Function at 0x401660
Capabilities:
Access the windows event log
Clear windows event logs
Query or enumerate registry value

Disassembly:
sub esp, 0x670
mov eax, dword [0x40b630]
push ebx
push edi
xor ebx, ebx
push eax
push 0x40b420
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
mov dword [esp + 0x28], edi
jne 0x4016cf
mov al, byte [esp + 0x680]
test al, al
je 0x4016c4
mov ecx, dword [0x40b630]
push 0x40b420
push ecx
push str.Could_not_open__s_event_log_on__s:
call fcn.004022ac
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call entry0
add esp, 4
pop edi
xor al, al
pop ebx
add esp, 0x670
ret
mov edx, dword [0x40b630]
push ebp
push esi
push edx
lea eax, [esp + 0x378]
push str.SystemCurrentControlSetServicesEventLog_s
push eax
call fcn.004022dd
mov al, byte [esp + 0x690]
add esp, 0xc
test al, al
je 0x401793
lea ecx, [esp + 0x28]
push ecx
push 0x80000002
push 0x40b420
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401733
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
lea eax, [esp + 0x374]
push edx
push eax
push ecx
call esi
test eax, eax
je 0x401754
push 0x40b420
push str.Could_not_open_Registry_on__s__so_event_strings_will_not_be_processed:_n
call fcn.004022ac
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call entry0
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x3c]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push eax
call esi
test eax, eax
jne 0x4017d0
lea ecx, [esp + 0x40]
lea edx, [esp + 0x4c]
push ecx
push 0x40b524
push edx
push eax
mov eax, dword [esp + 0x4c]
push str.PathName
push eax
mov dword [esp + 0x58], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x4017d0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x374]
push ecx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4017d0
push 0x40b420
push str.Could_not_open_Registry__so_event_strings_will_not_be_processed:_n
call fcn.004022ac
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call entry0
add esp, 4
push 0x4000
mov dword [esp + 0x30], 0x4000
call fcn.004023dd
mov ebp, eax
add esp, 4
mov dword [esp + 0x1c], ebp
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
push ebp
push 0
push 9
push edi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x401836
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x401be2
mov eax, dword [esp + 0x34]
push eax
push ebp
mov dword [esp + 0x34], eax
call fcn.00402590
add esp, 8
mov dword [esp + 0x1c], eax
jmp 0x401bcc
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x401bd0
mov ecx, dword [esp + 0x14]
mov al, byte [0x40b634]
inc ecx
test al, al
mov dword [esp + 0x14], ecx
je 0x4019d2
mov eax, dword [ebp + 8]
lea ebx, [ebp + 0x38]
push ebx
push eax
push str._03d__s_
call fcn.004022ac
mov ax, word [ebp + 0x18]
add esp, 0xc
test al, 1
je 0x40187c
push str.ERROR
jmp 0x4018ad
test al, 2
je 0x401887
push str.WARNING
jmp 0x4018ad
test al, 4
je 0x401892
push str.INFORMATION
jmp 0x4018ad
test al, 8
je 0x40189d
push str.AUDIT_SUCCESS
jmp 0x4018ad
test al, 0x10
je 0x4018a8
push str.AUDIT_FAILURE
jmp 0x4018ad
push str.UNKNOWN_TYPE
push 0x40a22c
call fcn.004022ac
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + ebx + 1]
push ecx
push 0x40a22c
call fcn.004022ac
lea edx, [ebp + 0xc]
push edx
call fcn.00402577
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x27c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x27c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x27c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x27b], al
mov ecx, dword [ebp + 0x14]
and ecx, 0xfffffff
push ecx
push edx
push str._s__d_
call fcn.004022ac
mov eax, dword [ebp + 0x28]
add esp, 0x18
test eax, eax
je 0x40199c
mov eax, dword [ebp + 0x2c]
mov ecx, 0x104
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x38]
lea edx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x170]
push edx
push ecx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x74]
add eax, ebp
push edx
push ecx
push eax
push 0x40b420
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x40199c
lea edx, [esp + 0x16c]
lea eax, [esp + 0x68]
push edx
push eax
push str._s_s_
call fcn.004022ac
add esp, 0xc
jmp 0x4019a9
push str.None_
call fcn.004022ac
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x684]
push ebp
push ebx
push ecx
push edx
call fcn.00401300
mov esi, eax
push esi
push 0x40a054
call fcn.004022ac
add esp, 0x18
jmp 0x401b96
mov eax, dword [ebp + 8]
lea esi, [ebp + 0x38]
push esi
push eax
push str.__03d___s_n
call fcn.004022ac
push str.___Type:
call fcn.004022ac
mov ax, word [ebp + 0x18]
add esp, 0x10
test al, 1
je 0x401a00
push str.ERROR
jmp 0x401a31
test al, 2
je 0x401a0b
push str.WARNING
jmp 0x401a31
test al, 4
je 0x401a16
push str.INFORMATION
jmp 0x401a31
test al, 8
je 0x401a21
push str.AUDIT_SUCCESS
jmp 0x401a31
test al, 0x10
je 0x401a2c
push str.AUDIT_FAILURE
jmp 0x401a31
push str.UNKNOWN_TYPE
push 0x40a1f4
call fcn.004022ac
add esp, 8
push 0x40a0e0
call fcn.004022ac
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push str.___Computer:__s_n
call fcn.004022ac
mov eax, dword [ebp + 0xc]
add esp, 0xc
cdq
add eax, 0xb6109100
push 0
adc edx, 2
push 0x989680
push edx
push eax
call fcn.004026b0
mov dword [esp + 0x44], eax
mov eax, edx
mov dword [esp + 0x48], edx
lea ecx, [esp + 0x50]
lea edx, [esp + 0x44]
push ecx
sar eax, 0x1f
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x58]
lea ecx, [esp + 0x50]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edi, 0x104
lea edx, [esp + 0x478]
push edi
push edx
lea eax, [esp + 0x60]
push 0
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea ecx, [esp + 0x57c]
push edi
push ecx
lea edx, [esp + 0x60]
push 0
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea eax, [esp + 0x478]
lea ecx, [esp + 0x57c]
push eax
push ecx
push str.___Time:______s__s
call fcn.004022ac
mov edx, dword [ebp + 0x14]
and edx, 0xfffffff
push edx
push str.___ID:________d__n
call fcn.004022ac
mov eax, dword [ebp + 0x28]
add esp, 0x14
test eax, eax
je 0x401b77
mov eax, dword [ebp + 0x2c]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
lea ecx, [esp + 0x170]
push edx
push ecx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x74]
add eax, ebp
push edx
push ecx
push eax
push 0x40b420
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x401b77
lea edx, [esp + 0x16c]
lea eax, [esp + 0x68]
push edx
push eax
push str.___User:______s_s_n
call fcn.004022ac
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x684]
push ebp
push esi
push ecx
push edx
call fcn.00401300
mov esi, eax
push esi
call fcn.00402510
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x40a030]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x401c2e
mov eax, dword [esp + 0x18]
mov esi, dword [ebp]
sub eax, esi
mov dword [esp + 0x18], eax
mov edx, dword [ebp]
add ebp, edx
test eax, eax
ja 0x401842
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [0x40a030]
cmp eax, ebx
je 0x401c32
jmp 0x4017eb
call esi
cmp eax, 0x26
je 0x401c0f
mov ecx, dword [0x40b630]
push 0x40b420
push ecx
push str.Error_reading__s_event_log_on__s:_n
call fcn.004022ac
add esp, 0xc
call esi
push eax
call entry0
add esp, 4
jmp 0x401c32
test ebx, ebx
jne 0x401c32
mov edx, dword [0x40b630]
push 0x40b420
push edx
push str.No_records_in__s_event_log_on__s._n
call fcn.004022ac
add esp, 0xc
jmp 0x401c32
mov edi, dword [esp + 0x30]
mov al, byte [0x40b62a]
pop esi
test al, al
pop ebp
je 0x401c70
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
test eax, eax
push 0x40b420
je 0x401c5c
mov eax, dword [0x40b630]
push eax
push str._s_event_log_on__s_cleared._n
jmp 0x401c68
mov ecx, dword [0x40b630]
push ecx
push str.Error_clearing__s_event_log_on__s._n
call fcn.004022ac
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop edi
mov al, 1
pop ebx
add esp, 0x670
ret