Function at 0x1033610
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov word [rsp + 0x10], dx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1590
call fcn.0105ee40
sub rsp, rax
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0x1580], rax
movzx eax, word [0x01001c38]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x1390], ax
lea rax, [rsp + 0x1392]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x1520], ax
lea rax, [rsp + 0x1522]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x870], ax
lea rax, [rsp + 0x872]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x470], ax
lea rax, [rsp + 0x472]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xd80], ax
lea rax, [rsp + 0xd82]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xc80], ax
lea rax, [rsp + 0xc82]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x1380], 0
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1544], 0
mov dword [rsp + 0x151c], 0
mov dword [rsp + 0xc78], 0
mov dword [rsp + 0xc74], 0
mov dword [rsp + 0x1514], 0
mov dword [rsp + 0x460], 0
mov dword [rsp + 0xc70], 0
mov dword [rsp + 0x1540], 0
mov dword [rsp + 0x1510], 0
mov r9d, 0x80
lea r8, [rsp + 0xc80]
mov edx, 0x17
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x80
xor edx, edx
lea rcx, [rsp + 0x1490]
call sub.MSVCR80.dll_memset
mov r8d, 0x200
xor edx, edx
lea rcx, [rsp + 0x1180]
call sub.MSVCR80.dll_memset
mov eax, dword [rsp + 0x15b8]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x460], eax
mov eax, dword [rsp + 0x460]
shl eax, 1
cmp eax, dword [rsp + 0x15b8]
je 0x1033828
jmp 0x1033f73
lea rax, [rsp + 0x15c0]
mov qword [rsp + 0x1388], rax
mov dword [rsp + 0xc78], 0
jmp 0x1033856
mov eax, dword [rsp + 0xc78]
add eax, 1
mov dword [rsp + 0xc78], eax
mov eax, dword [rsp + 0x460]
cmp dword [rsp + 0xc78], eax
jge 0x1033a5a
movsxd rax, dword [rsp + 0xc78]
cmp rax, 0x10
jae 0x1033a5a
xor eax, eax
test eax, eax
je 0x10338ad
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov eax, dword [rax]
mov dword [rsp + 0x1558], eax
jmp 0x10338d3
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov eax, dword [rax - 8]
mov dword [rsp + 0x1558], eax
mov eax, dword [rsp + 0x1558]
mov dword [rsp + 0xc70], eax
mov eax, dword [rsp + 0xc70]
mov dword [rsp + 0x155c], eax
cmp dword [rsp + 0x155c], 1
je 0x103390c
cmp dword [rsp + 0x155c], 2
je 0x10339d8
jmp 0x1033a55
xor eax, eax
test eax, eax
je 0x103393d
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov eax, dword [rax]
mov dword [rsp + 0x1560], eax
jmp 0x1033963
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov eax, dword [rax - 8]
mov dword [rsp + 0x1560], eax
mov eax, dword [rsp + 0x1560]
mov dword [rsp + 0x1514], eax
movsxd rax, dword [rsp + 0xc74]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x1180]
mov r9d, dword [rsp + 0x1514]
lea r8, [0x01001e68]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
mov rcx, rax
call fcn.01015ef0
movsxd rax, dword [rsp + 0xc74]
imul rax, rax, 0x20
lea rax, [rsp + rax + 0x1180]
movsxd rcx, dword [rsp + 0xc78]
mov qword [rsp + rcx*8 + 0x1490], rax
mov eax, dword [rsp + 0xc74]
add eax, 1
mov dword [rsp + 0xc74], eax
jmp 0x1033a55
xor eax, eax
test eax, eax
je 0x1033a0b
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov rax, qword [rax]
mov qword [rsp + 0x1568], rax
jmp 0x1033a33
mov rax, qword [rsp + 0x1388]
add rax, 8
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov rax, qword [rax - 8]
mov qword [rsp + 0x1568], rax
mov rax, qword [rsp + 0x1568]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0xc78]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + rax*8 + 0x1490], rcx
jmp 0x1033845
mov qword [rsp + 0x1388], 0
movzx eax, word [rsp + 0x15a8]
mov dword [rsp + 0x1570], eax
cmp dword [rsp + 0x1570], 1
je 0x1033a98
cmp dword [rsp + 0x1570], 2
je 0x1033ad2
cmp dword [rsp + 0x1570], 4
je 0x1033b09
jmp 0x1033b40
mov r9d, 0x21
lea r8, [0x01002384]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01015ef0
mov dword [rsp + 0x1518], 1
mov dword [rsp + 0x1380], 0x10
jmp 0x1033b75
mov r9d, 0x2b
lea r8, [0x01002384]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01015ef0
mov dword [rsp + 0x1518], 2
mov dword [rsp + 0x1380], 0x30
jmp 0x1033b75
mov r9d, 0x3f
lea r8, [0x01002384]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01015ef0
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1380], 0x40
jmp 0x1033b75
mov r9d, 0x3f
lea r8, [0x01002384]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
lea rcx, [rsp + 0x1520]
call fcn.01015ef0
mov dword [rsp + 0x1518], 3
mov dword [rsp + 0x1380], 0x40
mov eax, dword [rsp + 0x15a0]
and eax, 1
test eax, eax
je 0x1033c85
lea rcx, [0x01065b28]
call qword [0x01068178]
test eax, eax
jne 0x1033bcb
cmp dword [0x010679c0], 0
je 0x1033bbe
cmp dword [0x01067484], 0
je 0x1033bbe
lea rdx, [0x01007c30]
lea rcx, [0x01001b70]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065b28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010679c0], 0
je 0x1033bf1
cmp dword [0x01067484], 0
je 0x1033bf1
lea rdx, [0x01007c30]
lea rcx, [0x01001b38]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov ecx, dword [rsp + 0x15b0]
call fcn.01035650
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x1490]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
movzx ecx, word [rsp + 0x460]
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x15b0]
movzx r8d, ax
movzx edx, word [rsp + 0x15a8]
mov rcx, qword [0x010679b8]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
lea rcx, [0x01065b28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010679c0], 0
je 0x1033c85
cmp dword [0x01067484], 0
je 0x1033c85
lea rdx, [0x01007c30]
lea rcx, [0x01001b00]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov eax, dword [rsp + 0x15a0]
and eax, 2
test eax, eax
je 0x1033f73
mov qword [rsp + 0x1548], 0
mov qword [rsp + 0x1550], 0
mov qword [rsp + 0x1548], 0
mov qword [rsp + 0x1550], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x1490]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x15b0]
mov rdx, qword [0x01065df8]
mov ecx, 0x2800
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [rsp + 0x1544], eax
cmp dword [rsp + 0x1544], 0
jne 0x1033d98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x151c], eax
mov r8d, 0x400
lea rdx, [rsp + 0xd80]
mov ecx, dword [rsp + 0x151c]
call fcn.010529a0
movzx eax, word [rsp + 0xd80]
test eax, eax
je 0x1033d61
lea rax, [rsp + 0xd80]
mov qword [rsp + 0x1578], rax
jmp 0x1033d71
lea rax, [rsp + 0xc80]
mov qword [rsp + 0x1578], rax
mov rax, qword [rsp + 0x1578]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x15b0]
mov r8d, 0x173
xor edx, edx
mov ecx, 1
call fcn.01033fa0
cmp qword [rsp + 0x1548], 0
je 0x1033db0
mov rcx, qword [rsp + 0x1548]
call fcn.01015550
cmp qword [rsp + 0x1550], 0
je 0x1033dc8
mov rcx, qword [rsp + 0x1550]
call fcn.01015550
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dword [rsp + 0x1540], 0
jmp 0x1033df1
mov eax, dword [rsp + 0x1540]
add eax, 1
mov dword [rsp + 0x1540], eax
movsxd rax, dword [rsp + 0x1540]
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0xa
je 0x1033e15
movsxd rax, dword [rsp + 0x1540]
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0xd
jne 0x1033e19
jmp 0x1033de0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll__wcsrev]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wcslen]
movsxd rcx, dword [rsp + 0x1540]
sub rax, rcx
mov word [rsp + rax*2 + 0x60], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov dword [rsp + 0x1510], eax
cmp dword [rsp + 0x1510], 3
jl 0x1033eb2
mov eax, dword [rsp + 0x1510]
sub eax, 1
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
jne 0x1033eb2
mov eax, dword [rsp + 0x1510]
sub eax, 2
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
je 0x1033eb2
mov eax, dword [rsp + 0x1510]
sub eax, 3
cdqe
movzx eax, word [rsp + rax*2 + 0x60]
cmp eax, 0x2e
je 0x1033eb2
mov eax, dword [rsp + 0x1510]
sub eax, 1
cdqe
mov word [rsp + rax*2 + 0x60], 0
movzx eax, word [rsp + 0x60]
test eax, eax
je 0x1033f07
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1520]
lea r8, [0x01007c18]
mov edx, 0x200
lea rcx, [rsp + 0x870]
call fcn.01015ef0
mov word [rsp + 0xc6e], 0
mov r8d, dword [rsp + 0x1518]
xor edx, edx
lea rcx, [rsp + 0x870]
call fcn.01034220
mov eax, dword [rsp + 0x15a0]
and eax, 4
test eax, eax
je 0x1033f73
mov r9d, 0x200
lea r8, [rsp + 0x470]
mov edx, 0x4b
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x01067e30]
lea r8, [rsp + 0x470]
mov edx, 0x80
lea rcx, [rsp + 0x1390]
call fcn.01015ef0
mov r9d, dword [rsp + 0x1380]
lea r8, [rsp + 0x1390]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x1580]
xor rcx, rsp
call fcn.010588f0
add rsp, 0x1590
pop rdi
ret