Function at 0x14026f080
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
mov eax, 0x270
call fcn.1403cb200
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x1404f2b48]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.kernel32.dll_GetStdHandle]
xor r14d, r14d
mov rdi, rax
test rax, rax
je 0x14026f13f
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetFileType]
test eax, eax
je 0x14026f13f
lea rsi, [rbp + 0x258]
call fcn.140139100
mov r9, qword [rbp + 0x250]
lea rdx, [rbp + 0x10]
mov ebx, 0x200
mov qword [rsp + 0x28], rsi
mov r8d, ebx
mov qword [rsp + 0x20], r14
mov rcx, qword [rax]
or rcx, 1
call fcn.1403d5e80
or ecx, 0xffffffff
mov qword [rsp + 0x20], r14
test eax, eax
lea r9, [rbp]
lea rdx, [rbp + 0x10]
cmovs eax, ecx
mov rcx, rdi
test eax, eax
cmovs eax, ebx
mov r8d, eax
call qword [sym.imp.kernel32.dll_WriteFile]
jmp 0x14026f33e
mov r8, qword [rbp + 0x250]
mov eax, r14d
mov rcx, r8
mov ebx, 1
cmp byte [r8], r14b
je 0x14026f167
cmp eax, 0x80000000
jae 0x14026f167
add rcx, rbx
add eax, ebx
cmp byte [rcx], r14b
jne 0x14026f156
btr eax, 0x1f
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov esi, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14026f189
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1403cb200
sub rsp, rcx
lea rdi, [rsp + 0x50]
test rdi, rdi
jne 0x14026f1ae
lea rdi, [0x140423648]
jmp 0x14026f290
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14026f1eb
mov rdx, r14
test rsi, rsi
je 0x14026f290
mov rax, qword [rbp + 0x250]
movsx ecx, byte [rdx + rax]
mov word [rdi + rdx*2], cx
add rdx, rbx
cmp rdx, rsi
jb 0x14026f1d2
jmp 0x14026f1f4
test rsi, rsi
je 0x14026f290
mov rdx, r14
cmp word [rdi + rdx*2], 0x25
jne 0x14026f284
lea r8, [rdi + 2]
lea r8, [r8 + rdx*2]
movzx ecx, word [r8]
cmp ecx, 0x35
ja 0x14026f23a
je 0x14026f24b
sub ecx, 0x2a
je 0x14026f24b
sub ecx, 3
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
sub ecx, 2
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
cmp ecx, ebx
jne 0x14026f284
jmp 0x14026f24b
sub ecx, 0x36
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
sub ecx, ebx
je 0x14026f24b
sub ecx, ebx
jne 0x14026f254
add rdx, rbx
add r8, 2
jmp 0x14026f20a
sub ecx, 0xa
je 0x14026f27b
sub ecx, 0x10
je 0x14026f274
sub ecx, 0x10
je 0x14026f26d
cmp ecx, 0x10
jne 0x14026f284
lea eax, [rcx + 0x43]
jmp 0x14026f280
mov eax, 0x43
jmp 0x14026f280
mov eax, 0x73
jmp 0x14026f280
mov eax, 0x63
mov word [r8], ax
add rdx, rbx
cmp rdx, rsi
jb 0x14026f1f7
lea rsi, [rbp + 0x258]
call fcn.140139100
mov qword [rsp + 0x28], rsi
lea rdx, [rbp + 0x10]
mov r9, rdi
mov qword [rsp + 0x20], r14
mov r8d, 0xff
mov rcx, qword [rax]
or rcx, rbx
call fcn.1403d5ef0
mov word [rbp + 0x20e], r14w
call fcn.14026ef00
xor ecx, ecx
test eax, eax
jle 0x14026f327
lea rdx, [0x140423660]
call qword [sym.imp.advapi32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14026f33e
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x10]
mov qword [rbp], rax
xor r8d, r8d
lea rax, [rbp]
mov edx, ebx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], r14d
mov rcx, rdi
mov word [rsp + 0x28], bx
mov qword [rsp + 0x20], r14
call qword [sym.imp.advapi32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_DeregisterEventSource]
jmp 0x14026f33e
mov r9d, 0x10
lea r8, [0x140423670]
lea rdx, [rbp + 0x10]
call qword [sym.imp.user32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.1403cb150
lea rsp, [rbp + 0x220]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret