Function at 0x40ef38
Capabilities:
Access the windows event log

Disassembly:
push 0x2b8
mov eax, 0x44e9f8
call fcn.0042bcfc
mov ecx, dword [ecx + 4]
xor ebx, ebx
cmp ecx, ebx
sete al
cmp al, bl
je 0x40ef5c
xor eax, eax
jmp 0x40f42a
cmp ecx, ebx
jne 0x40ef6a
push 0x80004003
call fcn.00429ac0
lea eax, [ebp - 0x27c]
push eax
call fcn.0040e8c7
mov esi, dword [ebp - 0x27c]
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x40ef60
mov ecx, esi
call fcn.0040e2b6
mov dword [ebp - 0x274], eax
cmp eax, ebx
jne 0x40efa0
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
push esi
call dword [eax + 8]
jmp 0x40ef55
push 0x456384
lea ecx, [ebp - 0x26c]
call fcn.004014c2
xor edi, edi
cmp dword [ebp - 0x274], ebx
jle 0x40f35f
jmp 0x40efc6
mov esi, dword [ebp - 0x27c]
push 3
pop eax
mov word [ebp - 0x2c4], ax
mov dword [ebp - 0x2bc], edi
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2b4]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040e881
lea eax, [ebp - 0x2c4]
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x2b4]
cmp esi, ebx
je 0x40ef60
push 0xa
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0040e2e1
push eax
call fcn.0042f21e
add esp, 0xc
push eax
lea ecx, [ebp - 0x298]
call fcn.004014c2
push eax
lea eax, [ebp - 0x2a8]
push str._r_nNumber:
push eax
mov byte [ebp - 4], 5
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 6
call fcn.00406cef
mov ecx, dword [ebp - 0x2a8]
cmp ecx, ebx
je 0x40f06e
call fcn.004016e1
mov dword [ebp - 0x2a8], ebx
mov ecx, dword [ebp - 0x298]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f087
call fcn.004016e1
mov dword [ebp - 0x298], ebx
lea eax, [ebp - 0x2a4]
push eax
mov ecx, esi
call fcn.0040eda9
push eax
lea eax, [ebp - 0x2b0]
push str._r_nSQLState:
push eax
mov byte [ebp - 4], 7
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 8
call fcn.00406cef
mov ecx, dword [ebp - 0x2b0]
cmp ecx, ebx
je 0x40f0d3
call fcn.004016e1
mov dword [ebp - 0x2b0], ebx
mov ecx, dword [ebp - 0x2a4]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f0ec
call fcn.004016e1
mov dword [ebp - 0x2a4], ebx
push 0xa
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0040e337
push eax
call fcn.0042f21e
add esp, 0xc
push eax
lea ecx, [ebp - 0x28c]
call fcn.004014c2
push eax
lea eax, [ebp - 0x2a0]
push str._r_nNativeError:
push eax
mov byte [ebp - 4], 9
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0xa
call fcn.00406cef
mov ecx, dword [ebp - 0x2a0]
cmp ecx, ebx
je 0x40f14c
call fcn.004016e1
mov dword [ebp - 0x2a0], ebx
mov ecx, dword [ebp - 0x28c]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f165
call fcn.004016e1
mov dword [ebp - 0x28c], ebx
lea eax, [ebp - 0x294]
push eax
mov ecx, esi
call fcn.0040ed2d
push eax
lea eax, [ebp - 0x280]
push str._r_nDescription:
push eax
mov byte [ebp - 4], 0xb
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0xc
call fcn.00406cef
mov ecx, dword [ebp - 0x280]
cmp ecx, ebx
je 0x40f1b1
call fcn.004016e1
mov dword [ebp - 0x280], ebx
mov ecx, dword [ebp - 0x294]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f1ca
call fcn.004016e1
mov dword [ebp - 0x294], ebx
lea eax, [ebp - 0x29c]
push eax
mov ecx, esi
call fcn.0040ecef
push eax
lea eax, [ebp - 0x2ac]
push str._r_nSource:
push eax
mov byte [ebp - 4], 0xd
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0xe
call fcn.00406cef
mov ecx, dword [ebp - 0x2ac]
cmp ecx, ebx
je 0x40f216
call fcn.004016e1
mov dword [ebp - 0x2ac], ebx
mov ecx, dword [ebp - 0x29c]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f22f
call fcn.004016e1
mov dword [ebp - 0x29c], ebx
lea eax, [ebp - 0x288]
push eax
mov ecx, esi
call fcn.0040ed6b
push eax
lea eax, [ebp - 0x284]
push str._r_nHelpFile:
push eax
mov byte [ebp - 4], 0xf
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x10
call fcn.00406cef
mov ecx, dword [ebp - 0x284]
cmp ecx, ebx
je 0x40f27b
call fcn.004016e1
mov dword [ebp - 0x284], ebx
mov ecx, dword [ebp - 0x288]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f294
call fcn.004016e1
mov dword [ebp - 0x288], ebx
push 0xa
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0040e30c
push eax
call fcn.0042f21e
add esp, 0xc
push eax
lea ecx, [ebp - 0x270]
call fcn.004014c2
push eax
lea eax, [ebp - 0x290]
push str._r_nHelpContext:
push eax
mov byte [ebp - 4], 0x11
call fcn.00406d91
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x12
call fcn.00406cef
mov ecx, dword [ebp - 0x290]
cmp ecx, ebx
je 0x40f2f4
call fcn.004016e1
mov dword [ebp - 0x290], ebx
mov ecx, dword [ebp - 0x270]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x40f30d
call fcn.004016e1
mov dword [ebp - 0x270], ebx
push 0x456384
lea ecx, [ebp - 0x278]
call fcn.004014c2
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x13
call fcn.00406cef
mov ecx, dword [ebp - 0x278]
cmp ecx, ebx
je 0x40f348
call fcn.004016e1
mov dword [ebp - 0x278], ebx
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 1
call dword [eax + 8]
inc edi
cmp edi, dword [ebp - 0x274]
jl 0x40efc0
push 0x104
lea eax, [ebp - 0x268]
push eax
push dword [0x482c9c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [ebp - 0x26c]
test eax, eax
je 0x40f409
lea eax, [ebp - 0x268]
push 0x2e
push eax
call fcn.0042f0e2
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x268]
mov eax, edx
cmp word [ebp - 0x268], bx
je 0x40f3d2
movzx ecx, word [ebp - 0x268]
cmp cx, 0x5c
je 0x40f3c4
cmp cx, 0x2f
je 0x40f3c4
cmp cx, 0x3a
jne 0x40f3c7
lea edx, [eax + 2]
add eax, 2
movzx ecx, word [eax]
cmp cx, bx
jne 0x40f3b2
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
cmp eax, ebx
je 0x40f409
cmp esi, ebx
je 0x40f3ec
mov ecx, dword [esi]
mov dword [ebp - 0x270], ecx
jmp 0x40f3f2
mov dword [ebp - 0x270], ebx
push ebx
lea ecx, [ebp - 0x270]
push ecx
push ebx
push 1
push ebx
push ebx
push ebx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp esi, ebx
je 0x40f414
mov ecx, esi
call fcn.004016e1
mov eax, dword [ebp - 0x27c]
mov ecx, dword [eax]
or dword [ebp - 4], 0xffffffff
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x274]
call fcn.0042bd7f
ret