Function at 0x544620
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
push 0x6f1b50
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x544692
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 1
je 0x544689
push esi
call fcn.004f1b00
push eax
push esi
push str.Error_opening_event_log_for_user_account_tracking._err___d___s_._n
push 0x231
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_mon_mon_uat_winnt.c
push str.mon_uat
push dword [0x7d041c]
push 1
call fcn.004f21c0
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x666f4d51
push 0x8000
call fcn.004f3590
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x5446c2
push dword [ebp - 0x1c]
mov edi, 0xc
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0x8000
push eax
xor esi, esi
push ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
test eax, eax
jne 0x544742
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x544716
push esi
push str.GetOldestEventLogRecord_failed_with_status___lu
push 0x203
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_mon_mon_uat_winnt.c
push str.mon_uat_lastrecord_number
push dword [0x7d041c]
push 1
call fcn.004f21c0
add esp, 0x1c
test esi, esi
je 0x54477b
push esi
call fcn.004f1a60
add esp, 4
mov edi, eax
test byte [0x9538a8], 1
je 0x5448f2
push edi
push str.Failed_to_get_last_record_number__qrc___d.
push 0x243
jmp 0x5448d8
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
test eax, eax
jne 0x54476f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x544716
push esi
push str.GetNumberOfEventLogRecords_failed_with_status___lu
push 0x20b
jmp 0x5446fc
cmp dword [ebp - 0x10], esi
jne 0x544716
mov esi, 0x103
jmp 0x54471a
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x14]
mov esi, ecx
push edx
lea edx, [ebp - 8]
push edx
push dword [ebp - 0x18]
push ecx
push dword [eax]
push 5
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
jne 0x5447f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x7a
jne 0x5447e3
push dword [ebp - 4]
call fcn.004f3570
push 0x676f4d51
push dword [ebp - 0x14]
call fcn.004f3590
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x5446ab
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
jmp 0x544784
cmp edi, 0x5df
jne 0x5448b6
mov edi, dword [ebp - 0xc]
jmp 0x54477e
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
cmp edi, ecx
jge 0x544830
mov eax, dword [ebp + 8]
test edx, edx
je 0x544781
sub edx, dword [esi]
xor edi, edi
mov dword [ebp - 8], edx
add esi, dword [esi]
cmp edi, dword [ebx + 4]
mov edi, dword [ebp - 0xc]
mov eax, dword [esi + 0xc]
jg 0x54482d
jl 0x544825
cmp eax, dword [ebx]
ja 0x54482d
inc edi
mov dword [ebp - 0xc], edi
cmp edi, ecx
jl 0x544800
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
test edx, edx
je 0x544784
nop dword [eax + eax]
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp ecx, dword [ebx + 4]
jl 0x54489e
jg 0x544850
cmp eax, dword [ebx]
jb 0x54489e
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], ecx
mov ecx, dword [0x7d0398]
mov edi, dword [esi + 0x14]
cmp ecx, 0xffffffff
je 0x54489e
cmp ecx, edi
je 0x54487b
inc eax
lea ecx, [eax + eax*2]
mov ecx, dword [ecx*4 + 0x7d0398]
cmp ecx, 0xffffffff
jne 0x544865
jmp 0x54489e
lea eax, [eax + eax*2]
lea eax, [eax*4 + 0x7d0398]
test eax, eax
je 0x54489e
push dword [eax + 8]
mov eax, dword [eax + 4]
push esi
call eax
mov edi, eax
add esp, 8
test edi, edi
jne 0x5448f2
mov edx, dword [ebp - 8]
sub edx, dword [esi]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
add esi, dword [esi]
inc dword [eax]
test edx, edx
jne 0x544840
mov edi, dword [ebp - 0xc]
jmp 0x544781
cmp edi, 0x57
jne 0x5448bf
xor edi, edi
jmp 0x5448f2
cmp edi, 0x26
je 0x5448bb
test byte [0x9538a8], 1
je 0x5448f2
push edi
push str.Error_reading_Event_Logs__qrc___d.
push 0x292
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_mon_mon_uat_winnt.c
push str.mon_uat
push dword [0x7d041c]
push 1
call fcn.004f21c0
add esp, 0x1c
push dword [ebp - 4]
call fcn.004f3570
add esp, 4
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret