Function at 0x4b0860
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f1179
mov eax, dword fs:[0]
push eax
mov eax, 0x14cc
call fcn.005c2160
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x147c], ecx
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x103c], 0
push 0xfff
push 0
lea eax, [ebp - 0x103b]
push eax
call fcn.005c0cf0
add esp, 0xc
mov dword [ebp - 0x10], 0
push str.System
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b0c90
lea ecx, [ebp - 0x103c]
mov dword [ebp - 0x105c], ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x10fc]
push eax
push 0x1000
mov ecx, dword [ebp - 0x105c]
push ecx
push 0
push 9
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x4b0c86
cmp dword [ebp - 0x10fc], 0
jbe 0x4b0c49
mov eax, dword [ebp - 0x105c]
mov cx, word [eax + 0x14]
mov word [ebp - 0x111c], cx
movsx edx, word [ebp - 0x111c]
cmp edx, 0x1776
jne 0x4b0a82
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b5d0
movzx eax, al
test eax, eax
je 0x4b0a82
mov ecx, dword [ebp - 0x105c]
mov edx, dword [ecx + 0xc]
xor eax, eax
mov dword [ebp - 0x1124], edx
mov dword [ebp - 0x1120], eax
mov ecx, dword [ebp - 0x1120]
push ecx
mov edx, dword [ebp - 0x1124]
push edx
lea eax, [ebp - 0x1398]
push eax
call fcn.00508880
add esp, 0xc
mov dword [ebp - 0x1480], eax
mov ecx, dword [ebp - 0x1480]
mov dword [ebp - 0x1484], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1484]
push edx
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1398]
call fcn.0040b640
push 1
push 2
lea ecx, [ebp - 0x11a4]
call fcn.0040a750
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b520
push eax
push 0x62351c
lea eax, [ebp - 0x11a4]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea ecx, [ebp - 0x13b4]
push ecx
lea ecx, [ebp - 0x11a4]
call fcn.00408c00
mov dword [ebp - 0x1488], eax
mov edx, dword [ebp - 0x1488]
mov dword [ebp - 0x148c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x148c]
call fcn.0040b520
push eax
push 0x623528
push 0x51
push 0x623548
push 0x40
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13b4]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a4]
call fcn.004094e0
movsx eax, word [ebp - 0x111c]
cmp eax, 0x1775
jne 0x4b0bf0
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b5d0
movzx ecx, al
test ecx, ecx
je 0x4b0bf0
mov edx, dword [ebp - 0x105c]
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x11a8], ecx
mov edx, dword [ebp - 0x11a8]
push edx
mov eax, dword [ebp - 0x11ac]
push eax
lea ecx, [ebp - 0x13d0]
push ecx
call fcn.00508880
add esp, 0xc
mov dword [ebp - 0x1490], eax
mov edx, dword [ebp - 0x1490]
mov dword [ebp - 0x1494], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x1494]
push eax
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b620
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13d0]
call fcn.0040b640
mov ecx, dword [ebp - 0x147c]
mov edx, dword [ebp - 0x11ac]
mov dword [ecx + 0xb0], edx
mov eax, dword [ebp - 0x11a8]
mov dword [ecx + 0xb4], eax
push 1
push 2
lea ecx, [ebp - 0x122c]
call fcn.0040a750
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b520
push eax
push 0x623560
lea ecx, [ebp - 0x122c]
push ecx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x13ec]
push edx
lea ecx, [ebp - 0x122c]
call fcn.00408c00
mov dword [ebp - 0x1498], eax
mov eax, dword [ebp - 0x1498]
mov dword [ebp - 0x149c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x149c]
call fcn.0040b520
push eax
push 0x62356c
push 0x58
push 0x62358c
push 0x40
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x13ec]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x122c]
call fcn.004094e0
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b5d0
movzx ecx, al
test ecx, ecx
jne 0x4b0c1c
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b5d0
movzx edx, al
test edx, edx
jne 0x4b0c1c
jmp 0x4b0c49
mov eax, dword [ebp - 0x105c]
mov ecx, dword [ebp - 0x10fc]
sub ecx, dword [eax]
mov dword [ebp - 0x10fc], ecx
mov edx, dword [ebp - 0x105c]
mov eax, dword [ebp - 0x105c]
add eax, dword [edx]
mov dword [ebp - 0x105c], eax
jmp 0x4b0913
lea ecx, [ebp - 0x103c]
mov dword [ebp - 0x105c], ecx
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b5d0
movzx edx, al
test edx, edx
jne 0x4b0c81
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b5d0
movzx eax, al
test eax, eax
jne 0x4b0c81
jmp 0x4b0c86
jmp 0x4b08e6
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push 0x617a6f
lea ecx, [ebp - 0x10f8]
call fcn.0040b540
mov dword [ebp - 4], 6
lea edx, [ebp - 0x10f8]
push edx
push str.eds_kernel_powertype
call fcn.004040c0
mov ecx, eax
call fcn.0040c6f0
push 0x6235bc
lea ecx, [ebp - 0x10f8]
call fcn.0040b520
push eax
call fcn.005be4ae
add esp, 8
test eax, eax
jne 0x4b0f3f
push 0x617a81
lea ecx, [ebp - 0x1278]
call fcn.0040b540
mov byte [ebp - 4], 7
push 0x617a82
lea ecx, [ebp - 0x1250]
call fcn.0040b540
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1278]
push eax
push str.eds_kernel_quickpowerontime
call fcn.004040c0
mov ecx, eax
call fcn.0040c6f0
lea ecx, [ebp - 0x1250]
push ecx
push str.eds_kernel_quickpowerofftime
call fcn.004040c0
mov ecx, eax
call fcn.0040c6f0
lea ecx, [ebp - 0x1278]
call fcn.0040b520
push eax
call fcn.005bde25
add esp, 4
cdq
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], edx
lea ecx, [ebp - 0x1250]
call fcn.0040b520
push eax
call fcn.005bde25
add esp, 4
cdq
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], edx
mov edx, dword [ebp - 0x147c]
mov eax, dword [ebp - 0x125c]
mov dword [edx + 0xb0], eax
mov ecx, dword [ebp - 0x1258]
mov dword [edx + 0xb4], ecx
mov edx, dword [ebp - 0x1258]
push edx
mov eax, dword [ebp - 0x125c]
push eax
lea ecx, [ebp - 0x1408]
push ecx
call fcn.00508880
add esp, 0xc
mov dword [ebp - 0x14a0], eax
mov edx, dword [ebp - 0x14a0]
mov dword [ebp - 0x14a4], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x14a4]
push eax
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b620
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1408]
call fcn.0040b640
mov ecx, dword [ebp - 0x1230]
push ecx
mov edx, dword [ebp - 0x1234]
push edx
lea eax, [ebp - 0x1424]
push eax
call fcn.00508880
add esp, 0xc
mov dword [ebp - 0x14a8], eax
mov ecx, dword [ebp - 0x14a8]
mov dword [ebp - 0x14ac], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14ac]
push edx
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b620
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1424]
call fcn.0040b640
mov dword [ebp - 0x38], 1
push 1
push 2
lea ecx, [ebp - 0x12fc]
call fcn.0040a750
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b520
push eax
push 0x6235fc
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b520
push eax
push 0x623600
lea eax, [ebp - 0x12fc]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea ecx, [ebp - 0x1440]
push ecx
lea ecx, [ebp - 0x12fc]
call fcn.00408c00
mov dword [ebp - 0x14b0], eax
mov edx, dword [ebp - 0x14b0]
mov dword [ebp - 0x14b4], edx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x14b4]
call fcn.0040b520
push eax
push 0x623618
push 0xb1
push 0x623638
push 0x40
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1440]
call fcn.0040b640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12fc]
call fcn.004094e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1250]
call fcn.0040b640
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1278]
call fcn.0040b640
mov ecx, dword [ebp - 0x147c]
add ecx, 0x94
call fcn.0040b520
push eax
lea ecx, [ebp - 0x34]
call fcn.00516260
mov byte [ebp - 4], 0xd
push 0x617a83
push 0x623650
push 0x62365c
lea eax, [ebp - 0x1118]
push eax
lea ecx, [ebp - 0x34]
call fcn.005162e0
mov byte [ebp - 4], 0xe
push 0x617a96
push 0x623664
push 0x623670
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x34]
call fcn.005162e0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1118]
call fcn.0040b5d0
movzx edx, al
test edx, edx
jne 0x4b1149
lea ecx, [ebp - 0x1118]
call fcn.0040b520
mov dword [ebp - 0x14b8], eax
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b520
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0x14bc]
mov cl, byte [eax]
mov byte [ebp - 0x14bd], cl
mov edx, dword [ebp - 0x14b8]
cmp cl, byte [edx]
jne 0x4b103a
cmp byte [ebp - 0x14bd], 0
je 0x4b102e
mov eax, dword [ebp - 0x14bc]
mov cl, byte [eax + 1]
mov byte [ebp - 0x14be], cl
mov edx, dword [ebp - 0x14b8]
cmp cl, byte [edx + 1]
jne 0x4b103a
add dword [ebp - 0x14bc], 2
add dword [ebp - 0x14b8], 2
cmp byte [ebp - 0x14be], 0
jne 0x4b0fdc
mov dword [ebp - 0x14c4], 0
jmp 0x4b1045
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x14c4], eax
mov ecx, dword [ebp - 0x14c4]
mov dword [ebp - 0x14c8], ecx
cmp dword [ebp - 0x14c8], 0
jge 0x4b1149
lea edx, [ebp - 0x1118]
push edx
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b620
lea eax, [ebp - 0x1058]
push eax
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b620
mov ecx, dword [ebp - 0x147c]
add ecx, 0xb0
push ecx
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b520
push eax
call fcn.005086b0
add esp, 8
mov dword [ebp - 0x38], 2
push 1
push 2
lea ecx, [ebp - 0x137c]
call fcn.0040a750
mov byte [ebp - 4], 0x10
push 0x623678
lea edx, [ebp - 0x137c]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x145c]
push eax
lea ecx, [ebp - 0x137c]
call fcn.00408c00
mov dword [ebp - 0x14cc], eax
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0x14d0], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x14d0]
call fcn.0040b520
push eax
push str.CPowerOnOff::GetPowerOnOffTime
push 0xbf
push 0x6236a4
push 0x40
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x145c]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x137c]
call fcn.004094e0
push 1
push 2
lea ecx, [ebp - 0x10dc]
call fcn.0040a750
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x38]
push edx
push 0x6236bc
mov eax, dword [ebp - 0x147c]
mov ecx, dword [eax + 0xb4]
push ecx
mov edx, dword [eax + 0xb0]
push edx
push 0x6236c8
mov ecx, dword [ebp - 0x147c]
add ecx, 0x58
call fcn.0040b520
push eax
push 0x6236d4
mov ecx, dword [ebp - 0x147c]
add ecx, 0x3c
call fcn.0040b520
push eax
push 0x6236e0
lea eax, [ebp - 0x10dc]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.004665c0
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041c7c0
lea ecx, [ebp - 0x1478]
push ecx
lea ecx, [ebp - 0x10dc]
call fcn.00408c00
mov dword [ebp - 0x14d4], eax
mov edx, dword [ebp - 0x14d4]
mov dword [ebp - 0x14d8], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x14d8]
call fcn.0040b520
push eax
mov ecx, dword [ebp - 0x147c]
call fcn.004b4060
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1478]
call fcn.0040b640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x10dc]
call fcn.004094e0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1058]
call fcn.0040b640
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1118]
call fcn.0040b640
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.004a2dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10f8]
call fcn.0040b640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret