Function at 0x14006d85c
Capabilities:
Access the windows event log
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov esi, ecx
lea r13, str.Unspecified_failure
mov r12, r8
and esi, 7
test rdx, rdx
cmovne r13, rdx
mov rcx, r13
call fcn.14004d940
lea rcx, [rsp + 0x68]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x74]
movzx edx, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
movzx r11d, word [rsp + 0x76]
movzx r10d, word [rsp + 0x6e]
movzx eax, word [rsp + 0x6a]
movzx r9d, word [rsp + 0x68]
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r10d
mov edi, 0x800
lea r8, str._04u_02u_02u__02u_02u_02u._03u:
lea rcx, [rbp - 0x80]
mov edx, edi
mov dword [rsp + 0x20], eax
call fcn.14004baa8
mov r8, r13
movsxd rcx, eax
lea rax, [rcx + rbx]
lea ebx, [rdi - 3]
cmp rax, rbx
cmovb rbx, rax
sub rdi, rcx
mov r9, rbx
mov rdx, rdi
sub r9, rcx
lea rcx, [rbp + rcx - 0x80]
call fcn.140057628
lea rcx, [rbp - 0x80]
mov byte [rbp + rbx - 0x80], ILFindLastID
mov byte [rbp + rbx - 0x7f], 0xa
mov byte [rbp + rbx - 0x7e], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0xfffffff4
lea r14d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, rax
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rcx, str.logging_bailout.txt
mov ebx, 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
lea eax, [rbx - 2]
cmp rdi, 0xffffffffffffffff
je 0x14006d9ed
mov r9d, eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov r8d, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.logging_bailout
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
test rax, rax
je 0x14006daab
cmp esi, ebx
jl 0x14006da28
call fcn.14006d798
test eax, eax
je 0x14006da28
xor r9d, r9d
test r12, r12
setne r9b
add r9d, 0x3ed
jmp 0x14006da39
xor r9d, r9d
test r12, r12
setne r9b
add r9d, 0x3e8
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
test esi, esi
je 0x14006da65
dec esi
je 0x14006da65
dec esi
je 0x14006da65
dec esi
je 0x14006da65
dec esi
je 0x14006da5b
dec esi
jmp 0x14006da6a
mov ecx, 2
movzx ebx, cx
jmp 0x14006da6f
mov ebx, 1
mov ecx, 2
xor r8d, r8d
lea rax, [rsp + 0x58]
movzx edx, bx
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r8d
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], r8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret