Function at 0x105d809
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov eax, dword [0x1075004]
mov ebx, 0x1075004
cmp eax, ebx
je 0x105d84a
test byte [eax + 0x1c], 2
je 0x105d84a
cmp byte [eax + 0x19], 5
jb 0x105d84a
mov esi, 0x10053dc
push esi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
mov eax, dword [0x1075004]
jmp 0x105d84f
mov esi, 0x10053dc
cmp dword [ebp + 0x10], 0x40
jbe 0x105d87a
cmp eax, ebx
je 0x105d873
test byte [eax + 0x1c], 2
je 0x105d873
cmp byte [eax + 0x19], 2
jb 0x105d873
push esi
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
xor eax, eax
jmp 0x105da2d
cmp dword [0x10784c4], 0
jne 0x105d898
cmp eax, ebx
je 0x105d873
test byte [eax + 0x1c], 2
je 0x105d873
cmp byte [eax + 0x19], 3
jb 0x105d873
push esi
push 0x16
jmp 0x105d868
push edi
mov edi, 0x10784ac
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10784d0]
xor edx, edx
test eax, eax
jbe 0x105d8d5
mov ecx, dword [0x10784cc]
add ecx, 8
mov esi, dword [ebp + 8]
cmp dword [ecx - 4], esi
jne 0x105d8c8
mov esi, dword [ebp + 0xc]
cmp esi, dword [ecx]
ja 0x105d926
inc edx
add ecx, 0xc
cmp edx, eax
jb 0x105d8b9
mov esi, 0x10053dc
xor edx, edx
cmp dword [ebp + 0x10], edx
jbe 0x105d902
lea esi, [ebp + 0x14]
add esi, 4
mov eax, dword [esi]
lea ecx, [ebp + edx*4 - 0x108]
mov dword [ecx], eax
test eax, eax
jne 0x105d8f7
mov dword [ecx], 0x1001768
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x105d8df
mov esi, 0x10053dc
mov ecx, dword [ebp + 0x14]
xor edx, edx
shr ecx, 0x1e
inc edx
cmp ecx, edx
jbe 0x105d93f
push 2
pop eax
cmp ecx, eax
je 0x105d934
cmp ecx, 3
jne 0x105d94e
inc dword [0x10784a8]
mov dword [ebp - 8], edx
jmp 0x105d972
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x105da2c
inc dword [0x10784a4]
mov dword [ebp - 8], eax
jmp 0x105d972
inc dword [0x10784c8]
mov dword [ebp - 8], 4
jmp 0x105d972
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105d972
test byte [eax + 0x1c], 2
je 0x105d972
cmp byte [eax + 0x19], 2
jb 0x105d972
push ecx
push esi
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
dec eax
je 0x105d9cb
dec eax
je 0x105d9c2
dec eax
je 0x105d9b9
dec eax
je 0x105d9b0
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105d9d2
test byte [eax + 0x1c], 2
je 0x105d9d2
cmp byte [eax + 0x19], 2
jb 0x105d9d2
push dword [ebp + 8]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x105d9d2
mov dword [ebp - 4], 4
jmp 0x105d9d2
mov dword [ebp - 4], 3
jmp 0x105d9d2
mov dword [ebp - 4], 2
jmp 0x105d9d2
mov dword [ebp - 4], 1
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x10784c4]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x105da29
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105da29
test byte [eax + 0x1c], 2
je 0x105da29
cmp byte [eax + 0x19], 2
jb 0x105da29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push esi
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret