Function at 0x40e520
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c03e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x424018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
or ebx, 0xffffffff
test byte [0x424ce4], 1
lea esi, [ebx + 2]
jne 0x40e577
or dword [0x424ce4], esi
mov dword [ebp - 4], 0
call fcn.00410dc0
push 0x41cea0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
push 0x424cd0
call fcn.00411880
test byte [0x424c0c], 1
jne 0x40e5a8
or dword [0x424c0c], esi
mov dword [ebp - 4], esi
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x424ca4]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call edi
mov ecx, dword [0x424cac]
push ebx
push ecx
call edi
test byte [0x424c0c], 1
jne 0x40e5ec
or dword [0x424c0c], esi
mov dword [ebp - 4], 2
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
cmp byte [0x424c14], 0
jne 0x40e63c
test byte [0x424c0c], 1
jne 0x40e61d
or dword [0x424c0c], esi
mov dword [ebp - 4], 3
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov edx, dword [0x424ca4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41eee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e670
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test byte [0x424cb0], 1
jne 0x40e69c
or dword [0x424cb0], 1
mov dword [ebp - 4], 4
call fcn.00402900
push 0x41ce20
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x424ccc]
push ebx
push eax
call edi
mov ecx, dword [0x424cb8]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x424cb4
call fcn.00404180
mov eax, dword [0x424cb8]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [eax + 4], eax
mov eax, dword [0x424cb8]
mov dword [eax], eax
mov eax, dword [0x424cb8]
mov dword [eax + 8], eax
mov eax, dword [0x424ccc]
push eax
mov dword [0x424cbc], 0
call esi
test byte [0x424ce4], 1
jne 0x40e714
or dword [0x424ce4], 1
mov dword [ebp - 4], 5
call fcn.00410dc0
push 0x41cea0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
push 0x424cd0
call fcn.00411de0
test byte [0x424cf8], 1
jne 0x40e742
or dword [0x424cf8], 1
push 0x41cf80
mov byte [0x424cf4], 0
call fcn.00419b1d
add esp, 4
cmp byte [0x424cf4], 0
je 0x40e755
push 0x424ce8
call fcn.0040d0e0
mov byte [0x424cf4], 0
call fcn.0040e130
mov eax, dword [0x426ddc]
test eax, eax
je 0x40e78c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e78c
mov ecx, dword [0x426de0]
push ecx
mov dword [0x426ddc], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test byte [0x424c0c], 1
jne 0x40e7b8
or dword [0x424c0c], 1
mov dword [ebp - 4], 6
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
mov edx, dword [0x424c10]
push ebx
push edx
call edi
mov eax, dword [0x424c10]
push eax
mov byte [0x424c14], 0
call esi
test byte [0x424c0c], 1
jne 0x40e7fd
or dword [0x424c0c], 1
mov dword [ebp - 4], 7
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, dword [0x424c9c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x424c0c], 1
jne 0x40e833
or dword [0x424c0c], 1
mov dword [ebp - 4], 8
call fcn.0040dbc0
push 0x41cdb0
call fcn.00419b1d
add esp, 4
mov edx, dword [0x424ca4]
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret