Function at 0x4147a0
Capabilities:
Access the windows event log
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42282c
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x430f5c], 1
mov eax, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov ebx, 0x601
mov edi, 1
jne 0x414812
or dword [0x430f5c], edi
mov dword [ebp - 4], 0
call fcn.00414d40
push 0x423530
call fcn.0041d6db
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [0x430f18], 1
jne 0x41483d
or dword [0x430f18], edi
mov dword [ebp - 4], edi
call fcn.00402740
push 0x423420
call fcn.0041d6db
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x430f1c
mov edi, esi
call fcn.00403940
cmp eax, 2
ja 0x4149e4
mov eax, 0x430f44
call fcn.004169a0
push 0x430f44
call fcn.00416e70
push esi
mov ecx, 0x430f44
call fcn.00416bc0
test al, al
jne 0x414880
push esi
mov ecx, 0x430f44
call fcn.00416d20
test byte [0x430ea8], 1
jne 0x4148a2
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov edx, dword [0x430eb0]
push 0xffffffffffffffff
push edx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x430ef4], bl
je 0x4148bd
mov bl, 1
mov eax, dword [0x430eb0]
mov edi, dword [0x430ef8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x4149df
test edi, edi
je 0x4149df
mov edx, dword [ebp - 0x30]
push 0x430f1c
mov ecx, esi
call fcn.00402be0
mov ebx, eax
test ebx, ebx
jne 0x4149e4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edi]
mov edx, dword [edx + 0x3c]
push eax
push ecx
mov ecx, edi
call edx
mov ebx, eax
cmp ebx, 0x2306
jne 0x41493c
cmp dword [esi + 0x14], 0x10
jb 0x41491d
mov eax, dword [esi]
jmp 0x41491f
mov eax, esi
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edi]
mov edx, dword [edx + 0x3c]
push eax
push ecx
mov ecx, edi
call edx
mov ebx, eax
cmp ebx, 0x404
jne 0x414960
call fcn.00412370
test al, al
je 0x414991
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + 0x3c]
push ecx
push edx
mov ecx, edi
call eax
mov ebx, eax
test ebx, ebx
jne 0x414991
push 0x430f1c
mov dl, 1
mov ecx, esi
call fcn.004031e0
test al, al
jne 0x4149db
cmp dword [esi + 0x14], 0x10
mov ebx, 0x601
jb 0x414985
mov eax, dword [esi]
jmp 0x414987
mov eax, esi
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
call fcn.0040a660
push 1
mov ecx, esi
lea edi, [ebp - 0x2c]
call fcn.00404790
cmp dword [eax + 0x14], 8
jb 0x4149aa
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.004016d0
mov edi, dword [ebp - 0x38]
push 0x430f1c
call fcn.00403940
cmp eax, 1
jne 0x4149e4
push edi
mov eax, 0x430f1c
call fcn.004034c0
jmp 0x4149e4
xor ebx, ebx
jmp 0x4149e4
mov ebx, 0x300
test byte [0x430ea8], 1
jne 0x414a06
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
cmp byte [0x430eb8], 0
je 0x414a2e
push ebx
push 0x3011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
test ebx, ebx
je 0x414a66
push 0x425d34
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x414a66
push 0
push 0
push 0
push 0
push 0
push reloc.OLEAUT32.dll_VariantCopy
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret