Function at 0x646156af
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x646170a0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [esp + 0x18], 0
add esp, 0xc
xor esi, esi
mov eax, dword [0x64617004]
mov edi, 0x64617004
mov ecx, 0x64603fd0
cmp eax, edi
je 0x64615722
test byte [eax + 0x1c], 2
je 0x64615722
cmp byte [eax + 0x19], 5
jb 0x64615722
push dword [eax + 0x14]
mov edx, ecx
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.64604423
mov eax, dword [0x64617004]
mov ecx, 0x64603fd0
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x40
jbe 0x64615751
cmp eax, edi
je 0x6461574a
test byte [eax + 0x1c], 2
je 0x6461574a
cmp byte [eax + 0x19], 2
jb 0x6461574a
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
mov edx, ecx
pop ecx
call fcn.64604423
xor eax, eax
jmp 0x6461590c
cmp dword [0x64617474], esi
jne 0x64615773
cmp eax, edi
je 0x6461574a
test byte [eax + 0x1c], 2
je 0x6461574a
cmp byte [eax + 0x19], 3
jb 0x6461574a
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
jmp 0x64615742
push 0x64617454
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x64617478]
xor ecx, ecx
test edx, edx
je 0x646157b1
mov eax, dword [0x64617450]
mov edi, dword [ebp + 0xc]
add eax, 8
mov ebx, dword [ebp + 8]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp + 0x10]
jne 0x646157a4
cmp edi, dword [eax]
ja 0x646157fe
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x64615795
mov edi, 0x64617004
xor ecx, ecx
test ebx, ebx
je 0x646157d4
lea edx, [ebp + 0x14]
lea edx, [edx + 4]
mov eax, dword [edx]
mov dword [esp + ecx*4 + 0x10], eax
test eax, eax
jne 0x646157cf
mov dword [esp + ecx*4 + 0x10], 0x646012dc
inc ecx
cmp ecx, ebx
jb 0x646157ba
mov eax, dword [ebp + 0x14]
shr eax, 0x1e
cmp eax, 1
jbe 0x64615896
push 2
pop edx
cmp eax, edx
je 0x6461588c
cmp eax, 3
jne 0x6461580e
xor edi, edi
inc edi
inc dword [0x64617470]
jmp 0x6461583a
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x6461574a
mov ecx, dword [0x64617004]
cmp ecx, edi
je 0x64615836
test byte [ecx + 0x1c], dl
je 0x64615836
cmp byte [ecx + 0x19], dl
jb 0x64615836
push eax
push dword [ecx + 0x14]
mov edx, 0x64603fd0
push dword [ecx + 0x10]
push 0x17
pop ecx
call fcn.64604441
mov edi, dword [esp + 0xc]
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 1
je 0x646158ae
sub eax, 1
je 0x646158a9
sub eax, 1
je 0x646158a5
sub eax, 1
je 0x646158a1
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646158b1
test byte [eax + 0x1c], 2
je 0x646158b1
cmp byte [eax + 0x19], 2
jb 0x646158b1
push ecx
push dword [eax + 0x14]
mov edx, 0x64603fd0
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.64604441
jmp 0x646158b1
inc dword [0x6461747c]
mov edi, edx
jmp 0x6461583a
inc dword [0x6461746c]
push 4
pop edi
jmp 0x6461583a
push 4
jmp 0x646158ab
push 3
jmp 0x646158ab
push 2
pop esi
jmp 0x646158b1
xor esi, esi
inc esi
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
push ebx
push ecx
push dword [ebp + 0x14]
push esi
push edi
push dword [0x64617474]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x64615909
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64615909
test byte [eax + 0x1c], 2
je 0x64615909
cmp byte [eax + 0x19], 2
jb 0x64615909
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x64617004]
mov edx, 0x64603fd0
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x19
pop ecx
call fcn.64604441
xor eax, eax
inc eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.64615f50
mov esp, ebp
pop ebp
ret