Function at 0x421340
Capabilities:
Access the windows event log
Query environment variable
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1248
call fcn.00424a70
mov eax, dword [0x42c34c]
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, edx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x115c], eax
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1154], edx
mov dword [ebp - 0x1160], edx
mov dword [ebp - 0x1150], edx
jne 0x421396
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
call fcn.00424a57
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
cmp esi, reloc.ODBC32.dll_SQLAllocStmt
jne 0x4213b5
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
call fcn.00424a57
mov esp, ebp
pop ebp
ret 0x10
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x244]
rep stosd dword es:[edi], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x244]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test ebx, ebx
mov byte [ebp - 0x145], 0
je 0x42157a
mov edi, dword [sym.imp.MSVCR71.dll__strnicmp]
push 7
push str.distrib
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x421448
mov ecx, dword [str.ReplExceptDist.log]
mov edx, dword [0x42a864]
mov eax, dword [0x42a868]
mov dword [ebp - 0x44], ecx
mov ecx, dword [0x42a86c]
mov dword [ebp - 0x40], edx
mov dx, word [0x42a870]
mov dword [ebp - 0x3c], eax
mov al, byte [0x42a872]
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x34], dx
mov byte [ebp - 0x32], al
cmp byte [ebx], 0
je 0x4215a7
lea ecx, [ebp - 0x44]
push ecx
push esi
push ebx
jmp 0x4215b3
push 8
push str.snapshot
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x421470
mov ecx, 5
mov esi, str.ReplExceptSnapshot.log
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
jmp 0x421434
push 7
push str.logread
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x4214ba
mov ecx, dword [str.ReplExceptLogRdr.log]
mov edx, dword [0x42a820]
mov eax, dword [0x42a824]
mov dword [ebp - 0x44], ecx
mov ecx, dword [0x42a828]
mov dword [ebp - 0x40], edx
mov edx, dword [0x42a82c]
mov dword [ebp - 0x3c], eax
mov al, byte [0x42a830]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x30], al
jmp 0x421434
push 8
push str.replmerg
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x4214fc
mov ecx, dword [str.ReplExceptMerge.log]
mov edx, dword [0x42a800]
mov eax, dword [0x42a804]
mov dword [ebp - 0x44], ecx
mov ecx, dword [0x42a808]
mov dword [ebp - 0x40], edx
mov edx, dword [0x42a80c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
jmp 0x421434
push 8
push str.rdistcom
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x421548
mov eax, dword [str.ReplExceptDist.log]
mov ecx, dword [0x42a864]
mov edx, dword [0x42a868]
mov dword [ebp - 0x44], eax
mov eax, dword [0x42a86c]
mov dword [ebp - 0x40], ecx
mov cx, word [0x42a870]
mov dword [ebp - 0x3c], edx
mov dl, byte [0x42a872]
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], cx
mov byte [ebp - 0x32], dl
jmp 0x421434
mov eax, dword [str.ReplExcept.log]
mov ecx, dword [0x42a7e4]
mov edx, dword [0x42a7e8]
mov dword [ebp - 0x44], eax
mov ax, word [0x42a7ec]
mov dword [ebp - 0x40], ecx
mov cl, byte [0x42a7ee]
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x38], ax
mov byte [ebp - 0x36], cl
jmp 0x421434
mov edx, dword [str.ReplExcept.log]
mov eax, dword [0x42a7e4]
mov ecx, dword [0x42a7e8]
mov dword [ebp - 0x44], edx
mov dx, word [0x42a7ec]
mov dword [ebp - 0x40], eax
mov al, byte [0x42a7ee]
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x38], dx
mov byte [ebp - 0x36], al
lea eax, [ebp - 0x44]
push eax
push esi
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x344]
push str.The__s_executable_is_terminating_abnormally_because_it_hit_an_exception._Exception_Code__lx._Check_file__s_for_details.
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x14
push str.SQLSERVERAGENT
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x42161c
push 0
xor eax, eax
mov ecx, 0x10
lea edi, [ebp - 0x1248]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1248]
push ecx
push 0
push 1
push 0
push 0xc0000034
push 0
push 1
lea eax, [ebp - 0x344]
push esi
mov dword [ebp - 0x1248], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x42169f
lea edx, [ebp - 0x1164]
push edx
lea eax, [ebp - 0x244]
push eax
push 0
push str.SQLPath
push str.SOFTWAREMicrosoftMSSQLServerSetup
push reloc.ODBC32.dll_SQLAllocEnv
call fcn.00420bf0
add esp, 0x18
test eax, eax
jl 0x42169f
lea edi, [ebp - 0x244]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421655
mov ecx, dword [str.log_]
mov dx, word [0x42a728]
mov dword [edi], ecx
lea eax, [ebp - 0x44]
mov word [edi + 4], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421675
lea edi, [ebp - 0x244]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x421685
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4216b1
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
mov byte [ebp + eax - 0x244], cl
inc eax
test cl, cl
jne 0x4216a1
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x421c2e
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x421c2e
push ebx
call fcn.00420d00
add esp, 4
push 0
call dword [sym.imp.IMAGEHLP.dll_SymSetOptions]
push 0x800
lea ecx, [ebp - 0xc44]
push ecx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 1
lea edx, [ebp - 0xc44]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.IMAGEHLP.dll_SymInitialize]
test eax, eax
je 0x421c55
xor eax, eax
mov ecx, 0x29
lea edi, [ebp - 0x1208]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x115c]
mov esi, dword [eax + 4]
mov ecx, 0xb3
lea edi, [ebp - 0x114c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1094]
mov edx, dword [ebp - 0x1098]
mov eax, 3
mov dword [ebp - 0x1208], ecx
mov ecx, dword [ebp - 0x1088]
push 0x117
push 8
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x11f0], edx
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x11e4], ecx
mov dword [ebp - 0x11dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x1154], esi
je 0x421c34
xor eax, eax
mov ecx, 0x45
mov edi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x144]
stosb byte es:[edi], al
push str._r_n_r_n_r_nAn_exception_was_caught_r_nin
push edx
mov dword [esi], 0x18
mov dword [esi + 0x10], pe_nt_image_headers32
call dword [sym.imp.MSVCR71.dll_sprintf]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 8
push 0
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x144]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [ebp - 0x144]
push edx
push ebx
call edi
mov eax, dword [ebp - 0x1158]
test eax, eax
je 0x421839
cmp byte [eax], 0
je 0x421839
push 0
lea ecx, [ebp - 0x1150]
push ecx
push eax
call esi
mov edx, dword [ebp - 0x1158]
push eax
push edx
jmp 0x421867
push pe_nt_image_headers32
lea eax, [ebp - 0x244]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0x1150]
push ecx
lea edx, [ebp - 0x244]
push edx
call esi
push eax
lea eax, [ebp - 0x244]
push eax
push ebx
call edi
mov ecx, dword [ebp - 0x115c]
mov eax, dword [ecx]
test eax, eax
je 0x42187b
mov eax, dword [eax + 0xc]
jmp 0x42187d
xor eax, eax
push eax
lea edx, [ebp - 0x144]
push str._r_n_r_n_Exception_Address___08x_r_n
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x144]
push ecx
call esi
push eax
lea edx, [ebp - 0x144]
push edx
push ebx
call edi
mov eax, dword [ebp - 0x115c]
mov eax, dword [eax]
test eax, eax
je 0x4218c0
mov eax, dword [eax]
jmp 0x4218c2
xor eax, eax
push eax
lea ecx, [ebp - 0x144]
push str._Exception_Code___08x_r_n
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x1150]
push edx
lea eax, [ebp - 0x144]
push eax
call esi
push eax
lea ecx, [ebp - 0x144]
push ecx
push ebx
call edi
lea edx, [ebp - 0x144]
push str._r_n_r_n_r_nModule_Name_t_tReturn_Address_t_tLocation_r_n
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 8
push 0
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x144]
push ecx
call esi
push eax
lea edx, [ebp - 0x144]
push edx
push ebx
call edi
mov eax, dword [sym.imp.IMAGEHLP.dll_SymGetModuleBase]
mov ecx, dword [sym.imp.IMAGEHLP.dll_SymFunctionTableAccess]
mov edx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push eax
push ecx
push edx
lea eax, [ebp - 0x114c]
push eax
lea ecx, [ebp - 0x1208]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push 0x14c
call dword [sym.imp.IMAGEHLP.dll_StackWalk]
test eax, eax
je 0x421c20
mov edx, dword [ebp - 0x1208]
mov eax, dword [ebp - 0x1154]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x1208]
xor eax, eax
mov ecx, 0x8e
lea edi, [ebp - 0xe7c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0xe80]
push ecx
push edx
mov dword [ebp - 0xe80], 0x23c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.IMAGEHLP.dll_SymGetModuleInfo]
test eax, eax
je 0x421a5c
lea eax, [ebp - 0xe64]
lea edx, [eax + 1]
jmp 0x4219c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4219c0
sub eax, edx
mov dword [ebp - 0x1164], eax
jne 0x421a1e
mov eax, dword [str._No_Module_Info__t_t]
mov ecx, dword [0x42a604]
mov edx, dword [0x42a608]
mov dword [ebp - 0x144], eax
mov eax, dword [0x42a60c]
mov dword [ebp - 0x140], ecx
mov cx, word [0x42a610]
mov dword [ebp - 0x13c], edx
mov dl, byte [0x42a612]
mov dword [ebp - 0x138], eax
mov word [ebp - 0x134], cx
mov byte [ebp - 0x132], dl
jmp 0x421aa4
xor eax, eax
mov cl, byte [ebp + eax - 0xe64]
mov byte [ebp + eax - 0x144], cl
inc eax
test cl, cl
jne 0x421a20
lea edi, [ebp - 0x144]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421a40
mov ax, word [0x42a5fc]
mov cl, byte [0x42a5fe]
mov word [edi], ax
mov byte [edi + 2], cl
jmp 0x421aa4
mov edx, dword [str._No_Module_Info__t_t]
mov eax, dword [0x42a604]
mov ecx, dword [0x42a608]
mov dword [ebp - 0x144], edx
mov edx, dword [0x42a60c]
mov dword [ebp - 0x140], eax
mov ax, word [0x42a610]
mov dword [ebp - 0x13c], ecx
mov cl, byte [0x42a612]
mov dword [ebp - 0x138], edx
mov word [ebp - 0x134], ax
mov byte [ebp - 0x132], cl
push 0
lea edx, [ebp - 0x1150]
push edx
lea eax, [ebp - 0x144]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea ecx, [ebp - 0x144]
push ecx
push ebx
call edi
mov edx, dword [ebp - 0x1154]
mov ecx, dword [ebp - 0x1208]
push edx
lea eax, [ebp - 0x1160]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.IMAGEHLP.dll_SymGetSymFromAddr]
mov edx, dword [ebp - 0x11fc]
push edx
mov dword [ebp - 0x1158], eax
lea eax, [ebp - 0x144]
push str._08x_t_t
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x1150]
push ecx
lea edx, [ebp - 0x144]
push edx
call esi
push eax
lea eax, [ebp - 0x144]
push eax
push ebx
call edi
mov eax, dword [ebp - 0x1158]
test eax, eax
je 0x421bcc
mov edx, dword [ebp - 0x1154]
push pe_nt_image_headers32
lea ecx, [ebp - 0x444]
push ecx
push edx
call dword [sym.imp.IMAGEHLP.dll_SymUnDName]
test eax, eax
je 0x421c05
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x144]
push 0x42a5f0
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x1150]
push edx
lea eax, [ebp - 0x144]
push eax
call esi
push eax
lea ecx, [ebp - 0x144]
push ecx
push ebx
call edi
mov eax, dword [ebp - 0x1160]
test eax, eax
je 0x421c05
push eax
lea edx, [ebp - 0x144]
push str.___x
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x144]
push ecx
call esi
push eax
lea edx, [ebp - 0x144]
push edx
jmp 0x421c02
mov eax, dword [ebp - 0x1208]
push eax
lea ecx, [ebp - 0x144]
push str._08x
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x1150]
push edx
lea eax, [ebp - 0x144]
push eax
call esi
push eax
lea ecx, [ebp - 0x144]
push ecx
push ebx
call edi
push 0
lea edx, [ebp - 0x1150]
push edx
push 0x42a5dc
call esi
push eax
push 0x42a5dc
jmp 0x421924
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1154]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.IMAGEHLP.dll_SymCleanup]
test esi, esi
je 0x421c55
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.00424a57
mov esp, ebp
pop ebp
ret 0x10