Function at 0x1400728a0
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x258
mov r14d, ecx
mov esi, r8d
mov ebx, edx
xor r13d, r13d
lea rcx, [rsp + 0x58]
xor edx, edx
mov r8d, 0x1f8
mov qword [rsp + 0x50], r13
call sub.msvcrt.dll_memset
movzx ebp, r13w
movzx edi, r13w
mov rcx, qword [str.___t_]
lea rax, str.___t_
lea r15d, [r13 + 2]
cmp rcx, rax
je 0x140072927
test byte [rcx + 0x1c], r15b
je 0x140072927
cmp byte [rcx + 0x19], 5
jb 0x140072927
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0x14]
lea r8, [0x140005228]
call fcn.14000e618
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp esi, 0x40
jbe 0x140072959
cmp rcx, rax
je 0x140072952
test byte [rcx + 0x1c], r15b
je 0x140072952
cmp byte [rcx + 0x19], r15b
jb 0x140072952
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005228]
call fcn.14000e618
xor eax, eax
jmp 0x140072b77
cmp qword [0x14009a508], r13
jne 0x14007297c
cmp rcx, rax
je 0x140072952
test byte [rcx + 0x1c], r15b
je 0x140072952
mov ebx, 3
cmp byte [rcx + 0x19], bl
jb 0x140072952
lea edx, [rbx + 0x13]
jmp 0x140072942
lea rcx, [0x14009a510]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x14009a500]
mov ecx, r13d
mov r12d, 1
test edx, edx
je 0x1400729bc
mov rax, qword [0x14009a4b8]
add rax, 0xc
cmp dword [rax - 4], r14d
jne 0x1400729b1
cmp ebx, dword [rax]
ja 0x140072a24
add ecx, r12d
add rax, 0x10
cmp ecx, edx
jb 0x1400729a7
lea r8, [rsp + 0x2c0]
test esi, esi
je 0x1400729f5
add r8, 0xfffffffffffffff8
lea rdx, [rsp + 0x50]
mov r9, rsi
lea r8, [r8 + 8]
lea rax, [0x1400022d0]
mov rcx, qword [r8]
test rcx, rcx
cmovne rax, rcx
mov qword [rdx], rax
lea rdx, [rdx + 8]
sub r9, r12
jne 0x1400729d4
mov r9d, dword [rsp + 0x2b8]
mov eax, 4
shr r9d, 0x1e
lea ebx, [rax - 1]
cmp r9d, r12d
jbe 0x140072a79
cmp r9d, r15d
je 0x140072a6c
cmp r9d, ebx
jne 0x140072a36
add dword [0x14009a538], r12d
mov ebp, r12d
jmp 0x140072a83
lea rcx, [0x14009a510]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140072952
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x140072a83
test byte [rcx + 0x1c], r15b
je 0x140072a83
cmp byte [rcx + 0x19], r15b
jb 0x140072a83
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005228]
mov edx, 0x17
call fcn.14000e63c
jmp 0x140072a83
add dword [0x14009a53c], r12d
movzx ebp, r15w
jmp 0x140072a83
add dword [0x14009a504], r12d
movzx ebp, ax
lea rcx, [0x14009a510]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
dec eax
je 0x140072aee
dec eax
je 0x140072ae8
dec eax
je 0x140072ae3
dec eax
je 0x140072adc
mov rcx, qword [str.___t_]
lea rbx, str.___t_
cmp rcx, rbx
je 0x140072af9
test byte [rcx + 0x1c], r15b
je 0x140072af9
cmp byte [rcx + 0x19], r15b
jb 0x140072af9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005228]
mov edx, 0x18
mov r9d, r14d
call fcn.14000e63c
jmp 0x140072af9
mov edi, 4
jmp 0x140072af2
movzx edi, bx
jmp 0x140072af2
movzx edi, r15w
jmp 0x140072af2
movzx edi, r12w
lea rbx, str.___t_
mov r9d, dword [rsp + 0x2b8]
mov rcx, qword [0x14009a508]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
movzx r8d, di
movzx edx, bp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov word [rsp + 0x28], si
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x140072b74
mov rcx, qword [str.___t_]
cmp rcx, rbx
je 0x140072b74
test byte [rcx + 0x1c], r15b
je 0x140072b74
cmp byte [rcx + 0x19], r15b
jb 0x140072b74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140005228]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x19
call fcn.14000e63c
mov eax, r12d
add rsp, 0x258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret