Function at 0x42e7c0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1002c
call fcn.004c79c0
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x58
xor ebx, ebx
mov edi, ecx
push ebx
push edi
mov esi, edx
call fcn.004ca440
add esp, 0xc
lea eax, [ebp - 0x10018]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x10018]
mov dword [edi], eax
mov eax, dword [ebp - 0x10014]
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x50], eax
mov eax, dword [edi]
mov dword [edi + 0x48], eax
mov eax, dword [edi + 4]
push esi
push str.OldestFile:__s_n
mov dword [edi + 0x4c], eax
call fcn.0041e910
add esp, 8
push str.System
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [ebp - 0x10010], eax
test eax, eax
je 0x42eb30
lea ecx, [ebp - 0x1002c]
push ecx
lea ecx, [ebp - 0x1001c]
push ecx
push 0x10000
lea ecx, [ebp - 0x10008]
push ecx
push 0
push 9
push eax
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
je 0x42eb1a
mov eax, dword [ebp - 0x1001c]
lea ecx, [ebp - 0x10008]
add eax, ecx
mov esi, ecx
mov dword [ebp - 0x10020], eax
cmp ecx, eax
mov eax, dword [ebp - 0x10010]
jae 0x42e852
nop
cmp dword [esi + 4], 0x654c664c
jne 0x42eb07
movzx ecx, word [esi + 0x14]
lea eax, [esi + 0x38]
mov dword [ebp - 0x1000c], ecx
cmp ecx, 1
jne 0x42e915
push str.Microsoft_Windows_Kernel_General
push eax
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42e8e4
mov edx, edi
mov ecx, esi
call fcn.0042e520
mov ebx, eax
test ebx, ebx
jne 0x42eb22
lea ecx, [esi + 0x38]
push str.Microsoft_Windows_Power_Troubleshooter
push ecx
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42e9cf
mov edx, edi
mov ecx, esi
call fcn.0042e670
mov ebx, eax
test ebx, ebx
jne 0x42eb22
jmp 0x42e9cf
cmp ecx, 0xc
jne 0x42e94d
push str.Microsoft_Windows_Kernel_General
push eax
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42e9cf
push 1
mov edx, edi
mov ecx, esi
call fcn.0042e3b0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42eb22
jmp 0x42e9cf
cmp ecx, 0xd
jne 0x42e9d8
push str.Microsoft_Windows_Kernel_General
push eax
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42e9cf
mov eax, dword [esi + 0x24]
lea edx, [ebp - 0x10028]
xor ecx, ecx
add eax, esi
cmp cx, word [esi + 0x1a]
xorps xmm0, xmm0
movlpd qword [ebp - 0x10028], xmm0
sbb ebx, ebx
and ebx, eax
mov ecx, ebx
call fcn.0042e1e0
test eax, eax
jne 0x42eae1
mov eax, dword [edi + 0x54]
test al, 1
je 0x42eace
push ebx
push 0x52e110
and eax, 0xfffffffe
push str.Time:_____s___s__n_n
mov dword [edi + 0x54], eax
call fcn.0041e910
mov eax, dword [ebp - 0x10028]
add esp, 0xc
mov dword [edi + 0x48], eax
xor ebx, ebx
mov eax, dword [ebp - 0x10024]
mov dword [edi + 0x4c], eax
mov ecx, dword [ebp - 0x1000c]
lea eax, [esi + 0x38]
cmp dword [0x576b50], 0x600
ja 0x42eaa5
cmp ecx, 0x1779
jne 0x42ea18
push str.EventLog
push eax
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42eaa5
push eax
mov edx, edi
mov ecx, esi
call fcn.0042e3b0
add esp, 4
jmp 0x42eaa1
cmp ecx, 0x1776
jne 0x42eaa5
push str.EventLog
push eax
call fcn.004ce01a
add esp, 8
test eax, eax
jne 0x42eaa5
mov eax, dword [esi + 0xc]
mov ecx, 0x3e8
mul ecx
push 0
add eax, 0x30b66800
push 0x2710
adc edx, 0xa97
push edx
push eax
call fcn.004c7f50
mov dword [ebp - 0x10018], eax
mov eax, dword [edi + 0x54]
mov dword [ebp - 0x10014], edx
test al, 1
jne 0x42ea73
mov eax, 0x23d
jmp 0x42eaa1
push 0
push 0x52e110
and eax, 0xfffffffe
push str.Time:_____s___s__n_n
mov dword [edi + 0x54], eax
call fcn.0041e910
mov eax, dword [ebp - 0x10018]
add esp, 0xc
mov dword [edi + 0x48], eax
mov eax, dword [ebp - 0x10014]
mov dword [edi + 0x4c], eax
xor eax, eax
cmp ebx, eax
je 0x42eabf
test byte [edi + 0x1c], 1
je 0x42eab1
test byte [edi + 0x3c], 1
jne 0x42eaf4
add esi, dword [esi]
cmp esi, dword [ebp - 0x10020]
jb 0x42e8a0
test ebx, ebx
jne 0x42eb22
mov eax, dword [ebp - 0x10010]
jmp 0x42e852
push dword [ebp - 0x10010]
mov ebx, 0x23d
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x42eb38
push dword [ebp - 0x10010]
mov ebx, 0xb
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x42eb38
push dword [ebp - 0x10010]
mov ebx, 0x10007
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x42eb38
push dword [ebp - 0x10010]
mov ebx, 0x570
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x42eb38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [ebp - 0x10010]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x42eb38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor ecx, ecx
mov eax, 2
cmp ebx, 0x10007
pop edi
cmove eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret