Function at 0x40bb70
Capabilities:
Access the windows event log
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41bfdc
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x423018]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test byte [0x423ce4], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], edx
jne 0x40bbf7
or dword [0x423ce4], 1
mov dword [esp + 0xc8], edi
call fcn.004109f0
push 0x41c710
call fcn.0041946d
add esp, 4
mov dword [esp + 0xc8], esi
test byte [0x423cb0], 1
jne 0x40bc2b
mov eax, 1
or dword [0x423cb0], eax
mov dword [esp + 0xc8], eax
call fcn.00402990
push 0x41c690
call fcn.0041946d
add esp, 4
mov dword [esp + 0xc8], esi
test byte [0x423c0c], 1
jne 0x40bc5f
or dword [0x423c0c], 1
mov dword [esp + 0xc8], 2
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [esp + 0xc8], esi
cmp byte [0x423c15], 0
je 0x40bc86
push 0x7010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
mov eax, ebx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], edi
mov byte [esp + 0x4c], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bca0
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x4c]
call fcn.00401fb0
push 0x423cb4
mov edi, esi
mov dword [esp + 0xcc], 3
call fcn.00403a80
mov dword [esp + 0xc8], 0xffffffff
cmp dword [esp + 0x60], 0x10
mov esi, eax
jb 0x40bcef
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp esi, 2
ja 0x40c63a
xor eax, eax
cmp esi, eax
jne 0x40bde1
xor ecx, ecx
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], cx
mov dword [esp + 0xc8], 4
mov dword [esp + 0x78], eax
mov eax, ebx
mov dword [esp + 0x7c], 0xf
mov byte [esp + 0x68], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd35
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x68]
call fcn.00401fb0
mov edx, esi
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0xcc], 5
call fcn.00403620
mov byte [esp + 0xc8], 4
cmp dword [esp + 0x7c], 0x10
mov byte [esp + 0x13], al
jb 0x40bd80
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40bf1e
mov eax, dword [esp + 0x4c]
mov esi, 8
cmp dword [esp + 0x60], esi
jae 0x40bd9e
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.0040e7b0
add esp, 8
mov dword [esp + 0xc8], 0xffffffff
test eax, eax
je 0x40bdcd
lea esi, [esp + 0x4c]
mov dword [esp + 0x14], 0x402
call fcn.00401a30
jmp 0x40c642
cmp dword [esp + 0x60], esi
jb 0x40bde1
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [ebp + 0x10], 1
mov eax, ebx
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
lea edx, [eax + 1]
jne 0x40c1b7
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be05
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x68]
call fcn.00401fb0
push 0
mov edx, esi
push edx
mov ecx, 0x423cd0
mov dword [esp + 0xd0], 6
call fcn.00411820
mov dword [esp + 0xc8], 0xffffffff
cmp dword [esp + 0x7c], 0x10
mov byte [esp + 0x13], al
jb 0x40be59
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
mov eax, ebx
je 0x40bf4c
lea ecx, [esp + 0x68]
call fcn.00401990
push 1
lea ecx, [esp + 0x6c]
push ecx
mov ecx, 0x423cd0
mov dword [esp + 0xd0], 7
call fcn.00411820
or edi, 0xffffffff
lea esi, [esp + 0x68]
mov byte [esp + 0x13], al
mov dword [esp + 0xc8], edi
call fcn.004019d0
cmp byte [esp + 0x13], 0
je 0x40bf3f
mov eax, ebx
lea ecx, [esp + 0x68]
call fcn.00401990
push 1
push 0x423cd0
lea edx, [esp + 0x70]
lea ecx, [esp + 0x38]
mov dword [esp + 0xd0], 8
call fcn.00411620
lea esi, [esp + 0x68]
mov dword [esp + 0xc8], edi
call fcn.004019d0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
mov edx, dword [eax + 8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x10]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0x14]
lea esi, [esp + 0x30]
mov dword [ecx + 0xc], eax
mov dword [esp + 0x14], 0
call fcn.0040c700
jmp 0x40c642
lea esi, [esp + 0x4c]
mov dword [esp + 0x14], 0x402
mov dword [esp + 0xc8], 0xffffffff
call fcn.00401a30
jmp 0x40c642
mov dword [esp + 0x14], 0x100b
jmp 0x40c642
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bf64
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x4c]
call fcn.00401fb0
mov dword [esp + 0xc8], 9
mov ecx, dword [0x423ccc]
push 0xffffffffffffffff
push ecx
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, esi
push edx
mov eax, 0x423cb4
call fcn.004047e0
mov dword [esp + 0x14], eax
cmp eax, dword [0x423cb8]
je 0x40c009
mov esi, dword [eax + 0x1c]
mov edx, 0x10
cmp dword [eax + 0x20], edx
jb 0x40bfc4
mov ecx, dword [eax + 0xc]
jmp 0x40bfc7
lea ecx, [eax + 0xc]
mov edi, dword [esp + 0x5c]
mov eax, edi
cmp edi, esi
jb 0x40bfd3
mov eax, esi
cmp dword [esp + 0x60], edx
mov edx, dword [esp + 0x4c]
jae 0x40bfe1
lea edx, [esp + 0x4c]
call fcn.004028a0
test eax, eax
jne 0x40bffc
cmp edi, esi
jae 0x40bff3
or eax, 0xffffffff
jmp 0x40bffa
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sets al
test al, al
jne 0x40c009
lea eax, [esp + 0x14]
jmp 0x40c016
mov eax, dword [0x423cb8]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov ecx, dword [0x423cb8]
cmp dword [eax], ecx
setne al
test al, al
je 0x40c03a
lea edx, [esp + 0x4c]
mov ecx, 0x423cb4
call fcn.00403ed0
mov dl, byte [eax + 4]
mov byte [esp + 0x13], dl
mov eax, dword [0x423ccc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x13], 0
sete byte [esp + 0x13]
or esi, 0xffffffff
mov dword [esp + 0xc8], esi
cmp dword [esp + 0x60], 0x10
jb 0x40c06f
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40c083
mov dword [esp + 0x14], 0x100d
jmp 0x40c642
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x40c09d
cmp eax, 0x720
jne 0x40c63a
test byte [0x423c0c], 1
jne 0x40c0d1
or dword [0x423c0c], 1
mov dword [esp + 0xc8], 0xa
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [esp + 0xc8], esi
mov eax, dword [0x423c10]
push esi
push eax
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x423c14], 0
je 0x40c0f1
mov byte [esp + 0x13], 1
mov ecx, 0xd
mov esi, 0x423c50
lea edi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x423c10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x13], 0
jne 0x40c125
mov dword [esp + 0x14], 0x300
jmp 0x40c642
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0xb4]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x58]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 8], edx
lea edx, [esp + 0x38]
push edx
push ebx
push edi
mov dword [eax + 0xc], ecx
call dword [esp + 0xc8]
add esp, 0x20
mov dword [esp + 0x14], eax
cmp eax, 0x404
jne 0x40c558
push 0x423cd0
call fcn.00412610
test al, al
je 0x40c54b
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x38]
push eax
push ebx
push edi
call dword [esp + 0xc8]
jmp 0x40c53d
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c1b7
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x68]
call fcn.00401fb0
push 1
mov ecx, esi
push ecx
mov ecx, 0x423cd0
mov dword [esp + 0xd0], 0xb
call fcn.00411820
test al, al
sete byte [esp + 0x13]
mov dword [esp + 0xc8], 0xffffffff
cmp dword [esp + 0x7c], 0x10
jb 0x40c20e
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40bf3f
test byte [ebp + 0x14], 1
je 0x40c410
mov eax, ebx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c240
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x4c]
call fcn.00401fb0
mov dword [esp + 0xc8], 0xc
mov eax, dword [0x423ccc]
push 0xffffffffffffffff
push eax
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x20]
push ecx
mov edi, esi
mov eax, 0x423cb4
call fcn.00403fe0
mov eax, dword [eax]
cmp eax, dword [0x423cb8]
je 0x40c2a2
mov edx, esi
mov ecx, 0x423cb4
call fcn.00403ed0
mov dl, byte [eax + 4]
mov byte [esp + 0x13], dl
mov eax, dword [0x423ccc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x13], 0
mov dword [esp + 0xc8], 0xffffffff
sete byte [esp + 0x13]
cmp dword [esp + 0x60], 0x10
jb 0x40c2d8
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40c2ec
mov dword [esp + 0x14], 0x100d
jmp 0x40c642
mov eax, ebx
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c306
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x68]
call fcn.00401fb0
mov eax, dword [esp + 0x18]
mov edx, esi
push edx
push eax
push 0x423cd0
mov dword [esp + 0xd4], 0xd
call fcn.00412bd0
mov dword [esp + 0xc8], 0xffffffff
cmp dword [esp + 0x7c], 0x10
mov byte [esp + 0x13], al
jb 0x40c35d
mov ecx, dword [esp + 0x68]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40c410
mov edi, dword [esp + 0x18]
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [edi + 8]
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0xc]
push ebx
mov dword [eax + 8], edx
push 0x423cd0
mov dword [eax + 0xc], ecx
call fcn.004127d0
test al, al
je 0x40c3a7
mov dword [esp + 0x14], 0
jmp 0x40c642
mov edx, dword [edi]
mov ecx, dword [edi + 4]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [edi + 8]
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0xc]
mov dword [eax + 8], edx
mov esi, 0x423cd0
mov dword [eax + 0xc], ecx
call fcn.004124d0
test al, al
je 0x40c403
mov edx, dword [edi]
mov ecx, dword [edi + 4]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [edi + 8]
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0xc]
push ebx
mov dword [eax + 8], edx
push esi
mov dword [eax + 0xc], ecx
call fcn.004127d0
test al, al
je 0x40c403
mov dword [esp + 0x14], 0
jmp 0x40c642
mov dword [esp + 0x14], 0x100e
jmp 0x40c642
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x40c42a
cmp eax, 0x720
jne 0x40c63a
test byte [0x423c0c], 1
jne 0x40c462
or dword [0x423c0c], 1
mov dword [esp + 0xc8], 0xe
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [esp + 0xc8], 0xffffffff
mov eax, dword [0x423c10]
push 0xffffffffffffffff
push eax
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x423c14], 0
je 0x40c483
mov byte [esp + 0x13], 1
mov ecx, 0xd
mov esi, 0x423c50
lea edi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x423c10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x13], 0
jne 0x40c4b7
mov dword [esp + 0x14], 0x300
jmp 0x40c642
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0xb4]
mov edi, dword [esp + 0xa8]
push edx
mov edx, dword [esp + 0x44]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x38]
push eax
push ebx
push esi
call edi
add esp, 0x20
mov dword [esp + 0x14], eax
cmp eax, 0x404
jne 0x40c558
push 0x423cd0
call fcn.00412610
test al, al
je 0x40c54b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x58]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 8], edx
lea edx, [esp + 0x38]
push edx
push ebx
push esi
mov dword [eax + 0xc], ecx
call edi
add esp, 0x20
mov dword [esp + 0x14], eax
cmp eax, 0x404
jne 0x40c558
mov dword [esp + 0x14], 0x100c
jmp 0x40c642
cmp dword [esp + 0x14], 0
jne 0x40c642
mov eax, ebx
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], 0
mov byte [esp + 0x84], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c586
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x84]
call fcn.00401fb0
mov dword [esp + 0xc8], 0xf
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x58]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x38]
mov edx, dword [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x48]
push eax
push 0x423cd0
mov ecx, esi
call fcn.00410a90
mov dword [esp + 0xc8], 0xffffffff
cmp dword [esp + 0x98], 0x10
mov bl, al
jb 0x40c615
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x40c63a
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [eax], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
jmp 0x40c642
mov dword [esp + 0x14], 0x601
test byte [0x423c0c], 1
jne 0x40c66f
or dword [0x423c0c], 1
mov dword [esp + 0xc8], 0x10
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
cmp byte [0x423c15], 0
mov edi, dword [esp + 0x14]
je 0x40c69b
push edi
push 0x7011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
test edi, edi
je 0x40c6d3
push 0x41dee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40c6d3
push 0
push 0
push 0
push 0
push 0
push 0x8000000a
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, edi
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00419346
mov esp, ebp
pop ebp
ret