Function at 0x402580
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c646f
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x23c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40261d
push str.message_string_is_NULL
lea ecx, [ebp - 0x174]
call fcn.0040bdb0
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x104]
push ecx
lea ecx, [ebp - 0x150]
call fcn.0040bfb0
push 0x638098
lea edx, [ebp - 0x150]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.0040b3b0
mov eax, dword [ebp - 0xfc]
cmp dword [eax + 4], 0
jne 0x402681
push str.invalid_event_source_handle__NULL_
lea ecx, [ebp - 0x18c]
call fcn.0040bdb0
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x15c]
call fcn.0040b380
push 0x638088
lea eax, [ebp - 0x15c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18c]
call fcn.0040b3b0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0040b2a0
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 3
cmp dword [ebp + 0x10], 0
je 0x4027f0
push 4
lea ecx, [ebp - 0x18]
call fcn.004029d0
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004047e0
add esp, 8
mov dword [ebp - 0x140], eax
mov byte [ebp - 4], 4
push 0xb0
lea ecx, [ebp - 0xec]
call fcn.004029d0
push 1
push 3
lea ecx, [ebp - 0xec]
call fcn.00402e00
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xec]
test ecx, ecx
je 0x402709
lea edx, [ebp - 0xec]
add edx, 0x10
mov dword [ebp - 0xf8], edx
jmp 0x402713
mov dword [ebp - 0xf8], 0
push 0x6067e4
mov eax, dword [ebp - 0xf8]
push eax
call fcn.0040a4b0
add esp, 8
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x18]
call fcn.00402d50
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.0040a4b0
add esp, 8
mov dword [ebp - 0x114], eax
push 0x6067d8
mov edx, dword [ebp - 0x114]
push edx
call fcn.0040a4b0
add esp, 8
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x118]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov dword [ebp - 0x11c], eax
push 0x6067d4
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.0040a4b0
add esp, 8
lea edx, [ebp - 0x1a4]
push edx
lea ecx, [ebp - 0xec]
call fcn.00402d60
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0040a250
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1a4]
call fcn.0040a7f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.004029f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402d30
mov dword [ebp - 0xf0], 0
movzx edx, word [ebp + 0xc]
mov dword [ebp - 0xf4], edx
cmp dword [ebp - 0xf4], 1
je 0x402821
cmp dword [ebp - 0xf4], 2
je 0x40282d
cmp dword [ebp - 0xf4], 4
je 0x402839
jmp 0x402843
mov dword [ebp - 0xf0], 0xc0000104
jmp 0x402843
mov dword [ebp - 0xf0], 0x80000103
jmp 0x402843
mov dword [ebp - 0xf0], 0x40000102
push 0xc
lea ecx, [ebp - 0x24]
call fcn.004029d0
lea ecx, [ebp - 0x24]
call fcn.00402ce0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
call fcn.0040bfe0
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402b60
push 0
lea ecx, [ebp - 0x24]
call fcn.00402b00
mov dword [ebp - 0x12c], eax
push 0
mov ecx, dword [ebp - 0x12c]
push ecx
push 0
push 1
push 0
mov edx, dword [ebp - 0xf0]
push edx
push 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402b20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0040a7f0
jmp 0x40299d
mov dword [ebp - 4], 0xffffffff
jmp 0x4029ad
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret 0xc