Function at 0x100ffb62
Capabilities:
Accept command line arguments

Disassembly:
push 0xc5c
mov eax, 0x101748ed
call fcn.10004365
mov edi, 0x10212ff4
push edi
mov dword [ebp - 0xc58], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [0x10214718], bl
jne 0x100fff4f
push str.Microsoft.Office.Groove.GrooveLogsObfuscation
call fcn.100fd355
test al, al
je 0x100ffbbd
push ebx
push str.LogObfuscationDisabled
push 4
call fcn.101046f0
test eax, eax
jne 0x100ffbbd
mov al, 1
cmp byte [0x1021300d], bl
jne 0x100ffbbf
mov al, bl
push ebx
push ebx
push 4
lea ecx, [ebp - 0x430]
mov byte [0x10214598], al
call fcn.100f4810
push 0x20019
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 1
call fcn.10005925
push eax
lea ecx, [ebp - 0x430]
call fcn.10005a92
test eax, eax
jne 0x100fff3d
mov dword [ebp - 0x414], ebx
push ebx
push str.TraceThreadId
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x430]
call fcn.100fe149
test eax, eax
jne 0x100ffc37
push 0xa
push dword [ebp - 0x414]
call fcn.10112a6c
test eax, eax
setg byte [0x1020c584]
push ebx
push str.TraceTime
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x430]
call fcn.100fe149
test eax, eax
jne 0x100ffc69
push 0xa
push dword [ebp - 0x414]
call fcn.10112a6c
test eax, eax
setg byte [0x1020c585]
push ebx
push str.TraceToDebugOutput
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x430]
call fcn.100fe149
test eax, eax
jne 0x100ffc9b
push 0xa
push dword [ebp - 0x414]
call fcn.10112a6c
test eax, eax
setg byte [0x1020c586]
lea eax, [ebp - 0x830]
mov dword [ebp - 0x83c], 0x200
mov dword [ebp - 0x840], eax
xor eax, eax
mov byte [ebp - 0x838], bl
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], ebx
mov word [ebp - 0x82c], ax
push ebx
push str.TraceCSUFile
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x430]
call fcn.100fe149
test eax, eax
jne 0x100ffd3e
lea eax, [ebp - 0xc5c]
push eax
call fcn.100fc9bb
mov eax, dword [eax]
mov dword [ebp - 0xc54], eax
push eax
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 4
call fcn.10106c96
lea ecx, [ebp - 0xc54]
mov byte [ebp - 4], 5
call fcn.1000586f
mov esi, dword [ebp - 0x414]
push esi
mov byte [ebp - 4], 3
call fcn.1011208a
push eax
push esi
lea ecx, [ebp - 0x840]
call fcn.100f7153
jmp 0x100ffd6b
push ebx
push str.TraceFile
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x430]
call fcn.100fe149
test eax, eax
jne 0x100ffd6b
push dword [ebp - 0x414]
lea ecx, [ebp - 0x840]
call fcn.10106c96
mov eax, dword [ebp - 0x840]
xor ecx, ecx
cmp cx, word [eax]
je 0x100fff20
push eax
mov byte [ebp - 0x838], 1
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [ebp - 0xc4c], 0x200
xor edx, edx
lea ecx, [ebp - 0xc40]
xor eax, eax
mov dword [ebp - 0xc50], ecx
mov dword [ebp - 0xc44], edx
mov dword [ebp - 0xc40], edx
mov word [ebp - 0xc3c], ax
push 0x200
push ecx
push edx
mov byte [ebp - 4], 6
mov byte [ebp - 0xc48], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x100ffe0b
push 0x80004005
push 0x66673573
lea eax, [ebp - 0xc68]
push eax
call fcn.1010dea4
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.1010934c
lea ecx, [ebp - 0xc68]
mov byte [ebp - 4], 6
call fcn.100f57fa
push dword [ebp - 0xc50]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.1010e57c
mov edi, dword [ebp - 0x840]
push ebx
push esi
call fcn.100076e0
push eax
push edi
lea eax, [ebp - 0x840]
push str._s__s_pid_u.log
push eax
call fcn.100fbb2f
add esp, 0x14
xor ebx, ebx
mov ecx, 0x1020c588
push ebx
push 0x80
push 0x7021
push dword [ebp - 0x840]
call fcn.10102420
test al, al
je 0x100fff07
mov byte [0x10214719], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
test edi, edi
je 0x100ffe9e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100ffe84
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x100ffea2
mov esi, ebx
jmp 0x100ffeb8
add esi, esi
mov eax, esi
call fcn.10164551
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.100f7a73
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push str._nGrooveTrace_n_s___x__r_n_r_n
push 0x3ff
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.1010f38a
mov edx, dword [0x1020c588]
add esp, 0x18
mov ecx, 0x1020c588
mov esi, eax
push 2
push ebx
push ebx
call dword [edx + 8]
push esi
lea eax, [ebp - 0x410]
push eax
push dword [0x1020c590]
call fcn.1010a469
jmp 0x100fff0d
mov byte [0x10214719], bl
lea eax, [ebp - 0xc50]
push eax
mov ecx, eax
call fcn.10007611
mov edi, 0x10212ff4
lea eax, [ebp - 0x840]
push eax
mov ecx, eax
call fcn.10007611
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 8
call fcn.1000586f
lea ecx, [ebp - 0x430]
mov byte [0x10214718], 1
call fcn.10007637
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esp, [ebp - 0xc78]
call fcn.100045f2
ret