Function at 0x40def0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c20e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x425018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
or ebx, 0xffffffff
test byte [0x425ce8], 1
lea esi, [ebx + 2]
jne 0x40df47
or dword [0x425ce8], esi
mov dword [ebp - 4], 0
call fcn.00410760
push 0x41d060
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
push 0x425cd0
call fcn.00411220
test byte [0x425c0c], 1
jne 0x40df78
or dword [0x425c0c], esi
mov dword [ebp - 4], esi
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x425ca4]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call edi
mov ecx, dword [0x425cac]
push ebx
push ecx
call edi
test byte [0x425c0c], 1
jne 0x40dfbc
or dword [0x425c0c], esi
mov dword [ebp - 4], 2
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
cmp byte [0x425c14], 0
jne 0x40e00c
test byte [0x425c0c], 1
jne 0x40dfed
or dword [0x425c0c], esi
mov dword [ebp - 4], 3
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov edx, dword [0x425ca4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41ef14
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e040
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test byte [0x425cb0], 1
jne 0x40e06c
or dword [0x425cb0], 1
mov dword [ebp - 4], 4
call fcn.00402a10
push 0x41cfe0
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x425ccc]
push ebx
push eax
call edi
mov ecx, dword [0x425cb8]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x425cb4
call fcn.00404140
mov eax, dword [0x425cb8]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [eax + 4], eax
mov eax, dword [0x425cb8]
mov dword [eax], eax
mov eax, dword [0x425cb8]
mov dword [eax + 8], eax
mov eax, dword [0x425ccc]
push eax
mov dword [0x425cbc], 0
call esi
test byte [0x425ce8], 1
jne 0x40e0e4
or dword [0x425ce8], 1
mov dword [ebp - 4], 5
call fcn.00410760
push 0x41d060
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
push 0x425cd0
call fcn.00411780
test byte [0x425cfc], 1
jne 0x40e112
or dword [0x425cfc], 1
push 0x41d140
mov byte [0x425cf8], 0
call fcn.00419c3d
add esp, 4
cmp byte [0x425cf8], 0
je 0x40e125
push 0x425cec
call fcn.0040cbb0
mov byte [0x425cf8], 0
call fcn.0040daf0
mov eax, dword [0x427ddc]
test eax, eax
je 0x40e15c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e15c
mov ecx, dword [0x427de0]
push ecx
mov dword [0x427ddc], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test byte [0x425c0c], 1
jne 0x40e188
or dword [0x425c0c], 1
mov dword [ebp - 4], 6
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
mov edx, dword [0x425c10]
push ebx
push edx
call edi
mov eax, dword [0x425c10]
push eax
mov byte [0x425c14], 0
call esi
test byte [0x425c0c], 1
jne 0x40e1cd
or dword [0x425c0c], 1
mov dword [ebp - 4], 7
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, dword [0x425c9c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x425c0c], 1
jne 0x40e203
or dword [0x425c0c], 1
mov dword [ebp - 4], 8
call fcn.0040d580
push 0x41cf70
call fcn.00419c3d
add esp, 4
mov edx, dword [0x425ca4]
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret