Function at 0x2000d460
Capabilities:
Access the windows event log

Disassembly:
push 0xffffffffffffffff
push 0x20019d0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x30], 0x2001a830
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0x74]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [0x2001a4dc]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x2000d515
mov ecx, dword [esp + 0x64]
xor ebp, ebp
mov dword [esp + 0x5c], ebp
mov dword [esi], 0x2001a82c
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x2000d54e.2
xor edx, edx
mov dl, byte [eax + 0x2000d7d4]
jmp dword [edx*4 + 0x2000d7cc]
mov dword [esi + 0x120], ecx
jmp 0x2000d567
mov dword [esi + 0x120], 8
call fcn.20007990
push ebp
call dword [0x2001a4d4]
mov dword [esi + 0xf4], eax
mov dword [esi + 0xc0], 0xcc0020
mov byte [esi + 0xb4], 1
call dword [sym.imp.MSVCRT.dll__initterm]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0xc4], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [0x2001a480]
push ebp
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xc8], eax
mov al, byte [esp + 0x6c]
mov byte [esi + 0xbc], al
call edi
push 1
mov dword [esi + 0xd8], eax
call edi
mov ecx, dword [esi + 0x120]
mov dword [esi + 0xdc], eax
mov eax, 0x20
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
cdq
idiv ecx
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xd0], eax
lea eax, [ecx + ecx*2]
shl eax, 3
mov ecx, dword [esi + 0xf4]
cdq
and edx, 7
push ecx
add eax, edx
sar eax, 3
mov dword [esi + 0xd4], eax
call edi
mov edx, dword [esi + 0xf4]
mov dword [esi + 0xfc], eax
push edx
call edi
push ebp
mov dword [esi + 0x12c], eax
call edi
push ebp
mov dword [esi + 0xf8], eax
call edi
mov ecx, dword [esi + 0x120]
mov dword [esi + 0x100], eax
mov eax, dword [esi + 0xd8]
push 1
lea edi, [esi + 0x10c]
lea ebx, [esi + 0x110]
push eax
push ecx
mov ecx, esi
mov dword [edi], ebp
mov dword [ebx], ebp
call fcn.20012c70
mov edx, dword [esi + 0xdc]
mov ecx, dword [esi + 0x120]
mov dword [esi + 0x114], eax
mov eax, dword [esi + 0xd8]
push edx
push eax
push ecx
mov ecx, esi
call fcn.20012c70
mov edx, dword [esi + 0xd8]
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x120]
push 1
push edx
push eax
mov ecx, esi
call fcn.20012c70
mov dword [esi + 0x11c], eax
push ebp
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0xf4]
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push ecx
push edx
call edi
mov ecx, dword [esi + 0xf4]
push ebp
mov dword [esi + 0x104], eax
mov eax, dword [esi + 0x118]
push ebp
push ebx
push ebp
push eax
push ecx
call edi
mov ecx, dword [esi + 0xf4]
push ebp
lea edx, [esi + 0x128]
mov dword [esi + 0x108], eax
mov eax, dword [esi + 0x118]
push ebp
push edx
push ebp
push eax
push ecx
call edi
mov edx, dword [esi + 0x108]
mov edi, dword [0x2001a0f4]
mov dword [esi + 0x130], eax
mov eax, dword [esi + 0xfc]
push edx
push eax
call edi
mov ecx, dword [esi + 0x104]
mov edx, dword [esi + 0xf8]
push ecx
push edx
call edi
mov eax, dword [esi + 0x130]
mov ecx, dword [esi + 0x12c]
push eax
push ecx
call edi
mov edx, dword [esi + 0xdc]
mov eax, dword [esi + 0xd8]
mov edi, dword [0x2001a4d0]
push edx
push eax
push ebp
lea ecx, [esi + 0xe4]
push ebp
push ecx
call edi
mov edx, dword [esi + 0x118]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call fcn.200196d0
mov dword [esi + 0x2c], eax
mov byte [eax], 0x75
mov ecx, dword [esi + 0x2c]
mov dl, byte [esi + 0xb4]
add esp, 4
mov byte [ecx + 1], dl
mov eax, dword [esi + 0x118]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
push ecx
push edx
push ebp
lea eax, [esi + 4]
push ebp
push eax
call edi
mov ecx, dword [esi + 0x118]
xor edx, edx
mov eax, dword [ecx + 0x14]
div dword [esi + 0xdc]
lea edx, [esi + 0x14]
mov dword [esi + 0xcc], ebp
push edx
mov dword [esi + 0x124], eax
call dword [0x2001a178]
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc
cmp byte [eax], al
pop es
add byte [edi], al
add byte [eax], bh
pop es
add byte [eax + eax], al
pop es
add byte [eax + eax + 7], al
add byte [eax + eax], ah
pop es
add byte [eax + eax + 7], ah
add byte [eax + eax], dl
pop es
add byte [eax + eax + 7], dl
add byte [eax + eax], dh
pop es
add byte [eax + eax + 7], dh
add byte [ebx], al
add byte [eax], cl
add byte [ebx + 0x43000800], al
add byte [eax], cl
add bl, al
add byte [eax], cl
add byte [ebx], ah
add byte [eax], cl
add byte [ebx + 0x63000800], ah
add byte [eax], cl
add bl, ah
add byte [eax], cl
add byte [eax], al
add byte [0x5001000], al
add byte [eax], cl
add byte [0x5001800], al
add byte [eax + eax], al
add eax, 0x5001400
add byte [eax + eax], cl
add eax, 0x5001c00
add byte [edx], al
add byte [0x5001200], al
add byte [edx], cl
add byte [0x5001a00], al
add byte [esi], al
add byte [0x5001600], al
add byte [esi], cl
add byte [0x5001e00], al
add byte [ecx], al
add byte [0x5001100], al
add byte [ecx], cl
add byte [0x5001900], al
add byte [0x15000500], al
add byte [0x5000d00], al
add byte [0x3000500], bl
add byte [0x5001300], al
add byte [ebx], cl
add byte [0x5001b00], al
add byte [edi], al
add byte [0x5001700], al
add byte [eax], al
add dword [edx], eax
add eax, dword [esp + eax]
add eax, 0x6060605
push es
pop es
pop es
pop es
pop es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or cl, byte [edx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xe0e0e0d
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
invalid