Function at 0x404130
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
push esi
push edi
push 0x404690
call dword [sym.imp.MSVCR120.dll__set_invalid_parameter_handler]
mov esi, dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 4
push 0x64
push str.kwcoreservice2013
push 0x40c5c8
call esi
add esp, 0xc
push 0x64
push str.kwcoreserviceclass2013
push 0x40c560
call esi
add esp, 0xc
call dword [sym.imp.KwLib.dll_bool___cdecl_KwLib::Process::KillOtherInstance_void_]
push 0xffffffffffffffff
call dword [sym.imp.IMM32.dll_ImmDisableIME]
mov esi, dword [ebp + 8]
push 0x7f00
push 0
mov dword [esp + 0x3c], 0x30
mov dword [esp + 0x40], 3
mov dword [esp + 0x44], 0x403da0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x58], 6
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0x40c560
mov dword [esp + 0x64], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x40c5c8
push 0x40c560
push 0
mov dword [0x40c62c], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
je 0x404557
push str.Application
push 0
mov dword [0x40c5c4], eax
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov esi, eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
test esi, esi
je 0x404289
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
test eax, eax
je 0x404282
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
test eax, eax
je 0x404282
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov dword [0x40c030], eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov byte [esp + 0x13], 1
call dword [sym.imp.KwModConfig.dll_AfxGetConfigManager]
lea ecx, [esp + 0x13]
push ecx
push str.enabled
mov edx, dword [eax]
mov ecx, eax
push str.ErrorReportNew
call dword [edx + 0x70]
cmp byte [esp + 0x13], 0
push 0x40938e
push 0x40938e
sete byte [0x40c633]
call dword [sym.imp.pd.dll_StartKWMV]
push 0x404570
call dword [sym.imp.KwMV.dll_StartP2P_V1]
add esp, 0xc
test eax, eax
jne 0x40438a
push 0xb
push str.CoreService
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], eax
mov byte [esp + 0x3c], al
call fcn.00401540
push 0xb
push str.CoreService
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00401540
push str.StartP2P_failed
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x24]
push 4
push eax
call dword [sym.imp.KwLog.dll_void___cdecl_YL_Log_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0x10
cmp dword [esp + 0x30], 0x10
jb 0x404351
push dword [esp + 0x1c]
call esi
add esp, 4
cmp dword [esp + 0x48], 0x10
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
jb 0x404376
push dword [esp + 0x34]
call esi
add esp, 4
call dword [sym.imp.KwMV.dll_StopP2P]
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KwHttp.dll_InitKwHttpMgr]
mov esi, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 4
call esi
add esp, 4
test eax, eax
je 0x4043a9
mov dword [eax], vtable.CP2PStub.0
jmp 0x4043ab
xor eax, eax
push 0xc
mov dword [0x40c638], eax
call esi
add esp, 4
test eax, eax
je 0x4043c4
mov ecx, eax
call fcn.004070c0
jmp 0x4043c6
xor eax, eax
push 0x38
mov dword [0x40c634], eax
call esi
add esp, 4
test eax, eax
je 0x4043df
mov ecx, eax
call fcn.00407270
jmp 0x4043e1
xor eax, eax
push 4
push str.kwmu
lea ecx, [esp + 0x24]
mov dword [0x40c63c], eax
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00401540
push ecx
lea eax, [esp + 0x20]
push eax
call fcn.004049f0
cmp dword [esp + 0x30], 0x10
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x40442c
push dword [esp + 0x1c]
call edi
add esp, 4
mov ecx, dword [0x40c634]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov eax, dword [ecx]
call dword [eax + 0x4c]
push 0
push 0xbb8
push 0x3e9
push dword [0x40c5c4]
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4044a8
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x64]
push eax
call esi
lea eax, [esp + 0x64]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x404485
mov byte [0x40c632], 1
call dword [sym.imp.KwMV.dll_StopP2P]
call dword [sym.imp.KwHttp.dll_UninitKwHttpMgr]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404b10
mov esi, dword [0x40c63c]
test esi, esi
je 0x4044eb
lea eax, [esi + 0x1c]
mov dword [esi], vtable.CMsgCenter.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call edi
add esp, 4
mov ecx, dword [0x40c638]
test ecx, ecx
je 0x4044fb
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [0x40c634]
test esi, esi
je 0x40452c
mov ecx, dword [esi + 8]
mov dword [esi], vtable.CPlayCoreStub.0
test ecx, ecx
je 0x404518
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov eax, dword [esi + 4]
test eax, eax
je 0x404526
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
add esp, 4
mov eax, dword [esp + 0x6c]
mov dword [0x40c63c], 0
mov dword [0x40c638], 0
mov dword [0x40c634], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10