Function at 0x40e970
Capabilities:
Access the windows event log
Create thread
Get number of processors
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4450cb
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x461008]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x85
push eax
push dword [0x4636c8]
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.004048c0
call fcn.004047e0
test al, al
jne 0x40ea03
call fcn.004048c0
cmp dword [0x463664], 0
jne 0x40ea1e
push 0x44bdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x463664], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x463660], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x403560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x46365c], eax
call fcn.00402d10
cmp word [0x4639d8], 0
jne 0x40ea6f
push 0x104
push 0x4639d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x4639d8
call fcn.004087c0
call fcn.00404a60
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x463644
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
push 0x7530
push 0
push 0x4012a0
push eax
push 0x46363c
mov dword [0x463640], eax
call esi
call fcn.00407c90
push 0x4636dc
call edi
call fcn.00409a10
mov byte [0x46368d], al
mov byte [0x46368e], 0
call ebx
push 0
push 0
push 0x2bf20
push 0
push 0x412030
push eax
push 0x4636d4
mov dword [0x4636d8], eax
call esi
push 0x46369c
call edi
call fcn.00406220
call ebx
push 0
push 0xd05
push 0xd05
push 0
push 0x406610
push eax
push 0x463694
mov dword [0x463698], eax
call esi
push str.Service_run..._r_n
call fcn.00416f00
add esp, 4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4636cc], eax
call fcn.0040ce30
push 0x78
call fcn.0043198f
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x48], 0
test esi, esi
je 0x40eb79
push 0x78
push 0
push esi
call fcn.0043cf50
add esp, 8
mov ecx, esi
call fcn.0040c630
mov esi, eax
jmp 0x40eb7b
xor esi, esi
mov ecx, esi
mov dword [esp + 0x48], 0xffffffff
call fcn.0040cbb0
push str.Service_running._r_n
call fcn.00416f00
add esp, 4
mov dword [esp + 0x14], str.hmpalertsvc
lea eax, [esp + 0x14]
push 0
push eax
push 0
push 1
push 0
push 0x64
push 2
push 4
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40ebdd
call ebx
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
push 0xffffffffffffffff
push dword [0x4636cc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.Service_stopping..._r_n
call fcn.00416f00
add esp, 4
mov ecx, esi
call fcn.0040cd90
test esi, esi
je 0x40ec0c
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x18]
push str.PipeService_stopped._r_n
call fcn.00416f00
call fcn.00401190
push str.BackTrace_stopped._r_n
call fcn.00416f00
push str.Hardening_stopped._r_n
call fcn.00416f00
mov esi, dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
add esp, 0xc
push 0xffffffffffffffff
push dword [0x4636d8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x4636dc
call edi
push str.UpdateManager_stopped._r_n
call fcn.00416f00
add esp, 4
call fcn.00406340
push 0xffffffffffffffff
push dword [0x463698]
call esi
push 0x46369c
call edi
push str.FlyoutManager_stopped._r_n
call fcn.00416f00
add esp, 4
mov byte [0x46368c], 0
push 0xffffffffffffffff
push dword [0x4622ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x46366c]
test ecx, ecx
je 0x40eca4
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x463670]
test ecx, ecx
je 0x40ecb4
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x463674
call edi
push str.FileClassifier_stopped._r_n
call fcn.00416f00
add esp, 4
push 0
push 0x1388
push dword [0x46365c]
push dword [0x463660]
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
je 0x40ecf6
push 0
push dword [0x46365c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x4636cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], str.hmpalertsvc
push eax
push 0
push 1
push 0
push 0x64
push 2
push 4
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x40ed42
call ebx
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov eax, dword [0x463664]
test eax, eax
je 0x40ed5c
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov dword [0x463664], 0
push str.Service_stopped._r_n
call fcn.00416f00
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret