Function at 0x4eb764
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ebc41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
push 0x4ebc54
push 0
call sub.advapi32.dll_OpenEventLogA
mov esi, eax
test esi, esi
je 0x4ebc19
mov eax, 0x38
call fcn.00402a88
mov dword [ebp - 0x14], eax
mov edi, 0x38
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 0x14]
push eax
push 0
push 9
push esi
call sub.advapi32.dll_ReadEventLogA
mov ebx, eax
test ebx, ebx
jne 0x4eb817
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x26
je 0x4ebc11
cmp dword [ebp - 0x18], 0x7a
jne 0x4ebc11
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00402ad8
mov edi, dword [ebp - 0x10]
jmp 0x4eb7ce
mov eax, dword [ebp - 0x14]
cmp word [eax + 0x14], 0x1775
jne 0x4eb911
mov cx, 1
mov dx, 1
mov ax, 0x7b2
call fcn.0040a5e0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fdiv dword [0x4ebc5c]
faddp st(1)
fld xword [0x4ebc60]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040b438
mov eax, dword [ebp - 0x28]
call fcn.0040bcc0
fstp qword [ebp - 0x20]
wait
mov eax, dword [0x4f17e4]
call fcn.004054ec
test eax, eax
jne 0x4eb89d
push 1
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
jmp 0x4eb8e7
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x38]
fcomp dword [0x4ebc6c]
fnstsw ax
sahf
jbe 0x4eb8e7
mov eax, dword [0x4f17e4]
call fcn.004054ec
inc eax
push eax
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*8 - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 - 0x34], ecx
jmp 0x4ebc07
mov eax, dword [ebp - 0x14]
cmp word [eax + 0x14], 0x1776
jne 0x4ebaa4
mov cx, 1
mov dx, 1
mov ax, 0x7b2
call fcn.0040a5e0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fdiv dword [0x4ebc5c]
faddp st(1)
fld xword [0x4ebc60]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x34]
call fcn.0040b438
mov eax, dword [ebp - 0x34]
call fcn.0040bcc0
fstp qword [ebp - 0x20]
wait
mov eax, dword [0x4f17e4]
call fcn.004054ec
test eax, eax
jne 0x4eb99a
push 1
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
jmp 0x4eba7a
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x18]
fcomp dword [0x4ebc6c]
fnstsw ax
sahf
jae 0x4eba56
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x38]
fcomp dword [0x4ebc6c]
fnstsw ax
sahf
jbe 0x4eba7a
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x38]
fstp qword [ebp - 0x30]
wait
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x18]
fcomp qword [ebp - 0x30]
fnstsw ax
sahf
jae 0x4eba7a
mov eax, dword [0x4f17e4]
call fcn.004054ec
inc eax
push eax
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
jmp 0x4eba7a
mov eax, dword [0x4f17e4]
call fcn.004054ec
inc eax
push eax
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*8 - 0x18], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 - 0x14], ecx
jmp 0x4ebc07
mov eax, dword [ebp - 0x14]
cmp word [eax + 0x14], 0x1b7b
jne 0x4ebc07
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004ebca4
mov edx, dword [ebp - 0x24]
mov eax, 0x4ebc78
call fcn.00404a00
test eax, eax
jg 0x4ebc07
mov edx, dword [ebp - 0x24]
mov eax, 0x4ebc84
call fcn.00404a00
test eax, eax
jg 0x4ebc07
mov edx, dword [ebp - 0x24]
mov eax, 0x4ebc94
call fcn.00404a00
test eax, eax
jg 0x4ebc07
mov cx, 1
mov dx, 1
mov ax, 0x7b2
call fcn.0040a5e0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fdiv dword [0x4ebc5c]
faddp st(1)
fld xword [0x4ebc60]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x38]
call fcn.0040b438
mov eax, dword [ebp - 0x38]
call fcn.0040bcc0
fstp qword [ebp - 0x20]
wait
mov eax, dword [0x4f17e4]
call fcn.004054ec
test eax, eax
jne 0x4ebb77
push 1
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
jmp 0x4ebbe4
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x38]
fcomp dword [0x4ebc6c]
fnstsw ax
sahf
jbe 0x4ebbe4
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
fld qword [edx + eax*8 - 0x38]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jbe 0x4ebbe4
mov eax, dword [0x4f17e4]
call fcn.004054ec
inc eax
push eax
mov eax, 0x4f17e4
mov ecx, 1
mov edx, dword [0x4eb3e8]
call fcn.004056c8
add esp, 4
mov eax, dword [0x4f17e4]
call fcn.004054ec
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4f17e4]
lea eax, [edx + eax*8 - 8]
mov edx, dword [ebp - 0x24]
call fcn.00404450
mov edi, 0x38
jmp 0x4eb7ce
mov eax, dword [ebp - 0x14]
call fcn.00402ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebc48
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00404420
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404420
ret