Function at 0x411950
Capabilities:
Access the windows event log

Disassembly:
call fcn.0040bdd0
mov ecx, eax
call fcn.00414f10
mov eax, dword [0x42eeec]
test al, 1
jne 0x41197f
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [0x42eee0]
call edi
push 0xffffffffffffffff
push dword [0x42eee8]
call edi
mov eax, dword [0x42eeec]
test al, 1
jne 0x4119c2
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
mov eax, dword [0x42eeec]
add esp, 4
cmp dword [0x42ee94], 2
jne 0x4119f7
test al, 1
jne 0x4119e9
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push dword [0x42eee0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
ret
push ebx
push esi
push 0x423e40
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x411a2d
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call fcn.0040a440
mov esi, eax
push 0xffffffffffffffff
push dword [esi + 0x10]
call edi
mov ecx, dword [esi]
push dword [ecx + 4]
mov ecx, esi
call fcn.00406660
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
mov dword [esi + 4], 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0040bdd0
mov ecx, eax
call fcn.004154b0
mov eax, dword [0x42ef38]
test al, 1
jne 0x411aa0
or eax, 1
mov byte [0x42ef44], 0
push 0x420e10
mov dword [0x42ef38], eax
mov dword [0x42ef3c], 0
call fcn.0041d702
add esp, 4
cmp byte [0x42ef44], 0
je 0x411ab3
mov ecx, 0x42ef3c
call fcn.004103b0
mov eax, dword [0x42eeec]
mov byte [0x42ef44], 0
test al, 1
jne 0x411add
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push 0xffffffffffffffff
push dword [0x42ee90]
xor bl, bl
call edi
cmp byte [0x42eecc], 0
mov eax, 1
push dword [0x42ee90]
mov esi, dword [0x42eed0]
movzx ebx, bl
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x411b49
test esi, esi
je 0x411b49
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [0x42eeec]
test al, 1
jne 0x411b3f
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
mov ecx, 0x42ee90
call fcn.00411290
mov eax, dword [0x42eeec]
test al, 1
jne 0x411b71
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
mov eax, dword [0x42eeec]
add esp, 4
cmp dword [0x42eed4], 1
je 0x411baa
mov ecx, dword [0x42ef54]
test ecx, ecx
je 0x411baa
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x411ba5
push dword [0x42ef50]
mov dword [0x42ef54], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
mov eax, dword [0x42eeec]
test al, 1
jne 0x411bc8
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push 0xffffffffffffffff
push dword [0x42ee90]
call edi
push dword [0x42ee90]
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [0x42ee94], 2
call ebx
mov eax, dword [0x42eeec]
test al, 1
jne 0x411c0d
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push dword [0x42eed8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x42eeec]
test al, 1
jne 0x411c3c
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
push dword [0x42eee0]
call ebx
pop esi
pop ebx
pop edi
ret