Function at 0x40dc20
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419f4a
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x421018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x422c58], 1
mov esi, 1
jne 0x40dc7d
or dword [0x422c58], esi
mov dword [ebp - 4], 0
call fcn.004103d0
push 0x41aab0
call fcn.00417dd5
add esp, 4
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x40dc80
or ebx, 0xffffffff
push 0x422c40
call fcn.00410f40
test byte [0x422b68], 1
jne 0x40dcab
or dword [0x422b68], esi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov eax, dword [0x422c08]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push eax
call edi
mov ecx, dword [0x422c10]
push ebx
push ecx
call edi
test byte [0x422b68], 1
jne 0x40dce5
or dword [0x422b68], esi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
cmp dword [0x422b74], 2
jne 0x40dd2e
test byte [0x422b68], 1
jne 0x40dd0f
or dword [0x422b68], esi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov edx, dword [0x422c08]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41be5c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40dd62
push 0
push 0
push 0
push 0
push 0
push 0x40000002
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test byte [0x422c14], 1
jne 0x40dd8e
mov eax, 1
or dword [0x422c14], eax
mov dword [ebp - 4], eax
call fcn.00402990
push 0x41a9d0
call fcn.00417dd5
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [0x422c30]
push ebx
push eax
call edi
mov ecx, dword [0x422c1c]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x422c18
call fcn.00403ad0
mov eax, dword [0x422c1c]
mov dword [eax + 4], eax
mov eax, dword [0x422c1c]
mov dword [eax], eax
mov eax, dword [0x422c1c]
mov dword [eax + 8], eax
mov eax, dword [0x422c30]
xor esi, esi
push eax
mov dword [0x422c20], esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test byte [0x422c58], 1
jne 0x40de02
or dword [0x422c58], 1
mov dword [ebp - 4], 2
call fcn.004103d0
push 0x41aab0
call fcn.00417dd5
add esp, 4
mov dword [ebp - 4], ebx
push 0x422c40
call fcn.00411450
test byte [0x422c68], 1
jne 0x40de36
or dword [0x422c68], 1
push 0x41ab90
mov byte [0x422c64], 0
mov dword [0x422c5c], esi
call fcn.00417dd5
add esp, 4
cmp byte [0x422c64], 0
je 0x40de49
push 0x422c5c
call fcn.0040c660
test byte [0x422b68], 1
mov byte [0x422c64], 0
jne 0x40de72
or dword [0x422b68], 1
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov ecx, dword [0x422b70]
push 0xffffffffffffffff
push ecx
xor bl, bl
call edi
cmp byte [0x422bb4], bl
je 0x40de89
mov bl, 1
mov edx, dword [0x422b70]
mov ecx, 0xd
mov esi, 0x422bb8
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edx
call esi
test bl, bl
je 0x40deb5
mov eax, dword [ebp - 0x40]
push eax
call dword [ebp - 0x38]
add esp, 4
call fcn.0040d7d0
mov eax, dword [0x422b60]
test eax, eax
je 0x40dee5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40dee5
mov ecx, dword [0x422b64]
push ecx
mov dword [0x422b60], 0
call dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test byte [0x422b68], 1
mov edi, 1
jne 0x40df0b
or dword [0x422b68], edi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov edx, dword [0x422b70]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x422b70]
push eax
mov dword [0x422b74], 2
call esi
test byte [0x422b68], 1
jne 0x40df4d
or dword [0x422b68], edi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov ecx, dword [0x422c00]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x422b68], 1
jne 0x40df7b
or dword [0x422b68], edi
call fcn.0040d2d0
push 0x41a960
call fcn.00417dd5
add esp, 4
mov edx, dword [0x422c08]
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret