Function at 0x64615542
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x646170a0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [esp + 0x18], 0
add esp, 0xc
xor esi, esi
mov eax, dword [0x64617004]
mov edi, 0x64617004
mov ecx, 0x64603fe0
cmp eax, edi
je 0x646155b5
test byte [eax + 0x1c], 2
je 0x646155b5
cmp byte [eax + 0x19], 5
jb 0x646155b5
push dword [eax + 0x14]
mov edx, ecx
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.64604453
mov eax, dword [0x64617004]
mov ecx, 0x64603fe0
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x40
jbe 0x646155d7
cmp eax, edi
je 0x646155ff
test byte [eax + 0x1c], 2
je 0x646155ff
cmp byte [eax + 0x19], 2
jb 0x646155ff
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
jmp 0x646155f7
cmp dword [0x64617474], esi
jne 0x64615606
cmp eax, edi
je 0x646155ff
test byte [eax + 0x1c], 2
je 0x646155ff
cmp byte [eax + 0x19], 3
jb 0x646155ff
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
mov edx, ecx
pop ecx
call fcn.64604453
xor eax, eax
jmp 0x6461579f
push 0x64617454
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x64617478]
xor ecx, ecx
test edx, edx
je 0x64615644
mov eax, dword [0x64617450]
mov edi, dword [ebp + 0xc]
add eax, 8
mov ebx, dword [ebp + 8]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp + 0x10]
jne 0x64615637
cmp edi, dword [eax]
ja 0x64615691
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x64615628
mov edi, 0x64617004
xor ecx, ecx
test ebx, ebx
je 0x64615667
lea edx, [ebp + 0x14]
lea edx, [edx + 4]
mov eax, dword [edx]
mov dword [esp + ecx*4 + 0x10], eax
test eax, eax
jne 0x64615662
mov dword [esp + ecx*4 + 0x10], 0x646012ec
inc ecx
cmp ecx, ebx
jb 0x6461564d
mov eax, dword [ebp + 0x14]
shr eax, 0x1e
cmp eax, 1
jbe 0x64615729
push 2
pop edx
cmp eax, edx
je 0x6461571f
cmp eax, 3
jne 0x646156a1
xor edi, edi
inc edi
inc dword [0x64617470]
jmp 0x646156cd
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x646155ff
mov ecx, dword [0x64617004]
cmp ecx, edi
je 0x646156c9
test byte [ecx + 0x1c], dl
je 0x646156c9
cmp byte [ecx + 0x19], dl
jb 0x646156c9
push eax
push dword [ecx + 0x14]
mov edx, 0x64603fe0
push dword [ecx + 0x10]
push 0x17
pop ecx
call fcn.64604471
mov edi, dword [esp + 0xc]
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 1
je 0x64615741
sub eax, 1
je 0x6461573c
sub eax, 1
je 0x64615738
sub eax, 1
je 0x64615734
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64615744
test byte [eax + 0x1c], 2
je 0x64615744
cmp byte [eax + 0x19], 2
jb 0x64615744
push ecx
push dword [eax + 0x14]
mov edx, 0x64603fe0
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.64604471
jmp 0x64615744
inc dword [0x6461747c]
mov edi, edx
jmp 0x646156cd
inc dword [0x6461746c]
push 4
pop edi
jmp 0x646156cd
push 4
jmp 0x6461573e
push 3
jmp 0x6461573e
push 2
pop esi
jmp 0x64615744
xor esi, esi
inc esi
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
push ebx
push ecx
push dword [ebp + 0x14]
push esi
push edi
push dword [0x64617474]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x6461579c
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461579c
test byte [eax + 0x1c], 2
je 0x6461579c
cmp byte [eax + 0x19], 2
jb 0x6461579c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x64617004]
mov edx, 0x64603fe0
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x19
pop ecx
call fcn.64604471
xor eax, eax
inc eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.64615dc0
mov esp, ebp
pop ebp
ret