Function at 0x1000eb640
Capabilities:
Accept command line arguments
Access the windows event log

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1b50
call fcn.100131420
sub rsp, rax
mov qword [rsp + 0x1f0], 0xfffffffffffffffe
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x1b40], rax
mov word [rsp + 0x70], r9w
mov rdi, r8
mov qword [rsp + 0x90], r8
mov dword [rsp + 0x88], edx
mov rbx, rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x78], r8
lea rax, [0x100035aa0]
mov qword [rsp + 0xa0], rax
lea rax, [0x100037030]
mov qword [rsp + 0xa8], rax
lea rax, [0x100035a88]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x8b5
mov dword [rsp + 0xbc], 0xb
mov dword [rsp + 0xc0], 0xff
xor r15d, r15d
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
lea r12d, [r15 + 1]
mov byte [rsp + 0x143], r12b
lea esi, [r15 + 0x78]
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x170]
call fcn.1000e8000
nop
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x200], r15
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x208]
call sub.msvcrt.dll_memset
mov byte [rsp + 0xb30], r15b
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xb31]
call sub.msvcrt.dll_memset
movzx eax, word [rdi + 0xa0]
add eax, r12d
lea ecx, [rsi - 0x69]
cmp eax, ecx
jl 0x1000eb7af
lea rcx, [rsp + 0x170]
call fcn.1000e80ec
nop
mov rcx, rdi
call fcn.1000e7a50
jmp 0x1000ebdb8
mov word [rsp + 0x330], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x332]
call sub.msvcrt.dll_memset
mov r8d, 0x400
lea rdx, [rsp + 0x330]
mov rcx, rbx
call fcn.1000e9014
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rsp + 0x330]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
lea eax, [rcx + 7]
cdq
and edx, 7
lea r14d, [rdx + rax]
sar r14d, 3
shl r14d, 3
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
xor eax, eax
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
mov rdi, rcx
mov r12d, dword [rbx + 0x20]
mov r13, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, rax
lea eax, [rdi + 7]
cdq
and edx, 7
lea ebx, [rdx + rax]
sar ebx, 3
shl ebx, 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x330]
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov r13, qword [rsp + 0x90]
mov eax, dword [r13 + 0x18]
mov dword [rsp + 0x20], eax
mov r9, qword [r13 + 0x10]
lea r8, [0x100037070]
mov edx, 0x1000
lea rcx, [rsp + 0xb30]
call fcn.1000e71a4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb30]
repne scasb al, byte [rdi]
not rcx
lea edi, [rax + 1]
sub rcx, rdi
mov qword [rsp + 0x158], rcx
movzx edx, word [r13 + 0xa0]
lea eax, [rdi + rdx]
mov word [rsp + 0x72], ax
movzx r14d, r15w
cmp r14w, dx
jae 0x1000eb905
movzx ecx, r14w
mov rax, qword [r13 + rcx*8 + 0x28]
mov qword [rsp + rcx*8 + 0x200], rax
add r14w, di
jmp 0x1000eb8e8
mov qword [rsp + 0x90], r15
mov rcx, qword [rsp + 0x98]
call fcn.1000e8d2c
mov rdi, rax
mov qword [rsp + 0x90], rax
lea rcx, [0x10000d468]
cmp rax, r15
cmovne rcx, rax
movzx eax, r14w
mov qword [rsp + rax*8 + 0x200], rcx
lea r9, [rsp + 0x280]
lea rbx, [0x100035aa0]
mov qword [rsp + 0xa0], rbx
lea r12, [0x100037030]
mov qword [rsp + 0xa8], r12
lea rsi, [0x100035a88]
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x8f6
mov dword [rsp + 0xbc], 0xb
mov r11d, 0xff
mov dword [rsp + 0xc0], r11d
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
lea r8d, [rdx + 0xe]
cmp cx, r8w
jae 0x1000eb9d3
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000eb9bd
mov r8d, 0x64
mov rdx, r9
lea rcx, [rsp + 0xa0]
call fcn.1000e7fdc
mov r9d, 0x64
cmp dword [r13 + 0x20], r11d
cmovne r9d, dword [r13 + 0x20]
movzx edx, r14w
mov r8, qword [rsp + rdx*8 + 0x200]
mov qword [rsp + 0x28], r8
lea rcx, [0x1000370c8]
mov qword [rsp + 0x20], rcx
lea r8, [0x100035ee8]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.1000e8704
lea rcx, [rsp + 0xa0]
call fcn.1000e7a50
lea rdx, [0x100004e98]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r14, rax
cmp rax, r15
jne 0x1000ebb35
lea rdi, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x906
mov dword [rsp + 0xbc], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, 0xf
cmp cx, ax
jae 0x1000ebad0
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ebab6
mov r8d, 0x64
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1000e7fdc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x100037100]
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.1000e91dc
lea rcx, [rsp + 0xa0]
call fcn.1000e7a50
mov dword [rsp + 0x84], 0x8000ffff
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x84]
call sub.msvcrt.dll__CxxThrowException
xor r8d, r8d
lea rax, [rsp + 0xb30]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x158]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x72]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x88]
movzx edx, word [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r15d
jne 0x1000ebc55
lea r9, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x917
mov dword [rsp + 0xbc], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, 0xf
cmp cx, ax
jae 0x1000ebc08
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ebbee
mov r8d, 0x64
mov rdx, r9
lea rcx, [rsp + 0xa0]
call fcn.1000e7fdc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x100037150]
mov rdx, rbx
lea rcx, [rsp + 0x170]
call fcn.1000e91dc
lea rcx, [rsp + 0xa0]
call fcn.1000e7a50
lea rbx, [0x100035aa0]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp eax, r15d
jne 0x1000ebd49
lea rdi, [rsp + 0x280]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xb8], 0x91e
mov dword [rsp + 0xbc], 0xb
mov dword [rsp + 0xc0], 0xff
mov word [rsp + 0x140], r15w
mov byte [rsp + 0x142], r15b
mov edx, 1
mov byte [rsp + 0x143], dl
movzx ecx, r15w
mov eax, 0xf
cmp cx, ax
jae 0x1000ebce3
movzx eax, cx
mov qword [rsp + rax*8 + 0xc8], r15
add cx, dx
jmp 0x1000ebcc9
mov r8d, 0x64
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1000e7fdc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x100037190]
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.1000e91dc
lea rcx, [rsp + 0xa0]
call fcn.1000e7a50
mov dword [rsp + 0x80], 0x8000ffff
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x1000ebd7b
mov rcx, qword [rsp + 0x148]
cmp rcx, r15
je 0x1000ebd8e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x150]
cmp rcx, r15
je 0x1000ebda2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x170]
call fcn.1000e80ec
nop
mov rcx, r13
call fcn.1000e7a50
mov rcx, qword [rsp + 0x1b40]
xor rcx, rsp
call fcn.100130830
add rsp, 0x1b50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret