Function at 0x402f60
Capabilities:
Accept command line arguments
Access the windows event log
Move file
Resume thread

Disassembly:
sub esp, 0x42c
mov eax, dword [0x45fd20]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x434]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push ebp
push esi
mov dword [esp + 0x1c], eax
xor esi, esi
mov eax, dword [esp + 0x444]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x24], eax
cmp dword [0x361e340], 0x2f
jne 0x402fb8
lea eax, [esp + 0x18]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp esi, 0xbf247
jne 0x403000
push 0x461260
push dword [0x361e350]
mov dword [0x461260], 0x626f6c47
mov dword [0x461264], 0x6c416c61
mov dword [0x461268], 0x636f6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x24]
mov dword [0x361e33c], eax
push dword [ecx]
push 0
call eax
mov ebp, eax
cmp dword [0x361e340], 0x711
jne 0x403018
push 0
call edi
push 0
push 0
push 0
call ebx
inc esi
cmp esi, 0x142ccf
jl 0x402fa0
cmp dword [0x361e340], 0x661
jne 0x403049
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
xor esi, esi
cmp dword [0x361e340], 0x833
jne 0x403078
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
mov eax, dword [esp + 0x24]
xor edi, edi
cmp dword [eax], esi
jbe 0x403255
jmp 0x403090
cmp dword [0x361e340], 0x78e
jne 0x4030b5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x361e340], 0xa49
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
mov al, byte [edi + eax]
mov byte [esp + 0x12], al
jne 0x4030e5
push 0
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
cmp dword [0x361e340], 0xebd
mov eax, dword [ebx]
mov cl, byte [eax + edi + 1]
mov byte [esp + 0x11], cl
mov cl, byte [eax + edi + 2]
mov al, byte [eax + edi + 3]
mov byte [esp + 0x1f], cl
mov byte [esp + 0x13], al
jne 0x403115
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov al, byte [esp + 0x13]
mov dword [esp + 0x18], 0xcb345b8e
add dword [esp + 0x18], 0x34cba472
and ebx, 0x1f191881
add dword [esp + 0x18], 2
mov ecx, dword [esp + 0x18]
mov dl, al
mov eax, dword [0x361f5bc]
shl dl, cl
xor ecx, ecx
cmp dword [0x361e340], 0xfe0
mov dword [esp + 0x14], ecx
cmove eax, ecx
and dl, 0xc0
or byte [esp + 0x12], dl
mov dword [0x361f5bc], eax
xor ebx, 0x64a8d050
sub dword [esp + 0x14], 0x667523e6
shl eax, 4
add dword [esp + 0x14], 0x10ea4f44
add dword [esp + 0x14], 0x558ad4a6
mov bh, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
mov bl, bh
mov eax, dword [0x361e340]
shl bl, cl
cmp eax, 0x8c0
jne 0x4031b3
push 0
push 0
push dword [esp + 0x28]
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x30]
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov eax, dword [0x361e340]
and bl, 0xc0
or byte [esp + 0x11], bl
cmp eax, 0x447
jne 0x4031e0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov eax, dword [0x361e340]
shl bh, 6
cmp eax, 0x372
jne 0x4031f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, byte [esp + 0x1f]
mov al, byte [esp + 0x12]
or bl, bh
mov byte [esi + ebp], al
cmp dword [0x361e340], 0x441
jne 0x403219
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov cl, byte [esp + 0x11]
mov byte [esi + ebp + 1], cl
cmp dword [0x361e340], 0x1227
jne 0x403235
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
mov eax, dword [esp + 0x24]
add edi, 4
mov byte [esi + ebp + 2], bl
add esi, 3
mov dword [0x361f5c0], 0xf8d91dea
cmp edi, dword [eax]
jb 0x403090
mov ecx, dword [esp + 0x20]
pop edi
mov dword [ecx], ebp
mov dword [eax], esi
cmp dword [0x361e340], 0x827
pop esi
pop ebp
pop ebx
jne 0x403293
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00404b9a
add esp, 0x42c
ret