Function at 0x401040
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x4010d0
push eax
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x400
mov dword [esp + 0x20], str.LoadLibrary
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edx
push ebx
push 2
push ebx
push 0xc0001001
push ebx
push 1
push esi
call edi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 1
push ebx
push 0xc0001000
push ebx
push 1
push esi
mov dword [esp + 0x34], str.Could_not_load_the_Java_Virtual_Machine.
call edi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
push str.JNI_CreateJavaVM
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x401170
push eax
lea edx, [esp + 0x18]
push eax
push edx
push 0x400
mov dword [esp + 0x20], str.GetProcAddress
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push 0
mov edi, dword [sym.imp.ADVAPI32.dll_ReportEventA]
push eax
push 0
push 2
push 0
push 0xc0001001
push 0
push 1
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [esp + 0x10]
push 0
push edx
push 0
push 1
push 0
push 0xc0001000
push 0
push 1
push esi
mov dword [esp + 0x34], str.Could_not_find_the_JNI_CreateJavaVM_function_in_the_Virtual_Machine.
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov edi, dword [esp + 0x34]
lea ebp, [edi + 1]
mov dword [esp + 0x34], ebp
lea eax, [ebp*8]
push eax
call fcn.00404d6b
add esp, 4
mov esi, eax
test edi, edi
jle 0x4011aa
mov eax, dword [esp + 0x38]
mov ecx, esi
mov edx, edi
mov ebp, dword [eax]
add eax, 4
mov dword [ecx], ebp
add ecx, 8
dec edx
jne 0x401199
mov ebp, dword [esp + 0x34]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x30]
push ecx
mov dword [esi + edi*8], str.exit
push edx
mov dword [esi + edi*8 + 4], 0x404c60
push 0x40eba8
mov dword [esp + 0x24], 0x10002
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebp
mov byte [esp + 0x30], 1
call dword [esp + 0x1c]
test eax, eax
jl 0x401541
mov eax, dword [0x40eba8]
test eax, eax
je 0x401541
mov eax, dword [esp + 0x30]
test eax, eax
je 0x401541
push esi
call fcn.00404d60
add esp, 4
push 1
push section..text
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x2c]
test eax, eax
je 0x40123b
push eax
mov eax, dword [esp + 0x34]
push eax
push esi
call fcn.00401590
add esp, 0xc
test al, al
je 0x401573
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40125a
mov ecx, dword [esp + 0x30]
push eax
push ecx
push esi
call fcn.00401af0
add esp, 0xc
test al, al
je 0x401573
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x50], edi
mov edx, dword [eax]
call dword [edx + 0x390]
cmp al, 1
jne 0x401293
mov dword [esp + 0x2c], str.Could_not_find_the_service_start_class.
push 0
lea eax, [esp + 0x30]
jmp 0x401464
test edi, edi
jne 0x4012a9
mov dword [esp + 0x2c], str.Could_not_find_the_service_start_class.
push edi
lea eax, [esp + 0x30]
jmp 0x4014be
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
push str.__Ljava_lang_String__V
push edx
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c4]
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x3c], edi
mov ecx, dword [eax]
call dword [ecx + 0x390]
cmp al, 1
jne 0x4012ec
lea edx, [esp + 0x2c]
push 0
mov dword [esp + 0x30], str.Could_not_find_the_start_method.
push edx
jmp 0x401465
test edi, edi
jne 0x401302
mov dword [esp + 0x2c], str.Could_not_find_the_start_method.
push edi
lea eax, [esp + 0x30]
jmp 0x4014be
mov eax, dword [esp + 0x30]
push str.java_lang_String
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [eax]
call dword [edx + 0x390]
cmp al, 1
jne 0x401337
mov dword [esp + 0x2c], str.Could_not_find_the_String_class.
push 0
lea eax, [esp + 0x30]
jmp 0x401464
test ebp, ebp
jne 0x40134d
mov dword [esp + 0x2c], str.Could_not_find_the_String_class.
push ebp
lea eax, [esp + 0x30]
jmp 0x4014be
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x44]
push 0
push ebp
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2b0]
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x38], edi
mov ecx, dword [eax]
call dword [ecx + 0x390]
cmp al, 1
jne 0x40138d
lea edx, [esp + 0x2c]
push 0
mov dword [esp + 0x30], str.Could_not_create_a_start_parameter_array.
push edx
jmp 0x401465
test edi, edi
jne 0x4013a3
mov dword [esp + 0x2c], str.Could_not_create_a_start_parameter_array.
push edi
lea eax, [esp + 0x30]
jmp 0x4014be
mov eax, dword [esp + 0x44]
xor ebp, ebp
test eax, eax
jle 0x401429
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov eax, dword [edx]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x29c]
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x390]
cmp al, 1
je 0x4014a0
test edi, edi
je 0x4014b0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push edi
push ebp
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2b8]
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [eax]
call dword [edx + 0x390]
cmp al, 1
je 0x4014e6
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
inc ebp
add ecx, 4
cmp ebp, eax
mov dword [esp + 0x2c], ecx
jl 0x4013b5
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x30]
push edi
push edx
push eax
push ecx
call fcn.00402450
mov eax, dword [esp + 0x40]
add esp, 0x10
mov edx, dword [eax]
push eax
call dword [edx + 0x390]
cmp al, 1
jne 0x401530
mov dword [esp + 0x2c], str.Could_not_call_the_start_method.
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 1
push 0
push 0xc0001000
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov eax, dword [esp + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [eax]
call dword [edx + 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x2c], str.Could_not_create_a_start_parameter_string.
push 0
lea eax, [esp + 0x30]
jmp 0x401464
mov dword [esp + 0x2c], str.Could_not_create_a_start_parameter_string.
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 1
push 0
push 0xc0001000
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
lea ecx, [esp + 0x2c]
push 0
push ecx
push 0
push 1
push 0
push 0xc0001000
push 0
push 1
push esi
mov dword [esp + 0x50], str.Could_not_set_an_element_in_the_start_parameter_array.
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [esp + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x44]
push 0
push eax
push 0
push 1
push 0
push 0xc0001000
push 0
push 1
push ecx
mov dword [esp + 0x68], str.Could_not_initialize_the_Java_Virtual_Machine.
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call fcn.00404d60
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret