Function at 0x75b865f1
Capabilities:
Access the windows event log
Get session user name
Identify system language via api

Disassembly:
push 0x3b0
push 0x75b86f00
call fcn.75b813c1
mov eax, dword [0x75b8e004]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x334], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x370], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x338], edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x350], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x368], eax
xor ebx, ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x354], ebx
mov word [ebp - 0x340], bx
mov word [ebp - 0x33e], bx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x34c], ebx
or dword [ebp - 0x348], 0xffffffff
or dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x75b86689
mov dword [eax], ebx
cmp edx, ebx
je 0x75b8669c
cmp ecx, ebx
jne 0x75b8669c
push 0x57
pop edi
mov dword [ebp - 0x330], edi
jmp 0x75b8669f
push 0x57
pop edi
cmp ecx, ebx
je 0x75b866ab
mov eax, dword [ecx]
mov dword [ebp - 0x354], eax
or dword [ebp - 4], 0xffffffff
jmp 0x75b866dd
mov eax, dword [ebp - 0x330]
cmp eax, ebx
je 0x75b866f2
mov dword [ebp - 0x328], eax
jmp 0x75b86e38
cmp esi, ebx
je 0x75b86e32
cmp dword [esi + 4], ebx
je 0x75b86e32
mov eax, dword fs:[0x18]
add eax, 0xbf8
cmp esi, eax
jne 0x75b86733
push dword [esi + 4]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
neg al
sbb eax, eax
and eax, 0xffffffa9
add eax, edi
mov dword [ebp - 0x328], eax
jmp 0x75b86744
mov eax, dword [esi]
mov dword [ebp - 0x340], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x328], ebx
jne 0x75b86e38
cmp dword [0x75b8e51c], ebx
je 0x75b86764
cmp dword [0x75b8e548], ebx
jne 0x75b86820
call fcn.75b85f79
mov dword [ebp - 0x328], eax
cmp eax, ebx
jne 0x75b86820
call fcn.75b8bda9
test eax, eax
jne 0x75b86820
cmp dword [0x75b8e538], 1
jl 0x75b867f4
mov dword [ebp - 0x394], 0x80
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.ADVAPI32.dll_GetUserNameW
push 0x104
lea eax, [ebp - 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x3a0], eax
push ebx
lea eax, [ebp - 0x3a4]
push eax
push ebx
push 2
push ebx
push 0xc00003e8
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
push 5
pop eax
mov dword [ebp - 0x328], eax
mov esi, 0x75b825c8
cmp dword [0x75b8e4f0], 1
jb 0x75b86825
push ebx
push eax
push ebx
push 0xb
push 0x335
push esi
call fcn.75b85e47
add esp, 0x18
jmp 0x75b86825
mov esi, 0x75b825c8
cmp dword [ebp - 0x328], ebx
jne 0x75b86e3d
cmp dword [0x75b8e3ac], ebx
je 0x75b868d8
push ebx
push 0x1c
lea eax, [ebp - 0x3c0]
push eax
push ebx
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
cmp eax, ebx
jl 0x75b86862
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x32c], eax
jmp 0x75b86885
cmp dword [0x75b8e4f0], 3
jb 0x75b8687e
push ebx
push eax
push ebx
push 0xb
push 0x34b
push esi
call fcn.75b85e47
add esp, 0x18
or dword [ebp - 0x32c], 0xffffffff
push 0xf
pop eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x32c], ebx
jle 0x75b868d1
cmp dword [ebp - 0x32c], eax
jge 0x75b868d1
push 4
lea eax, [ebp - 0x348]
push eax
push 2
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jge 0x75b868d8
cmp dword [0x75b8e4f0], 3
jb 0x75b868d1
push ebx
push eax
push ebx
push 0xb
push 0x360
push esi
call fcn.75b85e47
add esp, 0x18
or dword [ebp - 0x32c], 0xffffffff
push dword [ebp - 0x33c]
call fcn.75b8783a
mov edi, eax
mov dword [ebp - 0x360], edi
cmp dword [0x75b8e4f0], 4
jb 0x75b86907
push ebx
push edi
push ebx
push 0xb
push 0x382
push esi
call fcn.75b85e47
add esp, 0x18
cmp edi, 5
je 0x75b86c55
cmp edi, 6
je 0x75b86c55
cmp edi, 7
je 0x75b86c55
cmp edi, 8
je 0x75b86c55
mov dword [ebp - 0x390], ebx
mov dword [ebp - 0x38c], ebx
mov dword [ebp - 0x388], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x35c], 0xfeced300
or dword [ebp - 0x358], 0xffffffff
lea eax, [ebp - 0x35c]
push eax
push ebx
push dword [0x75b8e51c]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, ebx
je 0x75b869b5
mov dword [ebp - 0x330], 0xaa
xor edi, edi
cmp dword [0x75b8e4f0], 1
jb 0x75b86be8
push ebx
push eax
push ebx
push 0xb
push 0x3da
push esi
call fcn.75b85e47
add esp, 0x18
jmp 0x75b86be8
cmp dword [0x75b8e4f0], 4
jb 0x75b869d1
push ebx
push ebx
push ebx
push 0xb
push 0x3dd
push esi
call fcn.75b85e47
add esp, 0x18
push 0x7a
pop edi
mov dword [ebp - 0x364], edi
cmp dword [ebp - 0x354], edi
jae 0x75b86a19
mov dword [ebp - 0x330], 0xea
cmp dword [0x75b8e4f0], 2
jb 0x75b86bdc
push ebx
push 4
push dword [ebp - 0x350]
push edi
push ebx
push 0xb
push 0x3e7
push esi
call fcn.75b85e47
add esp, 0x20
jmp 0x75b86bdc
mov dword [ebp - 4], 1
cmp dword [ebp - 0x360], 3
jne 0x75b86a58
cmp dword [ebp - 0x338], ebx
jne 0x75b86a3d
mov dword [ebp - 0x330], 0xea
jmp 0x75b86a78
mov edi, dword [ebp - 0x338]
mov dword [ebp - 0x344], edi
push 0x16
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x364]
jmp 0x75b86a78
cmp dword [ebp - 0x338], ebx
je 0x75b86a31
push 0xee
push ebx
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x338]
call fcn.75b87a31
or dword [ebp - 4], 0xffffffff
jmp 0x75b86aaa
cmp dword [ebp - 0x330], ebx
jne 0x75b86be8
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x384], eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
cmp dword [0x75b8e508], ebx
jne 0x75b86b1d
lea eax, [ebp - 0x390]
push eax
call fcn.75b8adcc
jmp 0x75b86bd6
push dword [0x75b8e4d8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
push dword [0x75b8e4e0]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call edi
mov ecx, 0x102
cmp eax, ecx
jne 0x75b86bc4
xor eax, eax
inc eax
mov dword [0x75b8e50c], eax
cmp dword [0x75b8e4f0], eax
jb 0x75b86b68
push ebx
push ecx
push ebx
push 0xb
push 0x436
push esi
call fcn.75b85e47
add esp, 0x18
cmp dword [0x75b8e538], 1
jl 0x75b86baf
mov eax, dword [ebp - 0x37c]
cmp eax, ebx
je 0x75b86b86
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x39c], eax
jmp 0x75b86b90
mov dword [ebp - 0x39c], 0x75b86ef4
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
push 1
push ebx
push 0xc00003f7
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventA
push dword [ebp - 0x37c]
call fcn.75b87fe3
push 0xffffffffffffffff
push dword [0x75b8e4e0]
call edi
mov dword [0x75b8e50c], ebx
mov eax, dword [ebp - 0x378]
mov edi, dword [ebp - 0x364]
mov dword [ebp - 0x330], eax
push dword [0x75b8e51c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 0x330]
cmp edx, ebx
je 0x75b86bfc
cmp dword [ebp - 0x354], edi
jb 0x75b86c28
jmp 0x75b86c2a
mov eax, dword [ebp - 0x338]
mov edi, dword [ebp - 0x344]
sub edi, eax
cmp dword [ebp - 0x354], edi
jb 0x75b86c23
mov ecx, dword [ebp - 0x350]
cmp ecx, ebx
je 0x75b86c1e
mov dword [ecx], edi
mov dword [eax + 0x14], edi
jmp 0x75b86c2a
mov edx, 0xea
xor edi, edi
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x368]
cmp eax, ebx
je 0x75b86c3c
mov dword [eax], edi
mov eax, dword [ebp - 0x36c]
cmp eax, ebx
je 0x75b86e3d
mov dword [eax], 3
jmp 0x75b86e3d
mov dword [ebp - 0x35c], 0xfeced300
or dword [ebp - 0x358], 0xffffffff
lea eax, [ebp - 0x35c]
push eax
push ebx
push dword [0x75b8e51c]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, ebx
je 0x75b86cad
mov dword [ebp - 0x328], 0xaa
cmp dword [0x75b8e4f0], 1
jb 0x75b86e3d
push ebx
push eax
push ebx
push 0xb
push 0x393
push esi
call fcn.75b85e47
add esp, 0x18
jmp 0x75b86e3d
cmp dword [0x75b8e4f0], 4
jb 0x75b86cc9
push ebx
push ebx
push ebx
push 0xb
push 0x396
push esi
call fcn.75b85e47
add esp, 0x18
cmp dword [ebp - 0x334], 0x80000004
jne 0x75b86cdd
mov dword [ebp - 0x34c], ebx
jmp 0x75b86d1a
cmp dword [ebp - 0x334], 0x80000050
jne 0x75b86cf5
mov dword [ebp - 0x34c], 0x75b8e4a4
jmp 0x75b86d1a
cmp dword [ebp - 0x334], 0x80000060
jne 0x75b86d1a
xor eax, eax
mov ecx, 0x75b8e4f8
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34c], ecx
push ecx
call fcn.75b8a1c2
push dword [ebp - 0x34c]
push dword [ebp - 0x368]
push dword [ebp - 0x350]
push dword [ebp - 0x338]
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x360]
call fcn.75b8a77a
mov edi, eax
cmp dword [0x75b8e4f0], 4
jb 0x75b86d6b
push ebx
push 4
lea eax, [ebp - 0x334]
push eax
push edi
push ebx
push 0xb
push 0x3ab
push esi
call fcn.75b85e47
add esp, 0x20
cmp edi, ebx
jge 0x75b86e04
cmp dword [ebp - 0x334], 0x80000060
jne 0x75b86de4
cmp dword [0x75b8e4f0], 3
jb 0x75b86d9b
push ebx
push edi
push ebx
push 0xb
push 0x3b1
push esi
call fcn.75b85e47
add esp, 0x18
xor eax, eax
mov ecx, 0x75b8e4f8
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.75b8a149
push dword [ebp - 0x34c]
push dword [ebp - 0x368]
push dword [ebp - 0x350]
push dword [ebp - 0x338]
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x360]
call fcn.75b8a77a
mov edi, eax
cmp edi, ebx
jge 0x75b86e04
cmp dword [0x75b8e4f0], 1
jb 0x75b86e04
push ebx
push edi
push ebx
push 0xb
push 0x3be
push esi
call fcn.75b85e47
add esp, 0x18
push edi
call fcn.75b87e50
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x36c], ebx
je 0x75b86e24
mov eax, dword [ebp - 0x36c]
mov dword [eax], 7
push dword [0x75b8e51c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x75b86e3d
mov dword [ebp - 0x328], edi
mov esi, 0x75b825c8
cmp dword [0x75b8e3ac], ebx
je 0x75b86e6a
mov eax, dword [ebp - 0x32c]
cmp eax, ebx
jle 0x75b86e6a
cmp eax, dword [ebp - 0x348]
je 0x75b86e6a
push 4
lea eax, [ebp - 0x32c]
push eax
push 2
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp dword [ebp - 0x33c], ebx
je 0x75b86ebb
mov eax, dword fs:[0x18]
add eax, 0xbf8
cmp dword [ebp - 0x370], eax
jne 0x75b86ebb
movzx ecx, word [ebp - 0x33e]
mov esi, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x370]
mov edi, dword [eax + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov esi, 0x75b825c8
cmp dword [0x75b8e4f0], 4
jb 0x75b86edc
push ebx
push dword [ebp - 0x328]
push ebx
push 0xb
push 0x4b2
push esi
call fcn.75b85e47
add esp, 0x18
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x1c]
call fcn.75b8c8aa
call fcn.75b816ac
ret 0x1c