Function at 0x40d8d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
xor ebx, ebx
test byte [0x422b68], 1
jne 0x40d8fb
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp byte [0x422b78], bl
je 0x40d921
push 0x1010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
test byte [0x422b68], 1
jne 0x40d943
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp dword [0x422b74], 2
jne 0x40daac
push esi
push edi
call fcn.004160d0
test al, al
jne 0x40dafd
push 0x41be5c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40d993
push 0
push 0
push 0
push 0
push 0
push 0xc0000005
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ebx, 0x300
test byte [0x422b68], 1
jne 0x40d9ba
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov edx, dword [0x422b70]
push 0xffffffffffffffff
push edx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x422bb4], 0
je 0x40d9da
mov byte [ebp - 1], 1
mov eax, dword [0x422b70]
mov ecx, 0xd
mov esi, 0x422bb8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call esi
cmp byte [ebp - 1], 0
je 0x40da07
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [ebp - 0x44]
add esp, 4
test byte [0x422b68], 1
jne 0x40da29
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov edx, dword [0x422b70]
push 0xffffffffffffffff
push edx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x422bb5], 0
je 0x40da74
mov eax, dword [0x422bec]
mov ecx, dword [0x422bf0]
mov edx, dword [0x422bf4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x422bf8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x422bfc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 1
mov edx, dword [0x422b70]
push edx
call esi
cmp byte [ebp - 1], 0
je 0x40da88
call fcn.0040d7d0
test byte [0x422b68], 1
jne 0x40daaa
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
pop edi
pop esi
test byte [0x422b68], 1
jne 0x40dace
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp byte [0x422b78], 0
je 0x40daf6
push ebx
push 0x1011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040d4f0
mov ebx, eax
test ebx, ebx
jne 0x40d998
call fcn.00406f10
call fcn.00402a30
test al, al
je 0x40d993
lea esi, [ebp - 0x18]
call fcn.0040d880
test al, al
jne 0x40db3e
push 0xc0000005
push 1
call fcn.0040be90
add esp, 8
jmp 0x40d993
call fcn.00403810
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call edi
push 0x14
lea ecx, [ebp - 0x18]
push ecx
lea edx, [esi + 0x7c]
push 0x14
push edx
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
add esp, 0x10
push eax
mov byte [esi + 0x45], 1
call ebx
call fcn.00403810
cmp byte [eax + 0x44], 0
jne 0x40dbb4
call fcn.00403810
mov esi, eax
mov ecx, dword [esi]
push 0xffffffffffffffff
push ecx
call edi
lea edx, [esi + 0x48]
push edx
call fcn.0040fcd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x40dba5
mov byte [esi + 0x44], 1
mov eax, dword [esi]
push eax
call ebx
mov ebx, edi
test edi, edi
jne 0x40d998
call fcn.00403810
mov ebx, eax
lea eax, [ebp - 0x4c]
call fcn.0040d470
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [ebp - 0x40]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40d998
push esi
call dword [ebp - 0x48]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40d998
call fcn.0040a0a0
mov ecx, eax
call fcn.0040c210
mov ebx, eax
test ebx, ebx
jne 0x40d998
call fcn.0040f520
push ebx
call fcn.00403810
mov esi, eax
call fcn.0040d4c0
jmp 0x40daaa