Function at 0x406620
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov eax, 0x108c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0046d550
sub esp, eax
mov esi, dword [ebp + 8]
test esi, 0x80
je 0x406664
mov ecx, esi
and ecx, 0x7f
cmp byte [ecx + sym.brltty.exe_logCategoryFlags], 0
je 0x40678a
lea eax, [ecx + ecx*2]
movzx esi, byte [sym.brltty.exe_categoryLogLevel]
xor ebx, ebx
mov edx, dword [eax*4 + 0x476a08]
jmp 0x40666e
xor ebx, ebx
cmp esi, 4
setle bl
xor edx, edx
movzx eax, byte [sym.brltty.exe_systemLogLevel]
cmp eax, esi
setge al
mov edi, eax
movzx eax, byte [sym.brltty.exe_stderrLogLevel]
cmp eax, esi
setge al
mov byte [ebp - 0x106d], al
or eax, edi
movzx eax, al
or eax, ebx
je 0x40678a
mov dword [ebp - 0x106c], edx
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x106c]
test edx, edx
mov eax, dword [eax]
mov byte [ebp - 0x1018], 0
mov dword [ebp - 0x1074], eax
je 0x406792
lea eax, [ebp - 0x1018]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x47673f
mov dword [esp + 4], 0x1000
mov dword [esp], eax
mov dword [ebp - 0x106c], eax
call fcn.0046e270
lea ecx, [ebp - 0x18]
add eax, dword [ebp - 0x106c]
cmp eax, ecx
cmova eax, ecx
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 8], edx
lea edx, [ebp - 0x18]
sub edx, eax
mov dword [esp + 4], edx
call dword [ebp + 0xc]
mov eax, edi
test al, al
jne 0x4067a3
cmp byte [ebp - 0x106d], 0
je 0x406775
mov eax, dword [0x4bc074]
mov esi, dword [sym.imp.msvcrt.dll__iob]
test eax, eax
je 0x406748
mov dword [esp], eax
call sym.brltty.exe_getLogEntryText
mov esi, dword [sym.imp.msvcrt.dll__iob]
cmp byte [eax], 0
jne 0x406910
mov eax, dword [ebp - 0x106c]
add esi, 0x40
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], esi
call sub.msvcrt.dll_fflush
test ebx, ebx
jne 0x4068e8
call sub.msvcrt.dll__errno
mov ebx, dword [ebp - 0x1074]
mov dword [eax], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x106c], eax
jmp 0x4066f9
mov eax, dword [0x4bc070]
test eax, eax
je 0x406875
lea eax, [ebp - 0x1060]
mov dword [esp], eax
lea edi, [ebp - 0x1058]
call sym.brltty.exe_getCurrentTime
mov eax, dword [ebp - 0x1060]
mov dword [esp + 8], 0x476744
mov dword [esp + 4], 0x20
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sym.brltty.exe_formatSeconds
mov edx, 0x431bde83
mov dword [esp + 0xc], edi
mov dword [esp + 4], str._.s._03u
mov ecx, eax
mov eax, edx
imul dword [ebp - 0x105c]
mov eax, dword [ebp - 0x105c]
mov dword [esp + 8], ecx
sar edx, 0x12
sar eax, 0x1f
sub edx, eax
mov eax, dword [0x4bc070]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], 0x40
mov dword [esp], edi
call sym.brltty.exe_formatThreadName
test eax, eax
jne 0x406944
mov eax, dword [0x4bc070]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x106c]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [0x4bc070]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [0x4bc070]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [0x475024]
cmp edx, 0xffffffff
je 0x406719
mov eax, dword [ebp - 0x106c]
cmp esi, 3
mov dword [ebp - 0x1058], eax
mov eax, 1
jg 0x406900
lea ecx, [ebp - 0x1058]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.advapi32.dll_ReportEventA
sub esp, 0x24
jmp 0x406719
mov eax, dword [ebp - 0x106c]
mov dword [esp], eax
call sym.brltty.exe_pushLogMessage
jmp 0x40677d
xor eax, eax
cmp esi, 4
setne al
lea eax, [eax + eax + 2]
jmp 0x40689a
lea edi, [esi + 0x40]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x476720
call sub.msvcrt.dll_fwrite
jmp 0x406748
mov eax, dword [0x4bc070]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x476761
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x40683c