Function at 0x75b8bf71
Capabilities:
Access the windows event log

Disassembly:
push 0x6c8
push 0x75b8c710
call fcn.75b813c1
mov eax, dword [0x75b8e004]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68c], esi
xor ebx, ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x654], ebx
mov dword [ebp - 0x658], ebx
test byte [esi + 0x140], 0x10
je 0x75b8bfbe
mov eax, 0x422
jmp 0x75b8c6f5
cmp dword [esi + 0x30], ebx
jne 0x75b8c6de
mov dword [ebp - 0x660], ebx
push 4
pop edi
mov dword [ebp - 0x688], edi
mov dword [ebp - 0x65c], ebx
push 1
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x660]
push eax
push ebx
push 0x75b82684
push dword [esi + 0x38]
call fcn.75b87e91
mov dword [ebp - 0x644], eax
cmp eax, ebx
jne 0x75b8c025
cmp dword [ebp - 0x660], edi
jne 0x75b8c025
cmp dword [ebp - 0x65c], 1
jne 0x75b8c025
or dword [esi + 0x140], 0x10
jmp 0x75b8c032
mov dword [ebp - 0x644], ebx
and dword [esi + 0x140], 0xffffffef
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x648], eax
cmp eax, ebx
jne 0x75b8c051
mov eax, 0x75b8c708
mov dword [ebp - 0x648], eax
cmp eax, ebx
je 0x75b8c064
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
mov dword [ebp - 0x64c], eax
jmp 0x75b8c06a
mov dword [ebp - 0x64c], ebx
cmp dword [esi + 0x164], ebx
jl 0x75b8c16a
jg 0x75b8c084
cmp dword [esi + 0x160], ebx
jbe 0x75b8c16a
push dword [esi + 0x148]
call fcn.75b8bde2
test eax, eax
je 0x75b8c09f
or dword [esi + 0x140], 0x20
jmp 0x75b8c16a
xor eax, eax
lea edi, [ebp - 0x6a0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x6a0]
push eax
push dword [esi + 0x34]
call fcn.75b87d28
mov dword [ebp - 0x644], eax
cmp eax, ebx
jne 0x75b8c16a
mov eax, dword [esi + 0x158]
cmp eax, dword [ebp - 0x6a0]
jne 0x75b8c100
mov eax, dword [esi + 0x15c]
cmp eax, dword [ebp - 0x69c]
jne 0x75b8c100
mov eax, dword [esi + 0x160]
cmp eax, dword [ebp - 0x698]
jne 0x75b8c100
mov eax, dword [esi + 0x164]
cmp eax, dword [ebp - 0x694]
je 0x75b8c093
cmp dword [0x75b8e538], 1
jl 0x75b8c16a
cmp dword [0x75b8e4f0], 3
jb 0x75b8c136
push ebx
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 1
push 0x16
push 0x133
push 0x75b825c8
call fcn.75b85e47
add esp, 0x20
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x67c], eax
push ebx
lea eax, [ebp - 0x680]
push eax
push ebx
push 2
push ebx
push 0x800007d3
push ebx
push 2
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
cmp dword [ebp - 0x644], ebx
jne 0x75b8c6ef
test byte [esi + 0x140], 0x10
jne 0x75b8c6ef
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x690], eax
push 8
push ebx
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x75b8c6c4
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x75b8c285
cmp dword [0x75b8e4f0], 1
jb 0x75b8c206
mov edi, dword [esi + 0xc]
cmp edi, ebx
je 0x75b8c1de
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x75b8c1d2
sub eax, edx
inc eax
jmp 0x75b8c1e0
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x159
push 0x75b825c8
call fcn.75b85e47
add esp, 0x28
cmp dword [0x75b8e538], 1
jl 0x75b8c27f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x228]
push eax
push dword [esi + 0xc]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x228]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ed
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.75b87fe3
cmp dword [ebp - 0x644], ebx
jne 0x75b8c45e
push dword [esi + 0x1c]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x75b8c373
cmp dword [0x75b8e4f0], 1
jb 0x75b8c2f4
mov edi, dword [esi + 0x1c]
cmp edi, ebx
je 0x75b8c2cc
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x75b8c2c0
sub eax, edx
inc eax
jmp 0x75b8c2ce
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x187
push 0x75b825c8
call fcn.75b85e47
add esp, 0x28
cmp dword [0x75b8e538], 1
jl 0x75b8c36d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x434]
push eax
push dword [esi + 0x1c]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x434]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ee
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.75b87fe3
cmp dword [ebp - 0x644], ebx
jne 0x75b8c45e
push dword [esi + 0x2c]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x75b8c45e
cmp dword [0x75b8e4f0], 1
jb 0x75b8c3df
mov edi, dword [esi + 0x2c]
cmp edi, ebx
je 0x75b8c3b7
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x75b8c3ab
sub eax, edx
inc eax
jmp 0x75b8c3b9
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x1af
push 0x75b825c8
call fcn.75b85e47
add esp, 0x28
cmp dword [0x75b8e538], 1
jl 0x75b8c458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x640]
push eax
push dword [esi + 0x1c]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x640]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ef
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.75b87fe3
xor eax, eax
inc eax
test byte [0x75b8e3a8], 4
jne 0x75b8c473
test byte [esi + 0x140], 0x20
je 0x75b8c475
xor eax, eax
cmp dword [ebp - 0x644], ebx
jne 0x75b8c682
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6b8], ebx
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x6b4], ecx
mov ecx, dword [esi + 0x148]
mov dword [ebp - 0x6b0], ecx
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], 0x800007d2
mov dword [ebp - 0x6a4], esi
cmp eax, ebx
je 0x75b8c4f4
lea eax, [ebp - 0x6b8]
push eax
call fcn.75b8827f
mov dword [ebp - 0x658], eax
cmp eax, ebx
jne 0x75b8c4fa
cmp dword [0x75b8e4f0], 3
jb 0x75b8c4fa
push ebx
push ebx
push ebx
push 0x16
push 0x1eb
push 0x75b825c8
call fcn.75b85e47
add esp, 0x18
jmp 0x75b8c4fa
mov dword [ebp - 0x658], ebx
push dword [esi + 0x10]
call dword [esi + 8]
mov dword [ebp - 0x650], eax
cmp eax, ebx
je 0x75b8c562
cmp dword [0x75b8e4f0], 1
jb 0x75b8c556
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x75b8c527
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
jmp 0x75b8c529
xor eax, eax
push ebx
push eax
push dword [esi + 0x10]
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push dword [ebp - 0x650]
push 0x11
push 0x16
push 0x1fa
push 0x75b825c8
call fcn.75b85e47
add esp, 0x28
mov dword [ebp - 0x654], 0xc00003f0
jmp 0x75b8c56f
lea eax, [esi + 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
or dword [ebp - 4], 0xffffffff
jmp 0x75b8c5e2
cmp dword [ebp - 0x658], ebx
je 0x75b8c5fb
push dword [ebp - 0x658]
call fcn.75b87af8
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x650], ebx
je 0x75b8c67b
xor edi, edi
inc edi
cmp dword [ebp - 0x654], 0xc00003f1
jne 0x75b8c61a
push esi
call fcn.75b87fe3
jmp 0x75b8c624
push 1
push esi
call fcn.75b88020
mov edi, eax
cmp edi, ebx
jbe 0x75b8c682
cmp dword [0x75b8e538], 1
jl 0x75b8c682
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x6d8], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 2
push ebx
push dword [ebp - 0x654]
push ebx
push 1
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
jmp 0x75b8c682
push ebx
push esi
call fcn.75b88020
mov edi, dword [ebp - 0x650]
cmp edi, ebx
je 0x75b8c6b1
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x75b8c6a9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x30], ebx
mov dword [ebp - 0x644], edi
jmp 0x75b8c6d0
call fcn.75b8ac77
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], edx
jmp 0x75b8c6d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
push dword [ebp - 0x690]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x75b8c6ef
call fcn.75b8ac77
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], edx
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x1c]
call fcn.75b8c8aa
call fcn.75b816ac
ret 4