Function at 0x414050
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov ecx, dword [eax]
mov eax, dword [0x42eac8]
mov dword [esp + 0x10], 0
mov byte [esp + 0xc], 1
mov dword [esp + 0x1c], ecx
cmp eax, dword [ecx + 4]
jle 0x4140b7
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x4140b7
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
add esp, 4
push 0x42eac8
call fcn.0041e8b5
add esp, 4
cmp dword [0x42ea64], 2
jne 0x41445f
call fcn.00413970
mov esi, eax
mov ebx, 1
test esi, esi
je 0x4140e8
push str.Error:_JhiGetRegistryValues___failed
call fcn.00401aa0
add esp, 4
mov edi, ebx
jmp 0x4142ee
call fcn.004050e0
mov esi, dword [eax + 0x40]
mov dword [esp + 0x14], esi
call fcn.004050e0
mov edi, dword [eax + 0x44]
cmp edi, 0xffffffff
jne 0x414135
mov ecx, esi
call fcn.00413d20
mov edi, eax
cmp edi, 0xffffffff
jne 0x414128
push str.Error:_discoverVmType___failed
call fcn.00401aa0
add esp, 4
mov esi, 0x300
mov edi, ebx
jmp 0x4142ee
call fcn.004050e0
cmp edi, 2
ja 0x414135
mov dword [eax + 0x44], edi
cmp esi, 1
je 0x414168
call fcn.0041c9a0
test al, al
jne 0x414168
push str.failed_to_register_for_HECI_events
call fcn.00401aa0
add esp, 4
mov edx, 0xc0000005
mov ecx, ebx
call fcn.00410fc0
mov esi, 0x300
mov edi, ebx
jmp 0x4142ee
call fcn.004050e0
cmp byte [eax + 0x38], 0
jne 0x4141b9
call fcn.004050e0
mov ebx, eax
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebx + 0x3c]
call fcn.00416b70
mov esi, eax
test esi, esi
jne 0x414196
mov byte [ebx + 0x38], 1
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x4141c8
push str.Error:_JhiPlugin_Register___failed
call fcn.00401aa0
add esp, 4
mov edi, 1
jmp 0x4142ee
push str.VM_Plugin_is_already_registered__skipping_registration
call fcn.00401b10
add esp, 4
jmp 0x4141cc
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
call fcn.004050e0
mov ecx, eax
call fcn.00412f70
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x4141f2
mov esi, 0x601
lea edi, [ebx + 1]
jmp 0x4142ee
push dword [0x42e054]
mov dword [esp + 0x24], fcn.00401cd0
mov ecx, ebx
mov dword [esp + 0x28], fcn.00401d60
mov eax, dword [ebx]
call dword [eax + 0x58]
mov eax, dword [ebx]
lea ecx, [esp + 0x20]
push ecx
push esi
mov ecx, ebx
call dword [eax + 8]
mov esi, eax
test esi, esi
je 0x414239
push str.Error:_pfnSetTransport___failed
call fcn.00401b10
add esp, 4
mov edi, 1
jmp 0x4142ee
cmp dword [esp + 0x14], 3
jne 0x414257
call fcn.004050e0
movzx ecx, byte [esp + 0xc]
xor edx, edx
cmp dword [eax + 0x44], 2
cmove ecx, edx
mov byte [esp + 0xc], cl
mov eax, dword [ebx]
mov ecx, ebx
push dword [esp + 0xc]
call dword [eax]
mov esi, eax
test esi, esi
je 0x41427c
push esi
push str.VM_plugin_Init_failure__with_ret_code:__08x
call fcn.00401b10
add esp, 8
mov edi, 1
jmp 0x4142ee
call fcn.004050e0
mov edx, dword [eax + 0x48]
test dx, dx
jne 0x4142ba
call fcn.004050e0
cmp dword [eax + 0x44], 2
jne 0x41429d
mov ecx, ebx
call fcn.00413e50
jmp 0x4142a2
call fcn.00413f50
mov esi, eax
mov ebx, edx
test si, si
je 0x41441b
call fcn.004050e0
mov dword [eax + 0x48], esi
mov dword [eax + 0x4c], ebx
call fcn.0040f300
mov ecx, eax
call fcn.00411800
mov esi, eax
test esi, esi
je 0x414437
push str.EventManager_Initialize_failed
call fcn.00401b10
add esp, 4
mov edi, 1
mov edx, 0xc0000004
mov ecx, edi
call fcn.00410fc0
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x42eac8]
cmp eax, dword [ecx + 4]
jle 0x414334
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x414334
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
add esp, 4
push 0x42eac8
call fcn.0041e8b5
add esp, 4
push 0xffffffffffffffff
push dword [0x42ea60]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x42ea98], 0
push dword [0x42ea60]
movzx ebx, bl
cmovne ebx, edi
mov edi, dword [0x42ea9c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x414376
test edi, edi
je 0x414376
mov eax, dword [edi]
mov ecx, edi
push dword [esp + 0xc]
call dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x42eac8]
cmp eax, dword [ecx + 4]
jle 0x4143bc
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x4143bc
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
add esp, 4
push 0x42eac8
call fcn.0041e8b5
add esp, 4
cmp byte [0x42ea98], 0
je 0x4143d1
call fcn.004050e0
mov ecx, eax
call fcn.00412fb0
push str.IntelDalJhi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x414405
push 0
push 0
push 0
push 0
push 0
push 0x40000001
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.JHI_init_failed
call fcn.00401aa0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Failed_getting_FW_version_from_FW._Aborting_init.
call fcn.00401aa0
add esp, 4
mov esi, 0x300
mov edi, 1
jmp 0x4142ee
cmp edi, 2
jne 0x414448
call fcn.0040c660
mov ecx, eax
call fcn.004043e0
push 0
call fcn.004050e0
mov ecx, eax
call fcn.00413020
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret