Function at 0x40e480
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b8ae
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
or ebx, 0xffffffff
test byte [0x423ce4], 1
lea esi, [ebx + 2]
jne 0x40e4d7
or dword [0x423ce4], esi
mov dword [ebp - 4], 0
call fcn.004109f0
push 0x41c710
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
push 0x423cd0
call fcn.004114c0
test byte [0x423c0c], 1
jne 0x40e508
or dword [0x423c0c], esi
mov dword [ebp - 4], esi
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x423ca4]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call edi
mov ecx, dword [0x423cac]
push ebx
push ecx
call edi
test byte [0x423c0c], 1
jne 0x40e54c
or dword [0x423c0c], esi
mov dword [ebp - 4], 2
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
cmp byte [0x423c14], 0
jne 0x40e59c
test byte [0x423c0c], 1
jne 0x40e57d
or dword [0x423c0c], esi
mov dword [ebp - 4], 3
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov edx, dword [0x423ca4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41dee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e5d0
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test byte [0x423cb0], 1
jne 0x40e5fc
or dword [0x423cb0], 1
mov dword [ebp - 4], 4
call fcn.00402990
push 0x41c690
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x423ccc]
push ebx
push eax
call edi
mov ecx, dword [0x423cb8]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x423cb4
call fcn.004041f0
mov eax, dword [0x423cb8]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [eax + 4], eax
mov eax, dword [0x423cb8]
mov dword [eax], eax
mov eax, dword [0x423cb8]
mov dword [eax + 8], eax
mov eax, dword [0x423ccc]
push eax
mov dword [0x423cbc], 0
call esi
test byte [0x423ce4], 1
jne 0x40e674
or dword [0x423ce4], 1
mov dword [ebp - 4], 5
call fcn.004109f0
push 0x41c710
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
push 0x423cd0
call fcn.00411a20
test byte [0x423cf8], 1
jne 0x40e6a2
or dword [0x423cf8], 1
push 0x41c7f0
mov byte [0x423cf4], 0
call fcn.0041946d
add esp, 4
cmp byte [0x423cf4], 0
je 0x40e6b5
push 0x423ce8
call fcn.0040d140
mov byte [0x423cf4], 0
call fcn.0040e090
mov eax, dword [0x425ddc]
test eax, eax
je 0x40e6ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e6ec
mov ecx, dword [0x425de0]
push ecx
mov dword [0x425ddc], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test byte [0x423c0c], 1
jne 0x40e718
or dword [0x423c0c], 1
mov dword [ebp - 4], 6
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
mov edx, dword [0x423c10]
push ebx
push edx
call edi
mov eax, dword [0x423c10]
push eax
mov byte [0x423c14], 0
call esi
test byte [0x423c0c], 1
jne 0x40e75d
or dword [0x423c0c], 1
mov dword [ebp - 4], 7
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, dword [0x423c9c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x423c0c], 1
jne 0x40e793
or dword [0x423c0c], 1
mov dword [ebp - 4], 8
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov edx, dword [0x423ca4]
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret