Function at 0x10063fb
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ReportEventW]
xor eax, eax
push esi
xor esi, esi
inc eax
cmp dword [ebp + 8], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jne 0x1006431
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
cmp word [ecx], 0x49
jne 0x1006431
mov dword [ebp - 8], eax
jmp 0x10064ab
push 0x1006372
push 0x10019a4
mov dword [0x1012fe0], 0x10
mov dword [0x1012fe4], 2
mov dword [0x1012fe8], 5
mov dword [0x1012fec], esi
mov dword [0x1012ff0], esi
mov dword [0x1012ff4], esi
mov dword [0x1012ff8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
cmp eax, esi
mov dword [0x1012fcc], eax
jne 0x10064a2
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push 4
push esi
push esi
push 0xc00007d1
push esi
push 1
push dword [0x1012b30]
call ebx
cmp dword [ebp - 4], esi
jne 0x100671f
push 0x1012b18
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1012a00
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.010048f7
cmp eax, 0xc00007d3
mov dword [ebp - 4], eax
jne 0x10064fd
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 8], esi
jne 0x1006706
mov dword [0x1012fec], 0x42a
mov dword [0x1012ff0], 0x7d3
jmp 0x1006706
mov dword [ebp - 4], esi
call fcn.0100463a
push 1
call sub.pdh.dll_PdhSetDefaultRealTimeDataSource
mov dword [ebp - 4], eax
call fcn.01003a63
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [0x1012b40], eax
jne 0x100655e
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push 4
push esi
push esi
push 0xc00007d2
push esi
push 2
push dword [0x1012b30]
call ebx
cmp dword [ebp - 8], esi
jne 0x100655e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov dword [0x1012fec], eax
cmp dword [ebp - 4], esi
jne 0x10065bc
cmp dword [ebp - 8], esi
jne 0x100658e
push 0x1012fe0
push dword [0x1012fcc]
mov dword [0x1012fe4], 4
mov dword [0x1012ff4], esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [ebp - 4], esi
jne 0x10065bc
push 4
push esi
push 0x10059b7
push 1
push 0x100123c
call dword [sym.imp.ADVAPI32.dll_WmiNotificationRegistrationW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x10065bc
call fcn.0100376a
call fcn.01006090
mov dword [ebp - 4], eax
call fcn.0100377b
cmp dword [0x1012b44], esi
jne 0x10065ed
cmp dword [ebp - 8], esi
jne 0x10066dc
push 0x1012fe0
push dword [0x1012fcc]
mov dword [0x1012fe4], 3
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
jmp 0x10066dc
cmp dword [ebp - 4], esi
jne 0x10066dc
call fcn.0100376a
push dword [0x1012b40]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [0x1012b44]
cmp edx, esi
je 0x10066b7
mov edi, 0x1012a18
mov ecx, dword [0x1012d54]
lea ecx, [ecx*4 + 4]
mov ebx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x1012b40]
xor ebx, ebx
mov dword [0x1012a18], eax
inc ebx
jmp 0x100665c
cmp dword [edx + 0xc], esi
je 0x100665a
mov eax, dword [edx + 4]
cmp eax, esi
je 0x100665a
mov dword [ebx*4 + 0x1012a18], eax
inc ebx
mov edx, dword [edx]
cmp edx, esi
jne 0x1006646
call fcn.0100377b
push 0xffffffffffffffff
push esi
mov edi, 0x1012a18
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, esi
jbe 0x1006698
cmp eax, ebx
jae 0x1006698
lea ebx, [eax*4 + 0x1012a18]
push dword [ebx]
call fcn.010037d8
push eax
call fcn.0100533b
push dword [ebx]
call fcn.0100433d
call fcn.0100376a
push dword [0x1012b40]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [0x1012b44]
cmp edx, esi
jne 0x100661a
cmp dword [ebp - 8], esi
jne 0x10066d7
push 0x1012fe0
push dword [0x1012fcc]
mov dword [0x1012fe4], 3
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.0100377b
push 4
push esi
push 0x10059b7
push esi
push 0x100123c
call dword [sym.imp.ADVAPI32.dll_WmiNotificationRegistrationW]
mov eax, dword [0x1012b40]
cmp eax, esi
je 0x1006706
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1012b40], esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x1012b18
call edi
push 0x1012a00
call edi
cmp dword [ebp - 8], esi
jne 0x100673a
push 0x1012fe0
push dword [0x1012fcc]
mov dword [0x1012fe4], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x1012b38]
cmp eax, esi
je 0x100675e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x1012b38], esi
mov dword [0x1012b3c], esi
mov eax, dword [0x1012b30]
cmp eax, esi
je 0x1006774
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov dword [0x1012b30], esi
pop edi
pop esi
pop ebx
leave
ret 8