Function at 0x40b990
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41c920
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x425018]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x425018]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x18], edi
test byte [0x425ce8], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
jne 0x40ba1d
or dword [0x425ce8], 1
mov dword [esp + 0xc0], edi
call fcn.00410760
push 0x41d060
call fcn.00419c3d
add esp, 4
or esi, 0xffffffff
mov dword [esp + 0xc0], esi
jmp 0x40ba20
or esi, 0xffffffff
test byte [0x425cb0], 1
jne 0x40ba54
mov eax, 1
or dword [0x425cb0], eax
mov dword [esp + 0xc0], eax
call fcn.00402a10
push 0x41cfe0
call fcn.00419c3d
add esp, 4
mov dword [esp + 0xc0], esi
test byte [0x425c0c], 1
jne 0x40ba88
or dword [0x425c0c], 1
mov dword [esp + 0xc0], 2
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [esp + 0xc0], esi
cmp byte [0x425c15], 0
je 0x40baaf
push 0x7010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
mov al, byte [ebp + 0x10]
dec al
cmp al, 1
ja 0x40bdae
mov eax, ebx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], edi
mov byte [esp + 0x34], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bad2
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x34]
call fcn.00402000
push 0x425cb4
mov edi, esi
mov dword [esp + 0xc4], 3
call fcn.00403ae0
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x48], 0x10
mov esi, eax
jb 0x40bb21
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp esi, 2
ja 0x40bdae
xor eax, eax
cmp esi, eax
jne 0x40bc15
xor edx, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], dx
mov dword [esp + 0xc0], 4
mov dword [esp + 0x70], eax
mov eax, ebx
mov byte [esp + 0x60], dl
mov dword [esp + 0x74], 0xf
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bb67
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x60]
call fcn.00402000
mov eax, esi
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xc4], 5
call fcn.00403680
mov byte [esp + 0xc0], 4
cmp dword [esp + 0x74], 0x10
mov byte [esp + 0x17], al
jb 0x40bbb2
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40bd0a
mov eax, dword [esp + 0x34]
mov esi, 8
cmp dword [esp + 0x48], esi
jae 0x40bbd0
lea eax, [esp + 0x34]
push 1
push eax
push ebx
call fcn.0040e4f0
add esp, 0xc
mov dword [esp + 0xc0], 0xffffffff
test eax, eax
je 0x40bc01
lea esi, [esp + 0x34]
mov dword [esp + 0x18], 0x402
call fcn.00401a90
jmp 0x40bdb6
cmp dword [esp + 0x48], esi
jb 0x40bc15
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x425cd0
call fcn.00412240
push 0x425cd0
call fcn.00412730
cmp byte [ebp + 0x10], 1
jne 0x40bd2b
mov eax, ebx
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc50
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x60]
call fcn.00402000
push 2
mov eax, esi
mov dword [esp + 0xc4], 6
push eax
mov ecx, 0x425cd0
mov dword [esp + 0x20], 1
call fcn.00411580
test al, al
jne 0x40bd90
mov byte [esp + 0x17], 0
test byte [esp + 0x18], 2
je 0x40bccb
and dword [esp + 0x18], 0xfffffffd
cmp dword [esp + 0x48], 0x10
jb 0x40bcb6
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
mov dword [esp + 0xc0], 0xffffffff
test byte [esp + 0x18], 1
je 0x40bcf2
cmp dword [esp + 0x74], 0x10
jb 0x40bcf2
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40bd9a
mov dword [esp + 0x18], 0x100b
jmp 0x40bdb6
lea esi, [esp + 0x34]
mov dword [esp + 0x18], 0x402
mov dword [esp + 0xc0], 0xffffffff
call fcn.00401a90
jmp 0x40bdb6
cmp byte [ebp + 0x10], 2
jne 0x40bc90
mov eax, ebx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd50
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x34]
call fcn.00402000
push 1
mov ecx, esi
push ecx
mov dword [esp + 0xc8], 7
mov ecx, 0x425cd0
mov dword [esp + 0x20], 2
call fcn.00411580
test al, al
je 0x40bc90
mov byte [esp + 0x17], 1
jmp 0x40bc95
cmp byte [ebp + 0x10], 1
jne 0x40be6d
test byte [ebp + 0x14], 1
jne 0x40be77
mov dword [esp + 0x18], 0x601
test byte [0x425c0c], 1
jne 0x40bde3
or dword [0x425c0c], 1
mov dword [esp + 0xc0], 0xc
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
cmp byte [0x425c15], 0
mov edi, dword [esp + 0x18]
je 0x40be0f
push edi
push 0x7011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
test edi, edi
je 0x40be47
push 0x41ef14
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40be47
push 0
push 0
push 0
push 0
push 0
push 0x8000000a
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, edi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00419b16
mov esp, ebp
pop ebp
ret
test byte [ebp + 0x14], 1
je 0x40c076
mov eax, ebx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be91
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x34]
call fcn.00402000
mov dword [esp + 0xc0], 8
mov ecx, dword [0x425ccc]
push 0xffffffffffffffff
push ecx
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, esi
push edx
mov eax, 0x425cb4
call fcn.00404740
mov dword [esp + 0x18], eax
cmp eax, dword [0x425cb8]
je 0x40bf36
mov esi, dword [eax + 0x1c]
mov edx, 0x10
cmp dword [eax + 0x20], edx
jb 0x40bef1
mov ecx, dword [eax + 0xc]
jmp 0x40bef4
lea ecx, [eax + 0xc]
mov edi, dword [esp + 0x44]
mov eax, edi
cmp edi, esi
jb 0x40bf00
mov eax, esi
cmp dword [esp + 0x48], edx
mov edx, dword [esp + 0x34]
jae 0x40bf0e
lea edx, [esp + 0x34]
call fcn.004028f0
test eax, eax
jne 0x40bf29
cmp edi, esi
jae 0x40bf20
or eax, 0xffffffff
jmp 0x40bf27
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sets al
test al, al
jne 0x40bf36
lea eax, [esp + 0x18]
jmp 0x40bf43
mov eax, dword [0x425cb8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
mov ecx, dword [0x425cb8]
cmp dword [eax], ecx
setne al
test al, al
je 0x40bf67
lea edx, [esp + 0x34]
mov ecx, 0x425cb4
call fcn.00403eb0
mov dl, byte [eax + 4]
mov byte [esp + 0x17], dl
mov eax, dword [0x425ccc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x17], 0
mov dword [esp + 0xc0], 0xffffffff
sete byte [esp + 0x17]
cmp dword [esp + 0x48], 0x10
jb 0x40bf9d
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40bfb1
mov dword [esp + 0x18], 0x100d
jmp 0x40bdb6
mov eax, ebx
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
jmp 0x40bfd0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bfd0
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x60]
call fcn.00402000
mov eax, dword [esp + 0x1c]
mov edx, esi
push edx
push eax
push 0x425cd0
mov dword [esp + 0xcc], 9
call fcn.00412f80
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x74], 0x10
mov byte [esp + 0x17], al
jb 0x40c027
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40c076
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x30]
push edx
push 0x425cd0
mov dword [eax + 0xc], ecx
call fcn.00412b50
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xffffeff2
add eax, 0x100e
mov dword [esp + 0x18], eax
jmp 0x40bdb6
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x40c090
cmp eax, 0x720
jne 0x40bdae
test byte [0x425c0c], 1
jne 0x40c0c8
or dword [0x425c0c], 1
mov dword [esp + 0xc0], 0xa
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [esp + 0xc0], 0xffffffff
mov ecx, dword [0x425c10]
push 0xffffffffffffffff
push ecx
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x425c14], 0
je 0x40c0ea
mov byte [esp + 0x17], 1
mov edx, dword [0x425c10]
mov ecx, 0xd
mov esi, 0x425c50
lea edi, [esp + 0x7c]
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esp + 0x17], 0
jne 0x40c11b
mov dword [esp + 0x18], 0x300
jmp 0x40bdb6
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov edi, dword [esp + 0xac]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x3c]
push eax
push ebx
push edi
call dword [esp + 0xc0]
add esp, 0x20
mov dword [esp + 0x18], eax
cmp eax, 0x404
jne 0x40c1c1
push 1
push 0x425cd0
call fcn.00412900
test al, al
je 0x40c1b0
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x3c]
push eax
push ebx
push edi
call dword [esp + 0xc0]
add esp, 0x20
mov dword [esp + 0x18], eax
cmp eax, 0x404
jne 0x40c1bd
mov dword [esp + 0x18], 0x100c
jmp 0x40bdb6
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40bdb6
mov dword [esp + 0x8c], eax
mov byte [esp + 0x7c], al
mov eax, ebx
mov dword [esp + 0x90], 0xf
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c1e4
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [esp + 0x7c]
call fcn.00402000
mov dword [esp + 0xc0], 0xb
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x3c]
mov edx, dword [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push ecx
push edx
push eax
mov ecx, esi
push ecx
mov ecx, dword [esp + 0x44]
mov ebx, 0x425cd0
call fcn.00410800
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x90], 0x10
mov bl, al
jb 0x40c26e
mov edx, dword [esp + 0x7c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x40bdae
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jmp 0x40bdb6