Function at 0x10287e0
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x14d8
call fcn.01047580
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov ecx, 9
mov esi, 0x10069c8
lea edi, [ebp - 0x149c]
rep movsd dword es:[edi], dword [esi]
mov ax, word [0x10015d4]
mov word [ebp - 0x408], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x1428], dx
push 0xfe
push 0
lea eax, [ebp - 0x1426]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0x14bc], cx
xor edx, edx
mov dword [ebp - 0x14ba], edx
mov dword [ebp - 0x14b6], edx
mov dword [ebp - 0x14b2], edx
mov dword [ebp - 0x14ae], edx
mov dword [ebp - 0x14aa], edx
mov dword [ebp - 0x14a6], edx
mov dword [ebp - 0x14a2], edx
mov word [ebp - 0x149e], dx
mov ax, word [0x10015d4]
mov word [ebp - 0xc10], ax
push 0x3fe
push 0
lea ecx, [ebp - 0xc0e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x810], dx
push 0x3fe
push 0
lea eax, [ebp - 0x80e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0x1120], cx
push 0x3fe
push 0
lea edx, [ebp - 0x111e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ax, word [0x10015d4]
mov word [ebp - 0xd20], ax
push 0xfe
push 0
lea ecx, [ebp - 0xd1e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x1324], 0
mov dword [ebp - 0x1474], 3
mov dword [ebp - 0x14c4], 0
mov dword [ebp - 0x1478], 0
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x1470], 0
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0xc14], 0
mov dword [ebp - 0x14c0], 0
mov dword [ebp - 0x146c], 0
push 0x80
lea edx, [ebp - 0xd20]
push edx
push 0x17
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0
lea ecx, [ebp - 0x1468]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x1320]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x14]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
shl eax, 1
cmp eax, dword [ebp + 0x14]
je 0x10289fb
jmp 0x1028f8c
lea ecx, [ebp + 0x18]
mov dword [ebp - 0x1328], ecx
mov dword [ebp - 0xc1c], 0
jmp 0x1028a1f
mov edx, dword [ebp - 0xc1c]
add edx, 1
mov dword [ebp - 0xc1c], edx
mov eax, dword [ebp - 0xc1c]
cmp eax, dword [ebp - 0x40c]
jge 0x1028b15
mov ecx, dword [ebp - 0x1328]
add ecx, 4
mov dword [ebp - 0x1328], ecx
mov edx, dword [ebp - 0x1328]
mov eax, dword [edx - 4]
mov dword [ebp - 0xc14], eax
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
cmp dword [ebp - 0x14d0], 1
je 0x1028a72
cmp dword [ebp - 0x14d0], 2
je 0x1028ae5
jmp 0x1028b10
mov edx, dword [ebp - 0x1328]
add edx, 4
mov dword [ebp - 0x1328], edx
mov eax, dword [ebp - 0x1328]
mov ecx, dword [eax - 4]
mov dword [ebp - 0x1470], ecx
mov edx, dword [ebp - 0x1470]
push edx
push 0x10017b4
push 0x10
mov eax, dword [ebp - 0xc18]
shl eax, 5
lea ecx, [ebp + eax - 0x1320]
push ecx
call fcn.01011d00
add esp, 0x10
mov edx, dword [ebp - 0xc18]
shl edx, 5
lea eax, [ebp + edx - 0x1320]
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp + ecx*4 - 0x1468], eax
mov edx, dword [ebp - 0xc18]
add edx, 1
mov dword [ebp - 0xc18], edx
jmp 0x1028b10
mov eax, dword [ebp - 0x1328]
add eax, 4
mov dword [ebp - 0x1328], eax
mov ecx, dword [ebp - 0x1328]
mov edx, dword [ecx - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc1c]
mov ecx, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1468], ecx
jmp 0x1028a10
mov dword [ebp - 0x1328], 0
movzx edx, word [ebp + 0xc]
mov dword [ebp - 0x14d4], edx
cmp dword [ebp - 0x14d4], 1
je 0x1028b49
cmp dword [ebp - 0x14d4], 2
je 0x1028b7a
cmp dword [ebp - 0x14d4], 4
je 0x1028ba8
jmp 0x1028bd6
push 0x21
push 0x1001bfc
push 0x10
lea eax, [ebp - 0x14bc]
push eax
call fcn.01011d00
add esp, 0x10
mov dword [ebp - 0x1474], 1
mov dword [ebp - 0x1324], 0x10
jmp 0x1028c02
push 0x2b
push 0x1001bfc
push 0x10
lea ecx, [ebp - 0x14bc]
push ecx
call fcn.01011d00
add esp, 0x10
mov dword [ebp - 0x1474], 2
mov dword [ebp - 0x1324], 0x30
jmp 0x1028c02
push 0x3f
push 0x1001bfc
push 0x10
lea edx, [ebp - 0x14bc]
push edx
call fcn.01011d00
add esp, 0x10
mov dword [ebp - 0x1474], 3
mov dword [ebp - 0x1324], 0x40
jmp 0x1028c02
push 0x3f
push 0x1001bfc
push 0x10
lea eax, [ebp - 0x14bc]
push eax
call fcn.01011d00
add esp, 0x10
mov dword [ebp - 0x1474], 3
mov dword [ebp - 0x1324], 0x40
mov ecx, dword [ebp + 8]
and ecx, 1
je 0x1028cdf
push 0x104c87c
call dword [0x104ef44]
test eax, eax
jne 0x1028c4f
cmp dword [0x104e7a8], 0
je 0x1028c44
cmp dword [0x104e0cc], 0
je 0x1028c44
lea edx, [ebp - 0x149c]
push edx
push 0x1001c84
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
push 0x104c87c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x104e7a8], 0
je 0x1028c76
cmp dword [0x104e0cc], 0
je 0x1028c76
lea eax, [ebp - 0x149c]
push eax
push 0x1001c50
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
push 0
lea ecx, [ebp - 0x1468]
push ecx
push 0
mov dx, word [ebp - 0x40c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0102a2b0
add esp, 4
push eax
mov dx, word [ebp + 0xc]
push edx
mov eax, dword [0x104e7a4]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0x104c87c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x104e7a8], 0
je 0x1028cdf
cmp dword [0x104e0cc], 0
je 0x1028cdf
lea ecx, [ebp - 0x149c]
push ecx
push 0x1001c1c
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
mov edx, dword [ebp + 8]
and edx, 2
je 0x1028f8c
mov dword [ebp - 0x14c8], 0
mov dword [ebp - 0x14cc], 0
mov dword [ebp - 0x14c8], 0
mov dword [ebp - 0x14cc], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x1468]
push eax
push 0x200
lea ecx, [ebp - 0x408]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x104ca4c]
push eax
push 0x2800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [ebp - 0x14c4], eax
cmp dword [ebp - 0x14c4], 0
jne 0x1028dbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1478], eax
push 0x400
lea ecx, [ebp - 0x1120]
push ecx
mov edx, dword [ebp - 0x1478]
push edx
call fcn.010425e0
add esp, 0xc
movzx eax, word [ebp - 0x1120]
test eax, eax
je 0x1028d94
lea ecx, [ebp - 0x1120]
mov dword [ebp - 0x14d8], ecx
jmp 0x1028da0
lea edx, [ebp - 0xd20]
mov dword [ebp - 0x14d8], edx
mov eax, dword [ebp - 0x14d8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x173
push 0
push 1
call fcn.01028fb0
add esp, 0x14
cmp dword [ebp - 0x14c8], 0
je 0x1028dd4
mov edx, dword [ebp - 0x14c8]
push edx
call fcn.01011d50
add esp, 4
cmp dword [ebp - 0x14cc], 0
je 0x1028dec
mov eax, dword [ebp - 0x14cc]
push eax
call fcn.01011d50
add esp, 4
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCR80.dll__wcsrev]
add esp, 4
mov dword [ebp - 0x14c0], 0
jmp 0x1028e17
mov edx, dword [ebp - 0x14c0]
add edx, 1
mov dword [ebp - 0x14c0], edx
mov eax, dword [ebp - 0x14c0]
movzx ecx, word [ebp + eax*2 - 0x408]
cmp ecx, 0xa
je 0x1028e3d
mov edx, dword [ebp - 0x14c0]
movzx eax, word [ebp + edx*2 - 0x408]
cmp eax, 0xd
jne 0x1028e41
jmp 0x1028e08
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCR80.dll__wcsrev]
add esp, 4
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
sub eax, dword [ebp - 0x14c0]
mov word [ebp + eax*2 - 0x408], 0
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov dword [ebp - 0x146c], eax
cmp dword [ebp - 0x146c], 3
jl 0x1028ed9
mov ecx, dword [ebp - 0x146c]
movzx edx, word [ebp + ecx*2 - 0x40a]
cmp edx, 0x2e
jne 0x1028ed9
mov eax, dword [ebp - 0x146c]
movzx ecx, word [ebp + eax*2 - 0x40c]
cmp ecx, 0x2e
je 0x1028ed9
mov edx, dword [ebp - 0x146c]
movzx eax, word [ebp + edx*2 - 0x40e]
cmp eax, 0x2e
je 0x1028ed9
mov ecx, dword [ebp - 0x146c]
mov word [ebp + ecx*2 - 0x40a], 0
movzx edx, word [ebp - 0x408]
test edx, edx
je 0x1028f2c
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x14bc]
push ecx
push 0x10069b0
push 0x200
lea edx, [ebp - 0xc10]
push edx
call fcn.01011d00
add esp, 0x14
mov word [ebp - 0x812], 0
mov eax, dword [ebp - 0x1474]
push eax
push 0
lea ecx, [ebp - 0xc10]
push ecx
call fcn.010291c0
add esp, 0xc
mov edx, dword [ebp + 8]
and edx, 4
je 0x1028f8c
push 0x200
lea eax, [ebp - 0x810]
push eax
push 0x4b
mov ecx, dword [0x104ef34]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104ec10
lea edx, [ebp - 0x810]
push edx
push 0x80
lea eax, [ebp - 0x1428]
push eax
call fcn.01011d00
add esp, 0x10
mov ecx, dword [ebp - 0x1324]
push ecx
lea edx, [ebp - 0x1428]
push edx
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret