Function at 0x140008590
Capabilities:
Access the windows event log
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rcx
xor r13d, r13d
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r13w
mov ebx, r13d
lea r12, [0x140078970]
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x14000861b
test dword [rcx + 0x1c], 0x10000000
je 0x14000861b
cmp byte [rcx + 0x19], 5
jb 0x14000861b
mov edx, 0xa4
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
mov r8, qword [rbp + 0xf]
cmp r8, 0x20
jb 0x140008642
mov qword [rbp + 0xf], 0x20
lea rax, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rax, qword [rbp - 1]
mov word [rax + 0x40], r13w
jmp 0x1400086a1
mov edx, 0x20
sub rdx, r8
mov rcx, qword [rbp + 0x17]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x14000868c
mov qword [rbp + 0xf], 0x20
lea r9, [rbp - 1]
cmp rcx, 8
cmovae r9, qword [rbp - 1]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140008681
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r13w
jmp 0x1400086a1
lfence
mov word [rsp + 0x20], r13w
mov r9, rdx
lea rcx, [rbp - 1]
call fcn.14000b6c0
lea rdi, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdi, qword [rbp - 1]
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x1400086df
test dword [rcx + 0x1c], 0x100000
je 0x1400086df
cmp byte [rcx + 0x19], 5
jb 0x1400086df
mov edx, 0x27
lea r8, [0x14006a120]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
mov r8, rdi
mov edx, 0x24
lea rcx, str.USBVID_8087PID_07DA
call fcn.14000e880
mov edi, eax
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x14000872f
test dword [rcx + 0x1c], 0x100000
je 0x14000872f
cmp byte [rcx + 0x19], 5
jb 0x14000872f
mov edx, 0x28
mov r9d, eax
lea r8, [0x14006a120]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, qword [0x140078970]
test edi, edi
jne 0x14000876d
cmp rcx, r12
je 0x140008bd3
test dword [rcx + 0x1c], 0x10000000
je 0x140008bd3
cmp byte [rcx + 0x19], 5
jb 0x140008bd3
mov edx, 0xa5
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
jmp 0x140008bd3
cmp rcx, r12
je 0x1400087a4
test dword [rcx + 0x1c], 0x10000000
je 0x1400087a4
cmp byte [rcx + 0x19], 5
jb 0x1400087a4
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae r9, qword [rbp - 1]
mov edx, 0xa6
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.140001830
call fcn.14000e770
mov ecx, r13d
cmp eax, 1
sete cl
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call fcn.14000e1b0
movsxd r9, eax
cmp r9d, 6
ja case.default.0x1400087e4
lea rdx, [0x140000000]
mov ecx, dword [rdx + r9*4 + 0x8ca4]
add rcx, rdx
jmp rcx
mov rax, qword [0x140078970]
cmp rax, r12
je 0x140008bd3
test dword [rax + 0x1c], 0x10000000
je 0x140008bd3
cmp byte [rax + 0x19], 5
jb 0x140008bd3
lfence
mov edx, 0xa7
mov rcx, qword [0x140078970]
jmp 0x140008bc3
mov rax, qword [0x140078970]
cmp rax, r12
je 0x140008bd3
test dword [rax + 0x1c], 0x10000000
je 0x140008bd3
cmp byte [rax + 0x19], 5
jb 0x140008bd3
lfence
mov edx, 0xa8
mov r9d, 1
mov rcx, qword [0x140078970]
jmp 0x140008bc3
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x1400088a3
test dword [rcx + 0x1c], 0x10000000
je 0x1400088a3
cmp byte [rcx + 0x19], 5
jb 0x1400088a3
lfence
mov edx, 0xa9
lea r8, [0x1400695b8]
mov rcx, qword [0x140078970]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, qword [0x140078970]
lea rdi, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdi, qword [rbp - 1]
cmp rcx, r12
je 0x1400088da
test dword [rcx + 0x1c], 0x100000
je 0x1400088da
cmp byte [rcx + 0x19], 5
jb 0x1400088da
mov edx, 0xc
lea r8, [0x14006a120]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
mov rcx, rdi
call fcn.14000f6e0
mov ebx, eax
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x14000891e
test dword [rcx + 0x1c], 0x100000
je 0x14000891e
cmp byte [rcx + 0x19], 5
jb 0x14000891e
mov edx, 0xd
mov r9d, eax
lea r8, [0x14006a120]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, qword [0x140078970]
test ebx, ebx
je 0x140008b85
lea rcx, [r14 + 0x38]
call fcn.140012b70
test eax, eax
jne 0x140008c91
mov rcx, qword [r14 + 0x88]
mov rax, qword [rcx + 8]
mov rdi, rcx
cmp byte [rax + 0x19], 0
jne 0x140008967
nop dword [rax + rax]
cmp dword [rax + 0x1c], ebx
jae 0x14000895b
mov rax, qword [rax + 0x10]
jmp 0x140008961
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140008950
cmp byte [rdi + 0x19], 0
jne 0x140008972
cmp ebx, dword [rdi + 0x1c]
jae 0x140008975
mov rdi, rcx
cmp rdi, rcx
jne 0x1400089d9
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x1400089ad
test dword [rcx + 0x1c], 0x10000000
je 0x1400089ad
cmp byte [rcx + 0x19], 3
jb 0x1400089ad
mov edx, 0xaa
mov r9d, ebx
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov dword [rbp - 0x29], ebx
mov byte [rbp - 0x25], 0xff
mov dword [rbp - 0x24], ebx
mov qword [rbp - 0x20], 1
mov dword [rbp - 0x18], r13d
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x11]
lea rcx, [r14 + 0x88]
call fcn.14000afd0
jmp 0x140008a0f
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008a0c
test dword [rcx + 0x1c], 0x10000000
je 0x140008a0c
cmp byte [rcx + 0x19], 5
jb 0x140008a0c
mov edx, 0xab
mov r9d, ebx
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
inc dword [rdi + 0x25]
lea rcx, [r14 + 0x38]
call fcn.140012b94
test eax, eax
jne 0x140008c99
mov r9d, ebx
mov dword [rbp + 0x1f], ebx
mov edi, r13d
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008a62
test dword [rcx + 0x1c], 0x10000000
je 0x140008a62
cmp byte [rcx + 0x19], 5
jb 0x140008a62
lea edx, [rax + 0x3a]
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
mov rcx, qword [0x140078970]
mov r9d, dword [rbp + 0x1f]
mov rax, qword [r14 + 8]
cmp rax, 0xffffffffffffffff
jne 0x140008aa1
cmp rcx, r12
je 0x140008a9a
test dword [rcx + 0x1c], 0x10000000
je 0x140008a9a
cmp byte [rcx + 0x19], 2
jb 0x140008a9a
lea edx, [rax + 0x3c]
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017a0
mov rcx, qword [0x140078970]
mov edi, 0x57
jmp 0x140008b18
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 4
mov word [rsp + 0x28], r13w
mov qword [rsp + 0x20], r13
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x140008b11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008b4b
test dword [rcx + 0x1c], 0x10000000
je 0x140008b18
cmp byte [rcx + 0x19], 2
jb 0x140008b18
mov edx, 0x3c
mov r9d, eax
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008b4b
test dword [rcx + 0x1c], 0x10000000
je 0x140008b4b
cmp byte [rcx + 0x19], 5
jb 0x140008b4b
mov edx, 0x3d
mov r9d, edi
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, qword [0x140078970]
test edi, edi
je 0x140008be2
cmp rcx, r12
je 0x140008c0f
test dword [rcx + 0x1c], 0x10000000
je 0x140008be2
cmp byte [rcx + 0x19], 3
jb 0x140008be2
mov edx, 0xac
mov r9d, edi
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
jmp 0x140008bdb
cmp rcx, r12
je 0x140008bd3
test dword [rcx + 0x1c], 0x10000000
je 0x140008bd3
cmp byte [rcx + 0x19], 2
jb 0x140008bd3
mov edx, 0xad
xor r9d, r9d
jmp 0x140008bc3
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008bd3
test dword [rcx + 0x1c], 0x10000000
je 0x140008bd3
cmp byte [rcx + 0x19], 2
jb 0x140008bd3
mov edx, 0xae
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
mov rcx, r14
call fcn.140008cc0
mov rcx, qword [0x140078970]
cmp rcx, r12
je 0x140008c0f
test dword [rcx + 0x1c], 0x10000000
je 0x140008c0f
cmp byte [rcx + 0x19], 5
jb 0x140008c0f
mov edx, 0xaf
mov r9d, ebx
lea r8, [0x1400695b8]
mov rcx, qword [rcx + 0x10]
call fcn.1400017d0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140008c4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c8b
call fcn.1400137f0
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r13w
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400117b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003737c
nop
mov ecx, eax
call fcn.140012c70
int3
mov ecx, eax
call fcn.140012c70
int3