Function at 0x5a1560
Capabilities:
Access the windows event log
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
shl eax, 5
push esi
push edi
xor edi, edi
lea ebx, [eax + 0x7d81f0]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x5a166b
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push esi
push eax
call fcn.005a1a50
add esp, 0x14
test eax, eax
jne 0x5a166b
test byte [ebx + 0x18], 0xa
je 0x5a1675
test esi, esi
je 0x5a163b
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx + 4]
cdq
push edx
push eax
push dword [ebx]
call fcn.005a20d0
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xc]
add esp, 0x10
push esi
push edi
push eax
push edi
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x2900
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x5a163e
push dword [ebp - 0xc]
call fcn.004f36e0
push 0x63564551
lea ebx, [eax + 2]
push ebx
call fcn.004f3590
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x5a161c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x5a163e
push ebx
push edi
call fcn.004f3630
push dword [ebp - 0xc]
push ebx
push edi
call fcn.004f3880
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x5a1678
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x5a166b
dec edi
test esi, esi
je 0x5a165a
mov eax, dword [esi + edi*4]
test eax, eax
je 0x5a165a
push eax
call fcn.004f3570
add esp, 4
test edi, edi
jne 0x5a1645
test esi, esi
je 0x5a166b
push esi
call fcn.004f3570
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x409
push ebx
push esi
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.005a1f30
add esp, 0x20
test eax, eax
je 0x5a16ef
test ebx, ebx
je 0x5a16c8
dec ebx
test esi, esi
je 0x5a16b7
mov eax, dword [esi + ebx*4]
test eax, eax
je 0x5a16b7
push eax
call fcn.004f3570
add esp, 4
test ebx, ebx
jne 0x5a16a2
test esi, esi
je 0x5a16c8
push esi
call fcn.004f3570
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5a16d8
push eax
call fcn.004f3570
add esp, 4
test edi, edi
je 0x5a166b
push edi
call fcn.004f3570
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test edi, edi
mov edx, dword [ebp - 0x18]
cmove edi, edx
mov dword [ebp - 0x1c], edi
test byte [ecx + 0x18], 1
je 0x5a17d7
test edx, edx
je 0x5a17d7
mov eax, dword [ecx + 4]
dec eax
cmp eax, 0x1f
ja case.0x5a1723.3
movzx eax, byte [eax + 0x5a1a00]
jmp dword [eax*4 + 0x5a19f0]
test byte [0x9538a8], 8
je 0x5a17d7
push edx
push 0x6e17a0
push 0x4f0
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_evt_evt.c
push str.evt_add_to_qlog
push dword [0x7d2f88]
push 8
jmp 0x5a17cc
test byte [0x9538a8], 2
je 0x5a17d7
push edx
push 0x6e17a0
push 0x4f3
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_evt_evt.c
push str.evt_add_to_qlog
push dword [0x7d2f88]
push 2
jmp 0x5a17cc
test byte [0x9538a8], 1
je 0x5a17d7
push edx
push 0x6e17a0
push 0x4f8
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_evt_evt.c
push str.evt_add_to_qlog
push dword [0x7d2f88]
push 1
jmp 0x5a17cc
test byte [0x9538a8], 0x10
je 0x5a17d7
push edx
push 0x6e17a0
push 0x4fb
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_common_evt_evt.c
push str.evt_add_to_qlog
push dword [0x7d2f88]
push 0x10
call fcn.004f21c0
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov eax, dword [ecx + 0x18]
test al, 2
je 0x5a1825
cmp dword [0x912088], 0
je 0x5a1825
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ecx + 4]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.005a20d0
add esp, 0x10
xor ecx, ecx
test ebx, ebx
cmovne ecx, esi
push 0
push ecx
push 0
push ebx
push 0
push dword [ebp - 0x14]
push 0
push eax
push dword [0x912088]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
test al, 8
je 0x5a197b
call fcn.00595110
mov edi, eax
call fcn.00595100
and edi, eax
xor esi, esi
and edi, 0x40
or edi, esi
je 0x5a1975
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
cmp eax, 0x1f
ja case.0x5a185b.1
movzx eax, byte [eax + 0x5a1a30]
jmp dword [eax*4 + 0x5a1a20]
mov dword [ebp - 0x10], 0x200030
jmp 0x5a187b
mov dword [ebp - 0x10], 0x200010
jmp 0x5a187b
mov dword [ebp - 0x10], 0x200040
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x5a1978
push 0x6a564551
push 0xc
call fcn.004f3590
mov esi, eax
add esp, 8
test esi, esi
je 0x5a1978
push 0x6b564551
push edi
call fcn.004f36e0
add esp, 4
add eax, 2
push eax
call fcn.004f3590
add esp, 8
mov dword [esi], eax
push 0x6c564551
push 0x6cb164
call fcn.004f36e0
add esp, 4
add eax, 2
push eax
call fcn.004f3590
mov ecx, dword [esi]
add esp, 8
mov dword [esi + 4], eax
test ecx, ecx
je 0x5a195a
test eax, eax
je 0x5a1951
push edi
push edi
call fcn.004f36e0
add esp, 4
add eax, 2
push eax
push dword [esi]
call fcn.004f3880
add esp, 0xc
push 0x6cb164
push 0x6cb164
call fcn.004f36e0
add esp, 4
add eax, 2
push eax
push dword [esi + 4]
call fcn.004f3880
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push esi
push 0x5a3220
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x24
cmp eax, 0xffffffff
jne 0x5a1948
mov eax, dword [esi]
test eax, eax
je 0x5a195a
push eax
jmp 0x5a1952
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5a1978
push ecx
call fcn.004f3570
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x5a196a
push eax
call fcn.004f3570
add esp, 4
push esi
call fcn.004f3570
add esp, 4
jmp 0x5a1978
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
test byte [eax + 0x18], 4
je 0x5a1995
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0059e320
add esp, 0xc
test ebx, ebx
je 0x5a19c6
nop dword [eax]
dec ebx
test esi, esi
je 0x5a19b5
mov eax, dword [esi + ebx*4]
test eax, eax
je 0x5a19b5
push eax
call fcn.004f3570
add esp, 4
test ebx, ebx
jne 0x5a19a0
test esi, esi
je 0x5a19c6
push esi
call fcn.004f3570
add esp, 4
mov esi, dword [ebp - 0x18]
cmp edi, esi
je 0x5a19da
test edi, edi
je 0x5a19da
push edi
call fcn.004f3570
add esp, 4
test esi, esi
je 0x5a19e7
push esi
call fcn.004f3570
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret