Function at 0x4cb268
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4cb270
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb524
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dc704]
cmp byte [eax], 0
je 0x4cb4e2
xor eax, eax
push ebp
push 0x4cb37f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov cl, 1
mov edx, 1
mov eax, ebx
call fcn.0046f6ec
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, 2
mov eax, ebx
call fcn.0046f6ec
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, 3
mov eax, ebx
call fcn.0046f6ec
lea eax, [ebp - 0x2c]
push eax
mov cl, 1
mov edx, 4
mov eax, ebx
call fcn.0046f6ec
mov eax, dword [ebp - 0x2c]
call fcn.00409ebc
mov esi, eax
lea eax, [ebp - 0x30]
push eax
mov cl, 1
mov edx, 5
mov eax, ebx
call fcn.0046f6ec
mov eax, dword [ebp - 0x30]
call fcn.00409ebc
mov edi, eax
lea eax, [ebp - 0x34]
push eax
mov cl, 1
mov edx, 6
mov eax, ebx
call fcn.0046f6ec
mov eax, dword [ebp - 0x34]
call fcn.00409ebc
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
push eax
mov cl, 1
mov edx, 7
mov eax, ebx
call fcn.0046f6ec
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x18]
call fcn.0046f984
lea eax, [ebp - 0x1c]
push eax
mov cl, 1
mov edx, 8
mov eax, ebx
call fcn.0046f6ec
lea eax, [ebp - 0x20]
push eax
mov cl, 1
mov edx, 9
mov eax, ebx
call fcn.0046f6ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb3a0
cmp dword [ebp - 0x1c], 0
je 0x4cb3b6
push 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0047129c
cmp dword [ebp - 8], 0
je 0x4cb3d8
push 0x4cb558
push dword [ebp - 8]
push 0x4cb568
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405438
jmp 0x4cb3e5
lea eax, [ebp - 0x24]
mov edx, 0x4cb574
call fcn.00405150
mov eax, dword [ebp - 0x10]
call fcn.00405578
push eax
mov eax, dword [ebp - 8]
call fcn.00405578
push eax
call sub.advapi32.dll_RegisterEventSourceA
mov ebx, eax
test ebx, ebx
je 0x4cb4b6
mov eax, dword [ebp - 0x18]
call fcn.00405578
mov dword [ebp - 0x28], eax
cmp esi, 4
ja case.default.0x4cb416
jmp dword [esi*4 + 0x4cb41d]
mov esi, 1
jmp 0x4cb456
mov esi, 2
jmp 0x4cb456
mov esi, 4
jmp 0x4cb456
mov esi, 8
jmp 0x4cb456
mov esi, 0x10
jmp 0x4cb456
xor esi, esi
push 0
lea eax, [ebp - 0x28]
push eax
push 0
push 1
push 0
mov eax, dword [ebp - 0x14]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_ReportEventA
test eax, eax
je 0x4cb484
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4cb590
call fcn.004053c4
jmp 0x4cb4ae
push 0x4cb5b4
push dword [ebp - 0x24]
push 0x4cb5d8
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x3c]
call fcn.004675b4
push dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00405438
push ebx
call sub.advapi32.dll_DeregisterEventSource
jmp 0x4cb4ef
push 0x4cb5e4
push dword [ebp - 0x24]
push 0x4cb5d8
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x40]
call fcn.004675b4
push dword [ebp - 0x40]
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00405438
jmp 0x4cb4ef
mov eax, dword [ebp - 4]
mov edx, 0x4cb610
call fcn.0040510c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb52b
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.004050dc
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004050dc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050dc
ret