Function at 0x1007901
Capabilities:
Access the windows event log

Disassembly:
push 0x80
push 0x10019e0
call fcn.01009f68
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
or ebx, 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov edi, dword [ebp + 8]
push edi
call fcn.01003275
test eax, eax
jne 0x100795c
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 1
jne 0x10079ec
push 1
push edi
call fcn.0100439d
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
cmp eax, ebx
jne 0x100797f
cmp edx, ebx
jne 0x100797f
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], 1
jne 0x10079ec
push edi
call fcn.01006832
lea eax, [ebp - 0x28]
push eax
push esi
cmp dword [edi + 0x4ec], 4
jne 0x100799c
push ebx
jmp 0x100799d
push esi
call sub.pdh.dll_PdhOpenQueryH
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10079ec
lea ecx, [edi + 0xbc]
mov dword [ebp - 0x90], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x90]
push eax
push 4
push 2
push esi
push 0x8000080a
push esi
push 2
push dword [0x1012b30]
mov ebx, dword [sym.imp.ADVAPI32.dll_ReportEventW]
call ebx
mov dword [ebp - 0x1c], esi
jmp 0x10079f2
mov ebx, dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [ebp - 0x1c], 1
jne 0x1007cc3
mov dword [ebp - 0x30], esi
mov eax, dword [edi + 0x4d8]
mov dword [ebp - 0x2c], eax
cmp word [eax], si
je 0x1007a3f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x34], eax
add dword [ebp - 0x34], 0x18
push dword [ebp - 0x34]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x24], eax
cmp eax, esi
jne 0x1007a65
mov dword [ebp - 0x38], 0x80000809
cmp dword [ebp - 0x38], esi
jne 0x1007c43
cmp dword [ebp - 0x30], esi
jbe 0x1007c16
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1007c6e
lea ecx, [ebp - 0x34]
push ecx
push eax
push dword [ebp - 0x2c]
call fcn.010093bd
test eax, eax
je 0x1007bb9
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
push dword [eax + 4]
push dword [ebp - 0x28]
call sub.pdh.dll_PdhAdd009CounterW
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1007aae
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
push dword [eax + 4]
push dword [ebp - 0x28]
call sub.pdh.dll_PdhAddCounterW
mov dword [ebp - 0x20], eax
mov edx, eax
mov ecx, 0xc0000000
and edx, ecx
cmp edx, ecx
je 0x1007b62
inc dword [ebp - 0x30]
cmp eax, esi
je 0x1007b07
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x90], ecx
lea ecx, [edi + 0xbc]
mov dword [ebp - 0x8c], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x90]
push eax
push 4
push 3
push esi
push 0x800007f3
push esi
push 2
push dword [0x1012b30]
call ebx
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x40], eax
cmp eax, esi
je 0x1007b42
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
lea ecx, [edi + 0x4dc]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], esi
jmp 0x1007bfe
mov dword [ebp - 0x38], 0x80000809
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x24], esi
jmp 0x1007a3f
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x90], ecx
lea ecx, [edi + 0xbc]
mov dword [ebp - 0x8c], ecx
push eax
call fcn.010026b9
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x20], 0xc0000bdb
jne 0x1007ba2
push esi
lea eax, [ebp - 0x90]
push eax
push esi
push 2
push esi
push 0x800007fe
jmp 0x1007bdf
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x90]
push eax
push 4
push 3
push esi
push 0x800007ec
jmp 0x1007bdf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [edi + 0xbc]
mov dword [ebp - 0x8c], eax
push esi
lea eax, [ebp - 0x90]
push eax
push esi
push 2
push esi
push 0x800007ee
push esi
push 2
push dword [0x1012b30]
call ebx
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x24], esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 0x2c], eax
jmp 0x1007a08
mov dword [ebp - 0x1c], esi
lea eax, [edi + 0xbc]
mov dword [ebp - 0x90], eax
push esi
lea eax, [ebp - 0x90]
push eax
push esi
push 1
push esi
push 0x800007ed
push esi
push 2
push dword [0x1012b30]
call ebx
jmp 0x1007c6e
lea eax, [edi + 0xbc]
mov dword [ebp - 0x90], eax
push esi
lea eax, [ebp - 0x90]
push eax
push esi
push 1
push esi
push 0x80000809
push esi
push 2
push dword [0x1012b30]
call ebx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], esi
je 0x1007cb8
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x78], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x54]
cmp eax, esi
jl 0x1007cd3
mov ecx, dword [ebp - 0x58]
jg 0x1007c8f
cmp ecx, esi
jbe 0x1007cd3
neg ecx
adc eax, esi
neg eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
push eax
push esi
push 1
lea eax, [ebp - 0x78]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
je 0x1007cd3
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x28]
call sub.pdh.dll_PdhCloseQuery
mov dword [ebp - 0x28], esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
jmp 0x1007eb8
lea eax, [edi + 0x9c]
mov dword [eax], 1
push 4
push eax
push 0x1001544
push dword [edi + 8]
call fcn.01002a4f
mov dword [ebp - 0x38], eax
lea eax, [edi + 0xbc]
mov dword [ebp - 0x90], eax
push esi
lea eax, [ebp - 0x90]
push eax
push esi
push 1
push esi
push 0x400007f5
push esi
push 4
push dword [0x1012b30]
call ebx
lea eax, [ebp - 0x48]
push eax
push 1
push edi
call fcn.01006b3c
cmp dword [ebp - 0x48], 0xffffffff
jne 0x1007d36
cmp dword [ebp - 0x44], 0xffffffff
je 0x1007dec
lea eax, [ebp - 0x50]
push eax
push esi
push 1
lea eax, [ebp - 0x78]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x102
jne 0x1007dc6
lea eax, [ebp - 0x70]
push eax
call fcn.01009395
cmp dword [edi + 0x4d0], esi
jne 0x1007dc3
push dword [ebp - 0x28]
call sub.pdh.dll_PdhCollectQueryData
mov dword [ebp - 0x20], eax
push eax
call fcn.01006a22
test eax, eax
jne 0x1007e07
mov eax, dword [ebp - 0x20]
and eax, 0xc0000000
cmp eax, 0x80000000
je 0x1007e07
lea eax, [edi + 0xbc]
mov dword [ebp - 0x90], eax
push dword [ebp - 0x20]
call fcn.010026b9
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x90]
push eax
push 4
push 2
push esi
push 0x800007f2
push esi
push 2
push dword [0x1012b30]
call ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
cmp dword [edi + 0x4d0], esi
jne 0x1007de9
lea eax, [ebp - 0x50]
push eax
push esi
push dword [edi + 0xc]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, 0x102
je 0x1007dec
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], esi
je 0x1007cb8
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.01006bcb
mov dword [ebp - 0x1c], eax
jmp 0x1007c6e
cmp dword [ebp - 0x20], esi
jne 0x1007e12
push edi
call fcn.010075ff
cmp dword [ebp - 0x48], esi
jne 0x1007e1c
cmp dword [ebp - 0x44], esi
je 0x1007e2c
add dword [ebp - 0x48], 0xffffffff
adc dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0x44]
je 0x1007dc6
lea eax, [ebp - 0x68]
push eax
call fcn.01009395
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x64]
sbb ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x5c], ecx
mov eax, dword [edi + 0x4f4]
mov edx, 0x2710
mul edx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
cmp ecx, edx
jg 0x1007e6f
jl 0x1007e65
cmp dword [ebp - 0x60], eax
jae 0x1007e6f
sub eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x7c]
sbb edx, ecx
jmp 0x1007e73
xor eax, eax
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
neg eax
adc edx, esi
neg edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
jmp 0x1007d36
push edi
call fcn.01003818
jmp 0x1007ef3
mov ebx, dword [edi + 0x4dc]
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x1007edc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebx]
mov dword [edi + 0x4dc], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [edi + 0x4dc], esi
jne 0x1007ec0
mov eax, dword [ebp - 0x1c]
call fcn.01009fa3
ret 4