Function at 0x41dde0
Capabilities:
Access the windows event log
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x338
mov eax, dword [0x47900c]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
push edi
mov byte [esp + 0x14], 1
call fcn.0040b470
cmp dword [eax + 4], 2
jne 0x41e767
call fcn.0041d590
mov edi, eax
test edi, edi
je 0x41de2d
push str.Error:_JhiGetRegistryValues___failed
call fcn.00402c50
add esp, 4
jmp 0x41e60b
call fcn.0040b470
mov esi, dword [eax + 0x3c]
mov dword [esp + 0x18], esi
call fcn.0040b470
mov edi, dword [eax + 0x40]
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
jne 0x41dfc5
or edi, edi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], edi
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movq qword [esp + 0x30], xmm0
test esi, esi
jne 0x41de80
push str.discoverVmType___transport_type_invalid._Aborting_discovery.
call fcn.00402c50
add esp, 4
jmp 0x41df9d
push str.Starting_VM_type_discovery...
call fcn.00402c70
add esp, 4
lea eax, [esp + 0x20]
push eax
push esi
call sym.jhi_service.exe_TEE_Transport_Create
add esp, 8
test eax, eax
je 0x41deb2
push eax
push str.AppletsManager::discoverVmType____failure_in_TEE_Transport_Create____teeCommStatus___d_n
call fcn.00402c50
add esp, 8
jmp 0x41df9d
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push 0
push 0x2711
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call dword [0x45e29c]
call esi
add esp, 0x10
test eax, eax
jne 0x41dee2
lea edi, [eax + 2]
mov eax, str.BHv2_detected.
jmp 0x41df20
cmp dword [esp + 0x18], 1
lea eax, [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ecx, esi
push eax
push 0
lea eax, [esp + 0x28]
jne 0x41df01
push 0x2710
jmp 0x41df06
push 0x2712
push eax
call dword [0x45e29c]
call esi
add esp, 0x10
test eax, eax
jne 0x41df5c
mov edi, 1
mov eax, str.BHv1_detected.
push eax
mov dword [esp + 0x10], edi
call fcn.00402c70
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x20]
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
call dword [0x45e29c]
call esi
add esp, 8
test eax, eax
je 0x41df69
push eax
push str.AppletsManager::discoverVmType____failure_in_pfnDisconnect____teeCommStatus___d_n
call fcn.00402c70
add esp, 8
jmp 0x41df69
push str.AppletsManager::discoverVmType____Couldnt_connect_to_either_BHv1_or_BHv2.
call fcn.00402c50
add esp, 4
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call dword [0x45e29c]
call esi
add esp, 4
test eax, eax
je 0x41df98
push eax
or edi, 0xffffffff
push str.AppletsManager::discoverVmType____failure_in_pfnTeardown____teeCommStatus___d_n
mov dword [esp + 0x14], edi
call fcn.00402c70
add esp, 8
cmp edi, 0xffffffff
jne 0x41dfb4
push str.Error:_discoverVmType___failed
call fcn.00402c50
add esp, 4
mov edi, 0x300
jmp 0x41e60b
call fcn.0040b470
mov esi, dword [esp + 0x18]
cmp edi, 0xffffffff
jle 0x41dfc5
mov dword [eax + 0x40], edi
cmp esi, 1
je 0x41e199
xor eax, eax
mov dword [esp + 0x90], 0xffffffff
push 0x200
push eax
mov word [esp + 0x91], ax
mov byte [esp + 0x93], al
mov byte [esp + 0x90], al
mov dword [esp + 0x94], eax
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x140]
push eax
call fcn.00437ca0
xor esi, esi
add esp, 0xc
cmp dword [0x47b7bc], esi
jne 0x41e18e
lea eax, [esp + 0x138]
push eax
call fcn.0041c760
test al, al
jne 0x41e040
push str.failed_getting_heci_device_details_n
jmp 0x41e13b
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x41e0cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error:__d
call fcn.00402c70
or eax, 0xffffffff
add esp, 8
mov dword [0x47b7bc], eax
cmp esi, 0x63
jge 0x41e0ae
push str.JHI_SERVICE__Failed_to_get_heci_device_handle._nSleeping_then_retrying..._n
call fcn.00402c70
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 2]
push eax
push str.JHI_SERVICE__Attempt__i_to_get_heci_device_handle._n
call fcn.00402c70
mov eax, dword [0x47b7bc]
add esp, 8
inc esi
cmp esi, 0x64
jl 0x41e040
cmp eax, 0xffffffff
jne 0x41e0d4
push str.failed_to_get_heci_device_handle_n
call fcn.00402c70
mov dword [0x47b7bc], 0
jmp 0x41e140
mov dword [0x47b7bc], eax
mov dword [esp + 0x58], eax
xorps xmm0, xmm0
push 1
lea eax, [esp + 0x50]
mov dword [0x47b7b8], 0
push eax
push dword [0x47b7c0]
mov dword [esp + 0x60], 0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
mov dword [esp + 0x80], 0
mov dword [esp + 0x58], 0x2c
mov dword [esp + 0x5c], 6
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov dword [0x47b7b8], eax
test eax, eax
jne 0x41e18e
push str.failed_to_register_heci_device_notification_n
call fcn.00402c70
add esp, 4
push str.failed_to_register_for_HECI_events
call fcn.00402c50
add esp, 4
push str.IntelDalJhi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41e184
push 0
push 0
push 0
push 0
push 0
push 0xc0000005
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edi, 0x300
jmp 0x41e60b
mov dword [esp + 0x84], vtable.intel_dal::IFirmwareInfo.0
sub edi, 1
je 0x41e2ab
sub edi, 1
je 0x41e1be
push str.Error:_pluginRegister___failed
call fcn.00402c50
add esp, 4
mov edi, 0x601
jmp 0x41e60b
push str.pluginRegister_start
call fcn.00402c70
mov eax, dword fs:[0x2c]
add esp, 4
mov eax, dword [eax]
lea ecx, [eax + 4]
mov eax, dword [0x47db34]
mov dword [esp + 0x10], ecx
cmp eax, dword [ecx]
jle 0x41e2a1
push 0x47db34
call fcn.004341ea
add esp, 4
cmp dword [0x47db34], 0xffffffff
jne 0x41e2a1
push 0x4c
push 0
push 0x47db38
call fcn.00437ca0
xorps xmm0, xmm0
mov dword [0x47db38], 0x472a1c
add esp, 0xc
mov dword [0x47db7c], 0
mov dword [0x47db80], 0xf
mov byte [0x47db6c], 0
movq qword [0x47db44], xmm0
movups xmmword [0x47db4c], xmm0
mov dword [0x47db5c], 0
movups xmmword [0x47b7e4], xmm0
push 0x45d8c0
movq qword [0x47b7f4], xmm0
mov byte [0x47db60], 0
mov byte [0x47db68], 0
mov dword [0x47db64], 0
mov dword [0x47db40], 3
call fcn.0043452c
add esp, 4
push 0x47db34
call fcn.004341a0
add esp, 4
mov edi, 0x47db38
jmp 0x41e363
push str.pluginRegister_start
call fcn.00402c70
mov eax, dword fs:[0x2c]
add esp, 4
mov eax, dword [eax]
lea ecx, [eax + 4]
mov eax, dword [0x47db0c]
mov dword [esp + 0x10], ecx
cmp eax, dword [ecx]
jle 0x41e35e
push 0x47db0c
call fcn.004341ea
add esp, 4
cmp dword [0x47db0c], 0xffffffff
jne 0x41e35e
xorps xmm0, xmm0
mov dword [0x47db14], 0
movlpd qword [0x47db1c], xmm0
movlpd qword [0x47db24], xmm0
movlpd qword [0x47db2c], xmm0
push 0x45d8a0
mov dword [0x47db10], 0x47116c
movups xmmword [0x47db1c], xmm0
mov dword [0x47db18], 2
movq qword [0x47db2c], xmm0
movups xmmword [0x47b7c4], xmm0
movq qword [0x47b7d4], xmm0
call fcn.0043452c
add esp, 4
push 0x47db0c
call fcn.004341a0
add esp, 4
mov edi, 0x47db10
push 0
push str.pluginRegister_end__result__0x_X
mov dword [esp + 0x24], edi
call fcn.00402c70
add esp, 8
call fcn.0040b470
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [edi]
push dword [0x47b798]
mov dword [esp + 0x48], fcn.004077e0
push dword [0x479a80]
mov esi, dword [eax + 0x58]
mov ecx, esi
mov dword [esp + 0x50], fcn.00407870
call dword [0x45e29c]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1c]
mov ecx, esi
call dword [0x45e29c]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x41e3f1
push str.Error:_pfnSetTransport___failed
call fcn.00402c70
add esp, 4
jmp 0x41e60b
cmp dword [esp + 0x18], 3
jne 0x41e40f
call fcn.0040b470
movzx ecx, byte [esp + 0x14]
xor edx, edx
cmp dword [eax + 0x40], 2
cmove ecx, edx
mov byte [esp + 0x14], cl
mov edi, dword [esp + 0x1c]
push dword [esp + 0x14]
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x45e29c]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x41e440
push edi
push str.VM_plugin_Init_failure__with_ret_code:__08x
call fcn.00402c70
add esp, 8
jmp 0x41e60b
call fcn.0040b470
cmp word [eax + 0x44], 0
jne 0x41e564
xorps xmm0, xmm0
xor al, al
movlpd qword [esp + 0x78], xmm0
or edi, 0xffffffff
mov byte [esp + 0xb], al
call fcn.0040b470
cmp dword [eax + 0x40], 2
jne 0x41e708
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
mov eax, dword [edi]
mov dword [esp + 0x88], 0
mov esi, dword [eax + 0x44]
mov ecx, esi
call dword [0x45e29c]
mov ecx, edi
call esi
mov edx, dword [esp + 0x18]
test edx, edx
je 0x41e4df
mov eax, dword [esp + 0x80]
cmp eax, 0xa0
je 0x41e6a1
push eax
push 0xa0
push str.Unexpected_metadata_size._Expected:__d._Got:__d
call fcn.00402c50
add esp, 0xc
push dword [esp + 0x18]
call fcn.00407870
add esp, 4
or edi, 0xffffffff
push str.Failed_to_get_FW_properties_from_FW.
call fcn.00402c50
add esp, 4
cmp word [esp + 0x78], 0
jne 0x41e504
push str.Got_0_as_major_version.
call fcn.00402c50
add esp, 4
call fcn.0040b470
mov ecx, dword [esp + 0x78]
mov dword [eax + 0x44], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0x48], ecx
call fcn.0040b470
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [esp + 0xb]
movsx ecx, al
push ecx
push str.The_signature_version_is:__d
mov byte [esi + 0x4c], al
call fcn.00402c70
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0040b470
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
mov dword [esi + 0x50], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esp + 0x10]
mov eax, dword [0x47da1c]
cmp eax, dword [ecx]
jle 0x41e5b6
push 0x47da1c
call fcn.004341ea
add esp, 4
cmp dword [0x47da1c], 0xffffffff
jne 0x41e5b6
xorps xmm0, xmm0
mov dword [0x47da28], 0
push 0x45cf90
movq qword [0x47da20], xmm0
call fcn.0043452c
add esp, 4
push 0x47da1c
call fcn.004341a0
add esp, 4
mov ecx, 0x47da20
call fcn.0041bb60
mov edi, eax
test edi, edi
je 0x41e71e
push str.EventManager_Initialize_failed
call fcn.00402c70
add esp, 4
push str.IntelDalJhi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41e60b
push 0
push 0
push 0
push 0
push 0
push 0xc0000004
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call fcn.0040b470
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x38]
push dword [esi]
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41e64a
mov eax, dword [eax]
push dword [esp + 0x14]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x45e29c]
mov ecx, dword [esp + 0x14]
call esi
push str.IntelDalJhi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41e67e
push 0
push 0
push 0
push 0
push 0
push 0xc000000c
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.JHI_init_failed
call fcn.00402c50
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
mov esi, edx
lea edi, [esp + 0x98]
mov ecx, 0x28
rep movsd dword es:[edi], dword [esi]
push edx
call fcn.00407870
movzx eax, word [esp + 0xf4]
mov edi, dword [esp + 0x9c]
mov word [esp + 0x7c], ax
movzx eax, word [esp + 0xf6]
mov word [esp + 0x7e], ax
movzx eax, word [esp + 0xf8]
mov word [esp + 0x80], ax
movzx eax, word [esp + 0xfa]
mov word [esp + 0x82], ax
mov al, byte [esp + 0xfc]
mov byte [esp + 0xf], al
jmp 0x41e4ec
lea ecx, [esp + 0x78]
call fcn.0041dc60
test al, al
jne 0x41e4ef
jmp 0x41e4e2
cmp dword [esp + 0xc], 2
jne 0x41e731
call fcn.004177a0
mov ecx, eax
call fcn.00409bd0
call fcn.0040b470
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x33c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret