Function at 0x402c90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x402cb9
jmp 0x402f13
push str.StartTraceW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push str.StopTraceW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push str.EnableTrace
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push str.SetTraceCallback
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push str.GetTraceEnableFlags
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push str.GetTraceLoggerHandle
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push str.RegisterTraceGuidsW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push str.UnregisterTraceGuids
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
push str.TraceEvent
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
push 0x43ce20
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push str.CreateTraceInstanceId
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
push str.TraceEventInstance
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
push str.OpenTraceW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
push str.CloseTrace
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
push str.ProcessTrace
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
push str.QueryAllTracesW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
push str.GetTraceEnableLevel
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
push str.FlushTraceW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
je 0x402f05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
je 0x402f05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x24], 0
je 0x402f05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3c], 0
je 0x402f05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x44], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x48], 0
je 0x402f05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x402f05
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x30], 0
je 0x402f05
mov edx, dword [ebp - 4]
cmp dword [edx + 0x34], 0
jne 0x402f09
jmp 0x402f13
mov eax, dword [ebp - 4]
mov dword [eax + 4], 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x402f24
mov ecx, dword [ebp - 4]
call fcn.00402f30
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov esp, ebp
pop ebp
ret