Function at 0x403f00
Capabilities:
Access the windows event log
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x418014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x538]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x538], 0x11c
push eax
mov edi, ecx
mov dword [ebp - 0x53c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403f4d
cmp dword [ebp - 0x534], 6
mov eax, 1
cmovae esi, eax
mov ecx, str._sAppEvent.evt
test esi, esi
mov eax, str._sApplication.evtx
cmove eax, ecx
push ebx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004049e0
mov ecx, str._sSysEvent.evt
test esi, esi
mov eax, str._sSystem.evtx
cmove eax, ecx
push ebx
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.004049e0
add esp, 0x18
push str.Application
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov ebx, dword [sym.imp.mketools.dll_MkeTlTraceLevel0]
mov dword [ebp - 0x540], eax
test eax, eax
je 0x403ff1
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push dword [ebp - 0x540]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea eax, [ebp - 0x210]
push eax
test esi, esi
je 0x403fe0
push str._LogSave__Windows_application_log:_Successful_backup__s_n
call dword [sym.imp.mketools.dll_MkeTlTraceLevel3]
add esp, 8
xor esi, esi
jmp 0x404004
push str._LogSave___ERR__Windows_application_log:_Backup_failure__s_n
call ebx
add esp, 8
mov esi, 0xfffffffe
jmp 0x403ffe
push str._LogSave___ERR__Windows_application_log:_Failed_in_opening_n
call ebx
add esp, 4
or esi, 0xffffffff
mov dword [ebp - 0x53c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp dword [edi + 0x18cc], eax
je 0x404033
cmp dword [edi + 0x18d0], 0
jne 0x40402e
push 0x64
call ebx
cmp dword [edi + 0x18cc], 0
jne 0x404014
xor eax, eax
jmp 0x404033
mov eax, 1
inc dword [edi + 0x18d4]
cmp dword [edi + 0x18d0], 0
jne 0x404046
test eax, eax
je 0x40405e
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c38d
mov esp, ebp
pop ebp
ret 4
test esi, esi
jne 0x40412a
push str.System
push esi
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [ebp - 0x540], eax
test eax, eax
je 0x4040cf
lea ecx, [ebp - 0x41c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push dword [ebp - 0x540]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea eax, [ebp - 0x41c]
push eax
test esi, esi
je 0x4040b9
push str._LogSave__Windows_sysytem_log:_Successful_backup__s_n
call dword [sym.imp.mketools.dll_MkeTlTraceLevel3]
mov esi, dword [ebp - 0x53c]
add esp, 8
jmp 0x4040e3
mov eax, dword [sym.imp.mketools.dll_MkeTlTraceLevel0]
push str._LogSave___ERR__Windows_sysytem_log:_Backup_failure__s_n
call eax
add esp, 8
mov esi, 0xfffffffc
jmp 0x4040e3
mov eax, dword [sym.imp.mketools.dll_MkeTlTraceLevel0]
push str._LogSave___ERR__Windows_sysytem_log:_Failed_in_opening_n
call eax
add esp, 4
mov esi, 0xfffffffd
xor eax, eax
cmp dword [edi + 0x18cc], eax
je 0x40410f
nop dword [eax]
cmp dword [edi + 0x18d0], 0
jne 0x40410a
push 0x64
call ebx
cmp dword [edi + 0x18cc], 0
jne 0x4040f0
xor eax, eax
jmp 0x40410f
mov eax, 1
inc dword [edi + 0x18d4]
cmp dword [edi + 0x18d0], 0
jne 0x404046
test eax, eax
jne 0x404046
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c38d
mov esp, ebp
pop ebp
ret 4