Function at 0x100a5b10
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183920
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x101ba3f8]
cmp eax, ebx
jne 0x100a5c6e
mov ecx, str.wevtapi.dll
call fcn.1005a380
mov dword [0x101ba3f8], eax
cmp eax, ebx
je 0x100a5c1c
push str.EvtQuery
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x101ba3fc], eax
push str.EvtRender
mov eax, dword [0x101ba3f8]
push eax
call esi
mov dword [0x101ba400], eax
push str.EvtSubscribe
mov ecx, dword [0x101ba3f8]
push ecx
call esi
mov dword [0x101ba404], eax
push str.EvtSeek
mov edx, dword [0x101ba3f8]
push edx
call esi
mov dword [0x101ba408], eax
push str.EvtNext
mov eax, dword [0x101ba3f8]
push eax
call esi
mov dword [0x101ba40c], eax
push str.EvtClose
mov ecx, dword [0x101ba3f8]
push ecx
call esi
mov dword [0x101ba410], eax
push str.EvtCreateRenderContext
mov edx, dword [0x101ba3f8]
push edx
call esi
mov dword [0x101ba414], eax
push str.EvtOpenPublisherMetadata
mov eax, dword [0x101ba3f8]
push eax
call esi
mov dword [0x101ba418], eax
push str.EvtFormatMessage
mov ecx, dword [0x101ba3f8]
push ecx
call esi
mov dword [0x101ba41c], eax
jmp 0x100a5c61
cmp dword [0x101ba3f4], ebx
je 0x100a5c66
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea edx, [ebp - 0x11f]
push edx
call fcn.1012e060
push 0x104
lea esi, [ebp - 0x120]
call fcn.10065360
mov eax, esi
push eax
push str._WEVT__Error_loading_WEVTAPI.DLL___s
push 0x101ba1e8
call fcn.1006ed90
add esp, 0x1c
mov eax, dword [0x101ba3f8]
cmp eax, ebx
je 0x100a5daa
mov eax, dword [0x101ba3fc]
cmp eax, ebx
je 0x100a5cc0
cmp dword [0x101ba400], ebx
je 0x100a5cc0
cmp dword [0x101ba404], ebx
je 0x100a5cc0
cmp dword [0x101ba408], ebx
je 0x100a5cc0
cmp dword [0x101ba40c], ebx
je 0x100a5cc0
cmp dword [0x101ba414], ebx
je 0x100a5cc0
cmp dword [0x101ba418], ebx
je 0x100a5cc0
cmp dword [0x101ba41c], ebx
je 0x100a5cc0
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x100a5db3
cmp dword [0x101ba3f4], ebx
je 0x100a5daa
cmp eax, ebx
jne 0x100a5ce2
push str._WEVT__Unable_to_GetProcAddress_EvtQuery__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba400], ebx
jne 0x100a5cfc
push str._WEVT__Unable_to_GetProcAddress_EvtRender__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba404], ebx
jne 0x100a5d16
push str._WEVT__Unable_to_GetProcAddress_EvtSubscribe__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba408], ebx
jne 0x100a5d30
push str._WEVT__Unable_to_GetProcAddress_EvtSeek__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba40c], ebx
jne 0x100a5d4a
push str._WEVT__Unable_to_GetProcAddress_EvtNext__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba414], ebx
jne 0x100a5d64
push str._WEVT__Unable_to_GetProcAddress_EvtCreateRenderContext__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba418], ebx
jne 0x100a5d7e
push str._WEVT__Unable_to_GetProcAddress_EvtOpenPublisherMetadata__
push 0x101ba1e8
call fcn.1006ed90
add esp, 8
cmp dword [0x101ba41c], ebx
jne 0x100a5daa
push str._WEVT__Unable_to_GetProcAddress_EvtFormatMessage__
push 0x101ba1e8
jmp 0x100a5da2
call fcn.1006ed90
add esp, 8
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10127db1
mov esp, ebp
pop ebp
ret