Function at 0x785220
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x58
cmp byte [0x007db1b5], 0
mov rdi, rcx
je 0x78527a
lea rcx, [0x007c54d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x7854db
lea rdx, [0x007c54e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x78526a
lea rcx, [0x007d07f0]
call rax
mov rcx, rbx
add rsp, 0x58
pop rdi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
cmp edx, 3
jne 0x78537e
mov r8, rcx
lea rdx, [rcx + 0x50]
mov rcx, qword [0x007d0980]
mov ebx, 1
mov r9d, ebx
call qword [fcn.007d0778]
cmp eax, 2
jne 0x7852ba
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [fcn.007d07a0]
mov eax, dword [0x007db1c4]
xor esi, esi
test bl, al
je 0x785321
mov rcx, qword [0x007d0978]
cmp rcx, 0xffffffffffffffff
je 0x785321
lea r9, [rsp + 0x88]
lea r8d, [rsi + 0x32]
lea rdx, [rdi + 0x50]
mov byte [rsp + 0x80], 0xa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x007d0978]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x007db1c4]
test al, 4
je 0x7854d1
mov rcx, qword [0x007d0988]
mov qword [rsp + 0x40], rsi
lea rax, [rdi + 0x1e]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov edx, ebx
mov r9d, 0x80000101
mov word [rsp + 0x28], bx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
test edx, edx
jne 0x785421
mov r8, rcx
lea rdx, [rcx + 0x1e]
mov rcx, qword [0x007d0980]
mov ebx, 1
mov r9d, ebx
call qword [fcn.007d0778]
cmp eax, 2
jne 0x7853b3
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [fcn.007d07a0]
mov eax, dword [0x007db1c4]
test bl, al
je 0x78541a
mov rcx, qword [0x007d0978]
cmp rcx, 0xffffffffffffffff
je 0x78541a
xor esi, esi
lea r9, [rsp + 0x88]
lea rdx, [rdi + 0x1e]
lea r8d, [rsi + 0x32]
mov byte [rsp + 0x80], 0xa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x007d0978]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x007db1c4]
test al, 4
jmp 0x7854b7
mov r8, rcx
lea rdx, [rcx + 0x1e]
mov rcx, qword [0x007d0980]
mov ebx, 1
mov r9d, ebx
call qword [fcn.007d0778]
cmp eax, 2
jne 0x78544e
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [fcn.007d07a0]
mov eax, dword [0x007db1c4]
test bl, al
je 0x7854b5
mov rcx, qword [0x007d0978]
cmp rcx, 0xffffffffffffffff
je 0x7854b5
xor esi, esi
lea r9, [rsp + 0x88]
lea rdx, [rdi + 0x1e]
lea r8d, [rsi + 0x32]
mov byte [rsp + 0x80], 0xa
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x007d0978]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x007db1c4]
test al, 4
je 0x7854d1
mov rcx, qword [0x007d0988]
lea r9, [rdi + 0x1e]
mov r8d, 0xc0000100
mov edx, ebx
call fcn.007857f0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret