Function at 0x105dbc9
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov eax, dword [0x1075004]
mov ebx, 0x1075004
cmp eax, ebx
je 0x105dc0a
test byte [eax + 0x1c], 2
je 0x105dc0a
cmp byte [eax + 0x19], 5
jb 0x105dc0a
mov esi, 0x10053dc
push esi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
mov eax, dword [0x1075004]
jmp 0x105dc0f
mov esi, 0x10053dc
cmp dword [ebp + 0x10], 0x40
jbe 0x105dc3a
cmp eax, ebx
je 0x105dc33
test byte [eax + 0x1c], 2
je 0x105dc33
cmp byte [eax + 0x19], 2
jb 0x105dc33
push esi
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
xor eax, eax
jmp 0x105dded
cmp dword [0x10784c4], 0
jne 0x105dc58
cmp eax, ebx
je 0x105dc33
test byte [eax + 0x1c], 2
je 0x105dc33
cmp byte [eax + 0x19], 3
jb 0x105dc33
push esi
push 0x16
jmp 0x105dc28
push edi
mov edi, 0x10784ac
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10784d0]
xor edx, edx
test eax, eax
jbe 0x105dc95
mov ecx, dword [0x10784cc]
add ecx, 8
mov esi, dword [ebp + 8]
cmp dword [ecx - 4], esi
jne 0x105dc88
mov esi, dword [ebp + 0xc]
cmp esi, dword [ecx]
ja 0x105dce6
inc edx
add ecx, 0xc
cmp edx, eax
jb 0x105dc79
mov esi, 0x10053dc
xor edx, edx
cmp dword [ebp + 0x10], edx
jbe 0x105dcc2
lea esi, [ebp + 0x14]
add esi, 4
mov eax, dword [esi]
lea ecx, [ebp + edx*4 - 0x108]
mov dword [ecx], eax
test eax, eax
jne 0x105dcb7
mov dword [ecx], 0x1001768
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x105dc9f
mov esi, 0x10053dc
mov ecx, dword [ebp + 0x14]
xor edx, edx
shr ecx, 0x1e
inc edx
cmp ecx, edx
jbe 0x105dcff
push 2
pop eax
cmp ecx, eax
je 0x105dcf4
cmp ecx, 3
jne 0x105dd0e
inc dword [0x10784a8]
mov dword [ebp - 8], edx
jmp 0x105dd32
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x105ddec
inc dword [0x10784a4]
mov dword [ebp - 8], eax
jmp 0x105dd32
inc dword [0x10784c8]
mov dword [ebp - 8], 4
jmp 0x105dd32
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105dd32
test byte [eax + 0x1c], 2
je 0x105dd32
cmp byte [eax + 0x19], 2
jb 0x105dd32
push ecx
push esi
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ca9d
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
dec eax
je 0x105dd8b
dec eax
je 0x105dd82
dec eax
je 0x105dd79
dec eax
je 0x105dd70
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105dd92
test byte [eax + 0x1c], 2
je 0x105dd92
cmp byte [eax + 0x19], 2
jb 0x105dd92
push dword [ebp + 8]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ca9d
jmp 0x105dd92
mov dword [ebp - 4], 4
jmp 0x105dd92
mov dword [ebp - 4], 3
jmp 0x105dd92
mov dword [ebp - 4], 2
jmp 0x105dd92
mov dword [ebp - 4], 1
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x10784c4]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x105dde9
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x105dde9
test byte [eax + 0x1c], 2
je 0x105dde9
cmp byte [eax + 0x19], 2
jb 0x105dde9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push esi
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ca9d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret