Function at 0x485c50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7077e0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x88], ecx
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push eax
push edi
push ecx
call fcn.00486780
push edi
push 0x7d04dc
mov edx, str.KLSVC
mov ecx, 1
call fcn.0045cc40
xor esi, esi
mov dword [ebp - 0x80], esi
mov eax, dword [ebp + 0x1c]
dec eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x84], 1
cmp eax, 3
ja case.default.0x485cce
jmp dword [eax*4 + 0x486124]
mov dword [ebp - 0x7c], 4
jmp case.default.0x485cce
mov dword [ebp - 0x7c], 2
jmp case.default.0x485cce
mov dword [ebp - 0x84], 2
mov dword [ebp - 0x7c], 1
cmp dword [ebp + 0xc], 0xffffffff
mov ecx, 3
push str._5xppaALmx6aaJAgipsaZj0_
cmovne ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x78], ecx
call fcn.006d446a
mov ebx, eax
mov dword [ebp - 0x4c], 0
xor eax, eax
mov dword [ebp - 0x48], 7
add esp, 8
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 3
test ebx, ebx
je 0x485ece
mov eax, ebx
lea ecx, [ebp - 0x5c]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.00449180
push str._5xppaALmx6aaJAgipsaZj0_
call fcn.006e550d
add esp, 4
lea edx, [ebx + eax*2]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485d70
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00449180
xor eax, eax
mov dword [ebp - 0x64], 0
push eax
push 0x780fa8
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.00449180
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
push 0x18
xor eax, eax
mov dword [ebp - 0x34], 0
push str._5xppaALmx6aaJAgipsaZj0_
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00449180
mov byte [ebp - 4], 5
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x34]
mov ebx, dword [ebp - 0x44]
cmovae eax, ebx
cmp dword [ebp - 0x18], 8
push eax
cmovae ecx, dword [ebp - 0x2c]
push 0
mov edx, dword [ebp - 0x1c]
call fcn.0046ae60
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x485e42
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x74]
push dword [ebp - 0x64]
cmovae ecx, dword [ebp - 0x74]
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
push edi
call fcn.004865f0
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push dword [ebp - 0x34]
cmovae eax, ebx
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push eax
mov eax, dword [ebp - 0x64]
cmovae ecx, dword [ebp - 0x2c]
add eax, edi
push eax
jmp 0x485df4
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x485e7d
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x485e73
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x486110
push ecx
push ebx
call fcn.006d0b31
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x485ebb
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x485eb1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x486115
push edx
push ecx
call fcn.006d0b31
add esp, 8
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae ebx, dword [ebp - 0x2c]
lea edi, [eax + eax]
jmp 0x485ef0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485ed3
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x5c]
call fcn.00449180
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
cmp edx, 8
cmovae eax, ecx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 4]
test eax, eax
je 0x485f58
push ebx
lea ecx, [ebp - 0x8c]
push ecx
push edi
push 1
push 0
push dword [ebp - 0x78]
push dword [ebp - 0x84]
push dword [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x485f52
push eax
push 0x8d
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_std_rptglobalreporter.cpp
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.00465440
add esp, 0x10
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x485f98
mov ecx, dword [ebp - 0x2c]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x485f88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48611a
push edx
push ecx
call fcn.006d0b31
mov edx, dword [ebp - 0x48]
add esp, 8
mov ecx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x4860a3
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x485fda
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48611f
push edx
push ecx
call fcn.006d0b31
add esp, 8
jmp 0x4860a3
test esi, esi
je 0x4860ea
push str.KLSTD::DefaultGlobalReporterImpl::Report
push 0x8f
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_std_rptglobalreporter.cpp
push 0x780fa8
mov edx, esi
mov ecx, 5
call fcn.00477010
push str.KLSTD::DefaultGlobalReporterImpl::Report
push 0x90
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_std_rptglobalreporter.cpp
push 0x780fa8
mov edx, esi
mov ecx, 4
call fcn.00477010
add esp, 0x20
lea ecx, [ebp - 0x80]
call fcn.00448f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret 0x18
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
aad 0x5c
dec eax
add dh, bl
pop esp
dec eax
add cl, dh
pop esp
dec eax
add bh, ah
pop esp
dec eax
add ah, cl
int3