Function at 0x9d0ee0
Capabilities:
Check os version
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa9b842
mov eax, dword fs:[0]
push eax
sub esp, 0xb70
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xb68], eax
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0xb80]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x74], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
cmp dword [0xc089d8], ebx
jne 0x9d0f58
cmp esi, ebx
jne 0x9d0f6e
push 0xc117b0
mov dword [0xc089d8], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
jmp 0x9d245f
cmp esi, ebx
jne 0x9d0f63
xor eax, eax
jmp 0x9d245f
push 0xc117b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push ebx
push ebx
call dword [0xbdda6c]
mov edi, eax
mov dword [esp + 0x4c], edi
cmp edi, ebx
jne 0x9d0f91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x3c], eax
jmp 0x9d2448
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x4c]
push ecx
push ebx
push ebx
push ebx
push esi
push edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
call dword [0xbdda58]
test eax, eax
jne 0x9d1002
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x3c], eax
cmp eax, 0x7a
jne 0x9d0ffa
mov ebx, dword [esp + 0x48]
push ebx
call fcn.00a7a155
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
je 0x9d13aa
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x4c]
push ecx
push eax
push ebx
push 0
push esi
push edi
call dword [0xbdda58]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x9d242e
mov edx, dword [esp + 0x30]
movzx eax, word [edx + 0x20]
mov ebx, dword [0xbe4cd4]
lea ecx, [esp + 0x40]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov eax, dword [0xbe4cbc]
push ecx
lea edx, [esp + 0xb0]
push edx
mov edi, 0xbe4cbc
mov dword [esp + 0x3c], eax
call fcn.0099cb00
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x9d1046
cmp eax, dword [esp + 0x34]
je 0x9d104b
call fcn.00a7a8a1
mov edi, dword [ebp + 8]
xor eax, eax
cmp dword [esi + 4], ebx
setne al
xor ebx, ebx
mov esi, eax
mov dword [esp + 0x34], esi
cmp edi, ebx
jne 0x9d106a
cmp esi, ebx
je 0x9d242a
lea ecx, [esp + 0x54]
push ecx
call fcn.009d5b70
mov dword [esp + 0xb88], ebx
cmp edi, ebx
jne 0x9d1083
cmp esi, ebx
je 0x9d109b
mov edx, dword [esp + 0x44]
push esi
push edx
push str._EVENT_BEGIN__EVID:_u__InOurList:_u_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 0xc
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp eax, ebx
jne 0x9d10aa
mov eax, 0xaa8704
xor ecx, ecx
mov word [esp + 0xb8], cx
mov ecx, eax
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
lea esi, [ecx + 2]
jmp 0x9d10d0
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x9d10d0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xb8]
call fcn.0085d720
mov byte [esp + 0xb88], 1
cmp dword [esp + 0xcc], 8
mov ebx, dword [esp + 0xb8]
jae 0x9d110c
lea ebx, [esp + 0xb8]
call fcn.00970430
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x9d11b3
push 0xc
push str.providername
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 2
call fcn.009d5900
mov edx, esi
lea edi, [edx + 1]
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x9d1158
sub edx, edi
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1186
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1191
cmp dword [esp + 0x34], ebx
je 0x9d11a4
push esi
push str._WEVT__ProviderName:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x30]
mov esi, dword [edi + 0x10]
cmp esi, ebx
je 0x9d12a6
push 0x62
lea edx, [esp + 0xf2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xf8], cx
call fcn.00a7ffb0
add esp, 0xc
push 0x32
lea eax, [esp + 0xf0]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ebx, [esp + 0xec]
call fcn.00970430
mov esi, eax
test esi, esi
je 0x9d12a4
push 0xc
push str.providerguid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 3
call fcn.009d5900
mov edx, esi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x9d1246
sub edx, ebx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1274
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], 0
jne 0x9d1281
cmp dword [esp + 0x34], 0
je 0x9d1294
push esi
push str._WEVT__ProviderGUID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
jne 0x9d12bd
movzx eax, word [edi + 0x30]
movzx ecx, word [esp + 0x44]
shl eax, 0x10
or eax, ecx
mov dword [esp + 0x44], eax
push 0x3ff
lea edx, [esp + 0x159]
push ebx
push edx
mov byte [esp + 0x160], bl
call fcn.00a7ffb0
mov eax, dword [esp + 0x50]
add esp, 0xc
push eax
lea ecx, [esp + 0x158]
push 0xaec054
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 7
push str.eventid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 4
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
jmp 0x9d1340
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d1340
sub edx, edi
push edx
lea eax, [esp + 0x158]
push eax
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1375
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1380
cmp dword [esp + 0x34], ebx
je 0x9d139a
lea edx, [esp + 0x154]
push edx
push str._WEVT__EventID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x11c], ebx
jne 0x9d13b7
xor eax, eax
jmp 0x9d13be
mov dword [esp + 0x3c], 0xe
jmp 0x9d242e
movzx eax, byte [eax + 0x110]
push eax
lea eax, [esp + 0x158]
push 0xaa1568
push eax
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 7
push str.version
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 5
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
jmp 0x9d1420
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d1420
sub edx, edi
push edx
lea edx, [esp + 0x158]
push edx
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1455
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1460
cmp dword [esp + 0x34], ebx
je 0x9d147a
lea ecx, [esp + 0x154]
push ecx
push str._WEVT__Version:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x4c], ebx
jne 0x9d1487
xor eax, eax
jmp 0x9d148b
movzx eax, byte [eax + 0x40]
push eax
lea edx, [esp + 0x158]
push 0xaa1568
push edx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 5
push str.level
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 6
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d14e8
sub edx, edi
push edx
lea ecx, [esp + 0x158]
push ecx
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d151d
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1528
cmp dword [esp + 0x34], ebx
je 0x9d1542
lea eax, [esp + 0x154]
push eax
push str._WEVT__Level:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov edi, dword [esp + 0x30]
cmp dword [edi + 0x5c], ebx
jne 0x9d154f
xor eax, eax
jmp 0x9d1553
movzx eax, byte [edi + 0x50]
push eax
lea ecx, [esp + 0x158]
push 0xafb060
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 4
push str.task
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 7
call fcn.009d5900
lea edx, [esp + 0x154]
lea esi, [edx + 1]
mov edi, edi
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x9d15b0
sub edx, esi
push edx
lea ecx, [esp + 0x158]
push ecx
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d15e5
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d15f0
cmp dword [esp + 0x34], ebx
je 0x9d160a
lea eax, [esp + 0x154]
push eax
push str._WEVT__Task:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
cmp dword [edi + 0x6c], ebx
jne 0x9d1613
xor eax, eax
jmp 0x9d1617
movzx eax, word [edi + 0x60]
push eax
lea ecx, [esp + 0x158]
push 0xaa1568
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 6
push str.opcode
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 8
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d1674
sub edx, edi
push edx
lea eax, [esp + 0x158]
push eax
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d16a9
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d16b4
cmp dword [esp + 0x34], ebx
je 0x9d16ce
lea edx, [esp + 0x154]
push edx
push str._WEVT__Opcode:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 0x7c], ebx
jne 0x9d16dd
xor eax, eax
xor ecx, ecx
jmp 0x9d16e3
mov eax, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x64]
push ecx
push eax
lea eax, [esp + 0x15c]
push str._0x_I64x
push eax
mov ecx, 0x400
call fcn.009cf960
add esp, 0x10
push 8
push str.keywords
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 9
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d1741
sub edx, edi
push edx
lea edx, [esp + 0x158]
push edx
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1776
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1781
cmp dword [esp + 0x34], ebx
je 0x9d179b
lea ecx, [esp + 0x154]
push ecx
push str._WEVT__Keywords:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x80]
mov edi, dword [eax + 0x84]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x8c]
push eax
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push ebx
push 0x989680
push edi
push esi
call fcn.00a97cd0
push ebx
push 0x64
push edx
push eax
call fcn.00a8a460
movzx ecx, word [esp + 0x84]
push edx
movzx edx, word [esp + 0x86]
push eax
movzx eax, word [esp + 0x88]
push ecx
movzx ecx, word [esp + 0x84]
push edx
movzx edx, word [esp + 0x8e]
push eax
movzx eax, word [esp + 0x8e]
push ecx
push edx
push eax
lea ecx, [esp + 0x174]
push str._02d__02d__02d__02d:_02d:_02d._I64u
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0x28
push 0xb
push str.timecreated
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xa
call fcn.009d5900
lea edx, [esp + 0x154]
mov esi, eax
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
cmp al, bl
jne 0x9d1877
sub edx, edi
push edx
lea eax, [esp + 0x158]
push eax
mov ecx, esi
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d18ac
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d18b7
cmp dword [esp + 0x34], ebx
je 0x9d18d1
lea edx, [esp + 0x154]
push edx
push str._WEVT__TimeCreated:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 0x94]
mov ecx, dword [edi + 0x90]
push eax
push ecx
lea edx, [esp + 0x15c]
push str._I64u
push edx
mov ecx, 0x400
call fcn.009cf960
add esp, 0x10
push 0xd
push str.eventrecordid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xb
call fcn.009d5900
lea edx, [esp + 0x154]
lea esi, [edx + 1]
lea ecx, [ecx]
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x9d1940
sub edx, esi
push edx
lea ecx, [esp + 0x158]
push ecx
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1975
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1980
cmp dword [esp + 0x34], ebx
je 0x9d199a
lea eax, [esp + 0x154]
push eax
push str._WEVT__EventRecordID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
cmp dword [edi + 0xac], ebx
je 0x9d1a90
push 0x62
lea edx, [esp + 0xf2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xf8], cx
call fcn.00a7ffb0
mov ecx, dword [edi + 0xa0]
add esp, 0xc
push 0x32
lea eax, [esp + 0xf0]
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ebx, [esp + 0xec]
call fcn.00970430
mov esi, eax
test esi, esi
je 0x9d1a8e
push 0xa
push str.activityid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xc
call fcn.009d5900
mov edx, esi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x9d1a30
sub edx, ebx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1a5e
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], 0
jne 0x9d1a6b
cmp dword [esp + 0x34], 0
je 0x9d1a7e
push esi
push str._WEVT__ActivityID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [edi + 0xbc], ebx
je 0x9d1b86
push 0x62
lea edx, [esp + 0xf2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xf8], cx
call fcn.00a7ffb0
mov ecx, dword [edi + 0xb0]
add esp, 0xc
push 0x32
lea eax, [esp + 0xf0]
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ebx, [esp + 0xec]
call fcn.00970430
mov esi, eax
test esi, esi
je 0x9d1b84
push 0x11
push str.relatedactivityid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xd
call fcn.009d5900
mov edx, esi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x9d1b26
sub edx, ebx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1b54
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], 0
jne 0x9d1b61
cmp dword [esp + 0x34], 0
je 0x9d1b74
push esi
push str._WEVT__RelatedActivityID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push 0x207
lea ecx, [esp + 0x971]
push ebx
push ecx
mov byte [esp + 0x978], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [esp + 0x661]
push ebx
push edx
mov byte [esp + 0x668], bl
call fcn.00a7ffb0
mov eax, dword [edi + 0xc0]
add esp, 0xc
cmp eax, 4
jbe 0x9d1be1
push eax
lea ecx, [esp + 0x660]
lea ebx, [esp + 0x970]
call fcn.0097b130
xor ebx, ebx
lea ecx, [esp + 0x154]
cmp byte [esp + 0x65c], bl
jne 0x9d1c0d
mov eax, dword [edi + 0xc0]
push eax
push str.SYSTEM:_lu
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
jmp 0x9d1c2f
mov edx, dword [edi + 0xc0]
push edx
lea eax, [esp + 0x660]
push eax
push str._s:_lu
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0x10
push 9
push str.processid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xe
call fcn.009d5900
lea edx, [esp + 0x154]
lea esi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x9d1c70
sub edx, esi
push edx
lea ecx, [esp + 0x158]
push ecx
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1ca5
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1cb0
cmp dword [esp + 0x34], ebx
je 0x9d1cca
lea eax, [esp + 0x154]
push eax
push str._WEVT__ProcessID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
mov ecx, dword [edi + 0xd0]
push ecx
lea edx, [esp + 0x158]
push 0xaec054
push edx
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
push 8
push str.threadid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0085d360
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0xf
call fcn.009d5900
lea edx, [esp + 0x154]
lea esi, [edx + 1]
jmp 0x9d1d30
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x9d1d30
sub edx, esi
push edx
lea ecx, [esp + 0x158]
push ecx
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1d65
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], ebx
jne 0x9d1d70
cmp dword [esp + 0x34], ebx
je 0x9d1d8a
lea eax, [esp + 0x154]
push eax
push str._WEVT__ThreadID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
cmp dword [edi + 0xec], ebx
jne 0x9d1d9a
mov eax, dword [edi + 0xe0]
jmp 0x9d1d9f
mov eax, 0xaa8704
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x9d1da4
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xb8]
call fcn.0085d720
cmp dword [esp + 0xcc], 8
mov ebx, dword [esp + 0xb8]
jae 0x9d1dd8
lea ebx, [esp + 0xb8]
call fcn.00970430
mov esi, eax
test esi, esi
je 0x9d1e85
push 7
push str.channel
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0x10
call fcn.009d5900
mov edx, esi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x9d1e27
sub edx, ebx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1e55
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], 0
jne 0x9d1e62
cmp dword [esp + 0x34], 0
je 0x9d1e75
push esi
push str._WEVT__Channel:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0xf0]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x9d1e90
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xb8]
call fcn.0085d720
cmp dword [esp + 0xcc], 8
mov ebx, dword [esp + 0xb8]
jae 0x9d1ec4
lea ebx, [esp + 0xb8]
call fcn.00970430
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x9d1f7d
push 8
push str.computer
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
call fcn.0085d360
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0x11
call fcn.009d5900
mov edx, esi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x9d1f11
sub edx, ebx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0x2c], 0x10
jb 0x9d1f3f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a7a9b9
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], edi
mov byte [esp + 0x18], 0
cmp dword [ebp + 8], edi
jne 0x9d1f5b
cmp dword [esp + 0x34], edi
je 0x9d1f6e
push esi
push str._WEVT__Computer:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x30]
cmp dword [esi + 0x10c], edi
je 0x9d2065
mov eax, dword [esi + 0x100]
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x48], edi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x9d2065
mov ebx, dword [esp + 0x40]
call fcn.00970430
mov esi, eax
test esi, esi
je 0x9d2054
push str.secuserid
lea ecx, [esp + 0x94]
call fcn.00901fd0
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0x12
call fcn.009d5900
mov edx, esi
lea ecx, [edx + 1]
lea esp, [esp]
mov bl, byte [edx]
inc edx
test bl, bl
jne 0x9d1ff0
sub edx, ecx
push edx
push esi
mov ecx, eax
call fcn.0085d360
mov byte [esp + 0xb88], 1
cmp dword [esp + 0xa8], 0x10
jb 0x9d2024
mov edx, dword [esp + 0x94]
push edx
call fcn.00a7a9b9
add esp, 4
cmp dword [ebp + 8], 0
jne 0x9d2031
cmp dword [esp + 0x34], 0
je 0x9d2044
push esi
push str._WEVT__UserSID:___s_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x30]
xor edi, edi
mov ecx, dword [esi]
push edi
push edi
push edi
push ecx
push edi
call dword [0xbdda70]
mov esi, eax
cmp esi, edi
jne 0x9d20c8
cmp dword [esp + 0xcc], 8
jb 0x9d2092
mov edx, dword [esp + 0xb8]
push edx
call fcn.00a7a9b9
add esp, 4
lea ecx, [esp + 0x54]
xor eax, eax
push ecx
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], edi
mov word [esp + 0xbc], ax
mov dword [esp + 0xb8c], 0xffffffff
call fcn.009d5a70
jmp 0x9d242a
push 0x103
lea edx, [esp + 0x559]
push edi
push edx
mov byte [esp + 0x560], 0
call fcn.00a7ffb0
mov eax, dword [esp + 0x80]
add esp, 0xc
mov ecx, esi
push eax
lea esi, [esp + 0xd4]
call fcn.009d0a80
add esp, 4
mov bl, 0x13
mov byte [esp + 0xb88], bl
cmp dword [esp + 0xe8], 0x10
mov eax, dword [esp + 0xd4]
jae 0x9d2120
lea eax, [esp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9d2123
sub eax, edx
inc eax
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
cmp esi, edi
je 0x9d2198
cmp dword [esp + 0xe8], 0x10
mov edx, dword [esp + 0xd4]
jae 0x9d2154
lea edx, [esp + 0xd4]
mov ecx, esi
mov al, byte [edx]
mov byte [ecx], al
inc edx
inc ecx
test al, al
jne 0x9d2156
push 0xaa1543
push 0xab76dc
push esi
call fcn.0095e130
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9d2178
sub eax, edx
push eax
push esi
lea ecx, [esp + 0xd8]
call fcn.0085d360
push esi
call fcn.00a78fec
add esp, 4
push 7
push str.message
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0xb8c], 0x14
call fcn.009d5900
push 0xffffffffffffffff
push edi
lea edx, [esp + 0xd8]
push edx
mov ecx, eax
call fcn.0085d280
mov byte [esp + 0xb88], bl
cmp dword [esp + 0x2c], 0x10
jb 0x9d21fc
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7a9b9
add esp, 4
mov ebx, dword [ebp + 8]
mov esi, dword [esp + 0x34]
cmp ebx, edi
jne 0x9d220f
cmp esi, edi
je 0x9d2394
cmp dword [esp + 0xe8], 0x10
mov eax, dword [esp + 0xd4]
jae 0x9d2227
lea eax, [esp + 0xd4]
push eax
push str._WEVT__Message:__s
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 8
cmp ebx, edi
jne 0x9d2246
cmp esi, edi
je 0x9d2394
mov ebx, dword [esp + 0x44]
push ebx
push str._EVENT_END___u_
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
push 0xaef428
mov eax, str.C:PROGRA2eScanLOGEventLog.log
call fcn.009d0d10
add esp, 0xc
cmp esi, edi
je 0x9d2394
cmp dword [esp + 0xe8], 0x10
mov ecx, dword [esp + 0xd4]
jae 0x9d228c
lea ecx, [esp + 0xd4]
lea esi, [esp + 0x554]
xor edx, edx
sub esi, ecx
mov al, byte [ecx]
cmp al, 0xd
je 0x9d22b2
cmp al, 0xa
je 0x9d22b2
test al, al
je 0x9d22b2
mov byte [esi + ecx], al
inc edx
inc ecx
cmp edx, 0x103
jl 0x9d2297
cmp edx, edi
jle 0x9d22d0
cmp byte [esp + edx + 0x553], 0x2e
lea edx, [esp + edx + 0x554]
jne 0x9d22cd
mov byte [edx - 1], 0
jmp 0x9d22d0
mov byte [edx], 0
cmp byte [esp + 0x65c], 0
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc0]
push edx
jne 0x9d2301
lea eax, [esp + 0x158]
push str.SYSTEM:_lu
push eax
mov ecx, 0x400
call fcn.009cf960
add esp, 0xc
jmp 0x9d2323
lea eax, [esp + 0x660]
push eax
lea ecx, [esp + 0x15c]
push str._s:_lu
push ecx
mov ecx, 0x400
call fcn.009cf960
add esp, 0x10
lea esi, [ebx + 0x61a8]
cmp esi, 0x7fff
jbe 0x9d234f
cmp dword [0xbdd4fc], edi
jne 0x9d234f
push esi
push ebx
push str._WEVT__WinEvent:_u___u__cannot_be_sent_as_it_is_above_32767__Set_WEvtSendLargeEvents1_if_DB_Support_available.
push str.C:PROGRA2eScanLOGEventLog.log
call fcn.0096a780
add esp, 0x10
jmp 0x9d2394
push ebx
lea edx, [esp + 0x868]
push str.Logged___u_
push edx
call fcn.00a78f30
add esp, 0xc
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x880]
push ecx
lea edx, [esp + 0x574]
push edx
push 0xaa154c
push edi
push esi
mov ecx, str.WinEvent
call fcn.00982e00
cmp dword [esp + 0xe8], 0x10
jb 0x9d23ae
mov eax, dword [esp + 0xd4]
push eax
call fcn.00a7a9b9
add esp, 4
cmp dword [esp + 0xcc], 8
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], edi
mov byte [esp + 0xd4], 0
jb 0x9d23e2
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.00a7a9b9
add esp, 4
xor edx, edx
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], edi
mov word [esp + 0xb8], dx
lea esi, [esp + 0x54]
mov dword [esp + 0xb88], 0x15
call fcn.009d5e10
mov dword [esp + 0xb88], 0xffffffff
mov eax, dword [esp + 0x54]
push eax
call fcn.00a7a9b9
add esp, 4
mov edi, dword [esp + 0x4c]
push edi
call dword [0xbdda68]
mov eax, dword [esp + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x9d2448
push eax
call fcn.00a78fec
add esp, 4
cmp dword [0xc089d8], ebx
je 0x9d245b
push 0xc117b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0xb80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb68]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret