Function at 0x10341e0
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov word [rsp + 0x10], dx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1590
call fcn.0105fe80
sub rsp, rax
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x1580], rax
movzx eax, word [0x01001c50]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x1390], ax
lea rax, [rsp + 0x1392]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x1520], ax
lea rax, [rsp + 0x1522]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x870], ax
lea rax, [rsp + 0x872]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x470], ax
lea rax, [rsp + 0x472]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xd80], ax
lea rax, [rsp + 0xd82]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xc80], ax
lea rax, [rsp + 0xc82]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x1380], 0
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1544], 0
mov dword [rsp + 0x151c], 0
mov dword [rsp + 0xc78], 0
mov dword [rsp + 0xc74], 0
mov dword [rsp + 0x1514], 0
mov dword [rsp + 0x460], 0
mov dword [rsp + 0xc70], 0
mov dword [rsp + 0x1540], 0
mov dword [rsp + 0x1510], 0
mov r9d, 0x80
lea r8, [rsp + 0xc80]
mov edx, 0x17
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x80
xor edx, edx
lea rcx, [rsp + 0x1490]
call sub.MSVCR80.dll_memset
mov r8d, 0x200
xor edx, edx
lea rcx, [rsp + 0x1180]
call sub.MSVCR80.dll_memset
mov eax, dword [rsp + 0x15b8]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x460], eax
mov eax, dword [rsp + 0x460]
shl eax, 1
cmp eax, dword [rsp + 0x15b8]
jne 0x10343fd
cmp dword [rsp + 0x15b8], 0
jge 0x1034402
jmp 0x1034b5c
cmp dword [rsp + 0x460], 0x11
jl 0x1034411
jmp 0x1034b5c
lea rax, [rsp + 0x15c0]
mov qword [rsp + 0x1388], rax
mov dword [rsp + 0xc78], 0
jmp 0x103443f
mov eax, dword [rsp + 0xc78]
add eax, 1
mov dword [rsp + 0xc78], eax
mov eax, dword [rsp + 0x460]
cmp dword [rsp + 0xc78], eax
jge 0x1034643
movsxd rax, dword [rsp + 0xc78]
cmp rax, 0x10
jae 0x1034643
xor eax, eax
test eax, eax
je 0x1034496
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov eax, dword [rax]
mov dword [rsp + 0x1558], eax
jmp 0x10344bc
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov eax, dword [rax - 8]
mov dword [rsp + 0x1558], eax
mov eax, dword [rsp + 0x1558]
mov dword [rsp + 0xc70], eax
mov eax, dword [rsp + 0xc70]
mov dword [rsp + 0x155c], eax
cmp dword [rsp + 0x155c], 1
je 0x10344f5
cmp dword [rsp + 0x155c], 2
je 0x10345c1
jmp 0x103463e
xor eax, eax
test eax, eax
je 0x1034526
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov eax, dword [rax]
mov dword [rsp + 0x1560], eax
jmp 0x103454c
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov eax, dword [rax - 8]
mov dword [rsp + 0x1560], eax
mov eax, dword [rsp + 0x1560]
mov dword [rsp + 0x1514], eax
movsxd rax, dword [rsp + 0xc74]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x1180]
mov r9d, dword [rsp + 0x1514]
lea r8, [0x01001e78]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
mov rcx, rax
call fcn.01016110
movsxd rax, dword [rsp + 0xc74]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x1180]
movsxd rcx, dword [rsp + 0xc78]
mov qword [rsp + rcx*8 + 0x1490], rax
mov eax, dword [rsp + 0xc74]
add eax, 1
mov dword [rsp + 0xc74], eax
jmp 0x103463e
xor eax, eax
test eax, eax
je 0x10345f4
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov rax, qword [rax]
mov qword [rsp + 0x1568], rax
jmp 0x103461c
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov qword [rsp + 0x1568], rax
mov rax, qword [rsp + 0x1568]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0xc78]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + rax*8 + 0x1490], rcx
jmp 0x103442e
mov qword [rsp + 0x1388], 0
movzx eax, word [rsp + 0x15a8]
mov dword [rsp + 0x1570], eax
cmp dword [rsp + 0x1570], 1
je 0x1034681
cmp dword [rsp + 0x1570], 2
je 0x10346bb
cmp dword [rsp + 0x1570], 4
je 0x10346f2
jmp 0x1034729
mov r9d, 0x21
lea r8, [0x010023a4]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01016110
mov dword [rsp + 0x1518], 1
mov dword [rsp + 0x1380], 0x10
jmp 0x103475e
mov r9d, 0x2b
lea r8, [0x010023a4]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01016110
mov dword [rsp + 0x1518], 2
mov dword [rsp + 0x1380], 0x30
jmp 0x103475e
mov r9d, 0x3f
lea r8, [0x010023a4]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01016110
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1380], 0x40
jmp 0x103475e
mov r9d, 0x3f
lea r8, [0x010023a4]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01016110
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1380], 0x40
mov eax, dword [rsp + 0x15a0]
and eax, 1
test eax, eax
je 0x103486e
lea rcx, [0x01066b28]
call qword [0x01069178]
test eax, eax
jne 0x10347b4
cmp dword [0x010689c0], 0
je 0x10347a7
cmp dword [0x01068484], 0
je 0x10347a7
lea rdx, [0x01007ec0]
lea rcx, [0x01001b80]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066b28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010689c0], 0
je 0x10347da
cmp dword [0x01068484], 0
je 0x10347da
lea rdx, [0x01007ec0]
lea rcx, [0x01001b48]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov ecx, dword [rsp + 0x15b0]
call fcn.01036230
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x1490]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
movzx ecx, word [rsp + 0x460]
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x15b0]
movzx r8d, ax
movzx edx, word [rsp + 0x15a8]
mov rcx, qword [0x010689b8]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
lea rcx, [0x01066b28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010689c0], 0
je 0x103486e
cmp dword [0x01068484], 0
je 0x103486e
lea rdx, [0x01007ec0]
lea rcx, [0x01001b10]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov eax, dword [rsp + 0x15a0]
and eax, 2
test eax, eax
je 0x1034b5c
mov qword [rsp + 0x1548], 0
mov qword [rsp + 0x1550], 0
mov qword [rsp + 0x1548], 0
mov qword [rsp + 0x1550], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x1490]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x15b0]
mov rdx, qword [0x01066df8]
mov ecx, 0x2800
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [rsp + 0x1544], eax
cmp dword [rsp + 0x1544], 0
jne 0x1034981
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x151c], eax
mov r8d, 0x400
lea rdx, [rsp + 0xd80]
mov ecx, dword [rsp + 0x151c]
call fcn.01053650
movzx eax, word [rsp + 0xd80]
test eax, eax
je 0x103494a
lea rax, [rsp + 0xd80]
mov qword [rsp + 0x1578], rax
jmp 0x103495a
lea rax, [rsp + 0xc80]
mov qword [rsp + 0x1578], rax
mov rax, qword [rsp + 0x1578]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x15b0]
mov r8d, 0x173
xor edx, edx
mov ecx, 1
call fcn.01034b80
cmp qword [rsp + 0x1548], 0
je 0x1034999
mov rcx, qword [rsp + 0x1548]
call fcn.01015770
cmp qword [rsp + 0x1550], 0
je 0x10349b1
mov rcx, qword [rsp + 0x1550]
call fcn.01015770
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dword [rsp + 0x1540], 0
jmp 0x10349da
mov eax, dword [rsp + 0x1540]
add eax, 1
mov dword [rsp + 0x1540], eax
movsxd rax, dword [rsp + 0x1540]
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0xa
je 0x10349fe
movsxd rax, dword [rsp + 0x1540]
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0xd
jne 0x1034a02
jmp 0x10349c9
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll__wcsrev]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wcslen]
movsxd rcx, dword [rsp + 0x1540]
sub rax, rcx
mov word [rsp + rax*2 + 0x60], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov dword [rsp + 0x1510], eax
cmp dword [rsp + 0x1510], 3
jl 0x1034a9b
mov eax, dword [rsp + 0x1510]
sub eax, 1
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
jne 0x1034a9b
mov eax, dword [rsp + 0x1510]
sub eax, 2
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
je 0x1034a9b
mov eax, dword [rsp + 0x1510]
sub eax, 3
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
je 0x1034a9b
mov eax, dword [rsp + 0x1510]
sub eax, 1
cdqe
mov word [rsp + rax*2 + 0x60], 0
movzx eax, word [rsp + 0x60]
test eax, eax
je 0x1034af0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1520]
lea r8, [0x01007ea8]
mov edx, 0x200
lea rcx, [rsp + 0x870]
call fcn.01016110
mov word [rsp + 0xc6e], 0
mov r8d, dword [rsp + 0x1518]
xor edx, edx
lea rcx, [rsp + 0x870]
call fcn.01034e00
mov eax, dword [rsp + 0x15a0]
and eax, 4
test eax, eax
je 0x1034b5c
mov r9d, 0x200
lea r8, [rsp + 0x470]
mov edx, 0x4b
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x01068e30]
lea r8, [rsp + 0x470]
mov edx, 0x80
lea rcx, [rsp + 0x1390]
call fcn.01016110
mov r9d, dword [rsp + 0x1380]
lea r8, [rsp + 0x1390]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x1580]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x1590
pop rdi
ret