Function at 0x1008c41
Capabilities:
Access the windows event log

Disassembly:
push 0x270
push 0x1001a08
call fcn.01009f68
mov eax, dword [0x1012070]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
or ebx, 0xffffffff
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x258], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
push esi
call fcn.01003275
test eax, eax
jne 0x1008cc5
mov dword [ebp - 0x22c], 1
cmp dword [ebp - 0x22c], 1
jne 0x1008cf0
push 1
push esi
call fcn.0100439d
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], edx
cmp eax, ebx
jne 0x1008cf0
cmp edx, ebx
jne 0x1008cf0
mov dword [ebp - 0x22c], edi
cmp dword [ebp - 0x22c], edi
je 0x1008d75
push esi
call fcn.01006832
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [ebp - 0x22c], edi
je 0x1008d75
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x280], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x248]
cmp eax, edi
jl 0x1008d7b
mov ecx, dword [ebp - 0x24c]
jg 0x1008d3d
cmp ecx, edi
jbe 0x1008d7b
neg ecx
adc eax, edi
neg eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x24c]
push eax
push edi
push 1
lea eax, [ebp - 0x280]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
je 0x1008d7b
mov dword [ebp - 0x22c], edi
push edi
jmp 0x100924a
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.01006a66
cmp dword [ebp - 0x238], edi
jne 0x1008d9c
cmp dword [ebp - 0x234], edi
je 0x1009213
lea eax, [ebp - 0x254]
push eax
push esi
call fcn.01006ae4
mov eax, dword [esi + 0xb0]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x270]
push eax
push 1
push esi
call fcn.01003f12
push edi
push esi
call fcn.010052a8
mov dword [ebp - 0x230], eax
cmp eax, edi
je 0x1008fa7
lea ebx, [esi + 0x4d8]
lea eax, [esi + 0x4f0]
push eax
lea eax, [esi + 0x568]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_StartTraceW]
mov dword [ebp - 0x230], eax
cmp eax, edi
jne 0x1008f09
mov dword [ebp - 0x26c], 1
mov eax, dword [esi + 0x538]
test al, 3
jne 0x1008f09
test eax, 0x10100
jne 0x1008f09
mov dword [ebp - 0x244], edi
mov eax, dword [ebp - 0x244]
cmp eax, dword [esi + 0x97c]
jae 0x1008ec7
push dword [ebx + 4]
push dword [ebx]
mov eax, dword [esi + 0x4e4]
mov ecx, dword [ebp - 0x244]
push dword [eax + ecx*4]
push edi
push edi
push 1
call dword [sym.imp.ADVAPI32.dll_EnableTrace]
mov dword [ebp - 0x230], eax
cmp eax, edi
jne 0x1008e74
inc dword [ebp - 0x258]
jmp 0x1008ebc
mov eax, dword [esi + 0x4e8]
mov ecx, dword [ebp - 0x244]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x268], eax
lea eax, [esi + 0xbc]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x268]
push eax
push 4
push 2
push edi
push 0x800007e0
push edi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
inc dword [ebp - 0x244]
jmp 0x1008e32
cmp dword [ebp - 0x258], edi
jle 0x1008ed7
mov dword [ebp - 0x230], edi
jmp 0x1008f09
lea eax, [esi + 0xbc]
mov dword [ebp - 0x268], eax
push edi
lea eax, [ebp - 0x268]
push eax
push edi
push 1
push edi
push 0x800007df
push edi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x22c], edi
cmp dword [ebp - 0x22c], edi
je 0x1008f75
cmp dword [ebp - 0x230], edi
jne 0x1008f75
lea eax, [esi + 0x9c]
mov dword [eax], 1
push 4
push eax
push 0x1001544
push dword [esi + 8]
call fcn.01002a4f
mov dword [ebp - 0x230], eax
lea eax, [esi + 0xbc]
mov dword [ebp - 0x268], eax
lea eax, [esi + 0x772]
mov dword [ebp - 0x264], eax
push edi
lea eax, [ebp - 0x268]
push eax
push edi
push 2
push edi
push 0x400007e7
push edi
push 4
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x1008fd9
lea eax, [esi + 0xbc]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x230], 0xb7
je 0x1008fb3
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x268]
push eax
push 4
push 1
push edi
push 0x800007de
jmp 0x1008fc4
lea eax, [esi + 0xbc]
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push edi
push eax
push edi
push 1
push edi
push 0x8000080e
push edi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x22c], edi
cmp dword [ebp - 0x22c], 1
jne 0x10090fd
or ebx, 0xffffffff
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
cmp eax, edi
jne 0x1009001
cmp ecx, edi
je 0x10090fd
mov edx, dword [ebp - 0x254]
cmp edx, ebx
jne 0x1009013
cmp dword [ebp - 0x250], ebx
je 0x1009067
cmp eax, ebx
jne 0x100901b
cmp ecx, ebx
je 0x1009029
cmp dword [ebp - 0x250], ecx
jg 0x1009067
jl 0x1009029
cmp edx, eax
ja 0x1009067
mov dword [ebp - 0x240], edx
mov edx, dword [ebp - 0x250]
mov dword [ebp - 0x23c], edx
cmp eax, ebx
jne 0x1009043
cmp ecx, ebx
je 0x1009095
sub eax, dword [ebp - 0x254]
mov dword [ebp - 0x238], eax
sbb ecx, dword [ebp - 0x250]
mov dword [ebp - 0x234], ecx
cmp ecx, edi
jg 0x1009095
jl 0x1009089
cmp eax, edi
jae 0x1009095
jmp 0x1009089
cmp eax, ebx
jne 0x100907d
cmp ecx, ebx
jne 0x100907d
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
jmp 0x1009089
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
cmp dword [ebp - 0x240], ebx
jne 0x10090a5
cmp dword [ebp - 0x23c], ebx
je 0x10090c3
mov eax, dword [ebp - 0x240]
neg eax
mov ecx, dword [ebp - 0x23c]
adc ecx, edi
neg ecx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp - 0x240], ebx
jne 0x10090d3
cmp dword [ebp - 0x23c], ebx
je 0x10090db
lea eax, [ebp - 0x240]
jmp 0x10090dd
xor eax, eax
push eax
push edi
push 1
lea eax, [ebp - 0x280]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
je 0x100915e
mov dword [ebp - 0x22c], edi
cmp dword [ebp - 0x26c], 1
jne 0x10091ec
mov eax, dword [esi + 0x538]
test al, 3
jne 0x10091c6
test eax, 0x10100
jne 0x10091c6
xor ebx, ebx
mov dword [ebp - 0x278], ebx
cmp ebx, dword [esi + 0x97c]
jae 0x10091c6
push dword [esi + 0x4dc]
push dword [esi + 0x4d8]
mov eax, dword [esi + 0x4e4]
push dword [eax + ebx*4]
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_EnableTrace]
mov dword [ebp - 0x230], eax
inc ebx
jmp 0x1009125
cmp dword [ebp - 0x254], ebx
jne 0x1009172
cmp dword [ebp - 0x250], ebx
je 0x1008fe9
cmp dword [ebp - 0x238], edi
jne 0x1009186
cmp dword [ebp - 0x234], edi
je 0x1008fe9
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x270]
push eax
push edi
push esi
call fcn.01003f12
lea eax, [esi + 0x4f0]
push eax
lea eax, [esi + 0x568]
push eax
push dword [esi + 0x4dc]
push dword [esi + 0x4d8]
call dword [sym.imp.ADVAPI32.dll_UpdateTraceW]
mov dword [ebp - 0x230], eax
jmp 0x1008fe9
lea eax, [esi + 0x4f0]
push eax
lea eax, [esi + 0x568]
push eax
push dword [esi + 0x4dc]
push dword [esi + 0x4d8]
call dword [sym.imp.ADVAPI32.dll_StopTraceW]
mov dword [ebp - 0x230], eax
cmp dword [esi + 0x4d0], edi
jne 0x1008d75
cmp dword [esi + 0x90], edi
je 0x1009213
push dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.01005412
cmp dword [ebp - 0x22c], edi
je 0x1008d75
lea eax, [ebp - 0x24c]
push eax
push esi
call fcn.01006bcb
mov dword [ebp - 0x22c], eax
jmp 0x1008d0d
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
call fcn.01009963
call fcn.01009fa3
ret 4