Function at 0x140019890
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x140113190]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r15, rcx
xor esi, esi
mov dword [rsp + 0x50], esi
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.140047780
cmp dword [rax], 1
ja 0x1400199e1
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
lea r8d, [rsi + 0x45]
lea rdx, str.Upgrade_log_not_found_after_upgrade_attempt:_msi_probably_did_not_run
lea rcx, [rsp + 0x180]
call fcn.140001c40
nop
lea rbx, str.era_updater
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14001998f
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rcx, qword [rsp + 0x180]
mov qword [rsp + 0x78], rcx
lea ecx, [rsi + 2]
xor r8d, r8d
lea edx, [rsi + 1]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x14001a03c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400199d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a06a
call fcn.140043f20
nop
jmp 0x14001a03c
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], 0xf
mov byte [rsp + 0x1e0], sil
mov r8d, 5
lea rdx, str.Agent
lea rcx, [rsp + 0x1e0]
call fcn.140008b20
nop
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
mov r8d, 0x13
lea rdx, str.RemoteAdministrator
lea rcx, [rsp + 0x1c0]
call fcn.140008b20
nop
lea r8, [rsp + 0x1e0]
lea rdx, [rsp + 0x1c0]
call fcn.140008fa0
mov r14, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140019b85
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
lea r8d, [rax + 0x51]
lea rdx, str.Cannot_move_upgrade_log:_error_loading_InstallConfiguration_after_upgrade_attempt
lea rcx, [rsp + 0x180]
call fcn.140001c40
nop
lea rbx, str.era_updater
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140019b37
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rcx, qword [rsp + 0x180]
mov qword [rsp + 0x60], rcx
lea ecx, [r14 + 2]
xor r8d, r8d
lea edx, [rcx - 1]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140019b80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a070
call fcn.140043f20
nop
jmp 0x14001a03c
lea rdx, [rsp + 0x1a0]
mov rcx, r14
call fcn.14000dcb0
nop
movdqa xmm0, xmmword [0x1400f16b0]
movdqu xmmword [rsp + 0x1d0], xmm0
mov word [rsp + 0x1c0], si
mov r8, qword [rsp + 0x1b0]
test r8, r8
je 0x140019c0f
lea rbx, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae rbx, qword [rsp + 0x1a0]
add rbx, r8
lea rdi, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae rdi, qword [rsp + 0x1a0]
call fcn.140045a60
mov r9, rax
lea r8, [rsp + 0x1c0]
mov rdx, rbx
mov rcx, rdi
call fcn.140044e80
nop
xor r8d, r8d
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x68]
call fcn.140047780
mov ebx, dword [rax]
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x140019c6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a076
call fcn.140043f20
nop
cmp ebx, 3
je 0x140019dc1
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
mov r8d, 0x4d
lea rdx, str.Cannot_move_upgrade_log:_Agent_logs_directory_not_found_after_upgrade_attempt
lea rcx, [rsp + 0x180]
call fcn.140001c40
nop
lea rbx, str.era_updater
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140019d2b
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rcx, qword [rsp + 0x180]
mov qword [rsp + 0x60], rcx
mov ecx, 2
xor r8d, r8d
lea edx, [rcx - 1]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140019d74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019d6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a07c
call fcn.140043f20
nop
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x14001a00c
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a082
call fcn.140043f20
nop
jmp 0x14001a00c
lea rdx, [rsp + 0x1c0]
mov rcx, r15
call fcn.140045dd0
mov rbx, rax
movdqa xmm0, xmmword [0x1400f16b0]
movdqu xmmword [rsp + 0x190], xmm0
mov word [rsp + 0x180], si
mov rdx, qword [rsp + 0x1b0]
test rdx, rdx
je 0x140019e4d
lea r12, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r12, qword [rsp + 0x1a0]
add r12, rdx
lea rdi, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae rdi, qword [rsp + 0x1a0]
call fcn.140045a60
mov r9, rax
lea r8, [rsp + 0x180]
mov rdx, r12
mov rcx, rdi
call fcn.140044e80
nop
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.140045500
movups xmm0, xmmword [rsp + 0x180]
movups xmmword [rsp + 0x1e0], xmm0
movups xmm1, xmmword [rsp + 0x190]
movups xmmword [rsp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x1400f16b0]
movdqu xmmword [rsp + 0x190], xmm0
mov word [rsp + 0x180], si
mov dword [rsp + 0x50], 1
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
mov rcx, r15
call fcn.1400476e0
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 8
jb 0x140019efb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a088
call fcn.140043f20
nop
movdqa xmm0, xmmword [0x1400f16b0]
movdqu xmmword [rsp + 0x1f0], xmm0
mov word [rsp + 0x1e0], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140019f5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a08e
call fcn.140043f20
nop
movdqa xmm0, xmmword [0x1400f16b0]
movdqu xmmword [rsp + 0x190], xmm0
mov word [rsp + 0x180], si
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x140019fbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019fb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a094
call fcn.140043f20
nop
jmp 0x140019fc8
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x14001a00c
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a09a
call fcn.140043f20
nop
mov byte [rsp + 0x1a0], 0
mov qword [rsp + 0x1b8], 0xf
mov qword [rsp + 0x1b0], rsi
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x140007bb3.0]
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140043ec0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
nop
call fcn.1400a3870
int3