Function at 0x409950
Capabilities:
Access the windows event log
Resolve dns

Disassembly:
sub esp, 0x11c
mov eax, dword [0x43e008]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x120]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
call edi
push eax
push str.__04d_:_Waiting_for_next_request...
call fcn.00404b70
add esp, 8
lea eax, [esp + 0x10]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov esi, eax
test esi, esi
je 0x4099db
cmp dword [esp + 0x10], 0
jne 0x4099db
cmp dword [esp + 0x14], 0xffffffff
je 0x409c54
call edi
push eax
push str.__04d_:_Received_request...
call fcn.00404b70
mov eax, dword [esp + 0x18]
add esp, 8
test esi, esi
je 0x409bff
test eax, eax
je 0x409bff
mov eax, dword [0x43f2a8]
mov dword [esp + 0x20], eax
mov eax, dword [0x43f290]
push 0xffffffffffffffff
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x409c69
test byte [0x43f278], 2
je 0x409a5f
cmp dword [str.Processing_a_request_with_status__d_on_pContext:_pCIOContext_n], eax
je 0x409a5f
mov eax, dword [esp + 0x10]
push eax
push dword [eax + 0x9c]
mov eax, dword [str.Processing_a_request_with_status__d_on_pContext:_pCIOContext_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x26000
push eax
call fcn.00405110
add esp, 0x14
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x9c]
sub eax, 0
je 0x409b34
sub eax, 1
je 0x409b34
sub eax, 1
je 0x409ac4
test byte [0x43f278], 2
je 0x409be8
cmp dword [str._CSsrp::SSRPWorkerThreadERR__invalid_state_status:__dWINERR_pContext:_pCIOContext__error:__dWINERR_n], 0
je 0x409be8
mov eax, dword [str._CSsrp::SSRPWorkerThreadERR__invalid_state_status:__dWINERR_pContext:_pCIOContext__error:__dWINERR_n]
push 0
push dword [esp + 0x14]
push dword [ecx + 0x9c]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x35c00
push eax
call fcn.00405110
add esp, 0x18
jmp 0x409be8
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
call fcn.00406360
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jne 0x409995
test byte [0x43f278], 2
je 0x409be8
cmp dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR_dispatching_request_error:__dWINERR__pContext:_pCIOContext_n], 0
je 0x409be8
push dword [esp + 0x10]
push 0
call ebp
push eax
mov eax, dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR_dispatching_request_error:__dWINERR__pContext:_pCIOContext_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x2bc00
push eax
call fcn.00405110
add esp, 0x18
jmp 0x409be8
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x10]
call fcn.00407820
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jne 0x409995
test byte [0x43f278], 2
je 0x409b93
cmp dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR__receiving_request_error:__dWINERR__pContext:_pCIOContext_n], 0
je 0x409b93
push dword [esp + 0x10]
push 0
call ebp
push eax
mov eax, dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR__receiving_request_error:__dWINERR__pContext:_pCIOContext_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x33000
push eax
call fcn.00405110
add esp, 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebp
mov dword [esp + 0x1c], eax
call ebp
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x409bdd
lea eax, [esp + 0x1c]
push eax
push 0
push 4
push 0
push 0
push 0xc04e0008
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
jmp 0x409bdf
push 0
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push 0
call fcn.004097a0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x409c4a
test byte [0x43f278], 2
je 0x409c37
cmp dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR_completion_status:__dWINERR__pCIOContext_n], 0
je 0x409c33
push dword [esp + 0x10]
push 0
call ebp
push eax
mov eax, dword [str._CSsrp::SSRPWorkerThreadERR___dWINERR_completion_status:__dWINERR__pCIOContext_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x20400
push eax
call fcn.00405110
add esp, 0x18
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409d53
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.004097a0
test eax, eax
jne 0x409995
jmp 0x409c79
call edi
push eax
push str.__04d_:_Received_shutdown...
call fcn.00404b70
add esp, 8
jmp 0x409d53
call edi
push eax
push str.__04d_:_Forced_shutdown...
call fcn.00404b70
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x409d53
push 0x100
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x34]
add esp, 0xc
add ecx, 8
mov esi, 2
mov edx, 0x10
cmp si, word [ecx]
push 2
push 0
push 0
push 0xff
push eax
mov eax, 0x1c
cmove eax, edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_getnameinfo]
test byte [0x43f278], 2
je 0x409cfa
cmp dword [str._CSsrp::SSRPWorkerThreadERRRET__worker_thread_terminated:__dWINERR_n], 0
je 0x409cfa
call ebp
push eax
mov eax, dword [str._CSsrp::SSRPWorkerThreadERRRET__worker_thread_terminated:__dWINERR_n]
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwsworker.cpp]
push 0x3f400
push eax
call fcn.00405110
add esp, 0x10
lea ebx, [esp + 0x28]
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x409d01
sub ebx, ecx
call ebp
push str.SQLBrowser
push 0
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x409d43
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [ebx + 1]
push eax
push 0
push 0
push 0xc04e000e
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
jmp 0x409d45
push 0
mov eax, dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x128]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004145b4
add esp, 0x11c
ret 4