Function at 0x140026570
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401d6668]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov ebp, r9d
mov r12d, r8d
mov r15d, edx
mov r14, rcx
mov rbx, qword [rsp + 0xd0]
cmp qword [rcx + 8], 0
je 0x140026853
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
xor edi, edi
mov qword [rsp + 0x70], rdi
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
sar rdx, 5
test rdx, rdx
je 0x1400265fc
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x140026882
lfence
lea rcx, [rsp + 0x60]
call fcn.140028160
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rbx + 8]
mov rbx, qword [rbx]
mov rdx, qword [rsp + 0x68]
cmp rbx, rsi
je 0x140026657
nop dword [rax]
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002661d
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
cmp rdx, rdi
je 0x140026635
mov qword [rdx], rax
add rdx, 8
mov qword [rsp + 0x68], rdx
jmp 0x14002664e
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140028810
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
add rbx, 0x20
cmp rbx, rsi
jne 0x140026610
cmp qword [r14 + 0x20], 0
je 0x140026698
lea rax, [r14 + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14002666c
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
cmp rdx, rdi
je 0x14002667f
mov qword [rdx], rax
add rdx, 8
jmp 0x140026698
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140028810
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
sub rdx, rbx
sar rdx, 3
lea r10, [0x140000000]
cmp ebp, 0x18
ja case.default.0x1400266bf
mov ecx, dword [r10 + rbp*4 + 0x26888]
add rcx, r10
jmp rcx
mov r9d, 0x40010010
jmp 0x1400267a7
mov r9d, 0xc0010011
jmp 0x1400267a7
mov r9d, 0x40010012
jmp 0x1400267a7
mov r9d, 0xc0010013
jmp 0x1400267a7
mov r9d, 0x40010014
jmp 0x1400267a7
mov r9d, 0xc0010015
jmp 0x1400267a7
mov r9d, 0x40010016
jmp 0x1400267a7
mov r9d, 0x40090017
jmp 0x1400267a7
mov r9d, 0x40090018
jmp 0x1400267a7
mov r9d, 0x400b0019
jmp 0x1400267a7
mov r9d, 0x400b001a
jmp 0x1400267a7
mov r9d, 0x400b001b
jmp 0x1400267a7
mov r9d, 0x400b001c
jmp 0x1400267a7
mov r9d, 0x4001001d
jmp 0x1400267a7
mov r9d, 0x4001001e
jmp 0x1400267a7
mov r9d, 0x8007001f
jmp 0x1400267a7
mov r9d, 0x800b1b5a
jmp 0x1400267a7
mov r9d, 0x800b1c25
jmp 0x1400267a7
mov r9d, 0x800b1c26
jmp 0x1400267a7
mov r9d, 0x800b1b5f
jmp 0x1400267a7
mov r9d, 0x800b1b60
jmp 0x1400267a7
mov r9d, 0x800b1c85
jmp 0x1400267a7
mov r9d, 0x800b1c86
jmp 0x1400267a7
mov r9d, 0x800b1c88
jmp 0x1400267a7
mov r9d, 0x800b1c89
jmp 0x1400267a7
xor r9d, r9d
xor r8d, r8d
test r12d, r12d
sete r8b
cmp r15d, 5
ja case.0x1400267c2.1
mov ecx, dword [r10 + r15*4 + 0x268ec]
add rcx, r10
jmp rcx
xor eax, eax
jmp 0x1400267e9
mov eax, 2
jmp 0x1400267e9
mov eax, 1
jmp 0x1400267e9
mov eax, 8
jmp 0x1400267e9
mov eax, 0x10
jmp 0x1400267e9
mov eax, 4
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], dx
mov qword [rsp + 0x20], 0
movzx edx, ax
mov rcx, qword [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
nop
test rbx, rbx
je 0x140026853
sub rdi, rbx
and rdi, 0xfffffffffffffff8
mov rax, rbx
cmp rdi, 0x1000
jb 0x140026848
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002687c
mov rdx, rdi
mov rcx, rbx
call fcn.140146acc
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140146a70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140117a1c
nop
call fcn.140020820
nop
shl dword [rsi + 2], 0
int3