Function at 0x1000308a
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bf2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x25a0
call fcn.10035de0
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x24ac], eax
mov dword [ebp - 0x24d4], eax
xor ebx, ebx
mov dword [ebp - 0x24fc], ebx
mov dword [ebp - 0x2544], ebx
mov dword [ebp - 0x24ec], 0x1811
mov byte [ebp - 0x8a8], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x8a7]
push eax
call fcn.10023400
mov esi, str.None_Yet
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x37]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x2524], ebx
mov eax, ebx
mov dword [ebp - 0x24e0], eax
mov dword [ebp - 0x2508], eax
mov esi, str.127.0.0.1
lea edi, [ebp - 0x18a8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f6
push ebx
lea eax, [ebp - 0x189e]
push eax
call fcn.10023400
add esp, 0x18
mov dword [ebp - 0x2528], 0x1811
mov dword [ebp - 0x2520], 0xd
mov dword [ebp - 0x2548], ebx
mov dword [ebp - 0x2558], ebx
mov dword [ebp - 0x24e4], ebx
mov dword [ebp - 0x24a8], ebx
xorps xmm0, xmm0
movlpd qword [ebp - 0x2560], xmm0
mov dword [ebp - 0x254c], ebx
mov dword [ebp - 0x24c8], ebx
mov dword [ebp - 0x24b4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x24e8], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
cmp dword [0x100c1c2c], 1
jl 0x10003217
lea eax, [ebp - 0x252c]
push eax
lea eax, [ebp - 0x2530]
push eax
push esi
call edi
test eax, eax
jne 0x100031ec
cmp dword [0x100c1c2c], 1
jl 0x10003217
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessWorkingSetSize_failed___d_
mov esi, dword [ebp - 0x24ac]
push esi
call fcn.10010a05
add esp, 0xc
jmp 0x100031f2
mov esi, dword [ebp - 0x24ac]
cmp dword [0x100c1c2c], 1
jl 0x1000321d
push dword [ebp - 0x252c]
push dword [ebp - 0x2530]
push str.Working_Set:_Min__d_Max__d
push esi
call fcn.10010a05
add esp, 0x10
jmp 0x1000321d
mov esi, dword [ebp - 0x24ac]
mov ecx, 0xa00000
mov dword [ebp - 0x252c], ecx
mov eax, 0x159000
mov dword [ebp - 0x2530], eax
push ecx
push eax
push dword [ebp - 0x24e8]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
jne 0x10003263
cmp dword [0x100c1c2c], 1
jl 0x100032c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetProcessWorkingSetSize_failed___d_
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [0x100c1c2c], 1
jl 0x100032c7
lea eax, [ebp - 0x252c]
push eax
lea eax, [ebp - 0x2530]
push eax
push dword [ebp - 0x24e8]
call edi
test eax, eax
jne 0x100032a4
cmp dword [0x100c1c2c], 1
jl 0x100032c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessWorkingSetSize_failed___d_
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [0x100c1c2c], 1
jl 0x100032c7
push dword [ebp - 0x252c]
push dword [ebp - 0x2530]
push str.Working_Set:_Min__d_Max__d
push esi
call fcn.10010a05
add esp, 0x10
push dword [ebp - 0x24e8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2598], ebx
mov dword [ebp - 0x2594], ebx
mov dword [ebp - 0x2590], ebx
xor ecx, ecx
push 7
pop esi
mov eax, esi
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
mov edi, eax
mov dword [ebp - 0x24e8], edi
xor ebx, ebx
mov eax, esi
mov ecx, 0x105
mul ecx
seto bl
neg ebx
or eax, ebx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
mov dword [0x100c15cc], eax
xor ebx, ebx
mov eax, esi
mov ecx, 0x105
mul ecx
seto bl
neg ebx
or eax, ebx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
mov dword [0x100c1cbc], eax
xor ecx, ecx
mov eax, esi
push 4
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
mov dword [0x100c1574], eax
xor ecx, ecx
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
mov esi, dword [ebp - 0x24ac]
mov dword [esi + 0x84], eax
or ebx, 0xffffffff
push ebx
push str.Security
mov eax, 0x105
push eax
push dword [0x100c15cc]
call fcn.1001fb15
push ebx
push str.System
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0x20a
push eax
call fcn.1001fb15
push ebx
push str.Application
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0x414
push eax
call fcn.1001fb15
add esp, 0x44
push ebx
push str.Directory_Service
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0x61e
push eax
call fcn.1001fb15
push ebx
push str.DNS_Server
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0x828
push eax
call fcn.1001fb15
push ebx
push str.DFS_Replication
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0xa32
push eax
call fcn.1001fb15
push ebx
push str.File_Replication_Service
mov eax, 0x105
push eax
mov eax, dword [0x100c15cc]
add eax, 0xc3c
push eax
call fcn.1001fb15
add esp, 0x40
push ebx
push str.LOG_TYPE_SECURITY
mov eax, 0x105
push eax
push dword [0x100c1cbc]
call fcn.1001fb15
push ebx
push str.LOG_TYPE_SYSTEM
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0x20a
push eax
call fcn.1001fb15
push ebx
push str.LOG_TYPE_APPLICATION
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0x414
push eax
call fcn.1001fb15
push ebx
push str.LOG_TYPE_DS
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0x61e
push eax
call fcn.1001fb15
add esp, 0x40
push ebx
push str.LOG_TYPE_DNS
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0x828
push eax
call fcn.1001fb15
push ebx
push str.LOG_TYPE_FRS
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0xa32
push eax
call fcn.1001fb15
push ebx
push str.LOG_TYPE_LFRS
mov eax, 0x105
push eax
mov eax, dword [0x100c1cbc]
add eax, 0xc3c
push eax
call fcn.1001fb15
add esp, 0x30
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
cmp dword [0x100c1c2c], 1
jl 0x10003540
push str.SNARE_is_Running
push esi
call fcn.10010a05
pop ecx
pop ecx
call fcn.10011da9
lea ecx, [ebp - 0x2528]
call fcn.10008838
lea ecx, [ebp - 0x2520]
call fcn.10018425
lea ecx, [ebp - 0x2548]
call fcn.10018442
lea ecx, [ebp - 0x24fc]
call fcn.1001845f
call fcn.1000befb
lea ecx, [ebp - 0x24ec]
call fcn.100086d9
lea ecx, [ebp - 0x18a8]
call fcn.100060b4
lea ecx, [ebp - 0x2558]
call fcn.10018408
cmp dword [ebp - 0x24fc], 0
je 0x100035b0
lea ecx, [ebp - 0x2544]
call fcn.1001847c
call fcn.10012f73
lea ecx, [ebp - 0x4a8]
call fcn.10012d5d
lea ecx, [ebp - 0x10a8]
call fcn.10014242
lea ecx, [ebp - 0x24c0]
call fcn.100184b1
call fcn.1000f49b
mov ecx, esi
call fcn.10010b19
call fcn.10018499
call fcn.1000e02b
mov dword [ebp - 0x24f0], eax
mov edx, 0xce05d9ad
mov ecx, 0x6a4abc5b
call fcn.1000619b
mov dword [ebp - 0x2570], eax
call fcn.10009a25
mov edi, eax
mov dword [ebp - 0x24dc], edi
test edi, edi
je 0x10003647
shl eax, 2
push eax
call fcn.1002010d
pop ecx
mov dword [ebp - 0x24e4], eax
test eax, eax
jne 0x10003647
cmp dword [0x100c1c2c], 9
jl 0x1000363d
push str.Cannot_allocate_memory_for_our_internal_Objective_match_list
push esi
call fcn.10010a05
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24dc], ebx
jmp 0x10003649
xor ebx, ebx
push ecx
mov edx, dword [ebp - 0x2528]
lea ecx, [ebp - 0x18a8]
call fcn.1000e381
pop ecx
mov dword [0x100c2cd4], eax
cmp dword [0x100c1c2c], 9
jl 0x1000368d
push str.Sockets_opened_connected
push esi
call fcn.10010a05
pop ecx
pop ecx
cmp dword [0x100c1c2c], 9
jl 0x1000368d
push str.Opening_event_log_sources
push esi
call fcn.10010a05
pop ecx
pop ecx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x24c4], ebx
add ecx, dword [0x100c15cc]
call fcn.100100dc
test eax, eax
mov eax, dword [0x100c1574]
mov dword [edi + eax], ebx
je 0x10003776
mov dword [ebp - 0x24f8], 1
mov dword [ebp - 0x2504], ebx
push ecx
lea eax, [ebp - 0x20a8]
push eax
mov eax, dword [0x100c1cbc]
mov edx, dword [ebp - 0x24c4]
lea edx, [edx + eax]
call fcn.1000abf6
pop ecx
pop ecx
test eax, eax
je 0x10003708
lea eax, [ebp - 0x20a8]
push eax
call dword [sym.imp.wevtapi.dll_EvtCreateBookmark]
mov ecx, dword [0x100c1574]
mov dword [edi + ecx], eax
test eax, eax
je 0x10003708
mov dword [ebp - 0x2504], eax
push 3
pop eax
jmp 0x1000370e
mov eax, dword [ebp - 0x24f8]
push eax
push ebx
push ebx
push dword [ebp - 0x2504]
push 0x1009e240
mov eax, dword [0x100c15cc]
add eax, dword [ebp - 0x24c4]
push eax
mov eax, dword [esi + 0x80]
push dword [eax + edi]
push ebx
call dword [sym.imp.wevtapi.dll_EvtSubscribe]
mov ecx, dword [esi + 0x84]
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x84]
cmp dword [edi + eax], ebx
jne 0x10003776
cmp dword [0x100c1c2c], 9
jl 0x10003776
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x100c15cc]
add eax, dword [ebp - 0x24c4]
push eax
push str.Failed_to_subscribe_to__S_events._Error__0x_lu
push esi
call fcn.10010a05
add esp, 0x10
mov ecx, dword [ebp - 0x24c4]
add ecx, 0x20a
mov dword [ebp - 0x24c4], ecx
add edi, 4
cmp ecx, 0xe46
jb 0x10003697
mov eax, dword [esi + 0x84]
cmp dword [eax], ebx
je 0x10005e1a
cmp dword [eax + 4], ebx
je 0x10005e1a
cmp dword [eax + 8], ebx
je 0x10005e1a
cmp dword [0x100c15c8], 0
je 0x10003801
lea edx, [ebp - 0x10a8]
mov ecx, dword [ebp - 0x24ec]
call fcn.10014a3e
test eax, eax
jle 0x100037e5
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx + 0x1c]
call fcn.1000b246
jmp 0x10003801
cmp dword [0x100c1c2c], 5
jl 0x100037fb
push str.Unable_to_start_web_server__1___disabling.
push esi
call fcn.10010a05
pop ecx
pop ecx
mov dword [0x100c15c8], ebx
mov dword [ebp - 0x253c], 1
mov dword [0x100c15c4], ebx
cmp dword [0x100c1c2c], 9
jl 0x10003827
push str.Entering_main_loop.
push esi
call fcn.10010a05
pop ecx
pop ecx
mov edi, ebx
push 8
pop edx
cmp dword [esi + 0x6c], ebx
je 0x10005d0e
inc edi
mov dword [ebp - 0x250c], edi
cmp dword [0x100c15c4], 0
je 0x1000384d
mov dword [esi + 0x6c], ebx
jmp 0x10005d0e
mov ecx, ebx
mov dword [ebp - 0x24f8], ebx
cmp ecx, dword [ebp - 0x253c]
jae 0x10005c7b
mov eax, ecx
shl eax, 6
mov dword [ebp - 0x24c0], eax
add eax, 0x40
cmp edx, eax
sbb edi, edi
and edi, 0xffffffc8
add edi, 0x40
xor eax, eax
mov edx, 0xbb8
test ecx, ecx
cmove eax, edx
push eax
push ebx
mov eax, ecx
shl eax, 8
add eax, dword [esi + 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x10005c5b
mov ecx, ebx
mov dword [ebp - 0x24b0], ecx
mov dword [ebp - 0x24c4], ecx
mov dword [ebp - 0x24bc], 8
mov ecx, dword [ebp - 0x253c]
dec ecx
mov edx, dword [ebp - 0x24f8]
cmp edx, ecx
jae 0x100038d0
cmp eax, edi
jb 0x100038d9
dec edi
cmp eax, edi
jae 0x100039a7
mov edi, dword [ebp - 0x24c0]
add edi, eax
mov dword [ebp - 0x24b0], edi
mov dword [ebp - 0x24c4], edi
mov eax, dword [esi + 0x80]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x2524], ebx
xor eax, eax
inc eax
cmp dword [0x100c1c2c], eax
jl 0x1000391f
push edi
push str.WAIT_OBJECT__d_Triggered.
push esi
call fcn.10010a05
add esp, 0xc
xor eax, eax
inc eax
test edi, edi
jne 0x10003932
mov dword [ebp - 0x24bc], 0x20
jmp 0x10003b20
cmp edi, eax
jne 0x10003945
mov dword [ebp - 0x24bc], 0x10
jmp 0x10003b20
push 2
pop ecx
cmp edi, ecx
jne 0x1000395b
mov dword [ebp - 0x24bc], 8
jmp 0x10003b20
cmp edi, 3
jne 0x1000396f
mov dword [ebp - 0x24bc], 4
jmp 0x10003b20
cmp edi, 4
jne 0x1000397f
mov dword [ebp - 0x24bc], ecx
jmp 0x10003b20
cmp edi, 5
jne 0x1000398f
mov dword [ebp - 0x24bc], eax
jmp 0x10003b20
cmp edi, 6
jne 0x10003b20
mov dword [ebp - 0x24bc], 0x80
jmp 0x10003b20
cmp edx, ecx
jne 0x100039dd
cmp eax, edi
jne 0x100039dd
mov eax, dword [esi + 0x80]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x100c1c2c], 5
jl 0x10003b20
push str.HandleWebThread:_WEB_Server_Reset_event_received
push esi
call fcn.10010a05
pop ecx
pop ecx
jmp 0x10003b20
cmp eax, 0x102
jne 0x10005c4b
cmp dword [0x100c1c2c], 9
jl 0x100039fe
push str.Timeout_hit
push esi
call fcn.10010a05
pop ecx
pop ecx
mov ecx, dword [ebp - 0x253c]
shl ecx, 2
mov eax, dword [ebp - 0x2524]
movzx eax, ax
cmp eax, ecx
jae 0x10003a1f
inc dword [ebp - 0x2524]
jmp 0x10005c66
mov dword [ebp - 0x2524], ebx
mov ecx, ebx
mov edx, dword [esi + 0x84]
push 6
pop edi
mov esi, dword [ebp - 0x24e0]
inc esi
xor eax, eax
cmp si, di
cmova esi, eax
mov dword [ebp - 0x2508], esi
movzx eax, si
cmp dword [edx + eax*4], ebx
jne 0x10003a52
inc ecx
cmp ecx, edi
jle 0x10003a36
mov dword [ebp - 0x24e0], esi
xor ecx, ecx
inc ecx
test si, si
jne 0x10003a6c
mov dword [ebp - 0x24bc], 0x20
jmp 0x10003adc
cmp si, cx
jne 0x10003a7d
mov dword [ebp - 0x24bc], 0x10
jmp 0x10003adc
push 2
pop edx
cmp si, dx
jne 0x10003a91
mov dword [ebp - 0x24bc], 8
jmp 0x10003adc
push 3
pop eax
cmp si, ax
jne 0x10003aa5
mov dword [ebp - 0x24bc], 4
jmp 0x10003adc
push 4
pop eax
cmp si, ax
jne 0x10003ab5
mov dword [ebp - 0x24bc], edx
jmp 0x10003adc
push 5
pop eax
cmp si, ax
jne 0x10003ac5
mov dword [ebp - 0x24bc], ecx
jmp 0x10003adc
mov eax, dword [ebp - 0x24bc]
cmp si, di
mov edx, 0x80
cmove eax, edx
mov dword [ebp - 0x24bc], eax
cmp dword [0x100c1c2c], ecx
mov esi, dword [ebp - 0x24ac]
mov edi, dword [ebp - 0x24e0]
jl 0x10003b02
movzx eax, di
push eax
push str.20_seconds_have_elapsed._Checking_a_log_file:__d
push esi
call fcn.10010a05
add esp, 0xc
movzx ecx, di
mov dword [ebp - 0x24b0], ecx
mov eax, dword [esi + 0x84]
cmp dword [eax + ecx*4], ebx
je 0x10005c33
mov dword [ebp - 0x24c4], ecx
mov edi, dword [0x100c15ac]
test edi, edi
je 0x10003e25
cmp dword [0x100c1c2c], 5
jl 0x10003b4a
push str.HandleWebThread:_resetting_the_web_thread
push esi
call fcn.10010a05
pop ecx
pop ecx
mov edi, dword [0x100c15ac]
cmp edi, 2
jne 0x10003d63
call fcn.10012c3e
cmp dword [0x100c15c8], 0
je 0x10003b66
call fcn.1000f478
call dword [sym.imp.WS2_32.dll_WSACancelBlockingCall]
mov eax, dword [0x100c2cd4]
mov dword [0x100c2cd8], eax
test eax, eax
je 0x10003bb4
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10003b90
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x100c2cd8]
or dword [eax], 0xffffffff
mov esi, dword [eax + 0x220]
push eax
call fcn.1001f0b9
pop ecx
mov eax, esi
mov dword [0x100c2cd8], eax
mov dword [0x100c2cd4], esi
test esi, esi
jne 0x10003b7a
mov esi, dword [ebp - 0x24ac]
mov dword [0x100c2cd4], ebx
call fcn.10011da9
lea ecx, [ebp - 0x2528]
call fcn.10008838
lea ecx, [ebp - 0x2520]
call fcn.10018425
lea ecx, [ebp - 0x2548]
call fcn.10018442
lea ecx, [ebp - 0x24fc]
call fcn.1001845f
call fcn.1000befb
lea ecx, [ebp - 0x24ec]
call fcn.100086d9
call fcn.1000f49b
lea ecx, [ebp - 0x18a8]
call fcn.100060b4
cmp dword [ebp - 0x24fc], 0
je 0x10003c24
lea ecx, [ebp - 0x2544]
call fcn.1001847c
call fcn.10012f73
lea ecx, [ebp - 0x4a8]
call fcn.10012d5d
lea ecx, [ebp - 0x10a8]
call fcn.10014242
lea ecx, [ebp - 0x24c0]
call fcn.100184b1
mov eax, dword [ebp - 0x24f0]
test eax, eax
je 0x10003c56
push eax
call fcn.1001f7cc
pop ecx
call fcn.1000e02b
mov dword [ebp - 0x24f0], eax
mov eax, dword [ebp - 0x24e4]
test eax, eax
je 0x10003c78
push eax
call fcn.1001f0b9
pop ecx
mov dword [ebp - 0x24e4], ebx
call fcn.10009a25
mov edi, eax
mov dword [ebp - 0x24dc], edi
test edi, edi
je 0x10003cb9
shl eax, 2
push eax
call fcn.1002010d
pop ecx
mov dword [ebp - 0x24e4], eax
test eax, eax
jne 0x10003cb9
cmp dword [0x100c1c2c], 9
jl 0x10003cb3
push str.Cannot_allocate_memory_for_our_internal_Objective_match_list
push esi
call fcn.10010a05
pop ecx
pop ecx
mov dword [ebp - 0x24dc], ebx
call fcn.10009779
push ecx
mov edx, dword [ebp - 0x2528]
lea ecx, [ebp - 0x18a8]
call fcn.1000e381
pop ecx
mov dword [0x100c2cd4], eax
cmp dword [0x100c15c8], 0
je 0x10003e1d
push 5
pop edi
cmp dword [0x100c1c2c], edi
jl 0x10003cfb
push str.Starting_web_thread.
push esi
call fcn.10010a05
pop ecx
pop ecx
lea edx, [ebp - 0x10a8]
mov ecx, dword [ebp - 0x24ec]
call fcn.10014a3e
test eax, eax
jg 0x10003d30
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x10a8]
mov ecx, dword [ebp - 0x24ec]
call fcn.10014a3e
test eax, eax
jle 0x10003d43
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx + 0x1c]
call fcn.1000b246
jmp 0x10003e1d
cmp dword [0x100c1c2c], edi
jl 0x10003d58
push str.Unable_to_start_web_server__2___disabling.
push esi
call fcn.10010a05
pop ecx
pop ecx
mov dword [0x100c15c8], ebx
jmp 0x10003e1d
cmp edi, 1
jne 0x10003e1d
cmp dword [0x100c15c8], 0
je 0x10003df1
cmp dword [0x100c1c2c], 5
jl 0x10003d8b
push str.Restarting_web_thread.
push esi
call fcn.10010a05
pop ecx
pop ecx
call fcn.1000f478
lea edx, [ebp - 0x10a8]
mov ecx, dword [ebp - 0x24ec]
call fcn.10014a3e
test eax, eax
jg 0x10003dc5
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x10a8]
mov ecx, dword [ebp - 0x24ec]
call fcn.10014a3e
test eax, eax
jle 0x10003dd5
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx + 0x1c]
call fcn.1000b246
jmp 0x10003df1
cmp dword [0x100c1c2c], 5
jl 0x10003deb
push str.Unable_to_start_web_server__2___disabling.
push esi
call fcn.10010a05
pop ecx
pop ecx
mov dword [0x100c15c8], ebx
mov eax, dword [0x100c2cd4]
jmp 0x10003e14
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10003e0e
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x100c2cd8]
or dword [eax], 0xffffffff
mov eax, dword [eax + 0x220]
test eax, eax
mov dword [0x100c2cd8], eax
jne 0x10003df8
mov edi, ebx
mov dword [0x100c15ac], edi
mov eax, 0x103
mov dword [ebp - 0x24f4], eax
mov dword [ebp - 0x2510], eax
mov dword [ebp - 0x251c], ebx
push 0x320
push ebx
lea eax, [ebp - 0x23c8]
push eax
call fcn.10023400
add esp, 0xc
mov eax, dword [esi + 0x84]
mov ecx, dword [ebp - 0x24b0]
cmp dword [eax + ecx*4], ebx
je 0x10005a40
test edi, edi
jne 0x10005a31
cmp dword [0x100c1c2c], 9
jl 0x10003e8a
push str.Call_EvtNext
push esi
call fcn.10010a05
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24b0]
mov dword [ebp - 0x251c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x251c]
push eax
push ebx
push 0x64
lea eax, [ebp - 0x23c8]
push eax
push 0xc8
mov eax, dword [esi + 0x84]
push dword [eax + ecx*4]
call dword [sym.imp.wevtapi.dll_EvtNext]
test eax, eax
jne 0x10003f57
cmp dword [0x100c1c2c], 9
jl 0x10003ed6
push str.Error_EvtNext
push esi
call fcn.10010a05
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x24f4], edi
mov dword [ebp - 0x2510], edi
cmp edi, 0x103
je 0x10003f38
cmp edi, 0x10dd
je 0x10003f38
cmp edi, 0xb7
je 0x10003f38
cmp dword [0x100c1c2c], 4
jl 0x10003f1a
push edi
push str.EvtNext_failed_with__lu
push esi
call fcn.10010a05
add esp, 0xc
cmp edi, 0x5b4
jne 0x10003f38
cmp dword [0x100c1c2c], 3
jl 0x10003f38
push str.EvtNext_failed_due_to_a_TIMEOUT_ERROR_n
push esi
call fcn.10010a05
pop ecx
pop ecx
cmp dword [0x100c1c2c], 9
jl 0x10003f4e
push str.goto_EvtNextCleanup
push esi
call fcn.10010a05
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x10005a40
or dword [ebp - 4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0x24d8], ebx
cmp edi, dword [ebp - 0x251c]
jae 0x100059c7
mov eax, ebx
mov dword [ebp - 0x24b8], eax
mov dword [ebp - 0x24c0], eax
mov dword [ebp - 0x2500], ebx
mov dword [ebp - 0x2550], ebx
mov dword [ebp - 0x2538], ebx
lea eax, [ebp - 0x2550]
push eax
lea eax, [ebp - 0x2538]
push eax
mov eax, dword [ebp - 0x24b4]
push eax
push ebx
push ebx
push dword [ebp + edi*4 - 0x23c8]
push dword [0x100c2c28]
call dword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x10004056
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10004041
xor ecx, ecx
mov eax, dword [ebp - 0x2538]
push 0x10
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
pop ecx
mov dword [ebp - 0x24b4], eax
lea ecx, [ebp - 0x2550]
push ecx
lea ecx, [ebp - 0x2538]
push ecx
push eax
push dword [ebp - 0x2538]
push ebx
push dword [ebp + edi*4 - 0x23c8]
push dword [0x100c2c28]
call dword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x10004056
cmp dword [0x100c1c2c], 6
jl 0x1000593a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_Render_Event_2__._Error__0x_x
push esi
call fcn.10010a05
add esp, 0xc
jmp 0x1000593a
cmp dword [0x100c1c2c], 6
jl 0x1000593a
push eax
push str.Couldnt_Render_Event_._Error__0x_x
jmp 0x10004033
push 0x4fb0
call fcn.1002010d
pop ecx
mov edi, eax
mov dword [ebp - 0x24a8], edi
test edi, edi
jne 0x10004084
cmp dword [0x100c1c2c], 9
jl 0x1000593a
push str.Unable_to_allocate_latest_VistaEvent_cache_n
jmp 0x10005932
push 0x4fb0
push ebx
push edi
call fcn.10023400
or esi, 0xffffffff
push esi
push str.unknown
push 0x64
push edi
call fcn.1001fb15
lea eax, [edi + 0xd0]
push esi
push str.not_yet
push 0x1a
push eax
call fcn.10021c86
lea eax, [edi + 0x100]
push esi
push 0x1009e5dc
push 0x100
push eax
call fcn.1001fb15
lea eax, [edi + 0x300]
push esi
push str.System
push 0x100
push eax
call fcn.1001fb15
add esp, 0x4c
lea eax, [edi + 0x500]
push esi
push 0x1009e5ec
push 0x100
push eax
call fcn.10021c86
push esi
push 0x1009e5ec
push 0x64
lea eax, [edi + 0x600]
push eax
call fcn.10021c86
push esi
push str.None
push 0x100
lea eax, [edi + 0x6a0]
push eax
call fcn.10021c86
add esp, 0x30
mov ecx, dword [ebp - 0x24b4]
movzx eax, word [ecx + 0x20]
mov dword [edi + 0xec], eax
lea eax, [ebp - 0x25ac]
push eax
lea eax, [ecx + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x23d8]
push eax
lea eax, [ebp - 0x25ac]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x20
lea eax, [ebp - 0x60]
push eax
push str.ddd_MMM_dd
lea eax, [ebp - 0x23d8]
push eax
push ebx
push 0x800
mov esi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
call esi
or edi, 0xffffffff
push edi
lea eax, [ebp - 0x60]
push eax
push 0x1a
lea eax, [ebp - 0x40]
push eax
call fcn.10021c86
add esp, 0x10
push 0x20
lea eax, [ebp - 0x60]
push eax
push 0x1009e604
lea eax, [ebp - 0x23d8]
push eax
push ebx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
lea eax, [ebp - 0x60]
push eax
push 0x1a
lea eax, [ebp - 0x40]
push eax
call fcn.1001f294
add esp, 0x10
push 0x20
lea eax, [ebp - 0x60]
push eax
push str.yyyy
lea eax, [ebp - 0x23d8]
push eax
push ebx
push 0x800
call esi
push edi
lea eax, [ebp - 0x60]
push eax
push 0x1a
lea eax, [ebp - 0x40]
push eax
call fcn.1001f294
add esp, 0x10
mov eax, dword [ebp - 0x24b4]
push dword [eax]
lea ecx, [ebp - 0x245c]
call fcn.1000e75a
mov dword [ebp - 4], 2
lea eax, [ebp - 0x245c]
push eax
call fcn.10012bee
cmp dword [eax], ebx
sete bl
mov dword [ebp - 4], edi
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x245c]
call fcn.10001770
test bl, bl
je 0x100042e5
mov ebx, dword [ebp - 0x24b4]
push dword [ebx]
lea ecx, [ebp - 0x24a4]
call fcn.1000e75a
mov dword [ebp - 4], 3
lea eax, [ebp - 0x24a4]
push eax
call fcn.10012bee
mov esi, eax
push edi
push edi
push edi
push dword [ebx]
push edi
call dword [sym.imp.wevtapi.dll_EvtOpenPublisherMetadata]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
push edi
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x24a4]
call fcn.10001770
push dword [ebx]
lea ecx, [ebp - 0x248c]
call fcn.1000e75a
mov dword [ebp - 4], 4
lea eax, [ebp - 0x248c]
push eax
call fcn.10012bee
cmp dword [eax], edi
sete bl
or dword [ebp - 4], 0xffffffff
push edi
push esi
lea ecx, [ebp - 0x248c]
call fcn.10001770
test bl, bl
je 0x100042e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x100c1c2c], 3
jl 0x10005950
push eax
push str.Bad_publisher:__lu
mov esi, dword [ebp - 0x24ac]
jmp 0x10004033
mov esi, dword [ebp - 0x24ac]
cmp dword [0x100c1c2c], 3
jl 0x10004301
push str.got_message
push esi
call fcn.10010a05
pop ecx
pop ecx
push 0xffffffffffffffff
mov edi, dword [ebp - 0x24b4]
push dword [edi + 0xf0]
push 0x64
mov ebx, dword [ebp - 0x24a8]
push ebx
call fcn.1001fb15
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push 0x1a
lea eax, [ebx + 0xd0]
push eax
call fcn.10021c86
push 0xffffffffffffffff
push dword [edi + 0xe0]
push 0x100
lea eax, [ebx + 0x300]
push eax
call fcn.1001fb15
add esp, 0x30
mov edi, dword [0x100c1574]
xor ebx, ebx
mov eax, dword [ebp - 0x24b0]
cmp dword [edi + eax*4], ebx
jne 0x10004372
push ebx
call dword [sym.imp.wevtapi.dll_EvtCreateBookmark]
mov ecx, dword [ebp - 0x24b0]
mov dword [edi + ecx*4], eax
mov eax, ecx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push dword [edi + eax*4]
call dword [sym.imp.wevtapi.dll_EvtUpdateBookmark]
test eax, eax
je 0x100043bd
push ebx
push 0x100c157c
mov edi, dword [ebp - 0x24a8]
lea eax, [edi + 0x47a8]
push eax
push 0x400
push 2
mov eax, dword [0x100c1574]
mov ecx, dword [ebp - 0x24b0]
push dword [eax + ecx*4]
push ebx
call dword [sym.imp.wevtapi.dll_EvtRender]
jmp 0x100043e1
cmp dword [0x100c1c2c], 3
jl 0x100043db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_in_bookmark:__d
push esi
call fcn.10010a05
add esp, 0xc
mov edi, dword [ebp - 0x24a8]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24b4]
push dword [eax]
push 0x100
lea eax, [edi + 0x100]
push eax
call fcn.1001fb15
add esp, 0x10
mov dword [ebp - 0x2504], ebx
mov eax, dword [ebp - 0x24b4]
cmp dword [eax + 0x10c], ebx
je 0x1000461e
mov dword [ebp - 4], 5
push dword [eax + 0x100]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000451c
mov byte [ebp - 0x1a4], bl
push 0x100
push ebx
lea eax, [ebp - 0x1a3]
push eax
call fcn.10023400
mov byte [ebp - 0x2a8], bl
push 0x100
push ebx
lea eax, [ebp - 0x2a7]
push eax
call fcn.10023400
add esp, 0x18
mov eax, 0x100
mov dword [ebp - 0x256c], eax
mov dword [ebp - 0x2564], eax
lea eax, [ebp - 0x25b0]
push eax
lea eax, [ebp - 0x2564]
push eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x256c]
push eax
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [ebp - 0x24b4]
push dword [eax + 0x100]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
lea ecx, [ebp - 0x1a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100044b5
sub ecx, edx
je 0x10004532
lea ecx, [ebp - 0x2a8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100044c9
lea eax, [ebp - 0x1a4]
push eax
sub ecx, edx
je 0x100044ff
lea eax, [ebp - 0x2a8]
push eax
push 0x1009e654
push 0xffffffffffffffff
push 0x100
lea eax, [edi + 0x500]
push eax
call fcn.1001f145
add esp, 0x18
jmp 0x10004532
push 0x1009e65c
push 0xffffffffffffffff
push 0x100
lea eax, [edi + 0x500]
push eax
call fcn.1001f145
add esp, 0x14
jmp 0x10004532
cmp dword [0x100c1c2c], 9
jl 0x10004532
push str.GetEventUserName:_IsValidSid_returned_FALSE__Not_much_I_can_do_with_an_invalid_SID._n
push esi
call fcn.10010a05
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x100047bb
push 0xffffffffffffffff
push 0x1009e5ec
push 0x100
lea eax, [edi + 0x500]
push eax
call fcn.10021c86
add esp, 0x10
mov dword [ebp - 0x2534], ebx
mov dword [ebp - 0x2554], ebx
mov eax, dword [0x100c2c34]
test eax, eax
jne 0x10004668
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_EvtCreateRenderContext__lu
push esi
call fcn.10010a05
add esp, 0xc
jmp 0x100047bb
lea ecx, [ebp - 0x2554]
push ecx
lea ecx, [ebp - 0x2534]
push ecx
push ebx
push ebx
push ebx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push eax
call dword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x100047bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000479c
xor ecx, ecx
mov eax, dword [ebp - 0x2534]
push 0x10
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
pop ecx
mov edi, eax
lea eax, [ebp - 0x2554]
push eax
lea eax, [ebp - 0x2534]
push eax
push edi
push dword [ebp - 0x2534]
push ebx
mov eax, dword [ebp - 0x24d8]
push dword [ebp + eax*4 - 0x23c8]
push dword [0x100c2c34]
call dword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x1000471d
cmp dword [0x100c1c2c], 6
jl 0x10004712
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_Render_Event_2__._Error__0x_x
push esi
call fcn.10010a05
add esp, 0xc
push edi
call fcn.10074045
jmp 0x10005939
cmp dword [edi + 0xc], ebx
je 0x10004747
mov eax, dword [ebp - 0x24a8]
add eax, 0x500
cmp dword [edi + 0x1c], ebx
je 0x10004739
push dword [edi]
push dword [edi + 0x10]
jmp 0x10004762
push ebx
push ebx
push 0x100
push eax
push 0xffffffffffffffff
push dword [edi]
jmp 0x10004786
cmp dword [edi + 0x2c], ebx
je 0x1000478e
mov eax, dword [ebp - 0x24a8]
add eax, 0x500
cmp dword [edi + 0x3c], ebx
je 0x10004779
push dword [edi + 0x20]
push dword [edi + 0x30]
push str._S_S
push 0xffffffffffffffff
push 0x100
push eax
call fcn.1001f145
add esp, 0x18
jmp 0x1000478e
push ebx
push ebx
push 0x100
push eax
push 0xffffffffffffffff
push dword [edi + 0x20]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.10074045
mov edi, dword [ebp - 0x24a8]
jmp 0x100047ba
cmp dword [0x100c1c2c], 6
jl 0x100047b4
push eax
push str.Couldnt_Render_User_._Error__0x_x
push esi
call fcn.10010a05
add esp, 0xc
push ebx
call fcn.10074045
pop ecx
mov ecx, dword [ebp - 0x24b4]
mov eax, dword [ecx + 0x70]
mov dword [edi + 0xf8], eax
mov eax, dword [ecx + 0x74]
mov dword [edi + 0xfc], eax
cmp dword [ecx + 0x4c], ebx
jne 0x100047e0
mov dword [ebp - 0x24cc], ebx
jmp 0x100047ea
movzx eax, byte [ecx + 0x40]
mov dword [ebp - 0x24cc], eax
mov dword [edi + 0xf0], ebx
add edi, 0x664
push 0xffffffffffffffff
push str.Unknown
push 0x3c
push edi
call fcn.10021c86
add esp, 0x10
mov eax, dword [ebp - 0x24cc]
cmp eax, 6
jne 0x1000482f
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 0x80
push 0xffffffffffffffff
push str.ActivityTracing
jmp 0x1000495c
cmp eax, 5
jne 0x10004850
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 0x40
push 0xffffffffffffffff
push str.Verbose
jmp 0x1000495c
push 4
pop edx
cmp eax, edx
jne 0x10004873
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 2
push 0xffffffffffffffff
push str.Information
jmp 0x1000495c
cmp eax, 3
jne 0x10004894
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 1
push 0xffffffffffffffff
push str.Warning
jmp 0x1000495c
push 2
pop ecx
cmp eax, ecx
jne 0x100048b3
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], edx
push 0xffffffffffffffff
push str.Error
jmp 0x1000495c
cmp eax, 1
jne 0x100048d4
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 0x20
push 0xffffffffffffffff
push str.Critical
jmp 0x1000495c
test eax, eax
jne 0x10004967
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], ecx
push 0xffffffffffffffff
push str.Information
push 0x3c
push edi
call fcn.10021c86
add esp, 0x10
mov ecx, dword [ebp - 0x24a8]
mov eax, dword [ecx + 0xf8]
mov dword [ebp - 0x2518], eax
mov edx, dword [ecx + 0xfc]
mov ecx, edx
and ecx, 0x100000
mov eax, ebx
or eax, ecx
je 0x10004939
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 8
push 0xffffffffffffffff
push str.Failure_Audit
jmp 0x1000495c
and edx, 0x200000
mov eax, ebx
or eax, edx
je 0x10004967
mov eax, dword [ebp - 0x24a8]
mov dword [eax + 0xf0], 0x10
push 0xffffffffffffffff
push str.Success_Audit
push 0x3c
push edi
call fcn.10021c86
add esp, 0x10
mov eax, dword [ebp - 0x24b4]
cmp dword [eax + 0x5c], ebx
je 0x10004ae9
cmp word [eax + 0x50], bx
je 0x10004ae9
push dword [eax]
lea ecx, [ebp - 0x2414]
call fcn.1000e75a
mov dword [ebp - 4], 7
lea eax, [ebp - 0x2414]
push eax
call fcn.10012bee
lea ecx, [ebp - 0x2500]
push ecx
push dword [ebp - 0x24c8]
push ebx
push 3
push ebx
push ebx
push ebx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push dword [eax]
mov edi, dword [sym.imp.wevtapi.dll_EvtFormatMessage]
call edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2414]
call fcn.10001770
test esi, esi
jne 0x10004add
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10004abd
mov esi, dword [ebp - 0x2500]
mov dword [ebp - 0x24b8], esi
lea eax, [esi + esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
pop ecx
mov dword [ebp - 0x24c8], eax
mov eax, dword [ebp - 0x24b4]
push dword [eax]
lea ecx, [ebp - 0x2474]
call fcn.1000e75a
mov dword [ebp - 4], 8
lea eax, [ebp - 0x2474]
push eax
call fcn.10012bee
lea ecx, [ebp - 0x2500]
push ecx
push dword [ebp - 0x24c8]
push esi
push 3
push ebx
push ebx
push ebx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push dword [eax]
call edi
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2474]
call fcn.10001770
push ebx
push ebx
push 0x100
mov eax, dword [ebp - 0x24a8]
add eax, 0x6a0
push eax
push 0xffffffffffffffff
push dword [ebp - 0x24c8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [ebp - 0x24ac]
mov eax, dword [ebp - 0x24c8]
test eax, eax
je 0x10004ae3
push eax
call fcn.10074045
pop ecx
mov dword [ebp - 0x24c8], ebx
jmp 0x10004ae3
cmp dword [0x100c1c2c], 7
jl 0x10004a9e
push eax
push str.EvtFormatMessageTask_Error:__d
mov esi, dword [ebp - 0x24ac]
push esi
call fcn.10010a05
add esp, 0xc
jmp 0x10004aa4
mov esi, dword [ebp - 0x24ac]
mov eax, dword [ebp - 0x24b4]
push dword [eax]
lea ecx, [ebp - 0x2444]
call fcn.1000e75a
mov dword [ebp - 4], 9
lea eax, [ebp - 0x2444]
push eax
call fcn.10012bee
lea ecx, [ebp - 0x2500]
push ecx
push dword [ebp - 0x24c8]
push dword [ebp - 0x24b8]
push 1
push ebx
push ebx
push ebx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push dword [eax]
mov edi, dword [sym.imp.wevtapi.dll_EvtFormatMessage]
call edi
mov dword [ebp - 0x24b8], eax
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2444]
call fcn.10001770
cmp dword [ebp - 0x24b8], 0
jne 0x10004c5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10004c1e
mov esi, dword [ebp - 0x2500]
lea eax, [esi + esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f0b0
pop ecx
mov dword [ebp - 0x24c8], eax
mov eax, dword [ebp - 0x24b4]
push dword [eax]
lea ecx, [ebp - 0x242c]
call fcn.1000e75a
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x242c]
push eax
call fcn.10012bee
lea ecx, [ebp - 0x2500]
push ecx
push dword [ebp - 0x24c8]
push esi
xor esi, esi
inc esi
push esi
push ebx
push ebx
push ebx
mov ecx, dword [ebp - 0x24d8]
push dword [ebp + ecx*4 - 0x23c8]
push dword [eax]
call edi
mov dword [ebp - 0x24b8], eax
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp - 0x242c]
call fcn.10001770
push ebx
push ebx
push 0x2000
mov eax, dword [ebp - 0x24a8]
add eax, 0x27a0
push eax
push 0xffffffffffffffff
push dword [ebp - 0x24c8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [ebp - 0x24ac]
jmp 0x10004c36
cmp dword [0x100c1c2c], 7
jl 0x10004c3f
push eax
push str.EvtFormatMessageEvent_Error:__d
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [ebp - 0x24b8], 0
jne 0x10004c5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x100c1c2c], 7
jl 0x1000593a
push eax
push str.EvtFormatMessageEvent_Error_2:__d
jmp 0x10004033
cmp dword [0x100c1c2c], 6
jl 0x10004c73
push str.VISTA:_Sending_VISTA_Event...
push esi
call fcn.10010a05
pop ecx
pop ecx
mov edi, dword [ebp - 0x24a8]
lea eax, [edi + 0x300]
test eax, eax
jne 0x10004c9a
cmp dword [0x100c1c2c], 3
jl 0x10005950
push str.FAILED_message__
jmp 0x10005932
cmp dword [0x100c1c2c], 6
jl 0x10004cb0
push str.VISTA:_Event_found__processing_data_for_VISTA_event
push esi
call fcn.10010a05
pop ecx
pop ecx
cmp dword [ebp - 0x24dc], 0
je 0x10004e4d
mov dword [ebp - 0x24d0], ebx
mov edi, dword [ebp - 0x24e4]
mov dword [ebp - 0x24cc], edi
call fcn.10009779
test edi, edi
jne 0x10004cef
cmp dword [0x100c1c2c], 7
jl 0x1000593a
push str.Match_Pointer_has_gone_away
jmp 0x10005932
mov dword [ebp - 4], 0xb
push dword [ebp - 0x24bc]
mov eax, dword [ebp - 0x24a8]
mov edx, dword [eax + 0xf0]
mov ecx, dword [eax + 0xec]
call fcn.100182e1
pop ecx
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
jmp 0x10004dc3
push 4
pop ecx
mov eax, dword [ebp - 0x24d0]
cmp dword [edi], ebx
je 0x10004df4
inc eax
mov dword [ebp - 0x24d0], eax
add edi, ecx
mov dword [ebp - 0x24cc], edi
cmp eax, dword [ebp - 0x24dc]
jae 0x10004df4
cmp dword [0x100c15c4], 0
je 0x10004cef
cmp dword [0x100c15c4], 0
je 0x10004e05
mov dword [esi + 0x6c], ebx
jmp 0x10005a40
test eax, eax
jne 0x10004e45
cmp dword [0x100c1c2c], 7
jl 0x10004e1f
push str.Match_Checker:_No_matches_found
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [ebp - 0x24a8]
add eax, 0x47a8
push eax
imul edx, dword [ebp - 0x24b0], 0x20a
add edx, dword [0x100c1cbc]
call fcn.1000d221
jmp 0x10005939
mov edi, dword [ebp - 0x24a8]
jmp 0x10004e53
mov eax, dword [ebp - 0x24d0]
test edi, edi
je 0x1000593a
cmp dword [0x100c1c2c], 7
jl 0x10004e73
push eax
push str.FastCheckObjective:_found_matches___d_
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [0x100c1c2c], 6
jl 0x10004e89
push str.VISTA:_done
push esi
call fcn.10010a05
pop ecx
pop ecx
lea eax, [edi + 0x300]
mov dword [ebp - 0x24b8], eax
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10004e9a
sub ecx, edx
sar ecx, 1
je 0x10005830
lea ecx, [edi + 0xd0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004eb8
sub ecx, edx
je 0x10005830
lea ecx, [edi + 0x100]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10004ed0
sub ecx, edx
sar ecx, 1
je 0x10005830
cmp dword [edi + 0xf0], ebx
je 0x10005830
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10004ef6
sub ecx, edx
sar ecx, 1
je 0x10005830
lea ecx, [edi + 0x27a0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004f14
sub ecx, edx
je 0x10005830
lea ecx, [edi + 0x6a0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004f2c
sub ecx, edx
je 0x10005830
cmp dword [0x100c1c2c], 6
jl 0x10004f6e
push str.Event_is_ready__checking_objectives
push esi
call fcn.10010a05
pop ecx
pop ecx
cmp dword [0x100c1c2c], 6
jl 0x10004f6e
push dword [edi + 0xec]
push str.ShortEventID:__d
push esi
call fcn.10010a05
add esp, 0xc
mov eax, ebx
mov dword [ebp - 0x24b8], eax
mov dword [ebp - 0x24c0], eax
cmp dword [0x100c1c2c], 6
jl 0x10004f99
push dword [ebp - 0x24dc]
push str.dwObjectiveCount:__d
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [ebp - 0x24dc], 0
jne 0x10004fb0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24b8], ecx
jmp 0x1000519a
mov dword [ebp - 0x24d0], ebx
mov edi, dword [ebp - 0x24e4]
mov dword [ebp - 0x24cc], edi
call fcn.10009779
mov eax, ebx
cmp dword [0x100c1c2c], 6
jl 0x10004fe1
push eax
push str.begin_MatchCount:__d
push esi
call fcn.10010a05
add esp, 0xc
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x24a8]
lea eax, [ecx + 0x27a0]
push eax
lea eax, [ecx + 0x500]
push eax
mov edx, dword [ecx + 0xec]
mov ecx, dword [edi]
call fcn.1000bcd4
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0x2540], ecx
or dword [ebp - 4], 0xffffffff
jmp 0x1000508f
xor edx, edx
inc edx
test ecx, ecx
js 0x10005105
mov eax, dword [edi]
cmp dword [eax + 0x14], ebx
je 0x100050be
cmp dword [0x100c1c2c], 7
jl 0x100050b3
push str.Excluding_this_event
push esi
call fcn.10010a05
pop ecx
pop ecx
mov dword [ebp - 0x24b8], ebx
jmp 0x10005152
mov eax, edx
mov dword [ebp - 0x24b8], eax
mov dword [ebp - 0x24c0], eax
cmp dword [0x100c1c2c], 7
jl 0x100050e8
push str.Checkobjective:_node_found
push esi
call fcn.10010a05
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2540]
mov eax, dword [ebp - 0x24a8]
cmp dword [eax + 0xc8], ecx
jge 0x100050fc
mov dword [eax + 0xc8], ecx
cmp dword [ebp - 0x2558], 0
je 0x10005152
add edi, 4
mov dword [ebp - 0x24cc], edi
mov eax, dword [ebp - 0x24d0]
inc eax
mov dword [ebp - 0x24d0], eax
cmp dword [0x100c1c2c], 6
jl 0x10005139
push eax
push str.end_MatchCount:__d
push esi
call fcn.10010a05
add esp, 0xc
mov eax, dword [ebp - 0x24d0]
cmp dword [edi], ebx
je 0x10005152
cmp eax, dword [ebp - 0x24dc]
jae 0x10005152
cmp dword [0x100c15c4], 0
je 0x10004fc9
cmp dword [0x100c15c4], 0
jne 0x10005a40
cmp dword [0x100c1c2c], 6
jl 0x100051b9
cmp dword [edi], ebx
jne 0x10005179
push str.Check_Objective_finished:_MatchPointer_has_gone_away
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [ebp - 0x24d0]
cmp eax, dword [ebp - 0x24dc]
jb 0x10005194
push str.Check_Objective_finished:_no_objectives_left_to_check
push esi
call fcn.10010a05
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24b8]
cmp dword [0x100c1c2c], 6
jl 0x100051b9
xor eax, eax
test ecx, ecx
setne al
push eax
push str.nodematch:__d
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [ebp - 0x24b8], 0
je 0x10005924
lea eax, [ebp - 0x2560]
push eax
call fcn.10021d2a
pop ecx
cmp dword [ebp - 0x24fc], 0
jne 0x100051e6
mov eax, dword [ebp - 0x24f0]
test eax, eax
je 0x10005265
lea eax, [ebp - 0x2560]
push eax
lea eax, [ebp - 0x23fc]
push eax
call fcn.100201c4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24f0]
test ecx, ecx
je 0x10005265
mov eax, dword [ebp - 0x23e8]
cmp eax, dword [ebp - 0x2590]
jne 0x1000522f
mov eax, dword [ebp - 0x23ec]
cmp eax, dword [ebp - 0x2594]
jne 0x1000522f
mov eax, dword [ebp - 0x23f0]
cmp eax, dword [ebp - 0x2598]
je 0x10005265
push ecx
call fcn.1001f7cc
pop ecx
call fcn.1000e02b
mov dword [ebp - 0x24f0], eax
mov eax, dword [ebp - 0x23e8]
mov dword [ebp - 0x2590], eax
mov eax, dword [ebp - 0x23ec]
mov dword [ebp - 0x2594], eax
mov eax, dword [ebp - 0x23f0]
mov dword [ebp - 0x2598], eax
mov byte [ebp - 0x24], bl
xor eax, eax
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x24fc], 0
je 0x10005327
lea edx, [ebp - 0x23fc]
lea ecx, [ebp - 0x24]
call fcn.10007bb4
mov ecx, dword [ebp - 0x24a8]
cmp dword [ebp - 0x2548], 0
je 0x100052b7
or eax, 0xffffffff
sub eax, dword [ecx + 0xc8]
xor eax, dword [ebp - 0x2520]
and eax, 7
xor eax, dword [ebp - 0x2520]
jmp 0x100052bd
mov eax, dword [ebp - 0x2520]
cmp dword [ebp - 0x2544], 0
je 0x100052f3
push dword [ecx + 0xc8]
push 0x100c1c50
lea ecx, [ebp - 0x24]
push ecx
push eax
push str.__ld__s__s_MSWinEventLog__d_:
push 0xffffffffffffffff
push 0x100
lea eax, [ebp - 0x3a8]
push eax
call fcn.1001f145
add esp, 0x20
jmp 0x1000535b
mov edx, 0x100bb730
push edx
push dword [ecx + 0xc8]
push edx
push 0x100c1c50
lea ecx, [ebp - 0x24]
push ecx
push eax
push str.__ld__s__s_MSWinEventLog_s_d_s
push 0xffffffffffffffff
push 0x100
lea eax, [ebp - 0x3a8]
push eax
call fcn.1001f145
add esp, 0x28
jmp 0x1000535b
mov ecx, 0x100bb730
push ecx
mov eax, dword [ebp - 0x24a8]
push dword [eax + 0xc8]
push ecx
push ecx
push 0x100c1c50
push str._s_sMSWinEventLog_s_d_s
push 0xffffffffffffffff
push 0x100
lea eax, [ebp - 0x3a8]
push eax
call fcn.1001f145
add esp, 0x24
mov edx, dword [ebp - 0x24a8]
lea ecx, [edx + 0x27a0]
mov eax, ecx
jmp 0x10005374
cmp byte [eax], 9
jne 0x10005373
mov byte [eax], 0x20
inc eax
cmp byte [eax], 0
jne 0x1000536b
lea edi, [edx + 0x7a0]
mov eax, dword [ebp - 0x24e8]
mov esi, dword [ebp - 0x24b0]
push dword [eax + esi*4]
mov esi, 0x100bb730
push esi
push ecx
push esi
push edi
push esi
lea eax, [edx + 0x6a0]
push eax
push esi
push edx
push esi
lea eax, [edx + 0x664]
push eax
push esi
lea eax, [edx + 0x600]
push eax
push esi
lea eax, [edx + 0x500]
push eax
push esi
lea eax, [edx + 0x100]
push eax
push esi
push dword [edx + 0xec]
push esi
lea eax, [edx + 0xd0]
push eax
push esi
push dword [0x100bb740]
push esi
lea eax, [edx + 0x300]
push eax
lea eax, [ebp - 0x3a8]
push eax
push str._s_S_s_d_s_s_s_ld_s_S_s_s_s_s_s_s_s_S_s_s_s_s_s_s_s_d_n
push 0xffffffffffffffff
push 0x2000
push 0x100c4cf0
call fcn.1001f145
add esp, 0x78
cmp dword [0x100c1c2c], 3
mov esi, dword [ebp - 0x24ac]
jl 0x10005449
test edi, edi
je 0x10005421
push edi
push str.DataString:__s
push esi
call fcn.10010a05
add esp, 0xc
cmp dword [0x100c1c2c], 3
jl 0x10005449
mov ecx, dword [ebp - 0x24a8]
lea eax, [ecx + 0x27a0]
test eax, eax
je 0x10005449
push eax
push str.szTempString:__s
push esi
call fcn.10010a05
add esp, 0xc
mov edi, 0x100c4cf0
mov eax, edi
cmp byte [0x100c4cf0], 0
je 0x1000546e
mov cl, byte [eax]
cmp cl, 0xa
je 0x10005465
cmp cl, 0xd
jne 0x10005468
mov byte [eax], 0x20
inc eax
cmp byte [eax], 0
jne 0x10005459
cmp dword [0x100c6cf0], 0
je 0x100054b1
push 0xffffffffffffffff
mov ecx, edi
call fcn.1000770c
push eax
push 0x40
lea eax, [ebp - 0xa0]
push eax
call fcn.10021c86
lea eax, [ebp - 0xa0]
push eax
push 0x100bb730
push edi
push str._s_s_s
push 0xffffffffffffffff
push 0x2000
push edi
call fcn.1001f145
add esp, 0x2c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100054b6
sub ecx, edx
cmp ecx, 0x2000
jb 0x100054d0
mov byte [ecx + 0x100c4cef], 0xa
jmp 0x100054e5
push 0xffffffffffffffff
push 0x1009eb84
push 0x2000
push edi
call fcn.1001f294
add esp, 0x10
cmp dword [0x100c1c2c], 3
jl 0x1000550d
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100054f3
sub ecx, edx
je 0x1000550d
push edi
push str.DEBUG:_Sending_the_following_string_to_the_server:__s
push esi
call fcn.10010a05
add esp, 0xc
mov edi, dword [ebp - 0x24f0]
test edi, edi
je 0x1000552b
push edi
push 0x100c4cf0
call fcn.1002043e
push edi
call fcn.10020771
add esp, 0xc
mov edi, ebx
cmp dword [0x100c1c2c], 3
jl 0x10005543
push str.DMM:sending..._n
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [0x100c2cd4]
mov dword [0x100c2cd8], eax
test eax, eax
je 0x10005802
cmp dword [eax], 0xffffffff
jne 0x100055eb
cmp dword [0x100c1c2c], 9
jl 0x1000557e
add eax, 0x14
push eax
push str.Socket_is_toast_for__s._Trying_to_reestablish.
push esi
call fcn.10010a05
add esp, 0xc
mov eax, dword [0x100c2cd8]
push ecx
push ecx
lea ecx, [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x2528]
mov ecx, eax
call fcn.100148fe
add esp, 0xc
mov ecx, dword [0x100c2cd8]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x100055eb
mov eax, dword [ebp - 0x2560]
mov dword [ecx + 0x218], eax
mov eax, dword [ebp - 0x255c]
mov dword [ecx + 0x21c], eax
mov eax, dword [ecx + 0x220]
mov dword [0x100c2cd8], eax
cmp dword [0x100c1c2c], 9
jl 0x10005675
push str.Failed_to_reconnect_socket
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [0x100c2cd8]
jmp 0x10005675
mov ecx, 0x100c4cf0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100055f3
sub ecx, edx
push ecx
lea eax, [ebp - 0x8a8]
push eax
push ecx
call fcn.1000de0e
add esp, 0xc
test eax, eax
jne 0x10005662
mov eax, dword [0x100c1c2c]
cmp eax, 9
jl 0x1000562f
lea eax, [ebp - 0x8a8]
push eax
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [0x100c1c2c]
cmp eax, 5
jl 0x1000564b
mov eax, dword [0x100c2cd8]
add eax, 0x14
push eax
push str.Socket_for__s_is_toast._Breaking_out___will_reestablish_next_time.
push esi
call fcn.10010a05
add esp, 0xc
mov eax, dword [0x100c2cd8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x100c2cd8]
or dword [eax], 0xffffffff
jmp 0x1000566a
xor edi, edi
inc edi
mov eax, dword [0x100c2cd8]
mov eax, dword [eax + 0x220]
mov dword [0x100c2cd8], eax
test eax, eax
jne 0x10005555
test edi, edi
je 0x10005802
mov edi, dword [ebp - 0x24a8]
lea eax, [edi + 0x47a8]
push eax
imul edx, dword [ebp - 0x24b0], 0x20a
add edx, dword [0x100c1cbc]
call fcn.1000d221
mov eax, edi
mov dword [0x100c1cc4], eax
mov dword [ebp - 0x24a8], ebx
mov dword [ebp - 0x2568], ebx
push 0xffffffffffffffff
push 0x100c1c50
push 0x64
push eax
lea eax, [ebp - 0x2568]
push eax
call fcn.10021a08
add esp, 0x18
mov edi, dword [ebp - 0x24e8]
mov eax, dword [ebp - 0x24b0]
mov eax, dword [edi + eax*4]
mov ecx, dword [0x100c1cc4]
mov dword [ecx + 0x47a0], eax
mov eax, dword [0x100bb740]
mov dword [ecx + 0xcc], eax
mov dword [ecx + 0x4fa8], ebx
mov dword [ecx + 0x4fac], ebx
push 0x1f4
push dword [0x100c1c44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100057e3
mov edi, dword [0x100c1c4c]
cmp edi, 0x32
jl 0x1000575c
mov esi, dword [0x100c1cb4]
mov eax, dword [esi + 0x4fac]
mov dword [0x100c1cb4], eax
mov dword [eax + 0x4fa8], ebx
push 0x4fb0
push ebx
push esi
call fcn.10023400
push esi
call fcn.1001f0b9
add esp, 0x10
dec edi
mov dword [0x100c1c4c], edi
mov edi, dword [ebp - 0x24e8]
push dword [0x100c1c44]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x100c1cc0]
mov ecx, dword [0x100c1cc4]
test eax, eax
je 0x10005789
mov dword [eax + 0x4fac], ecx
mov dword [ecx + 0x4fa8], eax
mov dword [0x100c1cc0], ecx
mov eax, dword [0x100c1cb4]
test eax, eax
cmove eax, ecx
mov dword [0x100c1cb4], eax
inc dword [0x100c1c4c]
mov eax, dword [ebp - 0x24b0]
inc dword [edi + eax*4]
cmp dword [edi + eax*4], 0xffffffff
jb 0x100057ba
mov dword [edi + eax*4], 1
mov eax, dword [0x100bb740]
inc eax
mov dword [0x100bb740], eax
mov esi, dword [ebp - 0x24ac]
cmp eax, 0xffffffff
jb 0x10005924
mov dword [0x100bb740], 1
jmp 0x10005924
cmp dword [0x100c1c2c], 9
jl 0x10005762
push str.VISTA:_EVENT_CACHE_FAILED__n
push esi
call fcn.10010a05
pop ecx
pop ecx
jmp 0x10005762
cmp dword [0x100c1c2c], 1
jl 0x10005818
push str.Failed_to_send_message__holding_position_in_event_log
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, ebx
mov dword [ebp - 0x24f4], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005a40
cmp dword [0x100c1c2c], 3
jl 0x10005846
push str.ERROR:_Invalid_VISTA_event.
push esi
call fcn.10010a05
pop ecx
pop ecx
lea ecx, [edi + 0x6a0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000584f
sub ecx, edx
mov dword [ebp - 0x24cc], ecx
lea ecx, [edi + 0x27a0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005867
sub ecx, edx
mov dword [ebp - 0x2514], ecx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, bx
jne 0x10005879
sub edi, ecx
sar edi, 1
mov ecx, dword [ebp - 0x24a8]
add ecx, 0x100
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10005897
sub ecx, edx
sar ecx, 1
mov edx, dword [ebp - 0x24a8]
add edx, 0xd0
lea eax, [edx + 1]
mov dword [ebp - 0x24c0], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100058bb
sub edx, dword [ebp - 0x24c0]
mov eax, dword [ebp - 0x24b8]
add eax, 2
mov dword [ebp - 0x24c0], eax
mov eax, dword [ebp - 0x24b8]
mov ax, word [eax]
add dword [ebp - 0x24b8], 2
cmp ax, bx
jne 0x100058d7
mov eax, dword [ebp - 0x24b8]
sub eax, dword [ebp - 0x24c0]
sar eax, 1
push dword [ebp - 0x24cc]
push dword [ebp - 0x2514]
push edi
mov edi, dword [ebp - 0x24a8]
push dword [edi + 0xf0]
push ecx
push edx
push eax
push str._d__d__d__d__d__d__d
push esi
call fcn.10010a05
add esp, 0x24
cmp dword [0x100c1c2c], 9
jl 0x1000593a
push str.Message_Complete
push esi
call fcn.10010a05
pop ecx
pop ecx
cmp dword [0x100c1c2c], 3
jl 0x10005950
push str.DMM:_Message_Complete
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [ebp - 0x24a8]
test eax, eax
je 0x1000596b
push eax
call fcn.1001f0b9
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24a8], ebx
jmp 0x1000596d
xor ebx, ebx
mov eax, dword [ebp - 0x24c8]
test eax, eax
je 0x10005984
push eax
call fcn.10074045
pop ecx
mov dword [ebp - 0x24c8], ebx
mov esi, dword [ebp - 0x24b4]
test esi, esi
je 0x1000599b
push esi
call fcn.10074045
pop ecx
mov dword [ebp - 0x24b4], ebx
mov edi, dword [ebp - 0x24d8]
push dword [ebp + edi*4 - 0x23c8]
call dword [sym.imp.wevtapi.dll_EvtClose]
mov dword [ebp + edi*4 - 0x23c8], ebx
inc edi
mov dword [ebp - 0x24d8], edi
mov esi, dword [ebp - 0x24ac]
jmp 0x10003f63
mov edi, dword [0x100c15ac]
mov ecx, dword [ebp - 0x24b0]
jmp 0x10003e66
mov eax, dword [esi + 0x80]
push dword [eax + ecx*4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x100c1c2c], 9
jl 0x10005a56
push str.EvtNextCleanup...
push esi
call fcn.10010a05
pop ecx
pop ecx
mov edi, ebx
cmp dword [ebp - 0x251c], 0
jbe 0x10005a8b
mov esi, dword [sym.imp.wevtapi.dll_EvtClose]
mov eax, dword [ebp + edi*4 - 0x23c8]
test eax, eax
je 0x10005a7c
push eax
call esi
mov dword [ebp + edi*4 - 0x23c8], ebx
inc edi
cmp edi, dword [ebp - 0x251c]
jb 0x10005a67
mov esi, dword [ebp - 0x24ac]
mov eax, dword [ebp - 0x24f4]
cmp eax, 0x103
je 0x10005bec
cmp eax, 0x10dd
je 0x10005bec
cmp eax, 6
je 0x10005bec
cmp eax, 0xb7
je 0x10005bec
mov edi, dword [ebp - 0x24b0]
cmp dword [0x100c1c2c], 5
jl 0x10005ae5
imul eax, edi, 0x20a
add eax, dword [0x100c15cc]
push eax
push str.ERROR:_Unable_to_collect_events__restarting_subscription_for__S
push esi
call fcn.10010a05
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x84]
cmp dword [eax + edi*4], 0
je 0x10005b05
push dword [eax + edi*4]
call dword [sym.imp.wevtapi.dll_EvtClose]
mov eax, dword [esi + 0x80]
cmp dword [eax + edi*4], 0
je 0x10005b1a
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
xor eax, eax
inc eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x80]
mov dword [ecx + edi*4], eax
imul edi, edi, 0x20a
mov ecx, dword [0x100c15cc]
lea ecx, [edi + ecx]
call fcn.100100dc
test eax, eax
je 0x10005bec
mov dword [ebp - 0x24c0], 1
mov dword [ebp - 0x24c4], ebx
mov eax, dword [0x100c1574]
mov ecx, dword [ebp - 0x24b0]
mov dword [eax + ecx*4], ebx
push ecx
lea eax, [ebp - 0x20a8]
push eax
mov edx, dword [0x100c1cbc]
lea edx, [edi + edx]
call fcn.1000abf6
pop ecx
pop ecx
test eax, eax
je 0x10005bb1
lea eax, [ebp - 0x20a8]
push eax
call dword [sym.imp.wevtapi.dll_EvtCreateBookmark]
mov ecx, dword [0x100c1574]
mov edx, dword [ebp - 0x24b0]
mov dword [ecx + edx*4], eax
test eax, eax
je 0x10005bb1
mov dword [ebp - 0x24c4], eax
push 3
pop eax
jmp 0x10005bb7
mov eax, dword [ebp - 0x24c0]
push eax
push ebx
push ebx
push dword [ebp - 0x24c4]
push 0x1009e240
mov eax, dword [0x100c15cc]
add eax, edi
push eax
mov eax, dword [esi + 0x80]
mov edi, dword [ebp - 0x24b0]
push dword [eax + edi*4]
push ebx
call dword [sym.imp.wevtapi.dll_EvtSubscribe]
mov ecx, dword [esi + 0x84]
mov dword [ecx + edi*4], eax
mov eax, dword [ebp - 0x24a8]
test eax, eax
je 0x10005c03
push eax
call fcn.1001f0b9
pop ecx
mov dword [ebp - 0x24a8], ebx
mov ecx, dword [ebp - 0x24c8]
test ecx, ecx
je 0x10005c1a
push ecx
call fcn.10074045
pop ecx
mov dword [ebp - 0x24c8], ebx
mov eax, dword [ebp - 0x24b4]
test eax, eax
je 0x10005c66
push eax
call fcn.10074045
pop ecx
mov dword [ebp - 0x24b4], ebx
jmp 0x10005c66
cmp dword [0x100c1c2c], 9
jl 0x10005c66
push str.Oh_dear._I_cant_seem_to_find_the_next_open_log_file._Something_quite_strange_is_going_on_here.
push esi
call fcn.10010a05
pop ecx
pop ecx
jmp 0x10005c66
cmp dword [0x100c1c2c], 9
jl 0x10005c66
push str.Warning:_An_event_occured_that_I_am_not_programmed_to_deal_with._Continuing
jmp 0x10005c41
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x24f8]
inc ecx
mov dword [ebp - 0x24f8], ecx
push 8
pop edx
jmp 0x10003855
mov edi, dword [ebp - 0x250c]
cmp edi, 0x258
jge 0x10005c91
cmp dword [esi + 0x88], ebx
je 0x10005d02
push 0xffffffffffffffff
push dword [esi + 0x90]
call dword [ebp - 0x2570]
cmp dword [ebp - 0x254c], 0
je 0x10005cb0
cmp dword [esi + 0x8c], ebx
jne 0x10005cff
mov dword [ebp - 0x254c], 1
mov dword [ebp - 0x2578], 0x100060f1
mov dword [ebp - 0x2574], esi
lea edx, [ebp - 0x2578]
lea ecx, [ebp - 0x2580]
call fcn.100188e4
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x2580]
call fcn.10018098
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x257c], 0
je 0x10005cff
call fcn.10021c2e
push 8
pop edx
cmp edi, 0x4b0
jl 0x1000382c
cmp dword [0x100c1c2c], 1
jl 0x10005d24
push str.SNARE_Closing
push esi
call fcn.10010a05
pop ecx
pop ecx
mov eax, dword [ebp - 0x24e4]
test eax, eax
je 0x10005d35
push eax
call fcn.1001f0b9
pop ecx
call fcn.1000f478
mov eax, dword [ebp - 0x24f0]
test eax, eax
je 0x10005d4b
push eax
call fcn.1001f7cc
pop ecx
mov edi, dword [0x100c2cd4]
mov dword [0x100c2cd8], edi
jmp 0x10005d7e
mov ecx, dword [edi]
cmp ecx, 0xffffffff
je 0x10005d6b
call fcn.100182c5
mov edi, dword [0x100c2cd8]
push edi
mov edi, dword [edi + 0x220]
mov dword [0x100c2cd8], edi
call fcn.1001f0b9
pop ecx
test edi, edi
jne 0x10005d59
mov dword [0x100c2cd4], ebx
mov edi, ebx
mov eax, dword [esi + 0x84]
cmp dword [edi + eax], 0
je 0x10005d9f
push dword [edi + eax]
call dword [sym.imp.wevtapi.dll_EvtClose]
mov eax, dword [esi + 0x80]
cmp dword [edi + eax], 0
je 0x10005db4
push dword [edi + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, 0x1c
jb 0x10005d8a
mov eax, dword [0x100c1c34]
test eax, eax
push 0
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10005dd1
push eax
call esi
mov eax, dword [0x100c1c38]
test eax, eax
je 0x10005ddd
push eax
call esi
mov eax, dword [0x100c1c3c]
test eax, eax
je 0x10005de9
push eax
call esi
mov eax, dword [0x100c2c28]
mov esi, dword [sym.imp.wevtapi.dll_EvtClose]
test eax, eax
je 0x10005e01
push eax
call esi
mov dword [0x100c2c28], ebx
mov eax, dword [0x100c2c34]
test eax, eax
je 0x10005e13
push eax
call esi
mov dword [0x100c2c34], ebx
call fcn.10012c3e
jmp 0x10005e38
cmp dword [0x100c1c2c], 9
jl 0x10005e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_Subscribe_to_Core_Events__Error__0x_x
push esi
call fcn.10010a05
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001e010
mov esp, ebp
pop ebp
ret