Function at 0x40aa30
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a404
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x421018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
or esi, 0xffffffff
test byte [0x422c58], 1
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xa4], edx
jne 0x40aaa9
or dword [0x422c58], 1
mov dword [ebp - 4], edi
call fcn.004103d0
push 0x41aab0
call fcn.00417dd5
add esp, 4
mov dword [ebp - 4], esi
test byte [0x422c14], 1
jne 0x40aad5
mov eax, 1
or dword [0x422c14], eax
mov dword [ebp - 4], eax
call fcn.00402990
push 0x41a9d0
call fcn.00417dd5
add esp, 4
mov dword [ebp - 4], esi
test byte [0x422b68], 1
jne 0x40aaf7
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp byte [0x422b78], 0
je 0x40ab1e
push 0x7010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
mov eax, ebx
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x30], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ab31
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [ebp - 0x30]
call fcn.00402020
push 0x422c18
mov edi, esi
mov dword [ebp - 4], 2
call fcn.00403220
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0x10
mov esi, eax
jb 0x40ab75
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp esi, 2
ja 0x40b09f
xor eax, eax
cmp esi, eax
jne 0x40aca0
xor ecx, ecx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], cx
mov dword [ebp - 4], 3
mov dword [ebp - 0x68], eax
mov eax, ebx
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40abb1
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [ebp - 0x78]
call fcn.00402020
mov ecx, esi
lea edi, [ebp - 0x5c]
mov byte [ebp - 4], 4
mov byte [ebp - 0x91], 0
call fcn.00403660
mov byte [ebp - 4], 5
cmp dword [ebp - 0x48], 8
mov eax, dword [ebp - 0x5c]
jae 0x40abea
mov eax, edi
push 0
push eax
call dword [sym.imp.MSVCR100.dll__waccess_s]
add esp, 8
test eax, eax
jne 0x40ac11
push eax
lea edx, [ebp - 0x5c]
push edx
or eax, 0xffffffff
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x91], 1
call fcn.00401ce0
mov esi, 8
cmp dword [ebp - 0x48], esi
jb 0x40ac28
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov byte [ebp - 4], 3
cmp dword [ebp - 0x64], 0x10
jb 0x40ac3f
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [ebp - 0x91], 0
je 0x40ad34
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], esi
jae 0x40ac57
lea eax, [ebp - 0x30]
push 1
push eax
push ebx
call fcn.0040e230
add esp, 0xc
test eax, eax
je 0x40ac87
mov ebx, 0x402
cmp dword [ebp - 0x1c], esi
jb 0x40b0a4
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x40b0a4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], esi
jb 0x40aca0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x422c40
call fcn.00411fe0
push 0x422c40
call fcn.004124c0
test byte [ebp + 0x10], 1
je 0x40aeca
mov eax, ebx
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40acd5
sub eax, esi
mov edi, eax
mov eax, ebx
lea esi, [ebp - 0x30]
call fcn.00402020
mov dword [ebp - 4], 6
mov edx, dword [0x422c30]
push 0xffffffffffffffff
push edx
mov byte [ebp - 0x91], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
push eax
mov eax, 0x422c18
call fcn.004040f0
mov dword [ebp - 0xa8], eax
cmp eax, dword [0x422c1c]
je 0x40ad97
mov esi, dword [eax + 0x1c]
mov edx, 0x10
cmp dword [eax + 0x20], edx
jb 0x40ad54
mov ecx, dword [eax + 0xc]
jmp 0x40ad57
mov ebx, 0x402
cmp dword [ebp - 0x1c], esi
jb 0x40b0a4
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x40b0a4
lea ecx, [eax + 0xc]
mov edi, dword [ebp - 0x20]
mov eax, edi
cmp edi, esi
jb 0x40ad62
mov eax, esi
cmp dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x30]
jae 0x40ad6d
lea edx, [ebp - 0x30]
call fcn.00402910
test eax, eax
jne 0x40ad88
cmp edi, esi
jae 0x40ad7f
or eax, 0xffffffff
jmp 0x40ad86
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sets al
test al, al
jne 0x40ad97
lea eax, [ebp - 0xa8]
jmp 0x40ada9
mov ecx, dword [0x422c1c]
mov dword [ebp - 0xac], ecx
lea eax, [ebp - 0xac]
mov edx, dword [0x422c1c]
cmp dword [eax], edx
setne al
test al, al
je 0x40adce
lea edx, [ebp - 0x30]
mov ecx, 0x422c18
call fcn.00403840
mov al, byte [eax + 4]
mov byte [ebp - 0x91], al
mov ecx, dword [0x422c30]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [ebp - 0x91], 0
mov dword [ebp - 4], 0xffffffff
sete byte [ebp - 0x91]
cmp dword [ebp - 0x1c], 0x10
jb 0x40ae03
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [ebp - 0x91], 0
je 0x40ae16
mov ebx, 0x100d
jmp 0x40b0a4
mov eax, ebx
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ae30
sub eax, edx
mov edi, eax
mov eax, ebx
lea esi, [ebp - 0x78]
call fcn.00402020
mov ecx, dword [ebp - 0x98]
mov eax, esi
push eax
push ecx
push 0x422c40
mov dword [ebp - 4], 7
call fcn.00412d20
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x64], 0x10
mov bl, al
jb 0x40ae7c
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x40aeca
mov ecx, dword [ebp - 0x98]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xa4]
push edx
push 0x422c40
mov dword [eax + 0xc], ecx
call fcn.00412900
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0xffffeff2
add ebx, 0x100e
jmp 0x40b0a4
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x40aee3
cmp eax, 0x720
jne 0x40b09f
test byte [0x422b68], 1
jne 0x40af05
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov ecx, dword [0x422b70]
push 0xffffffffffffffff
push ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x422bb4], bl
je 0x40af20
mov bl, 1
mov edx, dword [0x422b70]
mov ecx, 0xd
mov esi, 0x422bb8
lea edi, [ebp - 0x90]
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
jne 0x40af4d
mov ebx, 0x300
jmp 0x40b0a4
mov edi, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x9c]
push edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x90]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0xa0]
push eax
push esi
push ecx
call dword [ebp - 0x74]
mov ebx, eax
add esp, 0x20
cmp ebx, 0x404
jne 0x40afeb
push 1
push 0x422c40
call fcn.004126a0
test al, al
je 0x40afe1
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
push edi
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], edx
lea edx, [ebp - 0xa0]
push edx
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x90]
push esi
push eax
call dword [ebp - 0x74]
mov ebx, eax
add esp, 0x20
cmp ebx, 0x404
jne 0x40afeb
mov ebx, 0x100c
jmp 0x40b0a4
test ebx, ebx
jne 0x40b0a4
mov eax, esi
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b005
sub eax, esi
mov edi, eax
mov eax, dword [ebp - 0x9c]
lea esi, [ebp - 0x5c]
call fcn.00402020
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xa4]
push eax
mov ecx, esi
push ecx
mov ecx, dword [ebp - 0xa0]
push 0x422c40
call fcn.00410470
cmp dword [ebp - 0x48], 0x10
mov byte [ebp - 0x91], al
jb 0x40b077
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [ebp - 0x91], 0
je 0x40b09f
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jmp 0x40b0a4
mov ebx, 0x601
test byte [0x422b68], 1
jne 0x40b0c6
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp byte [0x422b78], 0
je 0x40b0ee
push ebx
push 0x7011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
test ebx, ebx
je 0x40b126
push 0x41be5c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40b126
push 0
push 0
push 0
push 0
push 0
push 0x8000000a
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00417cae
mov esp, ebp
pop ebp
ret