r9 + rsi*4 + 0x1e4c4]
add rcx, r9
jmp rcx
mov ecx, edi
movzx eax, byte [rsp + 0x40]
test r13, r13
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp case.0x18001e107.12
mov r8d, 0x1a
mov rdx, r15
lea rcx, [rbp - 0x61]
call fcn.18006f510
test al, al
je 0x18001e3e2
mov r11d, 0x6e
lea r10d, [r11 + 1]
lea r9, [0x180000000]
mov r8, qword [rsp + 0x50]
dec esi
lea eax, [rsi + 0x5f]
cmp eax, r12d
jbe 0x18001e457
mov rdx, qword [rbp - 0x69]
jmp 0x18001e0f7
mov qword [rbp - 0x71], rdi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
mov dword [rbp - 0x31], eax
lea r8, [rbp - 0x61]
mov rdx, r14
mov ecx, 0x90
call fcn.18001dfd0
jmp 0x18001e12e
mov dword [rbp - 0x17], 0x383420
jmp case.0x18001e107.12
test r15, r15
je case.0x18001e107.12
mov eax, dword [rbp - 0x79]
mov dword [r15], eax
jmp case.0x18001e107.12
mov eax, 0x63
mov word [rbp - 0x22], ax
jmp case.0x18001e107.12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, r14
mov edx, 0x8f
xor ecx, ecx
call fcn.180044950
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, r14
mov edx, 0x8f
xor ecx, ecx
call fcn.180044950
xor ecx, ecx
cmp al, 1
ja 0x18001e3f3
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, r14
mov edx, 0x8f
call fcn.180044950
movzx ecx, al
cmp ecx, 1
je 0x18001e136
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x18001e136
lea eax, [rcx - 9]
cmp eax, 2
ja 0x18001e451
jmp 0x18001e136
mov word [rbp - 0x21], r10w
mov dword [rbp - 0x20], 0x506564
jmp case.0x18001e107.12
movups xmm0, xmmword [str.EP0_RESTRICTION]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [0x180081248]
movups xmmword [rbp + 7], xmm1
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_BackupEventLogA]
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
jmp 0x18001e136
mov dword [rbp - 0x1a], 0x2d2074
jmp case.0x18001e107.12
mov dword [rsp + 0x48], 9
xor r9d, r9d
lea r8, [rsp + 0x48]
lea edx, [r9 + 0x71]
mov rcx, r14
call fcn.180042770
mov rdx, r14
mov ecx, 0xa6
call fcn.180062cb0
mov dword [rbp - 0x79], eax
cmp eax, 1
jl 0x18001e3f1
mov rdx, r14
mov ecx, 0xa6
call fcn.180062cb0
mov dword [rsp + 0x48], eax
cmp eax, 1
jge 0x18001e136
mov qword [rsp + 0x20], rdi
mov r9, r14
xor edx, edx
xor ecx, ecx
mov r8d, 0xd8
call fcn.18006e170
mov rax, qword [rbp - 0x49]
jmp 0x18001e45d
test rdx, rdx
je 0x18001e31f
mov eax, dword [rsp + 0x48]
mov dword [rdx], eax
test r8, r8
je 0x18001e333
mov eax, dword [rbp - 0x75]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [r8], eax
mov ebx, 1
mov dword [rsp + 0x44], ebx
jmp case.0x18001e107.12
mov eax, 0x72
mov word [rbp - 0x29], ax
mov eax, 0x65
mov word [rbp - 0x28], ax
mov dword [rbp - 0x27], 0x727574
mov word [rbp - 0x24], r11w
mov eax, 0x20
mov word [rbp - 0x23], ax
jmp case.0x18001e107.12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, r14
mov edx, 0x8f
xor ecx, ecx
call fcn.180044950
movzx eax, al
mov dword [rbp - 0x75], eax
add eax, 0xfffffff8
test eax, 0xffffffe7
jne 0x18001e2f4
jmp 0x18001e136
mov eax, 0x20
mov word [rbp - 0x14], ax
mov dword [rbp - 0x13], 0x31203c
mov eax, 0x30
mov word [rbp - 0x10], ax
mov byte [rsp + 0x40], 1
jmp case.0x18001e107.12
mov word [rbp - 0x1d], r10w
mov eax, 0x69
mov word [rbp - 0x1c], ax
mov word [rbp - 0x1b], r11w
jmp case.0x18001e107.12
mov byte [rsp + 0x44], 0
mov edi, dword [rsp + 0x44]
mov rax, qword [rbp - 0x49]
jmp 0x18001e45d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov r9, r14
mov r8d, 0xd8
xor edx, edx
call fcn.18006e170
mov rax, qword [rbp - 0x49]
jmp 0x18001e45d
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
cmp byte [rsp + 0x40], 0
je 0x18001e439
lea rdx, [rbp - 0x41]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r15 + 8]
cmp qword [r15], rax
setne byte [rsp + 0x44]
mov edi, dword [rsp + 0x44]
mov rax, qword [rbp - 0x49]
jmp 0x18001e45d
mov edi, ebx
mov rax, qword [rbp - 0x49]
jmp 0x18001e45d
mov rax, qword [rbp - 0x49]
mov edi, ebx
cmp rax, 0x10
jb 0x18001e498
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e493
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180076484
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret