Function at 0x10056fc8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x10c0
call fcn.10087c20
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [esp + 0x10b8], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
xor esi, esi
push 0x1000
push esi
push dword [esp + 0xc]
call fcn.1008c000
add esp, 0xc
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov dword [ecx], esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [ecx], esi
push str.System
push esi
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [esp + 8], eax
mov eax, 0x1dde12a5
mov esi, 0x3e34f981
mov dword [esp], ecx
cmp eax, 0x1dde12a4
jg 0x1005707b
cmp eax, 0xc7c6d87b
jg 0x100570be
cmp eax, 0xa9d681ac
je 0x1005714a
cmp eax, 0xaac5cbd3
je 0x10057226
cmp eax, 0xb2a35ab5
jne 0x10057042
mov eax, 0xee2e336b
mov dword [esp], 0
jmp 0x10057042
cmp eax, 0x3e34f980
jle 0x100570f6
cmp eax, 0x3e34f981
je 0x10057240
cmp eax, 0x498b5440
je 0x1005725d
cmp eax, 0x754465e8
jne 0x10057042
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x3c], 0
mov eax, 0xa9d681ac
cmove eax, esi
mov edi, dword [esp + 0x2c]
jmp 0x10057042
cmp eax, 0xc7c6d87c
je 0x1005727e
cmp eax, 0xf3e77b8b
jne 0x100572b7
lea eax, [esp + 0x58]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0
mov eax, 0x3b6000e7
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
jmp 0x10057042
cmp eax, 0x1dde12a5
je 0x100572a0
cmp eax, 0x3b6000e7
jne 0x10057042
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x40]
push eax
push 0x1000
mov ebx, dword [esp + 0x24]
push ebx
push 0
push 5
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
mov eax, 0x754465e8
mov ecx, 0x498b5440
cmove eax, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
jmp 0x10057042
mov edi, dword [esp + 0x10]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10a0], xmm0
movaps xmmword [esp + 0x1090], xmm0
movaps xmmword [esp + 0x1080], xmm0
movaps xmmword [esp + 0x1070], xmm0
push dword [edi + 0xc]
mov dword [esp + 0x38], ebx
lea ebx, [esp + 0x105c]
push ebx
call fcn.1005bfb0
add esp, 8
mov ecx, ebx
call fcn.10007bca
movsx ecx, word [edi + 0x14]
push eax
push ecx
push str._d__s_
push 0x40
lea edi, [esp + 0x1080]
push edi
call fcn.10009906
add esp, 0x14
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0xf
mov byte [esp + 0x40], 0
push edi
call fcn.1009ee80
add esp, 4
lea esi, [esp + 0x40]
mov ecx, esi
push eax
push edi
call fcn.10007b00
mov ecx, ebx
mov ebx, dword [esp + 0x34]
call fcn.100087f0
mov edi, dword [esp + 0x50]
mov ecx, esi
call fcn.10007bca
mov ecx, dword [ebp + 8]
push edi
push eax
call fcn.10008e94
mov ecx, esi
mov esi, 0x3e34f981
call fcn.100087f0
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp eax, 6
mov eax, 0xc7c6d87c
cmovge eax, esi
mov edi, dword [esp + 0xc]
jmp 0x10057042
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, 0x3b6000e7
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
jmp 0x10057042
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x30]
cmp eax, 6
mov eax, 0xaac5cbd3
mov ecx, 0x498b5440
cmovge eax, ecx
jmp 0x10057042
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
setne al
mov dword [esp], eax
mov eax, 0xee2e336b
jmp 0x10057042
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
sub dword [esp + 0x3c], ecx
mov ebx, dword [esp + 0x10]
add ebx, dword [eax]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, 0x754465e8
jmp 0x10057042
cmp dword [esp + 8], 0
mov eax, 0xf3e77b8b
mov ecx, 0xb2a35ab5
cmove eax, ecx
jmp 0x10057042
cmp eax, 0xee2e336b
jne 0x10057042
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 4]
mov ebx, dword [esp]
and bl, 1
mov ecx, dword [esp + 0x10b8]
xor ecx, ebp
call fcn.100879aa
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret