Function at 0x1007f0b
Capabilities:
Access the windows event log
Set registry value

Disassembly:
push 0x524
push 0x10019f0
call fcn.01009f68
mov eax, dword [0x1012070]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4f4], esi
xor ebx, ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
or edi, 0xffffffff
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x4b4], edi
mov dword [ebp - 0x4b0], edi
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x500], ebx
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c4], ebx
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
push esi
call fcn.01003275
test eax, eax
jne 0x1007fc5
mov dword [ebp - 0x470], 1
cmp dword [ebp - 0x470], 1
jne 0x1008606
push 1
push esi
call fcn.0100439d
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], edx
cmp eax, edi
jne 0x1007ff4
cmp edx, edi
jne 0x1007ff4
mov dword [ebp - 0x470], ebx
cmp dword [ebp - 0x470], 1
jne 0x1008606
push esi
call fcn.01006832
lea eax, [ebp - 0x47c]
push eax
push ebx
cmp dword [esi + 0x4ec], 4
jne 0x100801b
push edi
jmp 0x100801c
push ebx
call sub.pdh.dll_PdhOpenQueryH
mov dword [ebp - 0x474], eax
cmp eax, ebx
je 0x1008070
lea ecx, [esi + 0xbc]
mov dword [ebp - 0x4d4], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x4d4]
push eax
push 4
push 2
push ebx
push 0x8000080a
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x470], ebx
cmp dword [ebp - 0x470], 1
jne 0x1008606
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x4a4], ebx
mov edi, dword [esi + 0x4d8]
mov dword [ebp - 0x48c], edi
cmp word [edi], bx
je 0x100849e
push 0x2a
push edi
call fcn.0100a18d
pop ecx
pop ecx
test eax, eax
jne 0x10080cd
lea eax, [ebp - 0x4a4]
push eax
push 1
push dword [ebp - 0x47c]
push edi
push esi
call fcn.010068f4
mov dword [ebp - 0x478], eax
jmp 0x1008445
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x480], ebx
mov eax, dword [esi + 0xa0]
cmp eax, 6
jne 0x10081e1
mov dword [ebp - 0x4e0], 2
mov dword [ebp - 0x4e4], ebx
cmp dword [ebp - 0x4a0], ebx
jne 0x1008138
mov dword [ebp - 0x4a0], 0x801
push 0x1002
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x494], eax
cmp eax, ebx
jne 0x1008138
mov dword [ebp - 0x478], 0xe
mov dword [ebp - 0x4a0], ebx
mov edi, dword [ebp - 0x494]
cmp edi, ebx
je 0x100831a
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x49c]
push eax
push edi
push dword [ebp - 0x48c]
call sub.pdh.dll_PdhTranslateLocaleCounterW
mov dword [ebp - 0x474], eax
cmp eax, 0x800007d2
jne 0x100830c
push edi
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x4a0], ebx
mov eax, dword [ebp - 0x49c]
add eax, eax
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x494], edi
cmp edi, ebx
je 0x1008302
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x49c]
push eax
push edi
push dword [ebp - 0x48c]
call sub.pdh.dll_PdhTranslateLocaleCounterW
mov dword [ebp - 0x474], eax
jmp 0x100830c
cmp eax, ebx
je 0x10080f2
cmp eax, 1
je 0x10080f2
mov dword [ebp - 0x4e0], 2
cmp dword [esi + 0x4ec], 1
jne 0x10080f2
mov ecx, 0x90
xor eax, eax
lea edi, [ebp - 0x46c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x49c], 0x242
push ebx
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x48c]
call sub.pdh.dll_PdhParseCounterPathW
mov dword [ebp - 0x474], eax
cmp eax, ebx
jne 0x10082b2
push 0x10019ec
lea edi, [ebp - 0x46c]
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10080f2
mov edi, dword [edi + 8]
cmp edi, ebx
je 0x100827f
push 0x10019ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10080f2
lea eax, [ebp - 0x4a4]
push eax
push ebx
push dword [ebp - 0x47c]
push dword [ebp - 0x48c]
push esi
call fcn.010068f4
mov dword [ebp - 0x478], eax
cmp eax, ebx
je 0x1008480
mov dword [ebp - 0x478], ebx
jmp 0x10080f2
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x4d4], ecx
lea ecx, [esi + 0xbc]
mov dword [ebp - 0x4d0], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x4d4]
push eax
push 4
push 3
push ebx
push 0x8000080c
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x1008480
mov dword [ebp - 0x478], 0xe
cmp dword [ebp - 0x474], ebx
jne 0x100831a
mov dword [ebp - 0x4e4], edi
cmp dword [ebp - 0x4e4], ebx
je 0x1008445
mov dword [ebp - 0x4d8], 0x1000
mov dword [ebp - 0x4dc], 0xa
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 0x480], ebx
je 0x100836c
push dword [ebp - 0x480]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x480], ebx
mov eax, dword [ebp - 0x4d8]
add eax, eax
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
add eax, eax
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x480], eax
cmp eax, ebx
jne 0x1008396
mov dword [ebp - 0x478], 0xe
jmp 0x10083d4
push dword [ebp - 0x4e0]
lea eax, [ebp - 0x4d8]
push eax
push dword [ebp - 0x480]
push dword [ebp - 0x4e4]
push ebx
call sub.pdh.dll_PdhExpandWildCardPathW
mov dword [ebp - 0x474], eax
dec dword [ebp - 0x4dc]
cmp eax, 0x800007d2
jne 0x10083d4
cmp dword [ebp - 0x4dc], ebx
jne 0x1008340
cmp dword [ebp - 0x474], ebx
jne 0x1008423
cmp dword [ebp - 0x478], ebx
jne 0x1008423
mov edi, dword [ebp - 0x480]
mov dword [ebp - 0x524], edi
cmp word [edi], bx
je 0x1008423
lea eax, [ebp - 0x4a4]
push eax
push 1
push dword [ebp - 0x47c]
push edi
push esi
call fcn.010068f4
mov dword [ebp - 0x478], eax
cmp eax, 0xe
je 0x1008423
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
jmp 0x10083ea
cmp dword [ebp - 0x480], ebx
je 0x1008445
push dword [ebp - 0x480]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x480], ebx
cmp dword [ebp - 0x478], 0xe
jne 0x1008480
lea eax, [esi + 0xbc]
mov dword [ebp - 0x4d4], eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push ebx
push 1
push ebx
push 0x800007f9
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x470], ebx
mov edi, dword [ebp - 0x48c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [edi + eax*2 + 2]
mov dword [ebp - 0x48c], eax
mov edi, eax
jmp 0x1008095
cmp dword [ebp - 0x494], ebx
je 0x10084c0
push dword [ebp - 0x494]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x494], ebx
cmp dword [ebp - 0x470], ebx
je 0x10085f2
cmp dword [ebp - 0x4a4], ebx
jbe 0x10084e5
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1008517
mov dword [ebp - 0x470], ebx
lea eax, [esi + 0xbc]
mov dword [ebp - 0x4d4], eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push ebx
push 1
push ebx
push 0x800007ed
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [ebp - 0x470], ebx
je 0x10085f2
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x514], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x4c0]
cmp eax, ebx
jl 0x100857d
mov ecx, dword [ebp - 0x4c4]
jg 0x100854b
cmp ecx, ebx
jbe 0x100857d
neg ecx
adc eax, ebx
neg eax
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], eax
lea eax, [ebp - 0x4c4]
push eax
push ebx
push 1
lea eax, [ebp - 0x514]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
jne 0x10085ec
lea eax, [ebp - 0x488]
push eax
push 1
push esi
call fcn.01006b3c
cmp dword [ebp - 0x488], 0xffffffff
jne 0x10085a2
cmp dword [ebp - 0x484], 0xffffffff
je 0x100886c
mov ecx, dword [esi + 0xb4]
cmp ecx, 0xffffffff
je 0x10085b8
mov eax, dword [esi + 0xb8]
imul eax, ecx
jmp 0x10085ba
xor eax, eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], ebx
lea eax, [ebp - 0x4b4]
push eax
push ebx
push esi
call fcn.01006b3c
cmp dword [ebp - 0x4b4], 0xffffffff
jne 0x1008615
cmp dword [ebp - 0x4b0], 0xffffffff
jne 0x1008615
mov dword [ebp - 0x470], ebx
push dword [ebp - 0x47c]
call sub.pdh.dll_PdhCloseQuery
mov dword [ebp - 0x47c], ebx
or edi, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], edi
jmp 0x1008bf9
mov eax, dword [esi + 0x44]
cmp eax, 3
je 0x1008628
cmp eax, 1
mov dword [ebp - 0x498], ebx
jne 0x1008632
mov dword [ebp - 0x498], 1
lea edi, [esi + 0xb0]
mov eax, dword [edi]
mov dword [ebp - 0x4e8], eax
push dword [ebp - 0x498]
push dword [esi + 0xa0]
push dword [esi + 0xac]
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [esi + 0x88]
push dword [esi + 0x84]
push dword [esi + 0x80]
lea eax, [esi + 0xbc]
push eax
call fcn.01002a96
inc dword [ebp - 0x498]
cmp dword [esi + 0xac], 1
jne 0x10086b3
inc dword [edi]
cmp dword [edi], 0xf423f
jbe 0x1008699
mov dword [edi], ebx
push 4
push edi
push 4
push ebx
push 0x1001370
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x518]
push eax
push esi
call fcn.01006c48
mov edi, dword [ebp - 0x488]
cmp dword [ebp - 0x470], ebx
je 0x10085f2
or eax, 0xffffffff
cmp edi, eax
jne 0x10086ec
cmp dword [ebp - 0x484], eax
je 0x100886c
cmp dword [ebp - 0x4b4], ebx
jne 0x10086fc
cmp dword [ebp - 0x4b0], ebx
je 0x1008720
cmp edi, ebx
jne 0x1008708
cmp dword [ebp - 0x484], ebx
je 0x100875c
mov edx, dword [ebp - 0x4b0]
cmp edx, dword [ebp - 0x484]
jg 0x1008720
jl 0x1008762
cmp dword [ebp - 0x4b4], edi
jbe 0x1008762
mov dword [ebp - 0x4ac], edi
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x4a8], ecx
cmp dword [esi + 0x44], 1
je 0x1008744
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x4fc], 8
je 0x10087a6
mov ecx, dword [esi + 0x8c]
jmp 0x10087a8
mov edx, dword [ebp - 0x4b0]
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x4a8], edx
cmp edi, ebx
jne 0x1008780
cmp dword [ebp - 0x484], ebx
je 0x1008744
sub edi, ecx
mov dword [ebp - 0x488], edi
mov ecx, dword [ebp - 0x484]
sbb ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x484], ecx
cmp ecx, ebx
jg 0x1008744
jl 0x1008738
cmp edi, ebx
ja 0x1008744
jmp 0x1008738
xor ecx, ecx
mov eax, dword [esi + 0xa0]
cmp eax, 3
je 0x10087c1
cmp eax, 2
je 0x10087c1
cmp eax, 6
je 0x10087c1
xor eax, eax
jmp 0x10087c7
mov eax, dword [ebp - 0x4f8]
lea edx, [ebp - 0x490]
push edx
push ecx
push eax
push dword [ebp - 0x47c]
lea eax, [ebp - 0x4fc]
push eax
push dword [ebp - 0x518]
lea eax, [ebp - 0x228]
push eax
call sub.pdh.dll_PdhOpenLogW
mov dword [ebp - 0x474], eax
mov dword [ebp - 4], ebx
jmp 0x1008817
cmp eax, ebx
je 0x1008890
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x4d4], ecx
lea ecx, [esi + 0xbc]
mov dword [ebp - 0x4d0], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x4d4]
push eax
push 4
push 3
push ebx
push 0x800007d4
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x470], ebx
cmp dword [ebp - 0x470], ebx
je 0x10085f2
lea eax, [ebp - 0x4c4]
push eax
push esi
call fcn.01006bcb
mov dword [ebp - 0x470], eax
jmp 0x1008517
push ebx
lea eax, [ebp - 0x228]
push eax
push dword [esi + 8]
call fcn.010097ed
lea eax, [esi + 0x9c]
mov dword [eax], 1
push 4
push eax
push 0x1001544
push dword [esi + 8]
call fcn.01002a4f
mov dword [ebp - 0x478], eax
lea eax, [esi + 0xbc]
mov dword [ebp - 0x4d4], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x4d0], eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push ebx
push 2
push ebx
push 0x400007e7
push ebx
push 4
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
lea eax, [ebp - 0x4bc]
push eax
push ebx
push 1
lea eax, [ebp - 0x514]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
jne 0x10089b0
lea eax, [ebp - 0x50c]
push eax
call fcn.01009395
cmp dword [esi + 0x4d0], ebx
jne 0x10089aa
push dword [esi + 0x8c]
push dword [ebp - 0x490]
call sub.pdh.dll_PdhUpdateLogW
mov edi, eax
mov dword [ebp - 0x474], edi
push edi
call fcn.01006a22
test eax, eax
jne 0x1008a7b
mov eax, edi
and eax, 0xc0000000
cmp eax, 0x80000000
je 0x1008a7b
lea eax, [esi + 0xbc]
mov dword [ebp - 0x4d4], eax
push edi
call fcn.010026b9
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x4d4]
push eax
push 4
push 2
push ebx
push 0x800007e9
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4b8], ebx
cmp dword [esi + 0x4d0], ebx
jne 0x10089dc
lea eax, [ebp - 0x4bc]
push eax
push ebx
push dword [esi + 0xc]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, 0x102
je 0x10089e2
mov dword [ebp - 0x470], ebx
push ebx
push dword [ebp - 0x490]
call sub.pdh.dll_PdhCloseLog
mov dword [ebp - 0x490], ebx
cmp dword [esi + 0x4d0], ebx
jne 0x100886c
cmp dword [esi + 0x90], ebx
je 0x1008a1b
push dword [ebp - 0x470]
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.01005412
mov edi, dword [ebp - 0x488]
cmp edi, 0xffffffff
jne 0x1008a32
cmp dword [ebp - 0x484], edi
je 0x10086cd
push dword [ebp - 0x498]
push dword [esi + 0xa0]
push dword [esi + 0xac]
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [esi + 0x88]
push dword [esi + 0x84]
push dword [esi + 0x80]
lea eax, [esi + 0xbc]
push eax
call fcn.01002a96
inc dword [ebp - 0x498]
jmp 0x10086cd
cmp dword [ebp - 0x4ac], ebx
jne 0x1008a8b
cmp dword [ebp - 0x4a8], ebx
je 0x1008aab
add dword [ebp - 0x4ac], 0xffffffff
adc dword [ebp - 0x4a8], 0xffffffff
mov eax, dword [ebp - 0x4ac]
or eax, dword [ebp - 0x4a8]
je 0x10089b0
cmp dword [ebp - 0x4f0], ebx
jne 0x1008abb
cmp dword [ebp - 0x4ec], ebx
je 0x1008b06
cmp dword [esi + 0xa0], 3
je 0x1008b06
lea eax, [ebp - 0x52c]
push eax
push dword [ebp - 0x490]
call sub.pdh.dll_PdhGetLogFileSize
mov dword [ebp - 0x474], eax
cmp eax, ebx
jne 0x1008b06
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x528]
jb 0x10089b0
ja 0x1008b06
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0x52c]
jbe 0x10089b0
lea eax, [ebp - 0x504]
push eax
call fcn.01009395
mov edi, dword [ebp - 0x504]
sub edi, dword [ebp - 0x50c]
mov dword [ebp - 0x520], edi
mov ecx, dword [ebp - 0x500]
sbb ecx, dword [ebp - 0x508]
mov dword [ebp - 0x51c], ecx
mov eax, dword [esi + 0x4f4]
mov edx, 0x2710
mul edx
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], edx
cmp ecx, edx
jg 0x1008b5f
jl 0x1008b59
cmp edi, eax
jae 0x1008b5f
sub eax, edi
sbb edx, ecx
jmp 0x1008b63
xor eax, eax
xor edx, edx
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], edx
neg eax
adc edx, ebx
neg edx
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], edx
jmp 0x10088fa
push esi
call fcn.01003818
jmp 0x1008c1e
mov eax, dword [esi + 0x4dc]
mov ecx, dword [eax]
mov dword [esi + 0x4dc], ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esi + 0x4dc], ebx
jne 0x1008c01
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x1c]
call fcn.01009963
call fcn.01009fa3
ret 4