Function at 0x4046f0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x94c
mov eax, dword [0x41a2f0]
xor eax, esp
mov dword [esp + 0x948], eax
mov eax, dword [esp + 0x954]
push ebp
mov ebp, dword [esp + 0x95c]
push esi
mov esi, dword [esp + 0x958]
push edi
mov edi, dword [esp + 0x968]
push 0xa
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x970]
mov dword [esp + 0x20], ecx
push 0x14
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], eax
xor eax, eax
push ecx
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], edx
mov byte [esp + 0x3c], 0
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
call fcn.00407bcf
xor eax, eax
push 0x400
push eax
lea edx, [esp + 0x59]
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x5c], al
call fcn.00409500
add esp, 0x1c
push ebx
mov ecx, edi
mov edx, ebp
call fcn.00404310
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4047c2
push str.Elsevier.DaTong
push eax
mov dword [esp + 0x24], str.Fail_to_create_control_connection.
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
push ebp
lea eax, [esp + 0x20]
push eax
jmp 0x404b66
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
call fcn.00403ee0
mov edi, dword [esp + 0x2c]
add esp, 0x1c
test eax, eax
je 0x404b0d
cmp edi, 0xdc
jne 0x404b0d
mov edx, dword [esp + 0x1c]
push edx
push str.USER__s_r_n
mov ecx, 0x400
lea edi, [esp + 0x48]
call fcn.00401bb0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404820
sub eax, edx
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x48]
push edx
push eax
mov eax, ebx
call fcn.00404180
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x404b80
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
call fcn.00403ee0
add esp, 0x1c
test eax, eax
je 0x404afc
mov ecx, dword [esp + 0x10]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
je 0x4048a0
cmp eax, 3
jne 0x404afc
cmp eax, 3
jne 0x404957
mov edx, dword [esp + 0x28]
push edx
push str.PASS__s_r_n
mov ecx, 0x400
lea edi, [esp + 0x48]
call fcn.00401bb0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4048d0
sub eax, edx
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x48]
push edx
push eax
mov eax, ebx
call fcn.00404180
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x404b80
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
call fcn.00403ee0
add esp, 0x1c
test eax, eax
je 0x404943
mov ecx, dword [esp + 0x10]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
je 0x404957
push str.PASS_CMD_Reply_Fail.
call fcn.00401dc0
add esp, 4
xor ebp, ebp
jmp 0x404b80
push str.TYPE_I_r_n
mov ecx, 0x400
lea edi, [esp + 0x44]
call fcn.00401bb0
mov eax, edi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404972
sub eax, edx
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x48]
push edx
push eax
mov eax, ebx
call fcn.00404180
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x404b80
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
call fcn.00403ee0
add esp, 0x1c
test eax, eax
je 0x404ae8
mov ecx, dword [esp + 0x10]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x404ae8
mov ecx, dword [esi + 0xb4]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.004044e0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x404a1a
push str.Create_data_connection_Fail.
call fcn.00401dc0
add esp, 4
jmp 0x404b80
mov edx, dword [esp + 0x24]
push edx
push str.CWD__s_r_n
mov ecx, 0x400
lea edi, [esp + 0x48]
call fcn.00401bb0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404a40
mov esi, dword [esp + 0x18]
sub eax, edx
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x48]
push edx
push eax
mov eax, ebx
call fcn.00404180
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x404b80
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
push 0
push 0x400
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
call fcn.00403ee0
add esp, 0x1c
test eax, eax
je 0x404ad4
mov ecx, dword [esp + 0x10]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x404ad4
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x948]
xor ecx, esp
call fcn.004075fb
add esp, 0x94c
ret
push str.CWD_reply_Fail.
xor ebp, ebp
call fcn.00401dc0
add esp, 4
jmp 0x404b80
push str.TYPE_I_CMD_Reply_Fail.
xor ebp, ebp
call fcn.00401dc0
add esp, 4
jmp 0x404b80
push str.USER_CMD_Reply_Fail.
call fcn.00401dc0
add esp, 4
xor ebp, ebp
jmp 0x404b80
push 0x503
xor ebp, ebp
lea ecx, [esp + 0x44d]
push ebp
push ecx
mov byte [esp + 0x454], 0
call fcn.00409500
add esp, 0xc
lea edx, [esp + 0x40]
push edx
push edi
push str.Ftp_server_connect_response_code__d___220___s
mov ecx, 0x504
lea edi, [esp + 0x454]
call fcn.00401bb0
add esp, 0xc
push str.Elsevier.DaTong
mov eax, edi
push ebp
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push ebp
lea ecx, [esp + 0x1c]
mov esi, eax
push ecx
push 0
push 1
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.Elsevier.DaTong
push 0
mov dword [esp + 0x20], str.Fail_to_open_ftp_connection.
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0x954]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004075fb
add esp, 0x94c
ret