Function at 0x411e70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42234a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x42c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x430f5c], 1
jne 0x411ec6
or dword [0x430f5c], 1
mov dword [ebp - 4], 0
call fcn.00414d40
push 0x423530
call fcn.0041d6db
add esp, 4
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x411ec9
or ebx, 0xffffffff
mov edi, 0x430f44
call fcn.004158c0
test byte [0x430ea8], 1
jne 0x411ef5
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov eax, dword [0x430f08]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call esi
mov ecx, dword [0x430f10]
push ebx
push ecx
call esi
test byte [0x430ea8], 1
jne 0x411f30
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
cmp dword [0x430eb4], 2
jne 0x411f7a
test byte [0x430ea8], 1
jne 0x411f5b
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov edx, dword [0x430f08]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x425d34
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x411fae
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test byte [0x430f18], 1
jne 0x411fda
mov eax, 1
or dword [0x430f18], eax
mov dword [ebp - 4], eax
call fcn.00402740
push 0x423420
call fcn.0041d6db
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x430f34]
push ebx
push eax
call esi
mov ecx, dword [0x430f20]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x430f1c
call fcn.00406100
mov eax, dword [0x430f20]
mov dword [eax + 4], eax
mov eax, dword [0x430f20]
mov dword [eax], eax
mov eax, dword [0x430f20]
mov dword [eax + 8], eax
mov eax, dword [0x430f34]
xor edi, edi
push eax
mov dword [0x430f24], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test byte [0x430f5c], 1
jne 0x41204e
or dword [0x430f5c], 1
mov dword [ebp - 4], 2
call fcn.00414d40
push 0x423530
call fcn.0041d6db
add esp, 4
mov dword [ebp - 4], ebx
push 0x430f44
call fcn.00415e00
test byte [0x430f6c], 1
jne 0x412082
or dword [0x430f6c], 1
push 0x423640
mov byte [0x430f68], 0
mov dword [0x430f60], edi
call fcn.0041d6db
add esp, 4
cmp byte [0x430f68], 0
je 0x412095
mov edi, 0x430f60
call fcn.00410820
test byte [0x430ea8], 1
mov byte [0x430f68], 0
jne 0x4120be
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov ecx, dword [0x430eb0]
push 0xffffffffffffffff
push ecx
xor bl, bl
call esi
cmp byte [0x430ef4], bl
je 0x4120d5
mov bl, 1
mov edx, dword [0x430eb0]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x430ef8]
push edx
call edi
test bl, bl
je 0x41212c
test esi, esi
je 0x41212c
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov ebx, 1
test byte [0x430ea8], bl
jne 0x412120
or dword [0x430ea8], ebx
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov esi, 0x430eb0
call fcn.00411710
jmp 0x412131
mov ebx, 1
test byte [0x430ea8], 1
jne 0x412152
or dword [0x430ea8], ebx
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
cmp dword [0x430efc], ebx
je 0x412184
mov eax, dword [0x430fa0]
test eax, eax
je 0x412184
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x412184
mov eax, dword [0x430fa4]
push eax
mov dword [0x430fa0], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test byte [0x430ea8], 1
jne 0x4121a5
or dword [0x430ea8], ebx
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov ecx, dword [0x430eb0]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x430eb0]
push edx
mov dword [0x430eb4], 2
call edi
test byte [0x430ea8], 1
jne 0x4121e8
or dword [0x430ea8], ebx
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov eax, dword [0x430f00]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x430ea8], 1
jne 0x412215
or dword [0x430ea8], ebx
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
mov ecx, dword [0x430f08]
push ecx
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret