Function at 0x300fb924
Capabilities:
Accept command line arguments
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebx
call fcn.3010b6bc
test eax, eax
jne 0x300fb93d
inc eax
jmp 0x300fbd3a
mov byte [0x30277618], 1
call fcn.300fa9c1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.300faf80
call fcn.3010945f
cmp dword [0x302781f0], ebx
jne 0x300fb979
push 0x326b6375
push 0x300038c0
call fcn.300f2d34
push 0xf
pop eax
jmp 0x300fbd3a
call fcn.300f33f8
test al, al
jne 0x300fb995
push 0x33666674
push 0x3000388c
call fcn.300f2d34
push 9
jmp 0x300fb973
mov eax, dword [0x30276470]
cmp eax, 1
push esi
push edi
jne 0x300fba97
push 2
push 0xfa5
call fcn.3010bae9
push fcn.300fa070
push 8
push 0x1d
lea eax, [ebp - 4]
push 0x3022f0a8
push eax
mov dword [ebp - 4], 0xc9
call fcn.3011003b
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x300fbb34
cmp word [esi + 6], bx
jne 0x300fbbba
push ebx
lea eax, [ebp - 0xc]
push eax
push 8
push 0x30003a10
call fcn.3010996b
test eax, eax
jne 0x300fbbba
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x30001d88
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x300fbb0d
push 4
xor ecx, ecx
pop edx
xor eax, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.301089da
mov edi, eax
cmp edi, ebx
push ebx
je 0x300fba5d
movzx eax, word [esi + 4]
push edi
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
mov esi, eax
call fcn.300ee73d
pop ecx
jmp 0x300fba80
push 0x3569696a
call fcn.3010aa60
movzx eax, word [esi + 4]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov esi, eax
cmp esi, ebx
jne 0x300fba8f
push ebx
push 0x326b6470
call fcn.3010aa60
push dword [ebp - 8]
jmp 0x300fbbb4
cmp eax, 2
jne 0x300fbb15
push ebx
push 0xfa5
call fcn.3010bae9
push fcn.300fa070
push 8
push 0x1d
lea eax, [ebp - 8]
push 0x3022f0a8
push eax
mov dword [ebp - 8], 0xca
call fcn.3011003b
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x300fbb34
cmp word [esi + 6], bx
jne 0x300fbbba
push ebx
lea eax, [ebp - 0xc]
push eax
push 8
push 0x30003a10
call fcn.3010996b
test eax, eax
jne 0x300fbbba
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x30001d88
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x300fbb41
push ebx
push 0x326b646f
jmp 0x300fbb3a
cmp eax, 3
jne 0x300fbb21
push 4
jmp 0x300fba9d
cmp eax, 4
jne 0x300fbb2d
push 5
jmp 0x300fba9d
push 1
jmp 0x300fba9d
push ebx
push 0x326b646d
call fcn.3010aa60
jmp 0x300fbbba
push 4
xor ecx, ecx
pop edx
xor eax, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.301089da
mov edi, eax
cmp edi, ebx
push ebx
je 0x300fbb7f
movzx eax, word [esi + 4]
push edi
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
mov esi, eax
call fcn.300ee73d
pop ecx
jmp 0x300fbba2
push 0x3569696a
call fcn.3010aa60
movzx eax, word [esi + 4]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov esi, eax
cmp esi, ebx
jne 0x300fbbb1
push ebx
push 0x326b6470
call fcn.3010aa60
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp byte [0x30276474], bl
pop edi
pop esi
je 0x300fbbd0
push 3
push 0xfa5
call fcn.3010bae9
push 0x30003a2c
call fcn.3010a764
test eax, eax
je 0x300fbc01
push 1
push 0xfac
call fcn.3010bae9
cmp dword [0x30276470], 1
jne 0x300fbbfa
push 4
jmp 0x300fb973
call fcn.300f5126
jmp 0x300fbbf3
call fcn.300fa2fc
test al, al
jne 0x300fbc2d
push 2
push 0xfac
call fcn.3010bae9
cmp dword [0x30276470], 1
jne 0x300fbc26
push 0x12
jmp 0x300fb973
call fcn.300f51dc
jmp 0x300fbc1f
call fcn.300fa3a9
test al, al
jne 0x300fbc4c
push 0x326b6378
push 0x3000386c
call fcn.300f2d34
push 5
jmp 0x300fb973
cmp byte [0x30276474], bl
jne 0x300fbc64
call fcn.300fb16a
test al, al
je 0x300fbc64
push 7
jmp 0x300fb973
push 0x1000
push 0x30274470
push 1
call fcn.300f2db4
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x300fbc96
push 0x326b6379
push 0x30003848
call fcn.300f2d34
push 0xa
jmp 0x300fb973
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x300fbcb7
push 0x326b637a
push 0x3000382c
call fcn.300f2d34
push 2
jmp 0x300fb973
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
mov byte [0x30277619], 1
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
jge 0x300fbce3
push 0x326b6430
push eax
push 0x30003808
call fcn.300f2d54
call fcn.300fa26a
test al, al
je 0x300fbcf3
push 0x10
jmp 0x300fb973
push 0xb8
call fcn.301089da
cmp eax, ebx
je 0x300fbd0a
mov ecx, eax
call fcn.300ffa6b
jmp 0x300fbd0c
xor eax, eax
cmp eax, ebx
mov dword [0x30277548], eax
jne 0x300fbd1c
push 0x11
jmp 0x300fb973
cmp byte [eax], bl
je 0x300fbd23
push ebx
jmp 0x300fbd2e
cmp byte [eax + 1], bl
je 0x300fbd2c
push 1
jmp 0x300fbd2e
push 2
push 0xfa7
call fcn.3010bae9
xor eax, eax
pop ebx
leave
ret