Function at 0x41a6f0
Capabilities:
Clear windows event logs

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41ac3e
sub esp, 0x60
movzx edx, byte [0x67e2d4]
test dl, dl
je 0x41ac27
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [esp + 0x64]
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x68]
test edi, 0xc
je 0x41a7ac
mov eax, ebp
add ebp, 0x186a0
mov ecx, esi
adc esi, 0
test edi, 4
je 0x41a76a
mov dword [esp + 0x40], eax
lea eax, [0x571320]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x40]
jmp 0x41a794
test edi, 8
je 0x41a786
mov dword [esp + 0x48], eax
lea eax, [0x57131c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x48]
jmp 0x41a794
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x38], eax
mov eax, ebp
mov ebp, dword [esp + 0x38]
mov ebp, esi
mov esi, ecx
mov ecx, eax
mov eax, ebp
mov ebp, dword [esp + 0x38]
jmp 0x41a7c1
mov eax, 0x7fffffff
mov ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x5c], eax
mov eax, 0x7fffffff
mov dword [esp + 0x58], edx
mov ebx, dword [0x6582b0]
cmp dword [0x6582b4], ebx
jbe 0x41a7f5
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], esi
test edi, 2
setne bl
mov byte [esp + 0x17], bl
jmp 0x41ab44
mov ebx, dword [esp + 0x64]
jmp 0x41a80f
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov ebp, ecx
mov ecx, esi
mov esi, eax
mov eax, ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
movzx edx, byte [edx + 0x65]
test dl, dl
je 0x41a869
test edi, 1
je 0x41a836
mov edx, 1
jmp 0x41a86b
lea eax, [0x658b70]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
setne al
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x68]
mov edx, eax
mov eax, dword [esp + 0x24]
jmp 0x41a86b
xor edx, edx
test dl, dl
jne 0x41aa94
mov edx, dword [0x658244]
test edx, edx
sete dl
mov edi, dword [0x658240]
test edi, edi
xchg edi, ebx
sete bl
xchg edi, ebx
and edx, edi
test dl, dl
je 0x41a8af
mov dword [esp], ebx
call fcn.004230b0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edx, dword [ebx]
test edx, edx
je 0x41a8dc
mov edi, dword [edx + 0xc]
test edi, edi
jne 0x41a8c0
xor edx, edx
jmp 0x41a8de
lea ebp, [edi - 1]
mov dword [edx + 0xc], ebp
cmp ebp, 0x1fc
jae 0x41ab17
mov edx, dword [edx + edi*4 + 0xc]
mov ebp, dword [esp + 0x18]
jmp 0x41a8de
xor edx, edx
test edx, edx
jne 0x41a92c
mov dword [esp], ebx
call fcn.00422ed0
mov eax, dword [esp + 4]
test eax, eax
jne 0x41a916
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042d470
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.00422ed0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edx, eax
mov eax, dword [esp + 0x24]
test edx, edx
je 0x41aa90
mov dword [esp], edx
mov dword [esp + 4], ebx
call fcn.0041b040
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x14]
test ecx, ecx
sete dl
setg bl
mov ebp, dword [eax + 0x10]
cmp ebp, 0x7d0
xchg esi, ebx
setae bl
xchg esi, ebx
and esi, edx
or esi, ebx
xchg esi, eax
test al, al
xchg esi, eax
jne 0x41a984
mov edx, eax
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
jmp 0x41a7fb
nop
lea eax, [0x67e9c8]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
call fcn.00401cd0
mov eax, dword [esp + 0x68]
test eax, 2
jne 0x41a9b0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
jmp 0x41a9d6
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x1c]
sbb edx, ebx
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.004199f0
xor eax, eax
xor ecx, ecx
mov ebx, dword [esp + 0x64]
mov ebp, dword [ebx + 0x10]
mov esi, dword [esp + 0x20]
sub esi, ebp
mov ebp, dword [ebx + 0x14]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov edi, dword [esp + 0x24]
sbb edi, ebp
mov dword [esp + 0x24], edi
test edi, edi
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov edx, ebx
setl bl
test esi, esi
xchg edi, ebx
setbe bl
xchg edi, ebx
and edi, ebp
or ebx, edi
test bl, bl
je 0x41aa77
add esi, 0x186a0
mov ebx, dword [esp + 0x24]
adc ebx, 0
mov ebp, dword [esp + 0x5c]
test ebp, ebp
jne 0x41aa36
xor edi, edi
jmp 0x41aa6b
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov eax, dword [ebp]
mov edx, ebp
call eax
movzx eax, byte [esp]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x2c]
mov edi, eax
mov eax, dword [esp + 0x30]
xchg edi, eax
test al, al
xchg edi, eax
je 0x41a7fb
jmp 0x41aa84
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x24]
jmp 0x41a7fb
mov ebx, edx
mov edi, dword [esp + 0x68]
mov esi, eax
mov ebp, ecx
jmp 0x41aa94
mov edi, dword [esp + 0x68]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], esi
mov eax, dword [ebx + 0x14]
test eax, eax
sete cl
setg dl
mov esi, dword [ebx + 0x10]
test esi, esi
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ebp, ecx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x41ab13
nop
lea ecx, [0x67e9c8]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.00401cd0
mov eax, dword [esp + 0x68]
test eax, 2
je 0x41ab01
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x1c]
sbb edx, ebx
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.004199f0
mov eax, dword [esp + 0x64]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
add esp, 0x60
ret
mov eax, ebp
mov ecx, 0x1fc
call fcn.0045f4d0
mov edi, dword [esp + 0x68]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x58]
movzx ebx, byte [esp + 0x17]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx edx, byte [edx + 0x65]
test dl, dl
je 0x41ab8f
test edi, 1
je 0x41ab5b
mov edx, 1
jmp 0x41ab91
lea eax, [0x658b70]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
setne al
mov ecx, dword [esp + 0x20]
movzx ebx, byte [esp + 0x17]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x68]
mov edx, eax
mov eax, dword [esp + 0x24]
jmp 0x41ab91
xor edx, edx
test dl, dl
jne 0x41ac1e
lea eax, [0x6582b0]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 8]
dec eax
cmp dword [0x6582b4], eax
jbe 0x41ac0a
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov dword [esp + 4], eax
movzx eax, byte [esp + 0x17]
mov byte [esp + 8], al
call fcn.004184f0
mov edx, dword [esp + 0x5c]
test edx, edx
jne 0x41abe1
xor eax, eax
jmp 0x41abed
mov eax, dword [edx]
call eax
movzx eax, byte [esp]
mov edx, dword [esp + 0x5c]
test al, al
je 0x41ab23
mov ebx, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
jmp 0x41aa94
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
jmp 0x41a7f5
lea eax, [0x5616c4]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0041a6f0