Function at 0x402490
Capabilities:
Access the windows event log
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x435068]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push dword [esp + 0x18]
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 2
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.004048a0
mov edx, dword [esp + 0x24]
mov edi, 3
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], edi
nop dword [eax + eax]
mov ebx, eax
xor esi, esi
sub ebx, edx
mov cl, 1
add ebx, 3
shr ebx, 2
cmp edx, eax
mov eax, edx
cmova ebx, esi
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x402555
nop dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, edi
cdq
idiv dword [esp + 0x10]
test edx, edx
jne 0x40253d
xor eax, eax
movzx ecx, cl
cmp edi, dword [esp + 0x10]
cmovne ecx, eax
mov eax, dword [esp + 0x14]
inc esi
add eax, 4
mov dword [esp + 0x14], eax
cmp esi, ebx
jne 0x402520
mov edx, dword [esp + 0x24]
test cl, cl
je 0x40257f
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
je 0x40256c
mov dword [eax], edi
add eax, 4
mov dword [esp + 0x28], eax
jmp 0x402587
lea ecx, [esp + 0x18]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.004046f0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x7a120
jle 0x402500
test edx, edx
je 0x4025c9
sub ecx, edx
mov eax, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4025bf
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402741
push ecx
push edx
call fcn.004079d3
add esp, 8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x101
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x432a38
push str.c:windows_system.ini
call fcn.0040c5e2
add esp, 8
test eax, eax
je 0x40272a
push eax
call fcn.0040c802
add esp, 4
push str.Application
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
test eax, eax
jne 0x402622
push str.error_n
call fcn.004011d0
add esp, 4
push 0
call fcn.0040e77f
add esp, 4
push eax
call fcn.0040c486
movsd xmm0, qword [0x432ac8]
add esp, 4
xor edi, edi
movsd qword [esp + 0x18], xmm0
call fcn.0040c465
mov esi, eax
and esi, 0x80000001
jns 0x402659
dec esi
or esi, 0xfffffffe
inc esi
call fcn.0040c465
and eax, 0x80000001
jns 0x40266a
dec eax
or eax, 0xfffffffe
inc eax
movsd xmm1, qword [esp + 0x18]
lea ecx, [edi + 1]
addsd xmm1, qword [0x432ac8]
movsd xmm0, qword [0x432ad8]
imul eax, eax
imul esi, esi
addsd xmm1, qword [0x432ac0]
add eax, esi
cmp eax, 1
movsd qword [esp + 0x18], xmm1
cmovg ecx, edi
comisd xmm0, xmm1
mov edi, ecx
ja 0x402645
movd xmm0, edi
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm1
mulsd xmm0, qword [0x432ad0]
movaps xmm1, xmm0
call fcn.004027a0
push eax
call fcn.00404680
mov ecx, 0x1d7f
add esp, 4
mov ebx, 1
mov dword [esp + 0x18], ecx
nop word [eax + eax]
mov edi, ebx
cmp ebx, 2
jb 0x40271b
mov esi, 2
nop dword [eax]
xor edx, edx
mov eax, edi
div esi
test edx, edx
jne 0x402711
mov edi, eax
test esi, esi
je 0x402717
push esi
call fcn.00402920
push eax
call fcn.00404680
add esp, 4
jmp 0x402712
inc esi
cmp edi, 1
ja 0x4026f0
mov ecx, dword [esp + 0x18]
inc ebx
sub ecx, 1
mov dword [esp + 0x18], ecx
jne 0x4026e0
call fcn.00402190
mov ecx, dword [esp + 0x13c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040798d
mov esp, ebp
pop ebp
ret
call fcn.0040ea90
int3