Function at 0x42c2bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [esp], 0
call sym._EvtCreateBookmark_4
sub esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42c356
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_EvtCreateBookmark___bookmark___s__for___s__which_returned___lu_
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x128
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._EvtUpdateBookmark_8
sub esp, 8
test eax, eax
jne 0x42c3b6
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_EvtUpdateBookmark___bookmark___s__for___s__which_returned___lu_
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x131
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
lea eax, [ebp - 0x24]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._EvtRender_28
sub esp, 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42c407
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x7a
je 0x42c44e
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_EvtRender___to_get_buffer_size_to_update_bookmark___s__for___s__which_returned___lu_
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x142
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c4ca
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_calloc___memory_to_save_bookmark___s__for___s__which_returned____d____s__
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x14b
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._EvtRender_28
sub esp, 0x1c
test eax, eax
jne 0x42c54f
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_EvtRender___bookmark___s__for___s__which_returned___lu_
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x15b
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
mov eax, dword [ebp + 0xc]
add eax, 9
mov dword [esp + 4], 0x4f1632
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42c5ce
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_fopen___bookmark___s__for___s__which_returned____d____s__
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x163
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._mwarn
jmp 0x42c667
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fwrite
mov edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
jae 0x42c655
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_fwrite___to_bookmark___s__for___s__which_returned____d____s__
mov dword [esp + 8], global___func__.42
mov dword [esp + 4], 0x16d
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
jmp 0x42c667
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x1c], 0
je 0x42c686
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._EvtClose_4
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x42c697
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
leave
ret