Function at 0x411320
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fe96
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x430], ax
lea eax, [ebp - 0x42e]
push eax
call sub.MSVCR120.dll_memset
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0x14
mov dword [ebp - 0x464], 2
lea edx, [ebp - 0x430]
mov ecx, str.APPLETSLOCALE
call fcn.00402db0
add esp, 4
test al, al
jne 0x4113e6
push 0x423e40
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4113dc
push 0
push 0
push 0
push 0
push 0
push 0xc0000006
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 0x501
jmp 0x4115e5
mov esi, dword [sym.imp.MSVCR120.dll__waccess_s]
lea eax, [ebp - 0x430]
push 0
push eax
call esi
add esp, 8
test eax, eax
je 0x41143c
push 0x423e40
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x411432
push 0
push 0
push 0
push 0
push 0
push 0xc0000008
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 0x1000
jmp 0x4115e5
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x448]
call fcn.00405320
mov dword [ebp - 4], 0
mov eax, dword [0x42eeec]
test al, 1
jne 0x411478
or eax, 1
mov dword [0x42eeec], eax
call fcn.00411060
push 0x4209a0
call fcn.0041d702
add esp, 4
cmp dword [ebp - 0x438], 0
jne 0x411485
xor al, al
jmp 0x4114b6
push 0xffffffffffffffff
push dword [0x42ee90]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x448]
mov ecx, 0x42eeb4
push eax
call fcn.00406b70
push dword [0x42ee90]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, 1
test al, al
mov dword [ebp - 4], 0xffffffff
sete bl
cmp dword [ebp - 0x434], 8
jb 0x4114da
push dword [ebp - 0x448]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x4114e8
mov eax, 0x601
jmp 0x4115e5
push ecx
lea edx, [ebp - 0x220]
mov ecx, str.FILELOCALE
call fcn.00402db0
add esp, 4
test al, al
jne 0x411519
mov edx, 0xc0000006
mov ecx, 1
call fcn.0040f970
mov eax, 0x501
jmp 0x4115e5
lea eax, [ebp - 0x220]
push 0
push eax
call esi
add esp, 8
test eax, eax
jne 0x4114de
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x460]
call fcn.00405320
lea eax, [ebp - 0x460]
mov dword [ebp - 4], 1
push eax
call fcn.004053c0
mov ecx, eax
call fcn.004111f0
test al, al
lea ecx, [ebp - 0x460]
sete bl
call fcn.004025d0
test bl, bl
jne 0x4114de
lea edx, [ebp - 0x468]
mov dword [ebp - 0x468], 0
mov ecx, str.JHI_LOG
call fcn.00402e40
call fcn.004053c0
cmp dword [ebp - 0x468], 1
jne 0x41159d
mov byte [eax + 8], 1
jmp 0x4115a1
mov byte [eax + 8], 0
lea edx, [ebp - 0x464]
mov ecx, str.JHI_TRANSPORT_TYPE
call fcn.00402e40
mov edi, dword [ebp - 0x464]
test al, al
mov ecx, 2
cmove edi, ecx
mov dword [ebp - 0x464], edi
call fcn.004053c0
mov esi, eax
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
mov dword [esi + 0x44], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d60e
mov esp, ebp
pop ebp
ret