Function at 0x4556f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.Security
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov ebx, eax
push ebx
push str.Security
push str.OpenEventLog__s__lu_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x18
mov ecx, 0x545d60
call fcn.00458190
test ebx, ebx
jne 0x455759
mov ecx, str.Failed_to_open_event_log_n
call fcn.00458190
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push esi
push edi
mov ecx, 0x10000
call fcn.00455630
mov esi, eax
mov dword [ebp - 8], 0
push 0x1000
push str.Security
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0xc], 0
call fcn.004bbd3d
add esp, 8
cmp eax, 0xee6
jbe 0x4557b6
push 0x561208
push 0x561418
push str._S_longname__s.log.evtx.z
push 0x1000
push 0x547d60
call fcn.00471220
add esp, 0x14
jmp 0x4557e0
push str.Security
push 0x561208
push 0x561418
push str._S__s__S.log.evtx.z
push 0x1000
push 0x547d60
call fcn.00471220
add esp, 0x18
lea esp, [esp]
push 0x10000
push 0
push esi
call fcn.004c13c0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x10000
push esi
push 0
push 5
push ebx
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
jne 0x4558a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x7a
jne 0x45585e
push dword [ebp - 0xc]
xor edi, edi
push esi
call fcn.004bb52a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x455837
mov esi, eax
jmp 0x4557e0
mov ecx, str.memory_reallocation_failed_while_reading_event_log_n
call fcn.00458190
test esi, esi
je 0x455855
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x4557e0
cmp edi, 0x26
je 0x4558dd
push edi
push str.ReadEventLog_failed_with__lu
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
test esi, esi
je 0x45589b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x4558dd
mov eax, dword [ebp - 8]
test eax, eax
je 0x4558da
mov ecx, 0x1210
cmp word [esi + 0x14], cx
jne 0x4558cf
push dword [esi]
mov edx, esi
mov ecx, 0x547d60
call fcn.00457d50
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, 0x1210
sub eax, dword [esi]
mov dword [ebp - 8], eax
je 0x4558da
add esi, dword [esi]
jmp 0x4558b0
mov esi, dword [ebp - 0x10]
test edi, edi
je 0x4557e0
test esi, esi
je 0x4558f9
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop edi
pop esi
test eax, eax
jne 0x455924
mov ecx, str.Failed_to_close_event_log_handle_n
call fcn.00458190
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret