Function at 0x1001e24a
Capabilities:
Create thread

Disassembly:
mov eax, 0xfa74
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0xfa70], eax
mov eax, dword [esp + 0xfa78]
push ebx
push ebp
mov ebp, dword [esp + 0xfa84]
push esi
push edi
mov edi, dword [esp + 0xfa90]
xor esi, esi
push 0xfff
mov ebx, edx
lea edx, [esp + 0xba85]
push esi
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], esi
mov byte [esp + 0xba8c], 0
call fcn.1012e060
add esp, 0xc
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffeff
add eax, 0x504455
mov dword [esp + 0x38], eax
test ebp, ebp
je 0x1001d618
cmp byte [ebp], 0
je 0x1001d618
mov al, byte [ebp]
test al, al
je 0x1001d613
mov ecx, ebp
cmp al, 0x3b
jne 0x1001d60b
inc esi
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x1001d606
cmp esi, 6
jge 0x1001d630
push ebp
lea ecx, [esp + 0x3c]
push ecx
push str._EVPRO___s__Ignoring_Corrupt_EventBuf___s_
call fcn.10017540
add esp, 0xc
jmp 0x1001f2a6
cmp esi, 0xc
jne 0x1001d656
mov eax, ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d640
sub eax, edx
cmp byte [eax + ebp - 1], 0x3b
jne 0x1001d69d
mov byte [eax + ebp - 1], cl
jmp 0x1001d69d
cmp esi, 0xb
jge 0x1001d69d
mov ecx, 0xb
sub ecx, esi
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001d665
sub ecx, 1
mov dx, word [0x1015acf0]
mov word [edi], dx
jne 0x1001d662
mov al, 0x3b
mov edx, ebp
call fcn.100770c0
push eax
push esi
lea eax, [esp + 0x40]
push eax
push str._EVPRO___s__Normalizing_Event_PriorCC:_u__NewCC:_u
call fcn.10017540
mov edi, dword [esp + 0x24]
add esp, 0x10
cmp dword [0x101aa5a4], 5
jge 0x1001d6af
cmp dword [0x101a9f20], 0
je 0x1001d6c1
lea ecx, [esp + 0x38]
push ecx
push str._EVPRO___s__Event_Buffer_Processing_Begin...
call fcn.10017540
add esp, 8
cmp dword [esp + 0xfa94], 0
je 0x1001d849
test ebx, ebx
je 0x1001d860
cmp dword [0x101aa5a4], 5
mov edx, dword [esp + 0x28]
mov dword [edx], 0x13
mov eax, dword [str.250_Line_Accepted._r_n]
mov ecx, dword [0x1015ad5c]
mov edx, dword [0x1015ad60]
mov dword [esp + 0x50], eax
mov eax, dword [0x1015ad64]
mov dword [esp + 0x54], ecx
mov ecx, dword [0x1015ad68]
mov dword [esp + 0x58], edx
mov dl, byte [0x1015ad6c]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov byte [esp + 0x64], dl
jge 0x1001d72d
cmp dword [0x101a9f20], 0
je 0x1001d73f
lea eax, [esp + 0x38]
push eax
push str._EVPRO___s__Sending_Line_Accepted_Response...
call fcn.10017540
add esp, 8
lea eax, [esp + 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d746
sub eax, edx
mov edx, dword [ebx]
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.1000f9c0
add esp, 4
test eax, eax
jne 0x1001d7b1
cmp dword [0x101aa5a4], 5
jge 0x1001d79a
cmp dword [0x101a9f20], eax
jne 0x1001d79a
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov ecx, 0x8b2
cmp word [eax + 0x138], cx
jne 0x1001d849
cmp dword [0x101a9f54], 0
je 0x1001d849
lea edx, [esp + 0x38]
push edx
push str._EVPRO___s__ERROR__Unable_to_Send__LineAccepted__
call fcn.10017540
add esp, 8
jmp 0x1001d849
cmp dword [0x101aa5a4], 5
jge 0x1001d7e0
cmp dword [0x101a9f20], 0
jne 0x1001d7e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, 0x8b2
cmp word [ecx + 0x138], dx
jne 0x1001d849
cmp dword [0x101a9f54], 0
je 0x1001d849
lea edx, [esp + 0x1a80]
mov eax, ebp
sub edx, ebp
jmp 0x1001d7f0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001d7f0
lea eax, [esp + 0x1a80]
push eax
call fcn.10061df0
mov eax, ebp
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d810
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
sub eax, edx
lea edx, [esp + 0x1a80]
push edx
mov edx, dword [ecx + 0x124]
push edx
push eax
movzx eax, word [ecx + 0x138]
push eax
lea ecx, [esp + 0x48]
push ecx
push str._EVPRO___s__Log_Line_Recvd__u__len_d__FEser_d_:__s
call fcn.10017540
add esp, 0x18
test ebx, ebx
je 0x1001d860
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x1001d860
push eax
call sub.WS2_32.dll_closesocket
mov dword [ebx], 0xffffffff
cmp dword [0x101aa5a4], 5
jge 0x1001d872
cmp dword [0x101a9f20], 0
je 0x1001d884
lea edx, [esp + 0x38]
push edx
push str._EVPRO___s__Socket_Closed.__Processing_continues...
call fcn.10017540
add esp, 8
cmp dword [0x101a9f1c], 0
je 0x1001d8dc
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d892
sub eax, edx
add eax, 0xa
push eax
call fcn.10128320
mov esi, eax
add esp, 4
test esi, esi
je 0x1001d8dc
mov edx, esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001d8b3
push esi
call fcn.10061df0
push esi
push str._RCV___s
push 0x101ab010
call fcn.1006ed90
push esi
call fcn.10128243
add esp, 0x14
mov eax, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 1
mov dword [eax], 0xb
cmp dword [0x101ab114], esi
jne 0x1001d9c2
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
cmp dword [edx + 0x124], 0
je 0x1001d9c2
cmp dword [0x101a9f30], 0
jne 0x1001d923
cmp byte [ebp + 2], 0x20
jne 0x1001d9c2
push 0x104
lea eax, [esp + 0x274]
push eax
push str.yyyyMMdd
push 0
push 0
call fcn.1005cd90
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x104
lea ecx, [esp + 0x170]
push ecx
push 0x1015827c
push 0
push 0
call fcn.1005cd90
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea edx, [esp + 0x16c]
push edx
lea eax, [esp + 0x274]
push eax
lea ecx, [esp + 0xba88]
push 0x1015ae58
push ecx
call fcn.10127dc0
push 0x3b
push ebp
call fcn.10128490
add esp, 0x18
test eax, eax
je 0x1001d9c2
inc eax
push 0x3b
push eax
call fcn.10128490
add esp, 8
test eax, eax
je 0x1001d9c2
push eax
lea edx, [esp + 0xba84]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0xba80]
push eax
push ebp
call ebx
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d9c7
sub eax, edx
test eax, eax
jle 0x1001d9f5
mov cl, byte [eax + ebp - 1]
cmp cl, 0xd
je 0x1001d9e2
cmp cl, 0xa
jne 0x1001d9ea
sub eax, esi
test eax, eax
jg 0x1001d9d4
jmp 0x1001d9f5
cmp byte [eax + ebp - 1], 0x20
jne 0x1001d9f5
mov dword [esp + 0x2c], esi
push 0xfff
lea ecx, [esp + 0x5a85]
push 0
push ecx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x2c], 0
mov byte [esp + 0x5a8c], 0
call fcn.1012e060
push 0xfff
lea edx, [esp + 0x2a91]
push 0
push edx
mov byte [esp + 0x2a98], 0
call fcn.1012e060
push 0xfff
lea eax, [esp + 0xca9d]
push 0
push eax
mov byte [esp + 0xcaa4], 0
call fcn.1012e060
push 0xfff
lea ecx, [esp + 0x7aa9]
push 0
push ecx
mov byte [esp + 0x7ab0], 0
call fcn.1012e060
add esp, 0x30
mov ecx, 5
mov edx, ebp
call fcn.1001cd40
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001da91
cmp eax, 0xffffffff
jne 0x1001daea
lea edx, [esp + 0x1a80]
mov dword [esp + 0x24], esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, esi
test cl, cl
jne 0x1001daa0
lea edx, [esp + 0x1a80]
push edx
call fcn.10061df0
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
lea eax, [esp + 0x1a84]
push eax
movzx eax, word [edx + 0x138]
push eax
push str.Log_Line__u_:__s
call fcn.10017540
push str.Possibly_Corrupted_Event_with_NO_EventID
call fcn.10017540
add esp, 0x14
jmp 0x1001dfac
push esi
lea ecx, [esp + 0x24]
push 0x3b
push ecx
lea edx, [esp + 0xca8c]
push edx
xor cl, cl
mov edx, ebp
call fcn.10061f00
push esi
push 0x3b
lea eax, [esp + 0x38]
lea ecx, [esp + 0x7a98]
push eax
push ecx
xor cl, cl
mov edx, ebp
call fcn.10061f00
push esi
push 0x3b
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x5aac]
push eax
xor cl, cl
mov edx, ebp
call fcn.10061f00
push esi
lea ecx, [esp + 0x54]
push 0x3b
push ecx
lea edx, [esp + 0x2abc]
push edx
xor cl, cl
mov edx, ebp
call fcn.10061f00
add esp, 0x40
cmp byte [esp + 0x7a80], 0
je 0x1001dc8e
lea eax, [esp + 0x7a80]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001db70
sub eax, edx
cmp eax, 0x10
jb 0x1001db87
mov dword [esp + 0x24], esi
jmp 0x1001de76
lea eax, [esp + 0x7a80]
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001db93
sub eax, edx
je 0x1001dbdd
mov edi, edi
mov al, byte [esp + esi + 0x7a80]
cmp al, 0x61
jl 0x1001dbb3
cmp al, 0x7a
jle 0x1001de69
cmp al, 0x41
jl 0x1001dbbf
cmp al, 0x5a
jle 0x1001de69
lea eax, [esp + 0x7a80]
inc esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001dbd0
sub eax, edx
cmp esi, eax
jb 0x1001dba0
mov eax, dword [esp + 0x10]
add eax, 0xffffc568
cmp eax, 0x1387
ja 0x1001dc8e
lea ecx, [esp + 0x5a80]
push 0x2e
push ecx
call fcn.10128490
add esp, 8
test eax, eax
jne 0x1001dc8e
push 0xfff
push eax
lea edx, [esp + 0xaa89]
push edx
mov byte [esp + 0xaa8c], al
call fcn.1012e060
push 0xfff
lea eax, [esp + 0x3a91]
push 0
push eax
mov byte [esp + 0x3a98], 0
call fcn.1012e060
lea ecx, [esp + 0x5a98]
push ecx
lea edx, [esp + 0xaa9c]
push 0x1015aecc
push edx
call fcn.10127dc0
lea eax, [esp + 0x5aa4]
push eax
lea ecx, [esp + 0x3aa8]
push str.__s.local_
push ecx
call fcn.10127dc0
lea edx, [esp + 0x3ab0]
push edx
lea eax, [esp + 0xaab4]
push eax
push ebp
call fcn.10064100
add esp, 0x3c
mov esi, dword [esp + 0x10]
cmp esi, 0x180a
jne 0x1001dca5
mov edi, ebp
call fcn.1001d0e0
mov edi, dword [esp + 0x14]
cmp byte [esp + 0x2a80], 0
je 0x1001dd72
lea ecx, [esp + 0x2a80]
push 0x1015aee0
push ecx
call fcn.10135887
add esp, 8
test eax, eax
je 0x1001dd72
cmp esi, 0x1770
jl 0x1001dce4
cmp esi, 0x2710
jl 0x1001dd72
cmp esi, 0x4e20
jl 0x1001dcf4
cmp esi, 0x61a8
jl 0x1001dd72
push 1
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1a8c]
push eax
xor cl, cl
lea edx, [esp + 0x2a90]
mov dword [esp + 0x24], 0
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x14], 0xffffffff
je 0x1001dd72
or esi, 0xffffffff
jmp 0x1001dd30
lea ecx, [esp + 0x1a80]
push 0
push ecx
call fcn.10069e60
add esp, 8
test eax, eax
je 0x1001ded3
push 1
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1a8c]
push eax
xor cl, cl
lea edx, [esp + 0x2a90]
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x14], esi
jne 0x1001dd30
cmp dword [esp + 0x2c], 0
jne 0x1001dfac
cmp dword [0x101975f4], 0
je 0x1001dfac
cmp byte [edi], 0
je 0x1001dfac
mov eax, str.127.0
mov ecx, edi
call fcn.1005a140
test eax, eax
je 0x1001dfac
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
cmp dword [edx + 0x124], 0
je 0x1001dfac
cmp byte [esp + 0x2a80], 0
je 0x1001dfac
push 0xfff
lea eax, [esp + 0x3a85]
push 0
push eax
mov dword [esp + 0x20], 0
mov byte [esp + 0x3a8c], 0
call fcn.1012e060
push 1
lea ecx, [esp + 0x24]
push 0x2c
push ecx
lea edx, [esp + 0x3a98]
push edx
xor cl, cl
lea edx, [esp + 0x2a9c]
call fcn.10061f00
lea eax, [esp + 0x3a9c]
push 0
push eax
call fcn.10069e60
add esp, 0x24
test eax, eax
je 0x1001dfac
push 0
lea ecx, [esp + 0x2a84]
push edi
push ecx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001dfac
cmp dword [0x101975f4], 1
jne 0x1001df34
lea edx, [esp + 0x2a80]
push edx
push edi
push 0x1015af18
lea eax, [esp + 0x3a8c]
push eax
jmp 0x1001df4a
mov dword [esp + 0x24], 1
mov esi, 1
lea edx, [esp + 0x1a80]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, esi
test cl, cl
jne 0x1001de81
lea eax, [esp + 0x1a80]
push eax
call fcn.10061df0
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x1a84]
push ecx
movzx ecx, word [eax + 0x138]
push ecx
push str.Log_Line__u_:__s
call fcn.10017540
lea edx, [esp + 0x7a90]
push edx
push str.Possibly_Corrupted_Event_with_Time_as___s_
call fcn.10017540
add esp, 0x18
jmp 0x1001dfac
lea edx, [esp + 0x3a80]
mov dword [esp + 0x24], 1
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001dee6
lea ecx, [esp + 0x3a80]
push ecx
call fcn.10061df0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x3a84]
push edx
movzx edx, word [ecx + 0x138]
push edx
push str.Log_Line__u_:__s
call fcn.10017540
lea eax, [esp + 0x1a90]
push eax
push str.Possibly_Corrupted_Event_with_SourceIP___s_
call fcn.10017540
add esp, 0x18
jmp 0x1001dfac
push edi
lea ecx, [esp + 0x2a84]
push ecx
push 0x1015af18
lea edx, [esp + 0x3a8c]
push edx
call fcn.10127dc0
mov eax, dword [esp + 0x30]
add esp, 0x10
lea ecx, [eax + ebp]
push ecx
lea edx, [esp + 0x3a84]
push edx
lea eax, [esp + 0x5a88]
push eax
lea ecx, [esp + 0x7a8c]
push ecx
lea edx, [esp + 0xca90]
push edx
lea eax, [esp + 0xba94]
push str._s__s__s__s__s
push eax
call fcn.10127dc0
add esp, 0x1c
lea ecx, [esp + 0xba80]
push ecx
push ebp
call ebx
lea edx, [esp + 0x3a80]
push edx
lea eax, [esp + 0x2a84]
push eax
call ebx
cmp dword [esp + 0x24], 0
mov ecx, dword [esp + 0x28]
mov dword [ecx], 0xc
jne 0x1001e053
cmp byte [0x101b3978], 0
je 0x1001e053
cmp byte [0x101b3a80], 0
je 0x1001e053
cmp dword [0x101b3764], 0
je 0x1001e053
mov ecx, 7
mov edx, ebp
call fcn.1001cd40
mov esi, eax
test esi, esi
jl 0x1001e053
mov edi, 5
cmp dword [0x101aa5a4], edi
jge 0x1001e008
cmp dword [0x101a9f20], 0
je 0x1001e01a
lea edx, [esp + 0x38]
push edx
push str._EVPRO___s__Sending_SysLog_Msg
call fcn.10017540
add esp, 8
mov ecx, dword [esp + 0x10]
push 1
push esi
mov edx, ebp
call fcn.10028e30
add esp, 8
cmp dword [0x101aa5a4], edi
jge 0x1001e03c
cmp dword [0x101a9f20], 0
je 0x1001e053
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str._EVPRO___s__Sending_SysLog_Finished__EVID:__d_
call fcn.10017540
add esp, 0xc
mov edx, dword [esp + 0x28]
push 0xfff
lea eax, [esp + 0x6a85]
push 0
push eax
mov dword [edx], 0xd
mov byte [esp + 0x6a8c], 0
call fcn.1012e060
push 0xfff
lea ecx, [esp + 0x3a91]
push 0
push ecx
mov byte [esp + 0x3a98], 0
call fcn.1012e060
add esp, 0x18
cmp dword [esp + 0x24], 0
jne 0x1001e277
push 0x1000
push ebp
mov ecx, 2
lea edx, [esp + 0x6a88]
call fcn.1001ce60
add esp, 8
cmp byte [esp + 0x6a80], 0
je 0x1001e10a
push 0
lea edx, [esp + 0x6a84]
push 0x10157724
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e10a
xor ecx, ecx
jmp 0x1001e0f0
mov dl, byte [esp + ecx + 0x6a80]
mov byte [esp + ecx + 0x3a80], dl
inc ecx
test dl, dl
jne 0x1001e0f0
mov byte [esp + eax + 0x6a80], dl
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x1001e27b
cmp dword [0x101ac74c], 0
je 0x1001e27b
cmp dword [0x101aa494], 0
je 0x1001e14c
cmp dword [0x101aa49c], 0
jne 0x1001e27b
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
cmp dword [ecx + 0x124], 0
je 0x1001e27b
push esi
lea edx, [esp + 0x170]
push 0x101579f0
push edx
call fcn.10127dc0
add esp, 0xc
cmp dword [0x101ac74c], 0x13
je 0x1001e189
lea eax, [esp + 0x16c]
push eax
mov esi, 0x101acf78
call fcn.10089150
mov esi, dword [esp + 0x10]
test eax, eax
je 0x1001e27b
cmp esi, 0x2de
jne 0x1001e222
push 0x3ff
lea ecx, [esp + 0x685]
push 0
push ecx
mov byte [esp + 0x68c], 0
call fcn.1012e060
push 0x400
push ebp
mov ecx, 0xb
lea edx, [esp + 0x694]
call fcn.1001ce60
add esp, 0x14
cmp byte [esp + 0x680], 0
je 0x1001e222
cmp byte [0x101c3e40], 0
je 0x1001e1fb
lea edx, [esp + 0x680]
push edx
push 0x101c3e40
call fcn.10135887
add esp, 8
test eax, eax
je 0x1001e27b
cmp byte [esp + 0x680], 0
je 0x1001e222
xor eax, eax
jmp 0x1001e210
mov cl, byte [esp + eax + 0x680]
mov byte [eax + 0x101c3e40], cl
inc eax
test cl, cl
jne 0x1001e210
cmp dword [0x101aa5a4], 5
mov bl, byte [ebp]
jge 0x1001e237
cmp dword [0x101a9f20], 0
je 0x1001e249
lea eax, [esp + 0x38]
push eax
push str._EVPRO___s__SendEventToCloudThread__
call fcn.10017540
add esp, 8
push ebp
push 0
push 0x1001d060
call fcn.10127f7d
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e274
cmp byte [ebp], 0
je 0x1001e274
mov esi, 5
call fcn.1005a8b0
cmp byte [ebp], 0
jne 0x1001e264
mov byte [ebp], bl
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x24], 0
mov ecx, dword [esp + 0x28]
mov dword [ecx], 0xe
jne 0x1001edb3
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
cmp dword [eax + 0x124], 0
je 0x1001edb3
push 0x1fff
lea ecx, [esp + 0x8a85]
push 0
push ecx
mov byte [esp + 0x8a8c], 0
call fcn.1012e060
add esp, 0xc
test esi, esi
jle 0x1001ec8e
cmp esi, 0x2e1
je 0x1001e4c1
cmp esi, 0x2e2
je 0x1001e4c1
cmp esi, 0x355
je 0x1001e2f6
cmp esi, 0x357
jne 0x1001eb33
push 0x3ff
lea edx, [esp + 0x685]
push 0
push edx
mov byte [esp + 0x68c], 0
call fcn.1012e060
push 0x1000
lea eax, [esp + 0xa90]
push 0
push eax
call fcn.1012e060
mov esi, dword [esp + 0x40]
push 0x400
push ebp
mov ecx, 3
lea edx, [esp + 0x6a0]
mov dword [esi], 0x72
call fcn.1001ce60
add esp, 0x20
cmp byte [esp + 0x8a80], 0
jne 0x1001e36e
push 0x2000
push ebp
mov ecx, 9
lea edx, [esp + 0x8a88]
call fcn.1001ce60
add esp, 8
push 0
lea ecx, [esp + 0x8a84]
push str.Machine:__
push ecx
mov dword [esi], 0x73
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001eb33
xor ecx, ecx
add eax, 0xa
lea edx, [esp + eax + 0x8a80]
mov al, byte [edx]
inc edx
mov byte [esp + ecx + 0xa80], al
mov al, byte [edx]
inc ecx
cmp al, 0x5d
jne 0x1001e3a2
mov byte [esp + ecx + 0xa80], 0
mov al, byte [esp + 0xa80]
mov edx, esi
mov dword [edx], 0x74
cmp al, 0x5c
jne 0x1001e3dc
cmp byte [esp + 0xa81], al
jne 0x1001e3dc
mov edx, 2
jmp 0x1001e3e6
xor edx, edx
test al, al
je 0x1001eb33
lea eax, [esp + 0x6a80]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e3f0
sub eax, esi
lea esi, [esp + edx + 0xa80]
cmp eax, 0xf
jb 0x1001e41a
push 0xf
lea eax, [esp + 0x6a84]
push esi
push eax
call fcn.1013661b
add esp, 0xc
jmp 0x1001e42b
lea ecx, [esp + 0x6a80]
push esi
push ecx
call fcn.10135887
add esp, 8
test eax, eax
je 0x1001eb33
push 1
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x178]
push eax
xor cl, cl
lea edx, [esp + 0x690]
mov dword [esp + 0x24], 0
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x14], 0xffffffff
je 0x1001e4a6
lea ecx, [esp + 0x16c]
push esi
push ecx
call fcn.10135887
add esp, 8
test eax, eax
je 0x1001eb33
push 1
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x178]
push eax
xor cl, cl
lea edx, [esp + 0x690]
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x14], 0xffffffff
jne 0x1001e464
push ebp
push str._NOSEND___s
mov dword [esp + 0x20], 0
call fcn.10017540
add esp, 8
jmp 0x1001edb3
cmp byte [esp + 0x8a80], 0
jne 0x1001e4f3
push 0x2000
push ebp
mov ecx, 9
lea edx, [esp + 0x8a88]
call fcn.1001ce60
add esp, 8
cmp byte [esp + 0x8a80], 0
je 0x1001eb33
push 0x1fff
lea ecx, [esp + 0xda85]
push 0
push ecx
mov byte [esp + 0xda8c], 0
call fcn.1012e060
push 0xfff
lea edx, [esp + 0xa91]
push 0
push edx
mov dword [esp + 0x30], 0
mov byte [esp + 0xa98], 0
call fcn.1012e060
push 0xfff
lea eax, [esp + 0xaa9d]
push 0
push eax
mov byte [esp + 0xaaa4], 0
call fcn.1012e060
push 1
lea ecx, [esp + 0x40]
push 0x7c
push ecx
lea edx, [esp + 0xdab0]
push edx
xor cl, cl
lea edx, [esp + 0x8ab4]
call fcn.10061f00
or esi, 0xffffffff
add esp, 0x34
cmp dword [esp + 0x18], esi
je 0x1001e5ec
push 1
push 0x7c
lea eax, [esp + 0x20]
lea ecx, [esp + 0xda88]
push eax
push ecx
xor cl, cl
lea edx, [esp + 0x8a90]
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x18], esi
je 0x1001e5ec
push 1
push 0x7c
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xa8c]
push eax
xor cl, cl
lea edx, [esp + 0x8a90]
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x18], esi
je 0x1001e5ec
push 1
lea ecx, [esp + 0x1c]
push 0x7c
push ecx
lea edx, [esp + 0xaa8c]
push edx
xor cl, cl
lea edx, [esp + 0x8a90]
call fcn.10061f00
add esp, 0x10
cmp byte [esp + 0xa80], 0
je 0x1001eb33
cmp byte [esp + 0xaa80], 0
je 0x1001eb33
push 0x103
lea eax, [esp + 0x6d]
push 0
push eax
mov byte [esp + 0x74], 0
call fcn.1012e060
push 0x103
lea ecx, [esp + 0x17d]
push 0
push ecx
mov byte [esp + 0x184], 0
call fcn.1012e060
push 0x103
lea edx, [esp + 0x28d]
push 0
push edx
mov byte [esp + 0x294], 0
call fcn.1012e060
push 0x103
lea eax, [esp + 0x4a1]
push 0
push eax
mov byte [esp + 0x4a8], 0
call fcn.1012e060
push 0
lea ecx, [esp + 0xab4]
push str.64_bit
push ecx
call fcn.10063340
add esp, 0x3c
cmp eax, 0xffffffff
je 0x1001e699
mov dword [esp + 0x16c], 0x343678
push 0
lea edx, [esp + 0xaa84]
push str.Service_Pack
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e6ec
mov cl, byte [esp + eax + 0xaa8d]
lea eax, [esp + eax + 0xaa8d]
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x1001e6ec
cmp byte [eax + 1], 0x20
jne 0x1001e6ec
movsx eax, cl
push eax
lea ecx, [esp + 0x274]
push str.SP_c
push ecx
call fcn.10127dc0
add esp, 0xc
push 0
lea edx, [esp + 0xa84]
push str.2000
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e71c
mov cl, byte [0x1015afc4]
mov eax, dword [str.2000]
mov byte [esp + 0x6c], cl
jmp 0x1001e998
push 0
lea edx, [esp + 0xa84]
push 0x1015afc8
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e752
mov ax, word [0x1015afc8]
mov cl, byte [0x1015afca]
mov word [esp + 0x68], ax
mov byte [esp + 0x6a], cl
jmp 0x1001e99c
push 0
lea edx, [esp + 0xa84]
push str.2003
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e782
mov cl, byte [0x1015afd0]
mov eax, dword [str.2003]
mov byte [esp + 0x6c], cl
jmp 0x1001e998
push 0
lea edx, [esp + 0xa84]
push str.Vista
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e7af
mov eax, dword [str.Vista]
mov cx, word [0x1015afd8]
jmp 0x1001e993
push 0
lea edx, [esp + 0xa84]
push str.2008R2
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001e97d
push 0
lea eax, [esp + 0xa84]
push str.2008_R2
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001e97d
push 0
lea ecx, [esp + 0xa84]
push str.2008
push ecx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e823
mov edx, dword [str.2008]
mov al, byte [0x1015aff0]
mov dword [esp + 0x68], edx
mov byte [esp + 0x6c], al
jmp 0x1001e99c
push 0
lea ecx, [esp + 0xa84]
push 0x1015aff4
push ecx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e857
mov edx, dword [str.Win7]
mov al, byte [0x1015b004]
mov dword [esp + 0x68], edx
mov byte [esp + 0x6c], al
jmp 0x1001e99c
push 0
lea ecx, [esp + 0xa84]
push str.2012R2
push ecx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001e969
push 0
lea edx, [esp + 0xa84]
push str.2012_R2
push edx
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001e969
push 0
lea eax, [esp + 0xa84]
push str.2012
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e8cc
mov ecx, dword [str.2012]
mov dl, byte [0x1015b01c]
mov dword [esp + 0x68], ecx
mov byte [esp + 0x6c], dl
jmp 0x1001e99c
push 0
lea eax, [esp + 0xa84]
push 0x1015b020
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e903
mov ecx, dword [str.Win81]
mov dx, word [0x1015b030]
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], dx
jmp 0x1001e99c
push 0
lea eax, [esp + 0xa84]
push 0x1015b034
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e935
mov ecx, dword [str.Win8]
mov dl, byte [0x1015b044]
mov dword [esp + 0x68], ecx
mov byte [esp + 0x6c], dl
jmp 0x1001e99c
push 0
lea eax, [esp + 0xa84]
push 0x1015b048
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x1001e99c
mov ecx, dword [str.Win10]
mov dx, word [0x1015b058]
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], dx
jmp 0x1001e99c
mov eax, dword [str.2012R2]
mov cx, word [0x1015b00c]
mov dl, byte [0x1015b00e]
jmp 0x1001e98f
mov eax, dword [str.2008R2]
mov cx, word [0x1015afe0]
mov dl, byte [0x1015afe2]
mov byte [esp + 0x6e], dl
mov word [esp + 0x6c], cx
mov dword [esp + 0x68], eax
cmp byte [esp + 0x68], 0
je 0x1001eb33
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x170]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x484]
push 0x1015b05c
push eax
call fcn.10127dc0
lea ecx, [esp + 0x48c]
push ecx
lea edx, [esp + 0x38c]
push str.SOFTWAREMicroWorldeScan_for_WindowsOSList_s
push edx
call fcn.10127dc0
add esp, 0x20
lea ecx, [esp + 0x374]
call fcn.1007ec40
test eax, eax
jne 0x1001eb33
push 0x103
push eax
mov byte [esp + 0x584], al
lea eax, [esp + 0x585]
push eax
call fcn.1012e060
push 0x3ff
lea ecx, [esp + 0x691]
push 0
push ecx
mov byte [esp + 0x698], 0
call fcn.1012e060
push 0x104
push ebp
mov ecx, 2
lea edx, [esp + 0x59c]
call fcn.1001ce60
push 0x400
push ebp
mov ecx, 3
lea edx, [esp + 0x6a8]
call fcn.1001ce60
lea edx, [esp + 0x39c]
push str.SOFTWAREMicroWorldeScan_for_WindowsOSList
push edx
call fcn.10127dc0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x30
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x378]
push ecx
push reloc.WS2_32.dll_bind
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1001eaa3
mov edx, dword [esp + 0x20]
push edx
call ebx
lea eax, [esp + 0x478]
push eax
lea ecx, [esp + 0x378]
push str.SOFTWAREMicroWorldeScan_for_WindowsOSList_s
push ecx
call fcn.10127dc0
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x378]
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x1001eb33
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x57c]
push ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x580]
push edx
push 1
push 0
push str.HostName
push eax
call edi
lea ecx, [esp + 0x680]
push ecx
call esi
inc eax
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x684]
push edx
push 1
push 0
push str.HostIP
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call ebx
cmp dword [0x101ad5ac], 0
jne 0x1001eb59
lea ebx, [esp + 0x30]
mov esi, ebp
call fcn.1001cf30
test eax, eax
je 0x1001eb59
mov edi, dword [esp + 0x10]
mov dword [esp + 0x18], 1
jmp 0x1001eba8
mov eax, dword [0x101b31ec]
test eax, eax
je 0x1001eb6b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esp + 0x10]
push 0x1015b0f0
push 0
push ebp
push edi
mov edx, 0x101afeb8
mov ecx, 0x101af6b8
call fcn.100267f0
mov esi, eax
mov eax, dword [0x101b31ec]
add esp, 0x10
mov dword [esp + 0x18], esi
test eax, eax
je 0x1001eba0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x1001edb3
cmp dword [0x101ad18c], 0
je 0x1001edb3
cmp byte [0x101ad6b8], 0
je 0x1001edb3
push edi
lea edx, [esp + 0x274]
push 0x101579f0
push edx
call fcn.10127dc0
add esp, 0xc
cmp byte [0x101ad6b8], 0x2a
je 0x1001ebfb
lea eax, [esp + 0x270]
push eax
mov esi, 0x101ad6b8
call fcn.10089150
test eax, eax
je 0x1001edb3
push 0x103
lea ecx, [esp + 0x171]
push 0
push ecx
mov byte [esp + 0x178], 0
call fcn.1012e060
mov al, byte [0x101adeb8]
add esp, 0xc
test al, al
je 0x1001ec9b
cmp byte [esp + 0x6a80], 0
je 0x1001ec9b
cmp al, 0x2a
je 0x1001ec9b
lea edx, [esp + 0x6a80]
push edx
mov esi, 0x101adeb8
call fcn.10089150
test eax, eax
jne 0x1001ec9b
cmp byte [esp + 0x3a80], al
je 0x1001ec61
lea eax, [esp + 0x3a80]
push eax
call fcn.10089150
test eax, eax
jne 0x1001ec9b
cmp dword [0x101aa5a4], 5
jge 0x1001ec7b
cmp dword [0x101a9f20], 0
je 0x1001edb3
mov edi, dword [esp + 0x10]
push edi
push str._EVPRO__Not_inserting_event___u__into_map_A_
call fcn.10017540
add esp, 8
jmp 0x1001edb3
mov dword [esp + 0x18], 0
jmp 0x1001edb3
cmp byte [0x101aeeb8], 0
je 0x1001ed6e
push 0x1fff
lea ecx, [esp + 0x3a85]
push 0
push ecx
mov dword [esp + 0x20], 0
mov byte [esp + 0x3a8c], 0
call fcn.1012e060
add esp, 0xc
cmp byte [esp + 0x8a80], 0
jne 0x1001ecfd
push 0x2000
push ebp
mov ecx, 9
lea edx, [esp + 0x8a88]
call fcn.1001ce60
add esp, 8
cmp byte [esp + 0x8a80], 0
je 0x1001ed6e
push 1
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3a8c]
push eax
xor cl, cl
mov edx, 0x101aeeb8
call fcn.10061f00
or esi, 0xffffffff
add esp, 0x10
cmp dword [esp + 0x14], esi
je 0x1001ed6e
push 0
lea ecx, [esp + 0x3a84]
push ecx
lea edx, [esp + 0x8a88]
push edx
call fcn.10063340
add esp, 0xc
cmp eax, esi
jne 0x1001eed5
push 1
push 0x2c
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x3a88]
push eax
push ecx
xor cl, cl
mov edx, 0x101aeeb8
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x14], esi
jne 0x1001ed26
lea edx, [esp + 0x16c]
push edx
push ebp
push edi
push 0
call sym.DNSLIB.dll_InsertIntoTempMap
test eax, eax
jne 0x1001edb3
cmp dword [0x101aa5a4], 5
jge 0x1001ed98
cmp dword [0x101a9f20], eax
je 0x1001edb3
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x16c]
push eax
push edi
lea ecx, [esp + 0x40]
push ecx
push str._EVPRO___s__ERROR__Error_in_inserting_event___u__into_map:__s
call fcn.10017540
add esp, 0x10
cmp dword [0x101aa5a4], 5
jge 0x1001edd9
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov ecx, 0x8b2
cmp word [eax + 0x138], cx
jne 0x1001ee23
cmp dword [0x101a9f54], 0
je 0x1001ee23
push 0x101a68b4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x101c01c8]
mov edi, dword [0x101c01a8]
push 0x101a68b4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
add edi, esi
push edi
push ecx
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
push str._EVPRO___s__Corr:__u___SendThisEv:__u___HND:_0x_x___EvtQCount:__u_
call fcn.10017540
add esp, 0x18
cmp dword [esp + 0x24], 0
mov edx, dword [esp + 0x28]
mov dword [edx], 0xf
jne 0x1001f24a
cmp dword [esp + 0x18], 0
je 0x1001ef0c
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [ecx]
test eax, eax
je 0x1001ef0c
cmp eax, 0xffffffff
je 0x1001ef0c
mov esi, dword [esp + 0x10]
push esi
mov eax, ebp
call fcn.10016bf0
add esp, 4
cmp dword [0x101a9f60], 0
je 0x1001ef10
cmp esi, 0xb5
je 0x1001eea8
cmp esi, 0xb6
je 0x1001eea8
cmp esi, 0xb7
je 0x1001eea8
cmp esi, 0xb8
je 0x1001eea8
cmp esi, 0xb9
je 0x1001eea8
cmp esi, 0xbc
jne 0x1001ef10
push ebp
push 0
push 0x100ac460
call fcn.10127f7d
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001ef02
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._AWS__Error_Creating_JSON_Thread__LE:_u
push 0
call fcn.1006ed90
add esp, 0xc
jmp 0x1001ef10
cmp dword [0x101aa5a4], 5
jge 0x1001eeef
cmp dword [0x101a9f20], 0
je 0x1001edb3
mov edi, dword [esp + 0x10]
push edi
push str._EVPRO__Not_inserting_event___u__into_map_B_
call fcn.10017540
add esp, 8
jmp 0x1001edb3
mov esi, 5
call fcn.1005a8b0
mov esi, dword [esp + 0x10]
cmp byte [0x101b0eb8], 0
je 0x1001f0b2
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
cmp dword [eax + 0x124], 0
je 0x1001f0b2
push esi
lea ecx, [esp + 0x170]
push 0x101579f0
push ecx
call fcn.10127dc0
add esp, 0xc
cmp byte [0x101b0eb8], 0x2a
je 0x1001ef63
lea esi, [esp + 0x16c]
call fcn.1001d520
test eax, eax
je 0x1001f0b2
cmp dword [0x101b335c], 0
jne 0x1001f028
cmp dword [0x101aa6bc], 0
jne 0x1001f028
cmp dword [esp + 0x2c], 0
je 0x1001ef9b
mov dx, word [0x1015b260]
mov al, byte [0x1015b262]
mov word [esp + 0x44], dx
mov byte [esp + 0x46], al
jmp 0x1001efb1
mov cx, word [0x1015b264]
mov dl, byte [0x1015b266]
mov word [esp + 0x44], cx
mov byte [esp + 0x46], dl
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001efb6
sub eax, edx
add eax, 0xa
push eax
call fcn.10128320
mov esi, eax
add esp, 4
test esi, esi
je 0x1001f0b2
mov edx, esi
mov eax, ebp
sub edx, ebp
jmp 0x1001efe0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001efe0
push esi
call fcn.10061df0
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 0x2a88]
push eax
lea ecx, [esp + 0x5a8c]
push ecx
push edx
lea eax, [esp + 0x58]
push eax
push str.__s__Event_Recd:__u__SrcHost:_s__SrcIP:_s__Line:_s
push 0x101ab118
call fcn.1006ed90
push esi
call fcn.10128243
add esp, 0x24
jmp 0x1001f0b2
mov eax, ebp
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f030
sub eax, edx
add eax, 0xa
push eax
call fcn.10128320
mov esi, eax
add esp, 4
test esi, esi
je 0x1001f0b2
mov edx, esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001f051
push esi
call fcn.10061df0
mov eax, dword [0x101aa6ac]
push esi
push 0x101b31fc
push 0x101b3870
lea ecx, [esp + 0x2a90]
push ecx
mov ecx, dword [0x101aa6bc]
lea edx, [esp + 0x5a94]
push edx
mov edx, dword [0x101b335c]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
push str._FE__Event_Sent:__u__SE:_u__DS:__u__SS:_u__UE:_u__SrcHost:_s__SrcIP:_s___s:_s__Line:_s
push 0x101aaf08
call fcn.1006ed90
push esi
call fcn.10128243
add esp, 0x38
cmp dword [esp + 0x18], 0
je 0x1001f24a
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov dword [edi], 0x14
mov eax, dword [edx]
cmp dword [eax + 0x124], 0
je 0x1001f242
cmp dword [0x101b335c], 0
jne 0x1001f0f0
cmp dword [0x101aa6bc], 0
je 0x1001f242
cmp dword [0x101aacf0], 0
je 0x1001f104
push 0x118
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x101aa5a4], 5
jge 0x1001f11a
cmp dword [0x101a9f20], 0
je 0x1001f1e5
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f120
sub eax, edx
add eax, 0xa
push eax
call fcn.10128320
mov esi, eax
add esp, 4
test esi, esi
je 0x1001f1e5
mov edx, esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001f145
push esi
call fcn.10061df0
add esp, 4
cmp byte [0x101b3870], 0
push esi
je 0x1001f197
mov ecx, dword [0x101aa6ac]
mov edx, dword [0x101aa6bc]
mov eax, dword [0x101b335c]
push ecx
push edx
push eax
push 0x101b31fc
push 0x101b3870
lea ecx, [esp + 0x1a98]
push str.SendToParent___s:_s___u:_u:_u__:__s
push ecx
call fcn.10127dc0
add esp, 0x20
jmp 0x1001f1c5
mov edx, dword [0x101aa6ac]
mov eax, dword [0x101aa6bc]
mov ecx, dword [0x101b335c]
push edx
push eax
push ecx
push 0x101b31fc
lea edx, [esp + 0x1a94]
push str.NOT_SENDING_to_Parent__NULL:_s___u:_u:_u__:__s
push edx
call fcn.10127dc0
add esp, 0x1c
lea eax, [esp + 0x1a80]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str._EVPRO___s___s
call fcn.10017540
push esi
call fcn.10128243
add esp, 0x10
cmp byte [0x101b3870], 0
je 0x1001f242
cmp dword [0x101aa6ac], 0
jne 0x1001f242
cmp dword [0x101b335c], 0
push 0
mov dword [edi], 0x1d
mov edx, 0x1014d5e3
mov ecx, 0x101b31fc
push 0
je 0x1001f22f
push 1
push 1
push 0x101b3870
push 2
push 0
push ebp
call fcn.10026f50
mov dword [edi], 0x15
jmp 0x1001f282
push 2
push 1
push 0x101b3870
push 0
push 0
push ebp
call fcn.10026f50
mov dword [edi], 0x15
jmp 0x1001f282
cmp dword [0x101aa5a4], 5
jge 0x1001f25c
cmp dword [0x101a9f20], 0
je 0x1001f282
cmp dword [esp + 0x24], 0
push ebp
je 0x1001f270
lea edx, [esp + 0x3c]
push edx
push str._EVPRO___s__Not_forwarding_event_as_this_is_corrupted_event:__s
jmp 0x1001f27a
lea eax, [esp + 0x3c]
push eax
push str._EVPRO___s__Not_forwarding_event_as_SendThisEvent_is_false:__s
call fcn.10017540
add esp, 0xc
cmp dword [0x101aa5a4], 5
jge 0x1001f294
cmp dword [0x101a9f20], 0
je 0x1001f2a6
lea ecx, [esp + 0x38]
push ecx
push str._EVPRO___s__Event_Buffer_Processing_Ends.
call fcn.10017540
add esp, 8
mov ecx, dword [esp + 0xfa80]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0xfa74
ret