Function at 0x646155be
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x646170a0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [esp + 0x18], 0
add esp, 0xc
xor esi, esi
mov eax, dword [0x64617004]
mov edi, 0x64617004
mov ecx, 0x64603fe0
cmp eax, edi
je 0x64615631
test byte [eax + 0x1c], 2
je 0x64615631
cmp byte [eax + 0x19], 5
jb 0x64615631
push dword [eax + 0x14]
mov edx, ecx
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.64604453
mov eax, dword [0x64617004]
mov ecx, 0x64603fe0
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x40
jbe 0x64615653
cmp eax, edi
je 0x6461567b
test byte [eax + 0x1c], 2
je 0x6461567b
cmp byte [eax + 0x19], 2
jb 0x6461567b
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
jmp 0x64615673
cmp dword [0x64617474], esi
jne 0x64615682
cmp eax, edi
je 0x6461567b
test byte [eax + 0x1c], 2
je 0x6461567b
cmp byte [eax + 0x19], 3
jb 0x6461567b
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
mov edx, ecx
pop ecx
call fcn.64604453
xor eax, eax
jmp 0x6461581b
push 0x64617454
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x64617478]
xor ecx, ecx
test edx, edx
je 0x646156c0
mov eax, dword [0x64617450]
mov edi, dword [ebp + 0xc]
add eax, 8
mov ebx, dword [ebp + 8]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp + 0x10]
jne 0x646156b3
cmp edi, dword [eax]
ja 0x6461570d
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x646156a4
mov edi, 0x64617004
xor ecx, ecx
test ebx, ebx
je 0x646156e3
lea edx, [ebp + 0x14]
lea edx, [edx + 4]
mov eax, dword [edx]
mov dword [esp + ecx*4 + 0x10], eax
test eax, eax
jne 0x646156de
mov dword [esp + ecx*4 + 0x10], 0x646012ec
inc ecx
cmp ecx, ebx
jb 0x646156c9
mov eax, dword [ebp + 0x14]
shr eax, 0x1e
cmp eax, 1
jbe 0x646157a5
push 2
pop edx
cmp eax, edx
je 0x6461579b
cmp eax, 3
jne 0x6461571d
xor edi, edi
inc edi
inc dword [0x64617470]
jmp 0x64615749
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x6461567b
mov ecx, dword [0x64617004]
cmp ecx, edi
je 0x64615745
test byte [ecx + 0x1c], dl
je 0x64615745
cmp byte [ecx + 0x19], dl
jb 0x64615745
push eax
push dword [ecx + 0x14]
mov edx, 0x64603fe0
push dword [ecx + 0x10]
push 0x17
pop ecx
call fcn.64604471
mov edi, dword [esp + 0xc]
push 0x64617454
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 1
je 0x646157bd
sub eax, 1
je 0x646157b8
sub eax, 1
je 0x646157b4
sub eax, 1
je 0x646157b0
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646157c0
test byte [eax + 0x1c], 2
je 0x646157c0
cmp byte [eax + 0x19], 2
jb 0x646157c0
push ecx
push dword [eax + 0x14]
mov edx, 0x64603fe0
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.64604471
jmp 0x646157c0
inc dword [0x6461747c]
mov edi, edx
jmp 0x64615749
inc dword [0x6461746c]
push 4
pop edi
jmp 0x64615749
push 4
jmp 0x646157ba
push 3
jmp 0x646157ba
push 2
pop esi
jmp 0x646157c0
xor esi, esi
inc esi
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
push ebx
push ecx
push dword [ebp + 0x14]
push esi
push edi
push dword [0x64617474]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x64615818
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64615818
test byte [eax + 0x1c], 2
je 0x64615818
cmp byte [eax + 0x19], 2
jb 0x64615818
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x64617004]
mov edx, 0x64603fe0
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x19
pop ecx
call fcn.64604471
xor eax, eax
inc eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.64615e30
mov esp, ebp
pop ebp
ret