Function at 0x10070de
Capabilities:
Access the windows event log
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], esi
je 0x10075f1
cmp dword [ebp + 0xc], esi
je 0x10075f1
cmp dword [eax + 0x90], esi
je 0x10075f1
mov eax, dword [eax + 0xa8]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x10075b1
mov ebx, dword [ebp + 8]
test byte [ebx + 0x4f1], 0x7f
je 0x10075f4
lea eax, [ebx + 0xbc]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x100714d
push eax
call edi
mov esi, eax
add esi, 3
cmp dword [ebp + 0x10], 0
je 0x100715c
push dword [ebp + 0x10]
call edi
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x1007170
push eax
call edi
lea esi, [esi + eax + 3]
cmp dword [ebp + 0x14], 0
je 0x100717f
push dword [ebp + 0x14]
call edi
lea esi, [esi + eax + 3]
cmp dword [ebp + 0x18], 0
je 0x100718e
push dword [ebp + 0x18]
call edi
lea esi, [esi + eax + 3]
cmp dword [ebp + 0x1c], 0
je 0x100719d
push dword [ebp + 0x1c]
call edi
lea esi, [esi + eax + 3]
mov eax, dword [ebx + 0x4e8]
test eax, eax
je 0x10071ae
push eax
call edi
lea esi, [esi + eax + 3]
lea eax, [esi + esi + 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor edx, edx
test ebx, ebx
je 0x10073e5
mov ecx, dword [ebp + 8]
mov word [ebx], dx
mov eax, dword [ecx + 0x4f0]
test ah, 1
mov edi, 0x10019d0
je 0x10071fb
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 0x10019cc
mov dword [ebp - 0xc], 0x10019c8
jmp 0x1007205
mov dword [ebp - 0x10], 0x10019c0
mov dword [ebp - 0xc], edi
test ah, 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1007245
lea eax, [ecx + 0xbc]
cmp eax, edx
je 0x100723e
push edi
push ebx
call esi
mov eax, dword [ebp + 8]
add eax, 0xbc
push eax
push ebx
mov dword [ebp - 8], 1
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
jmp 0x1007245
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edx
jne 0x10073d3
test byte [ecx + 0x4f1], 8
je 0x1007297
cmp dword [ebp + 0x10], edx
je 0x1007287
cmp dword [ebp - 8], edx
je 0x1007269
push dword [ebp - 0x10]
push ebx
call esi
jmp 0x1007274
push edi
push ebx
call esi
mov dword [ebp - 8], 1
push dword [ebp + 0x10]
push ebx
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
jmp 0x100728e
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edx
jne 0x10073d3
test byte [ecx + 0x4f1], 4
je 0x10072ec
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
cmp dword [eax + 4], edx
je 0x10072dc
cmp dword [ebp - 8], edx
je 0x10072b8
push dword [ebp - 0x10]
push ebx
call esi
jmp 0x10072c3
push edi
push ebx
call esi
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push dword [eax + 4]
push ebx
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
jmp 0x10072e3
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edx
jne 0x10073d3
test byte [ecx + 0x4f1], 0x20
je 0x1007335
cmp dword [ebp + 0x14], edx
je 0x1007325
cmp dword [ebp - 8], edx
je 0x1007307
push dword [ebp - 0x10]
push ebx
call esi
jmp 0x1007312
push edi
push ebx
call esi
mov dword [ebp - 8], 1
push dword [ebp + 0x14]
push ebx
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
jmp 0x100732c
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edx
jne 0x10073d3
test byte [ecx + 0x4f1], 0x10
je 0x100738d
cmp dword [ebp + 0x18], edx
je 0x1007381
cmp dword [ebp + 0x1c], edx
je 0x1007381
cmp dword [ebp - 8], edx
je 0x1007355
push dword [ebp - 0x10]
push ebx
call esi
jmp 0x1007360
push edi
push ebx
call esi
mov dword [ebp - 8], 1
push dword [ebp + 0x18]
push ebx
call esi
push 0x10019bc
push ebx
call esi
push dword [ebp + 0x1c]
push ebx
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
jmp 0x1007388
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edx
jne 0x10073d3
test byte [ecx + 0x4f1], 0x40
je 0x10073d3
cmp dword [ecx + 0x4e8], edx
je 0x10073cc
cmp dword [ebp - 8], edx
je 0x10073ab
push dword [ebp - 0x10]
push ebx
call esi
jmp 0x10073b6
push edi
push ebx
call esi
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
push dword [eax + 0x4e8]
push ebx
call esi
push dword [ebp - 0xc]
push ebx
call esi
xor edx, edx
jmp 0x10073d3
mov dword [ebp - 4], 0x57
cmp dword [ebp - 8], edx
je 0x10073ec
cmp dword [ebp - 0x18], edx
je 0x10073ec
push edi
push ebx
call esi
xor edx, edx
jmp 0x10073ec
mov dword [ebp - 4], 0xe
cmp dword [ebp - 4], edx
jne 0x1007579
mov eax, dword [ebp + 8]
push dword [eax + 0x90]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov esi, eax
add esi, 3
test ebx, ebx
je 0x1007416
push ebx
call edi
lea esi, [esi + eax + 1]
lea eax, [esi + esi]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
je 0x1007579
mov eax, dword [ebp + 8]
push dword [eax + 0x90]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call edi
push esi
call fcn.01009e55
mov dword [esp], 0x1001978
push esi
call fcn.01009def
test eax, eax
pop ecx
pop ecx
jne 0x1007479
push 0x100196c
push esi
call fcn.01009def
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x10], 0x28
je 0x1007480
mov dword [ebp + 0x10], 0x30
mov eax, dword [ebp + 8]
mov word [esi], 0x22
push dword [eax + 0x90]
lea eax, [esi + 2]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [esi + eax*2], 0x22
inc eax
test ebx, ebx
je 0x10074b5
lea eax, [esi + eax*2]
mov word [eax], 0x20
push ebx
add eax, 2
push eax
call edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 4
call edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x94]
xor esi, esi
cmp eax, esi
je 0x1007516
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push esi
push esi
push dword [ebp + 0x10]
push esi
push esi
push esi
push dword [ebp - 0x14]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1007530
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push dword [ebp + 0x10]
push esi
push esi
push esi
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
call edi
cmp dword [ebp + 0x10], esi
je 0x100756e
cmp dword [ebp - 0x28], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], esi
je 0x1007559
cmp dword [ebp - 0x28], 0xffffffff
je 0x1007559
push dword [ebp - 0x28]
call edi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], esi
je 0x1007582
cmp dword [ebp - 0x2c], 0xffffffff
je 0x1007582
push dword [ebp - 0x2c]
call edi
mov dword [ebp - 0x2c], esi
jmp 0x1007582
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1007582
mov dword [ebp - 4], 0xe
xor esi, esi
cmp ebx, esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x1007597
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [ebp - 0x14], esi
je 0x10075a9
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov eax, dword [ebp - 4]
cmp eax, esi
pop edi
je 0x10075f4
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0xbc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push 2
push 0
push 0x800007f6
push 0
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [ebp - 4]
mov dword [esi + 0xa8], eax
jmp 0x10075f4
push 0x57
pop eax
pop esi
pop ebx
leave
ret 0x18