Function at 0x10001129
Capabilities:
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x80000004
push 0
push str.C:Windows_sysnativedrivers_sysdiag_win10.sys
push 1
mov ebx, 0x244
call fcn.10001f00
add esp, 0x10
push 0x80000004
push 0
push str.C:Windows_sysnativedrivers_sysdiag.sys
push 1
mov ebx, 0x244
call fcn.10001f00
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x100011be
push 0x80000005
push 0
push 0x1000d298
push 0x80000004
push 0
push str.C:Windows_sysnativedrivers_sysdiag_win10.sys
push 2
mov ebx, 0x26c
call fcn.10001f10
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100011b9
mov eax, 2
jmp 0x100016d9
jmp 0x100011ff
push 0x80000005
push 0
push 0x1006fb20
push 0x80000004
push 0
push str.C:Windows_sysnativedrivers_sysdiag.sys
push 2
mov ebx, 0x26c
call fcn.10001f10
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100011ff
mov eax, 2
jmp 0x100016d9
push 0x80000301
push 0
push 0x7d0
push 1
mov ebx, 0x67c
call fcn.10001fb0
add esp, 0x10
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push str.Loader.json
push dword [ebp - 4]
mov ecx, 2
call fcn.100010cd
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000125a
push ebx
call fcn.10001adb
add esp, 4
push 0x80000005
push 0
push 0x100cf47d
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001279
mov eax, 0x10106285
push eax
push 2
mov ebx, 0x26c
call fcn.10001f10
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000129f
push ebx
call fcn.10001adb
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x100012b3
mov eax, 3
jmp 0x100016d9
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push 0x10106286
push dword [ebp - 4]
mov ecx, 2
call fcn.100010cd
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100012f0
push ebx
call fcn.10001adb
add esp, 4
push 0x80000005
push 0
push 0x10106293
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1000130f
mov eax, 0x10106285
push eax
push 2
mov ebx, 0x26c
call fcn.10001f10
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001335
push ebx
call fcn.10001adb
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x10001349
mov eax, 3
jmp 0x100016d9
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 8], eax
push str.Loader.json
push dword [ebp - 8]
push str.Loader1.exe
push dword [ebp - 4]
mov ecx, 4
call fcn.100010cd
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100013a3
push ebx
call fcn.10001adb
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100013b3
push ebx
call fcn.10001adb
add esp, 4
push 0x80000301
push 0
push 1
push 0x80000002
push 0
push 1
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100013de
mov eax, 0x10106285
push eax
push 3
mov ebx, 0x2c0
call fcn.10002050
add esp, 0x28
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10001404
push ebx
call fcn.10001adb
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x10001418
mov eax, 4
jmp 0x100016d9
push dword [ebp + 0xc]
mov eax, str.Version
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, str.Driver
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.100016df
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001448
push ebx
call fcn.10001adb
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001458
push ebx
call fcn.10001adb
add esp, 4
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.10001fb0
add esp, 0x10
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push str.Loader.json
push dword [ebp - 4]
mov ecx, 2
call fcn.100010cd
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100014b3
push ebx
call fcn.10001adb
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100014c6
mov eax, 0x10106285
push eax
push 1
mov ebx, 0x244
call fcn.10001f00
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100014e9
push ebx
call fcn.10001adb
add esp, 4
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push str.Loader.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.100010cd
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001526
push ebx
call fcn.10001adb
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001539
mov eax, 0x10106285
push eax
push 1
mov ebx, 0x244
call fcn.10001f00
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000155c
push ebx
call fcn.10001adb
add esp, 4
push 0
mov ebx, 0x104
call fcn.10001fc0
add esp, 4
mov dword [ebp - 4], eax
push 0x10106286
push dword [ebp - 4]
mov ecx, 2
call fcn.100010cd
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001599
push ebx
call fcn.10001adb
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100015ac
mov eax, 0x10106285
push eax
push 1
mov ebx, 0x244
call fcn.10001f00
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100015cf
push ebx
call fcn.10001adb
add esp, 4
push 0
push 0
push 0
push 0x80000002
push 0
push 0
push 0x80000004
push 0
push str.wevtutil_cl_security
push 3
mov ebx, 0x2c0
call fcn.10002050
add esp, 0x28
push 0
push 0
push 0
push 0x80000002
push 0
push 0
push 0x80000004
push 0
push str.wevtutil_cl_system
push 3
mov ebx, 0x2c0
call fcn.10002050
add esp, 0x28
push 0
push 0
push 0
push 0x80000002
push 0
push 0
push 0x80000004
push 0
push str.wevtutil_cl_application
push 3
mov ebx, 0x2c0
call fcn.10002050
add esp, 0x28
mov dword [ebp - 4], esp
push str.VK12D
xor eax, eax
call dword [0x10155d74]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000168d
push 0x881
push 0x401000e
push 6
call fcn.10001aed
add esp, 0xc
mov eax, str.C:Windows_sysnativedrivers_sysdiag.sys
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.10001782
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100016ae
push ebx
call fcn.10001adb
add esp, 4
mov eax, str.C:Windows_sysnativedrivers_sysdiag_win10.sys
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.10001782
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100016cf
push ebx
call fcn.10001adb
add esp, 4
mov eax, 0
jmp 0x100016d9
mov esp, ebp
pop ebp
ret 8