Function at 0x13a6ad01
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov eax, dword [0x13a6e004]
mov ebx, 0x13a6e004
cmp eax, ebx
je 0x13a6ad42
test byte [eax + 0x1c], 2
je 0x13a6ad42
cmp byte [eax + 0x19], 5
jb 0x13a6ad42
mov esi, 0x13a58b78
push esi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
mov eax, dword [0x13a6e004]
jmp 0x13a6ad47
mov esi, 0x13a58b78
cmp dword [ebp + 0x10], 0x40
jbe 0x13a6ad72
cmp eax, ebx
je 0x13a6ad6b
test byte [eax + 0x1c], 2
je 0x13a6ad6b
cmp byte [eax + 0x19], 2
jb 0x13a6ad6b
push esi
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
xor eax, eax
jmp 0x13a6af25
cmp dword [0x13a6e74c], 0
jne 0x13a6ad90
cmp eax, ebx
je 0x13a6ad6b
test byte [eax + 0x1c], 2
je 0x13a6ad6b
cmp byte [eax + 0x19], 3
jb 0x13a6ad6b
push esi
push 0x16
jmp 0x13a6ad60
push edi
mov edi, 0x13a6e734
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x13a6e758]
xor edx, edx
test eax, eax
jbe 0x13a6adcd
mov ecx, dword [0x13a6e754]
add ecx, 8
mov esi, dword [ebp + 8]
cmp dword [ecx - 4], esi
jne 0x13a6adc0
mov esi, dword [ebp + 0xc]
cmp esi, dword [ecx]
ja 0x13a6ae1e
inc edx
add ecx, 0xc
cmp edx, eax
jb 0x13a6adb1
mov esi, 0x13a58b78
xor edx, edx
cmp dword [ebp + 0x10], edx
jbe 0x13a6adfa
lea esi, [ebp + 0x14]
add esi, 4
mov eax, dword [esi]
lea ecx, [ebp + edx*4 - 0x108]
mov dword [ecx], eax
test eax, eax
jne 0x13a6adef
mov dword [ecx], 0x13a01848
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x13a6add7
mov esi, 0x13a58b78
mov ecx, dword [ebp + 0x14]
xor edx, edx
shr ecx, 0x1e
inc edx
cmp ecx, edx
jbe 0x13a6ae37
push 2
pop eax
cmp ecx, eax
je 0x13a6ae2c
cmp ecx, 3
jne 0x13a6ae46
inc dword [0x13a6e730]
mov dword [ebp - 8], edx
jmp 0x13a6ae6a
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x13a6af24
inc dword [0x13a6e72c]
mov dword [ebp - 8], eax
jmp 0x13a6ae6a
inc dword [0x13a6e750]
mov dword [ebp - 8], 4
jmp 0x13a6ae6a
mov eax, dword [0x13a6e004]
cmp eax, ebx
je 0x13a6ae6a
test byte [eax + 0x1c], 2
je 0x13a6ae6a
cmp byte [eax + 0x19], 2
jb 0x13a6ae6a
push ecx
push esi
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
dec eax
je 0x13a6aec3
dec eax
je 0x13a6aeba
dec eax
je 0x13a6aeb1
dec eax
je 0x13a6aea8
mov eax, dword [0x13a6e004]
cmp eax, ebx
je 0x13a6aeca
test byte [eax + 0x1c], 2
je 0x13a6aeca
cmp byte [eax + 0x19], 2
jb 0x13a6aeca
push dword [ebp + 8]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
jmp 0x13a6aeca
mov dword [ebp - 4], 4
jmp 0x13a6aeca
mov dword [ebp - 4], 3
jmp 0x13a6aeca
mov dword [ebp - 4], 2
jmp 0x13a6aeca
mov dword [ebp - 4], 1
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x13a6e74c]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x13a6af21
mov eax, dword [0x13a6e004]
cmp eax, ebx
je 0x13a6af21
test byte [eax + 0x1c], 2
je 0x13a6af21
cmp byte [eax + 0x19], 2
jb 0x13a6af21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x13a6e004]
push esi
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret