Function at 0x44c7c0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
mov dword [esp + 8], str.Application
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], str.System
xor ebx, ebx
mov dword [esp + 0x14], str.Security
mov edx, eax
mov dword [esp + 4], eax
cmp ecx, edx
push esi
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 3
push edi
mov dword [esp + 0x10], ecx
nop dword [eax]
mov edi, dword [eax]
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov esi, eax
test esi, esi
je 0x44c8be
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
test eax, eax
jne 0x44c87f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_clear_event_log
push 0x451d00
push eax
call fcn.004518c0
mov edx, edi
mov ecx, eax
call fcn.004518c0
mov edx, 0x5f2ad0
mov ecx, eax
call fcn.004518c0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x44c8ff
push 0x451d00
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Event_log
call fcn.004518c0
mov edx, edi
mov ecx, eax
call fcn.004518c0
mov edx, str._cleared_successfully
mov ecx, eax
call fcn.004518c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x44c8ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_event_log
push 0x451d00
push eax
call fcn.004518c0
mov edx, edi
mov ecx, eax
call fcn.004518c0
mov edx, str.._Error_code:
mov ecx, eax
call fcn.004518c0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [esp + 0xc]
inc ebx
add eax, 4
mov dword [esp + 0xc], eax
cmp ebx, dword [esp + 0x10]
jne 0x44c810
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00579e58
mov esp, ebp
pop ebp
ret