Function at 0x76aa99df
Capabilities:
Access the windows event log
Get process heap flags
Query or enumerate registry key

Disassembly:
push 0x2e8
push 0x76aaa138
call fcn.76aa13c1
mov eax, dword [0x76aae004]
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x294], edi
push 0x76aaa020
lea eax, [ebp - 0x258]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call esi
push 0x76aaa000
lea eax, [ebp - 0x250]
push eax
call esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x228], edi
lea eax, [ebp - 0x228]
push eax
push 4
pop esi
push esi
push 0x76aae538
push esi
push esi
push 0x76aaa088
call fcn.76aa7667
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x228]
push eax
push esi
push 0x76aae560
push esi
push esi
push 0x76aaa0a8
call fcn.76aa7667
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x228], 0x2710
lea eax, [ebp - 0x228]
push eax
push esi
push 0x76aae3b0
push esi
push esi
push 0x76aaa0d0
call fcn.76aa7667
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x228], 0x1d4c0
lea eax, [ebp - 0x228]
push eax
push esi
push 0x76aae3a4
push esi
push esi
push 0x76aaa100
call fcn.76aa7667
mov dword [ebp - 0x240], eax
cmp dword [0x76aae514], edi
jne 0x76aa9af6
push 0x76aaa128
push edi
call sub.ADVAPI32.dll_RegisterEventSourceW
mov dword [0x76aae514], eax
cmp dword [0x76aae524], edi
jne 0x76aa9f55
mov eax, dword [ebp - 0x24e]
add eax, 0x202
mov word [ebp - 0x23a], ax
mov word [ebp - 0x23c], ax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x2ec], eax
movzx ecx, word [ebp - 0x23a]
push ecx
push 8
pop ebx
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call esi
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x274], 0x18
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x268], 0x40
lea eax, [ebp - 0x258]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x260], edi
mov eax, 0x20019
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x274]
push ecx
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x240], eax
mov ecx, 0x218
mov dword [ebp - 0x2dc], ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x2e4], eax
push ecx
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x2f4], 0x418
mov word [ebp - 0x28e], 0x200
mov eax, dword fs:[0x18]
mov dword [ebp - 0x2e8], eax
push 0x200
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov dword [ebp - 0x28c], eax
mov word [ebp - 0x296], 0x100
mov eax, dword fs:[0x18]
mov dword [ebp - 0x2f0], eax
push 0x100
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x240], edi
jl 0x76aa9f55
cmp dword [ebp - 0x238], edi
je 0x76aa9f55
cmp dword [ebp - 0x25c], edi
je 0x76aa9f55
cmp dword [ebp - 0x28c], edi
je 0x76aa9f55
cmp eax, edi
je 0x76aa9f55
mov dword [ebp - 0x27c], edi
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x240], edi
jl 0x76aa9f35
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x2dc]
mov esi, dword [ebp - 0x25c]
push esi
push edi
push dword [ebp - 0x27c]
push dword [ebp - 0x22c]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
mov dword [ebp - 0x240], eax
inc dword [ebp - 0x27c]
cmp eax, edi
jl 0x76aa9f35
xor eax, eax
mov ax, word [esi + 0xc]
lea ecx, [eax + 2]
cmp word [ebp - 0x23a], cx
jb 0x76aa9f2a
mov word [ebp - 0x23c], ax
movzx eax, ax
push eax
add esi, 0x10
push esi
push dword [ebp - 0x238]
call sub.msvcrt.dll_memmove
add esp, 0xc
movzx eax, word [ebp - 0x23c]
shr eax, 1
mov ecx, dword [ebp - 0x238]
mov word [ecx + eax*2], di
push dword [ebp - 0x238]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov dword [ebp - 0x274], 0x18
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], 0x40
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x260], edi
mov eax, 0x2001f
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x274]
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
mov ebx, dword [sym.imp.ntdll.dll_NtOpenKey]
call ebx
mov esi, eax
mov dword [ebp - 0x240], esi
cmp esi, edi
jge 0x76aa9dcc
mov eax, 0x20019
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x274]
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x240], esi
cmp esi, edi
jl 0x76aa9e6a
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x22c]
call fcn.76aa895b
mov dword [ebp - 0x2f8], eax
cmp eax, edi
je 0x76aa9e29
cmp dword [0x76aae524], edi
jne 0x76aa9e10
mov dword [0x76aae524], eax
mov dword [ebp - 0x278], eax
mov dword [0x76aae530], 1
jmp 0x76aa9f2a
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
mov dword [ebp - 0x278], eax
inc dword [0x76aae530]
jmp 0x76aa9f2a
cmp dword [0x76aae4f0], 1
jb 0x76aa9e59
push edi
movzx eax, word [ebp - 0x246]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
push 1
push 0x13
push 0x4e4
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x20
push dword [ebp - 0x230]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x76aa9f2a
xor ebx, ebx
inc ebx
cmp dword [0x76aae4f0], ebx
jb 0x76aa9e9b
push edi
movzx eax, word [ebp - 0x246]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
push ebx
push 0x13
push 0x4f5
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x20
cmp esi, 0xc0000034
je 0x76aa9eab
cmp dword [0x76aae538], ebx
jge 0x76aa9eb7
cmp dword [0x76aae538], 2
jl 0x76aa9f2a
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2e0], edi
mov dword [ebp - 0x280], edi
push esi
call fcn.76aa7e50
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x280], ebx
push 2
pop eax
cmp dword [0x76aae538], eax
jl 0x76aa9eec
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2e0], ebx
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
mov ecx, dword [ebp - 0x280]
shl ecx, 2
push ecx
push ebx
push edi
push 0x800007d1
push edi
push eax
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
mov dword [ebp - 0x240], edi
jmp 0x76aa9c72
cmp dword [ebp - 0x284], edi
je 0x76aa9f49
push dword [ebp - 0x284]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x22c]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 4], 0xffffffff
call fcn.76aa9f78
mov ecx, dword [ebp - 0x1c]
call fcn.76aac8aa
call fcn.76aa16ac
ret