Function at 0x10009fe0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100cd008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x74], eax
jmp 0x1000a00a
mov ecx, dword [ebp - 0x74]
add ecx, 0x767
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp + 0x14]
add edx, 0x603b
cmp dword [ebp - 0x74], edx
jae 0x1000a302
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1054
ja 0x1000a09f
cmp dword [ebp - 0x60], 0x1054
je 0x1000a11f
cmp dword [ebp - 0x60], 0x84b
ja 0x1000a07d
cmp dword [ebp - 0x60], 0x84b
je 0x1000a18b
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
sub dword [ebp - 0x64], 0xe4
je 0x1000a103
sub dword [ebp - 0x64], 0xa2
je 0x1000a149
sub dword [ebp - 0x64], 0x44
je 0x1000a1a0
jmp 0x1000a2fd
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x70], edx
sub dword [ebp - 0x70], 0x8ed
je 0x1000a287
sub dword [ebp - 0x70], 0x44
je 0x1000a191
jmp 0x1000a2fd
cmp dword [ebp - 0x60], 0x1f22
ja 0x1000a0e4
cmp dword [ebp - 0x60], 0x1f22
je 0x1000a1e4
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
sub dword [ebp - 0x68], 0x1098
je 0x1000a207
sub dword [ebp - 0x68], 0x723
je 0x1000a1af
sub dword [ebp - 0x68], 0x44
je 0x1000a1d3
jmp 0x1000a2fd
cmp dword [ebp - 0x60], 0x1f66
je 0x1000a1fc
cmp dword [ebp - 0x60], 0x2689
je 0x1000a234
jmp 0x1000a2fd
dec dword [eax + 0x6c]
cmp dword [eax + 0x6c], 0
jg 0x1000a287
xor edx, edx
mov dword [eax + 0x6c], edx
call fcn.10027610
jmp 0x1000a2fd
lea ecx, [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x78], eax
mov edx, 8
shl edx, 0
movsd xmm0, qword [0x100c1118]
movsd qword [ebp + edx - 0x58], xmm0
jmp 0x1000a2fd
mov byte [ebp - 0x69], 1
mov al, byte [ebp - 0x69]
mov byte [ebp - 0x59], al
mov dword [ebp - 0x7c], 0
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x78], ecx
mov edx, 8
imul eax, edx, 0
movsd xmm0, qword [0x100c1c78]
movsd qword [ebp + eax - 0x40], xmm0
mov dword [ebp - 0x80], 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x84], ecx
jmp 0x1000a2fd
ret
mov edi, 0x64e2380
cmp dword [esi + edx*4], ecx
jne 0x1000a11f
jmp 0x1000a2fd
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push edi
jmp 0x1000a2fd
mov edx, 8
shl edx, 1
movsd xmm0, qword [0x100c14a8]
movsd qword [ebp + edx - 0x58], xmm0
cmp dword [ebp - 0x78], 0
jne 0x1000a1ce
mov byte [ebp - 0x59], 0
jmp 0x1000a2fd
mov eax, dword [edi + esi]
mov dword [eax + ecx*4], edx
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x1000a207
jmp 0x1000a2fd
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.1000a8d0
movsd qword [ebp - 0x8c], xmm0
jmp 0x1000a2fd
pop edi
pop esi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x20]
inc dword [eax]
mov dword [esi + edx*4], 0xffff
mov edi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0x18]
mov esi, edx
imul esi, esi, 0x18
movsd qword [esi + edi + 8], xmm0
cmp dword [ebp + 0x10], ecx
jle 0x1000a196
jmp 0x1000a2fd
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1000a257
mov ecx, dword [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, 0x1007cb60
mov ecx, str.eraSepp
movsd xmm2, qword [0x100c07d0]
movsd xmm1, qword [0x100c1ee0]
movsd xmm0, qword [ebp - 0x8c]
call fcn.10027f90
add esp, 4
jmp 0x1000a2fd
mov edx, 8
shl edx, 0
movsd xmm0, qword [0x100c1400]
movsd qword [ebp + edx - 0x40], xmm0
mov eax, 8
shl eax, 1
movsd xmm0, qword [0x100c14a8]
movsd qword [ebp + eax - 0x40], xmm0
mov ecx, dword [str.MyEventProvider]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x1007cf6c]
mov dword [ebp - 0x14], edx
mov eax, dword [0x1007cf70]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1007cf74]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x28]
push edx
lea edx, [ebp - 8]
lea ecx, [ebp - 0x18]
call fcn.10062b50
add esp, 4
mov eax, 8
imul ecx, eax, 0
movsd xmm0, qword [0x100c3328]
movsd qword [ebp + ecx - 0x58], xmm0
jmp 0x10009ffe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062dbb
mov esp, ebp
pop ebp
ret