Function at 0x40dd73
Capabilities:
Access the windows event log
Create process on windows
Move file

Disassembly:
push 0x474
mov eax, 0x43a6ce
call fcn.00422e53
mov ebx, ecx
mov dword [ebp - 0x438], ebx
mov eax, dword [ebx + 0x40]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x474], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x464], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x448], eax
mov al, byte [ebx + 0x46]
push 0x65aac
mov dword [ebp - 0x47c], edi
mov byte [ebp - 0x451], al
mov dword [ebp - 0x444], 1
call fcn.0041dca4
pop ecx
test eax, eax
je 0x40ddea
mov ecx, eax
call fcn.00411b2d
mov esi, eax
mov dword [ebp - 0x480], eax
jmp 0x40ddf2
xor esi, esi
mov dword [ebp - 0x480], esi
test esi, esi
je 0x40e8b5
mov ecx, esi
call fcn.00412981
push 0
push edi
push str.database
call fcn.004127fe
push 0
push dword [ebp - 0x464]
mov ecx, esi
push str.appName
call fcn.004127fe
push 0
push dword [ebp - 0x45c]
mov ecx, esi
push str.appVersion
call fcn.004127fe
push 1
push dword [ebp - 0x474]
mov ecx, esi
push str.minidumpZip
call fcn.004127fe
mov ecx, dword [ebp - 0x474]
push 0
call fcn.0041311a
push eax
push 0x443300
mov ecx, esi
call fcn.004127fe
mov eax, dword [0x44c5d0]
mov dword [ebp - 0x470], eax
push dword [ebp - 0x45c]
and dword [ebp - 4], 0
lea eax, [ebp - 0x470]
push dword [ebp - 0x464]
push edi
push str._s_s_s
push eax
call fcn.00410fe2
mov eax, dword [0x44c5d0]
add esp, 0x14
mov dword [ebp - 0x468], eax
mov edx, dword [ebp - 0x464]
lea eax, [ebp - 0x468]
push eax
push str.post_post_action.php
push 0x442998
push dword [ebp - 0x45c]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00414e10
add esp, 0x10
push 0x1bb
push ecx
push 3
push dword [ebp - 0x468]
mov ecx, esi
call fcn.00411dcb
test eax, eax
jne 0x40defd
push 0x50
push ecx
push 3
push dword [ebp - 0x468]
mov ecx, esi
call fcn.00411dcb
test eax, eax
je 0x40e88f
mov ecx, esi
call fcn.00412f6d
push eax
lea ecx, [ebp - 0x434]
call fcn.0041131c
push dword [ebp - 0x468]
mov ecx, ebx
push str.HTTP_post_response:
call fcn.0040f28f
push dword [ebp - 0x434]
xor edi, edi
mov ecx, ebx
push edi
call fcn.0040f28f
push str._____________________________
push edi
mov ecx, ebx
call fcn.0040f28f
mov eax, dword [0x44c5d0]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x478]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x470]
mov edx, str.LogPostResponse
push eax
call fcn.004148cd
mov dword [esp], str.True
push dword [ebp - 0x478]
call fcn.0041e344
pop ecx
pop ecx
test eax, eax
jne 0x40dfc3
push 0x4433c4
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], edi
push str.BugSplatPost.log
push eax
call fcn.0041f6b8
add esp, 0xc
cmp dword [ebp - 0x444], edi
je 0x40dfc3
push dword [ebp - 0x434]
push dword [ebp - 0x444]
call fcn.004206a6
push dword [ebp - 0x444]
call fcn.0041f833
add esp, 0xc
push str.:::::_DB_UPDATED_
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x444], 2
call fcn.00410b51
mov dword [ebp - 0x440], eax
test eax, eax
jns 0x40dff9
push edi
push str.Server_error._HTTP_request_succeeded__but_report_failed_to_post
mov ecx, ebx
call fcn.0040f28f
jmp 0x40e85d
mov esi, dword [0x44c5d0]
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x450], esi
mov edi, esi
mov dword [ebp - 0x46c], edi
mov ebx, esi
mov dword [ebp - 0x460], ebx
push str.:::::_DB_UPDATED_
mov byte [ebp - 4], 8
call fcn.0041e578
add eax, dword [ebp - 0x440]
pop ecx
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 9
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push 0x4434a0
lea ecx, [ebp - 0x434]
call fcn.00410b51
mov dword [ebp - 0x440], eax
test eax, eax
js 0x40e341
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410a23
push eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0xa
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push 0x4434a0
call fcn.0041e578
add eax, dword [ebp - 0x440]
pop ecx
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0xb
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push 0x4434a0
lea ecx, [ebp - 0x434]
call fcn.00410b51
mov dword [ebp - 0x440], eax
test eax, eax
js 0x40e341
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410a23
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 0xc
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push 0x4434a0
call fcn.0041e578
add eax, dword [ebp - 0x440]
pop ecx
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0xd
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push 0x4434a0
lea ecx, [ebp - 0x434]
call fcn.00410b51
mov dword [ebp - 0x440], eax
test eax, eax
js 0x40e341
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410a23
push eax
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0xe
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
mov esi, 0x4434a0
push esi
call fcn.0041e578
add eax, dword [ebp - 0x440]
pop ecx
push eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0xf
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push esi
lea ecx, [ebp - 0x434]
call fcn.00410b51
mov esi, eax
test esi, esi
js 0x40e33b
push esi
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410a23
push eax
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0x10
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
mov edi, 0x4434a0
push edi
call fcn.0041e578
pop ecx
add eax, esi
lea ecx, [ebp - 0x434]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x11
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push edi
lea ecx, [ebp - 0x434]
call fcn.00410b51
mov esi, eax
test esi, esi
js 0x40e335
push esi
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x434]
call fcn.00410a23
push eax
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x12
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
push edi
call fcn.0041e578
pop ecx
add eax, esi
lea ecx, [ebp - 0x434]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00410b2c
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x13
call fcn.00411378
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.0041115a
mov ebx, dword [ebp - 0x460]
mov edi, dword [ebp - 0x46c]
mov esi, dword [ebp - 0x450]
push dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x438]
push str.HTTP_request_succeeded
call fcn.0040f28f
push dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x438]
push 0
call fcn.0040f28f
push dword [ebp - 0x458]
mov ecx, dword [ebp - 0x438]
push 0
call fcn.0040f28f
mov ecx, dword [ebp - 0x438]
push esi
push 0
call fcn.0040f28f
mov ecx, dword [ebp - 0x438]
push edi
push 0
call fcn.0040f28f
push ebx
mov ebx, dword [ebp - 0x438]
mov ecx, ebx
push 0
call fcn.0040f28f
cmp dword [edi - 8], 0
jle 0x40e78e
push edi
call fcn.004204ae
pop ecx
test eax, eax
js 0x40e686
cmp byte [ebp - 0x451], 0
jne 0x40e686
lea ecx, [ebp - 0x460]
call fcn.004109d2
lea ecx, [ebp - 0x460]
call fcn.0041097d
mov eax, dword [ebp - 0x460]
cmp dword [eax - 8], 0
je 0x40e409
push 1
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e686
mov eax, dword [0x44c5d0]
mov dword [ebp - 0x438], eax
mov edx, dword [ebp - 0x464]
lea eax, [ebp - 0x438]
mov ecx, dword [ebp - 0x47c]
push eax
push dword [ebp - 0x45c]
mov byte [ebp - 4], 0x14
call fcn.00414c8e
pop ecx
pop ecx
test al, al
jne 0x40e467
mov edx, dword [ebp - 0x464]
lea eax, [ebp - 0x438]
mov ecx, dword [ebp - 0x47c]
push eax
push str.browse_crashinfo.php
push str.http:__
push dword [ebp - 0x45c]
call fcn.00414e10
add esp, 0x10
push str._vendor
lea ecx, [ebp - 0x440]
call fcn.0041110a
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x440]
cmp dword [eax - 8], 0
je 0x40e496
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0x14
call fcn.0041115a
push dword [ebp - 0x47c]
lea ecx, [ebp - 0x438]
call fcn.00410c94
push str.app
lea ecx, [ebp - 0x440]
call fcn.0041110a
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x440]
cmp dword [eax - 8], 0
je 0x40e4e5
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0x14
call fcn.0041115a
push dword [ebp - 0x464]
lea ecx, [ebp - 0x438]
call fcn.00410c94
push 0x443528
lea ecx, [ebp - 0x440]
call fcn.0041110a
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x440]
cmp dword [eax - 8], 0
je 0x40e534
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0x14
call fcn.0041115a
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x438]
call fcn.00410c94
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x40e5b9
push eax
call fcn.0041e578
pop ecx
test eax, eax
je 0x40e5b9
push str.key
lea ecx, [ebp - 0x440]
call fcn.0041110a
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x440]
cmp dword [eax - 8], 0
je 0x40e598
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0x14
call fcn.0041115a
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x438]
push eax
call fcn.00410c94
push str.id
lea ecx, [ebp - 0x448]
call fcn.0041110a
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x448]
cmp dword [eax - 8], 0
je 0x40e5e8
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 0x14
call fcn.0041115a
cmp dword [edi - 8], 0
je 0x40e60c
push edi
push dword [edi - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
push str.row
lea ecx, [ebp - 0x448]
call fcn.0041110a
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x448]
cmp dword [eax - 8], 0
je 0x40e63b
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 0x14
call fcn.0041115a
cmp dword [esi - 8], 0
je 0x40e65f
push esi
push dword [esi - 8]
lea ecx, [ebp - 0x438]
call fcn.00410c2e
push 1
xor eax, eax
push eax
push eax
push dword [ebp - 0x438]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 8
call fcn.0041115a
mov eax, dword [ebx + 0x3c]
cmp dword [eax - 8], 0
jle 0x40e78e
mov eax, dword [ebx + 0x50]
cmp dword [eax - 8], 0
jle 0x40e78e
push dword [ebp - 0x44c]
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0042073a
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x44354c
push 0x104
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push dword [ebp - 0x458]
push 0x104
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x44354c
push 0x104
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push edi
mov edi, 0x104
push edi
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x44354c
push edi
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push esi
push edi
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x443550
push edi
push eax
call fcn.00420796
add esp, 0xc
lea eax, [ebp - 0x424]
push dword [ebx + 0x3c]
push edi
push eax
call fcn.0042073a
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x424]
push eax
push dword [ebx + 0x50]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
call fcn.00414b61
push str.BugSplat
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e820
push ebx
lea ecx, [ebp - 0x44c]
call fcn.004111a4
push ebx
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x430], eax
call fcn.004111a4
push ebx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x42c], eax
call fcn.004111a4
push ebx
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x430]
push eax
push ebx
push 3
push ebx
push 1
push ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ecx
lea ecx, [ebp - 0x44c]
call fcn.00411235
push ecx
lea ecx, [ebp - 0x458]
call fcn.00411235
push ecx
lea ecx, [ebp - 0x450]
call fcn.00411235
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ecx, [ebp - 0x460]
call fcn.0041115a
lea ecx, [ebp - 0x46c]
call fcn.0041115a
lea ecx, [ebp - 0x450]
call fcn.0041115a
lea ecx, [ebp - 0x458]
call fcn.0041115a
lea ecx, [ebp - 0x44c]
call fcn.0041115a
mov esi, dword [ebp - 0x480]
lea ecx, [ebp - 0x478]
call fcn.0041115a
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.0041115a
mov edi, dword [ebp - 0x444]
test edi, edi
jne 0x40e895
push dword [ebp - 0x474]
call fcn.0041f11a
pop ecx
jmp 0x40e895
mov edi, dword [ebp - 0x444]
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
lea ecx, [ebp - 0x468]
call fcn.0041115a
lea ecx, [ebp - 0x470]
call fcn.0041115a
jmp 0x40e8bb
mov edi, dword [ebp - 0x444]
mov eax, edi
call fcn.00422e02
ret