Function at 0x1000eba6c
Capabilities:
Accept command line arguments
Access the windows event log

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1b50
call fcn.1001319e0
sub rsp, rax
mov qword [rsp + 0x1f0], 0xfffffffffffffffe
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x1b40], rax
mov word [rsp + 0x70], r9w
mov rdi, r8
mov qword [rsp + 0x90], r8
mov dword [rsp + 0x88], edx
mov rbx, rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x78], r8
lea rax, [0x100035c10]
mov qword [rsp + 0xa0], rax
lea rax, [0x1000371a0]
mov qword [rsp + 0xa8], rax
lea rax, [0x100035bf8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x8b5
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
xor r15d, r15d
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
lea r12d, [r15 + 1]
mov byte [rsp + 0x143], r12b
lea esi, [r15 + 0x78]
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x170]
call fcn.1000e842c
nop
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x200], r15
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x208]
call sub.msvcrt.dll_memset
mov byte [rsp + 0xb30], r15b
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xb31]
call sub.msvcrt.dll_memset
movzx eax, word [rdi + 0xa0]
add eax, r12d
lea ecx, [rsi - 0x69]
cmp eax, ecx
jl 0x1000ebbdb
lea rcx, [rsp + 0x170]
call fcn.1000e8518
nop
mov rcx, rdi
call fcn.1000e7e7c
jmp 0x1000ec1e4
mov word [rsp + 0x330], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x332]
call sub.msvcrt.dll_memset
mov r8d, 0x400
lea rdx, [rsp + 0x330]
mov rcx, rbx
call fcn.1000e9440
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rsp + 0x330]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
lea eax, [rcx + 7]
cdq
and edx, 7
lea r14d, [rdx + rax]
sar r14d, 3
shl r14d, 3
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
xor eax, eax
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
mov rdi, rcx
mov r12d, dword [rbx + 0x20]
mov r13, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, rax
lea eax, [rdi + 7]
cdq
and edx, 7
lea ebx, [rdx + rax]
sar ebx, 3
shl ebx, 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x330]
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov r13, qword [rsp + 0x90]
mov eax, dword [r13 + 0x18]
mov dword [rsp + 0x20], eax
mov r9, qword [r13 + 0x10]
lea r8, [0x1000371e0]
mov edx, 0x1000
lea rcx, [rsp + 0xb30]
call fcn.1000e75d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb30]
repne scasb al, byte [rdi]
not rcx
lea edi, [rax + 1]
sub rcx, rdi
mov qword [rsp + 0x158], rcx
movzx edx, word [r13 + 0xa0]
lea eax, [rdi + rdx]
mov word [rsp + 0x72], ax
movzx r14d, r15w
cmp r14w, dx
jae 0x1000ebd31
movzx ecx, r14w
mov rax, qword [r13 + rcx*8 + 0x28]
mov qword [rsp + rcx*8 + 0x200], rax
add r14w, di
jmp 0x1000ebd14
mov qword [rsp + 0x90], r15
mov rcx, qword [rsp + 0x98]
call fcn.1000e9158
mov rdi, rax
mov qword [rsp + 0x90], rax
lea rcx, [0x10000d468]
cmp rax, r15
cmovne rcx, rax
movzx eax, r14w
mov qword [rsp + rax*8 + 0x200], rcx
lea r9, [rsp + 0x280]
lea rbx, [0x100035c10]
mov qword [rsp + 0xa0], rbx
lea r12, [0x1000371a0]
mov qword [rsp + 0xa8], r12
lea rsi, [0x100035bf8]
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x8f6
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov r11d, 0xff
mov dword [rsp + 0xc0], r11d
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
lea r8d, [rdx + 0xe]
cmp cx, r8w
jae 0x1000ebdff
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ebde9
mov r8d, 0x64
mov rdx, r9
lea rcx, [rsp + 0xa0]
call fcn.1000e8408
mov r9d, 0x64
cmp dword [r13 + 0x20], r11d
cmovne r9d, dword [r13 + 0x20]
movzx edx, r14w
mov r8, qword [rsp + rdx*8 + 0x200]
mov qword [rsp + 0x28], r8
lea rcx, [0x100037238]
mov qword [rsp + 0x20], rcx
lea r8, [0x100036058]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.1000e8b30
lea rcx, [rsp + 0xa0]
call fcn.1000e7e7c
lea rdx, [0x100004e98]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r14, rax
cmp rax, r15
jne 0x1000ebf61
lea rdi, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x906
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, AtlModuleInit
cmp cx, ax
jae 0x1000ebefc
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ebee2
mov r8d, 0x64
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1000e8408
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x100037270]
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.1000e9608
lea rcx, [rsp + 0xa0]
call fcn.1000e7e7c
mov dword [rsp + 0x84], 0x8000ffff
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x84]
call sub.msvcrt.dll__CxxThrowException
xor r8d, r8d
lea rax, [rsp + 0xb30]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x158]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x72]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x88]
movzx edx, word [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r15d
jne 0x1000ec081
lea r9, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x917
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, AtlModuleInit
cmp cx, ax
jae 0x1000ec034
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ec01a
mov r8d, 0x64
mov rdx, r9
lea rcx, [rsp + 0xa0]
call fcn.1000e8408
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x1000372c0]
mov rdx, rbx
lea rcx, [rsp + 0x170]
call fcn.1000e9608
lea rcx, [rsp + 0xa0]
call fcn.1000e7e7c
lea rbx, [0x100035c10]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp eax, r15d
jne 0x1000ec175
lea rdi, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x91e
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, AtlModuleInit
cmp cx, ax
jae 0x1000ec10f
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ec0f5
mov r8d, 0x64
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1000e8408
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x100037300]
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.1000e9608
lea rcx, [rsp + 0xa0]
call fcn.1000e7e7c
mov dword [rsp + 0x80], 0x8000ffff
lea rdx, [0x1001731d8]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x1000ec1a7
mov rcx, qword [rsp + 0x148]
cmp rcx, r15
je 0x1000ec1ba
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x150]
cmp rcx, r15
je 0x1000ec1ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x170]
call fcn.1000e8518
nop
mov rcx, r13
call fcn.1000e7e7c
mov rcx, qword [rsp + 0x1b40]
xor rcx, rsp
call fcn.100130df0
add rsp, 0x1b50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret