Function at 0x10126fd
Capabilities:
Accept command line arguments
Access the windows event log

Disassembly:
mov eax, 0x101531c
call fcn.01011388
push ecx
mov eax, 0x12c8
call fcn.01014980
mov eax, dword [0x101704c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x54]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1270], ebx
mov dword [ebp - 0x1280], eax
push 0x10064d0
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x127c], esp
xor esi, esi
push esi
push 0x4000
push 0x625
push 0x10064c8
push 0x10060b0
mov dword [ebp - 4], esi
call fcn.01007e91
lea ecx, [ebp - 0x12b0]
call fcn.01007fe5
mov dword [ebp - 0x125c], esi
mov dword [ebp - 0x126c], esi
xor eax, eax
mov edx, 0x10064b8
mov byte [ebp - 0x1258], 0
mov ecx, 0x400
lea edi, [ebp - 0x1257]
rep stosd dword es:[edi], eax
mov esi, edx
lea edi, [ebp - 0xb4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x24
pop ecx
lea edi, [ebp - 0xa4]
rep stosd dword es:[edi], eax
mov esi, edx
lea edi, [ebp - 0x154]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x24
pop ecx
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x144]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x125c]
push eax
push 1
push 8
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x101282d
lea eax, [ebp - 0x125c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x101282d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x101280b
call esi
jmp 0x1012817
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x128c], eax
push 0x1015504
lea eax, [ebp - 0x128c]
jmp 0x10129a1
and dword [ebp - 0x1260], 0
lea eax, [ebp - 0x1260]
push eax
push 0x100
lea eax, [ebp - 0x254]
push eax
push 1
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x101288b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1012869
call esi
jmp 0x1012875
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1284], eax
push 0x1015504
lea eax, [ebp - 0x1284]
jmp 0x10129a1
lea eax, [ebp - 0x126c]
push eax
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x10128d4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10128b2
call esi
jmp 0x10128be
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1288], eax
push 0x1015504
lea eax, [ebp - 0x1288]
jmp 0x10129a1
push 0x50
pop esi
lea eax, [ebp - 0x127c]
push eax
lea eax, [ebp - 0x1264]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x1274]
push eax
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x254]
mov dword [ebp - 0x1274], esi
push 0
mov dword [ebp - 0x1264], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x1012947
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1012928
call esi
jmp 0x1012934
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1290], eax
push 0x1015504
lea eax, [ebp - 0x1290]
jmp 0x10129a1
push 0x10025a0
push esi
lea eax, [ebp - 0xb4]
push eax
call fcn.01011ab1
test eax, eax
jge 0x1012974
mov dword [ebp - 0x1294], 0x8000ffff
push 0x1015504
lea eax, [ebp - 0x1294]
jmp 0x10129a1
lea eax, [ebp - 0x154]
push eax
push esi
lea eax, [ebp - 0xb4]
push eax
call fcn.01011ab1
test eax, eax
jge 0x10129f3
mov dword [ebp - 0x1298], 0x8000ffff
push 0x1015504
lea eax, [ebp - 0x1298]
push eax
call sub.msvcrt.dll__CxxThrowException
push dword [ebp - 0x1268]
push 0x1006448
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1268], esp
push 0
push 0x4000
push 0x656
push 0x10064c8
push 0x10060b0
call fcn.01007e91
lea eax, [ebp - 0x12b0]
push eax
call fcn.0100821c
add esp, 0x4c
mov eax, 0x10129ed
ret
mov eax, dword [ebp - 0x1280]
cmp word [eax], 0
mov dword [ebp - 4], 2
mov dword [ebp - 0x1264], 0x100643c
jne 0x1012a1a
mov dword [ebp - 0x1264], 0x100643a
mov edi, dword [ebp - 0x126c]
test edi, edi
mov dword [ebp - 0x1260], edi
jne 0x1012a39
mov dword [ebp - 0x1260], 0x1006424
mov edi, 0x1006424
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push eax
call esi
push edi
mov dword [ebp - 0x1270], eax
call esi
mov dword [ebp - 0x1274], eax
lea eax, [ebp - 0xb4]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0xc
mov dword [ebp - 0x127c], eax
call edi
push eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x1270]
add eax, 7
pop ecx
push dword [ebp - 0x1280]
cdq
push 8
pop ecx
idiv ecx
shl eax, 3
push eax
mov eax, dword [ebp - 0x1274]
add eax, 7
cdq
idiv ecx
push dword [ebp - 0x1264]
push dword [ebp - 0x1260]
shl eax, 3
push eax
lea eax, [ebp - 0xb4]
push eax
mov eax, dword [ebp - 0x127c]
add eax, 7
cdq
idiv ecx
shl eax, 3
push eax
call edi
push eax
push 8
lea eax, [esi + 7]
cdq
pop ecx
idiv ecx
shl eax, 3
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebx + 0xc]
lea eax, [ebp - 0x1258]
push dword [ebx + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0x10063b8
push 0x1000
push eax
call fcn.01011a83
lea eax, [ebp - 0x1258]
add esp, 0x48
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1012b09
sub eax, ecx
xor esi, esi
mov ebx, eax
xor ecx, ecx
cmp cx, word [ebp + 0x4c]
jae 0x1012b32
movzx eax, cx
shl eax, 2
mov edx, dword [ebp + eax + 0x24]
mov dword [ebp + eax - 0x12d8], edx
inc ecx
jmp 0x1012b18
push 0x10058d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, esi
jne 0x1012b70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006368
push 0x8000ffff
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1268], esp
push esi
push 0x8000
push 0x67f
jmp 0x1012c0b
lea eax, [ebp - 0x1258]
push eax
lea eax, [ebp - 0x12d8]
push eax
push ebx
push dword [ebp + 0x4c]
push esi
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x50]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, esi
jne 0x1012bd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006328
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1268], esp
push esi
push 0x8000
push 0x68e
push 0x10064c8
push 0x10060b0
call fcn.01007e91
lea eax, [ebp - 0x12b0]
push eax
call fcn.0100821c
add esp, 0x4c
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp eax, esi
jne 0x1012d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10062d8
push 0x8000ffff
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1268], esp
push esi
push 0x8000
push 0x693
push 0x10064c8
push 0x10060b0
call fcn.01007e91
lea eax, [ebp - 0x12b0]
push eax
call fcn.010082c0
mov eax, dword [ebp - 0x1278]
push eax
push 0x1002828
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1278], esp
push 0
push 2
push 0x695
push 0x10064c8
push 0x10060b0
mov dword [ebp - 0x12b0], eax
call fcn.01007e91
lea eax, [ebp - 0x12b0]
push eax
call fcn.0100821c
add esp, 0x4c
mov eax, 0x1012d00
ret
cmp dword [ebp - 0x126c], esi
mov dword [ebp - 4], 1
je 0x1012d1d
push dword [ebp - 0x126c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x125c], esi
je 0x1012d31
push dword [ebp - 0x125c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x12b0]
mov byte [ebp - 4], 0
call fcn.01008075
lea ecx, [ebp + 0x10]
call fcn.01007f37
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.010110c9
pop edi
pop esi
pop ebx
leave
ret