Function at 0x1014cfb
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac0
mov eax, dword [0x1036a44]
and dword [ebp - 0xa84], 0
and dword [ebp - 0xa88], 0
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xa90], ecx
mov byte [ebp - 0xa7d], 0
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov edi, eax
cmp di, 0x41
jb 0x1014f7f
cmp di, 0x5a
ja 0x1014f7f
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
movzx eax, di
push eax
lea eax, [ebp - 0x20c]
push 0x1001a6c
push eax
call esi
add esp, 0xc
push 0x400
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1014f84
push edi
call fcn.0101ecbd
xor ebx, ebx
inc ebx
cmp al, bl
jne 0x1014c52
cmp dword [ebp + 0xc], ebx
je 0x1014c52
mov eax, 0xc10007d0
jmp 0x1014f84
push edi
call fcn.0101ecf6
cmp al, bl
jne 0x1014c6b
cmp dword [ebp + 0xc], ebx
je 0x1014c6b
mov eax, 0xc10007d1
jmp 0x1014f84
call fcn.01004490
mov ecx, dword [ebp - 0xa90]
lea eax, [ebp - 0xac0]
push eax
push edi
call fcn.01014310
push dword [ebp - 0xab4]
push dword [ebp - 0xab8]
call fcn.01013f2e
cmp eax, ebx
je 0x1014df6
jbe 0x1014cb5
cmp eax, 3
jbe 0x1014daf
cmp eax, 4
je 0x1014cc4
cmp eax, 5
je 0x1014daf
mov dword [ebp - 0xa84], 0xc10007cf
jmp 0x1014f72
push dword [ebp - 0xab4]
push dword [ebp - 0xab8]
call fcn.0100661d
test eax, eax
je 0x1014f23
push 0x80000000
mov ecx, eax
call fcn.01006a65
test eax, eax
mov dword [ebp - 0xa88], eax
je 0x1014d79
push eax
call fcn.0101efdc
test eax, eax
jge 0x1014d3b
push dword [ebp - 0xa88]
call fcn.0101f4b2
cmp dword [ebp + 0xc], 0
je 0x1014e65
lea eax, [ebp - 0x20c]
push eax
call fcn.0100380c
test al, al
je 0x1014e8a
mov ecx, dword [ebp - 0xa90]
push edi
call fcn.010141c2
jmp 0x1014eba
lea eax, [ebp - 0x20c]
push eax
call fcn.01011e9f
push ebx
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 0xa7d], bl
call fcn.010037dd
test al, al
jne 0x1014d68
mov dword [ebp - 0xa84], 0xc10007cf
lea eax, [ebp - 0xa88]
push eax
call fcn.01007701
jmp 0x1014f2d
lea eax, [ebp - 0x20c]
push eax
call fcn.01011e9f
push ebx
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 0xa7d], bl
call fcn.010037dd
test al, al
jne 0x1014f36
mov dword [ebp - 0xa84], 0xc100041d
jmp 0x1014f2d
lea eax, [ebp - 0xa88]
push eax
push edi
call fcn.01007657
test al, al
je 0x1014d0c
lea eax, [ebp - 0x20c]
push eax
call fcn.01011e9f
push ebx
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 0xa7d], bl
call fcn.010037dd
test al, al
jne 0x1014d68
mov dword [ebp - 0xa84], 0xc100041d
jmp 0x1014d68
lea eax, [ebp - 0xa7c]
push eax
push dword [ebp - 0xab4]
push dword [ebp - 0xab8]
call fcn.01028c90
cmp al, bl
jne 0x1014f23
test byte [ebp - 0xa60], bl
je 0x1014e2d
mov dword [ebp - 0xa84], 0xc1000412
jmp 0x1014f72
movzx eax, di
push eax
lea eax, [ebp - 0xc]
push 0x1001d18
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and word [ebp - 0xc], 0
lea eax, [ebp - 0xa88]
push eax
push edi
call fcn.01007657
test al, al
jne 0x1014ec9
cmp dword [ebp + 0xc], 0
jne 0x1014e7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa84], 0xc10003f2
jmp 0x1014f72
lea eax, [ebp - 0x20c]
push eax
call fcn.0100380c
test al, al
jne 0x1014e99
mov dword [ebp - 0xa84], 0xc100041d
jmp 0x1014f72
mov ecx, dword [ebp - 0xa90]
push edi
call fcn.010141c2
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xa70]
push dword [ebp - 0xa74]
call fcn.01021457
mov dword [ebp - 0xa84], 0x100040d
jmp 0x1014f72
lea eax, [ebp - 0x20c]
push eax
call fcn.01011e9f
push ebx
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 0xa7d], bl
call fcn.010037dd
mov byte [ebp - 0xa89], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xa70]
push dword [ebp - 0xa74]
call fcn.01021457
lea eax, [ebp - 0xa88]
push eax
call fcn.01007701
cmp byte [ebp - 0xa89], bl
je 0x1014f36
mov dword [ebp - 0xa84], 0xc10007cf
jmp 0x1014f66
mov dword [ebp - 0xa84], 0xc10007cf
cmp dword [ebp - 0xa84], 0
jne 0x1014f48
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0xa90]
push dword [ebp + 0x10]
push edi
call fcn.01014210
cmp byte [ebp - 0xa7d], 0
je 0x1014f72
cmp dword [ebp - 0xa84], 0
je 0x1014f72
cmp dword [ebp - 0xa84], 0x100040d
je 0x1014f72
lea eax, [ebp - 0x20c]
push eax
call fcn.01011e15
call fcn.010044a1
mov eax, dword [ebp - 0xa84]
jmp 0x1014f84
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102e95a
leave
ret 0x10