Function at 0x76aa65f1
Capabilities:
Access the windows event log
Get session user name
Identify system language via api

Disassembly:
push 0x3b0
push 0x76aa6f00
call fcn.76aa13c1
mov eax, dword [0x76aae004]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x334], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x370], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x338], edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x350], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x368], eax
xor ebx, ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x354], ebx
mov word [ebp - 0x340], bx
mov word [ebp - 0x33e], bx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x34c], ebx
or dword [ebp - 0x348], 0xffffffff
or dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x76aa6689
mov dword [eax], ebx
cmp edx, ebx
je 0x76aa669c
cmp ecx, ebx
jne 0x76aa669c
push 0x57
pop edi
mov dword [ebp - 0x330], edi
jmp 0x76aa669f
push 0x57
pop edi
cmp ecx, ebx
je 0x76aa66ab
mov eax, dword [ecx]
mov dword [ebp - 0x354], eax
or dword [ebp - 4], 0xffffffff
jmp 0x76aa66dd
mov eax, dword [ebp - 0x330]
cmp eax, ebx
je 0x76aa66f2
mov dword [ebp - 0x328], eax
jmp 0x76aa6e38
cmp esi, ebx
je 0x76aa6e32
cmp dword [esi + 4], ebx
je 0x76aa6e32
mov eax, dword fs:[0x18]
add eax, 0xbf8
cmp esi, eax
jne 0x76aa6733
push dword [esi + 4]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
neg al
sbb eax, eax
and eax, 0xffffffa9
add eax, edi
mov dword [ebp - 0x328], eax
jmp 0x76aa6744
mov eax, dword [esi]
mov dword [ebp - 0x340], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x328], ebx
jne 0x76aa6e38
cmp dword [0x76aae51c], ebx
je 0x76aa6764
cmp dword [0x76aae548], ebx
jne 0x76aa6820
call fcn.76aa5f79
mov dword [ebp - 0x328], eax
cmp eax, ebx
jne 0x76aa6820
call fcn.76aabda9
test eax, eax
jne 0x76aa6820
cmp dword [0x76aae538], 1
jl 0x76aa67f4
mov dword [ebp - 0x394], 0x80
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.ADVAPI32.dll_GetUserNameW
push 0x104
lea eax, [ebp - 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x3a0], eax
push ebx
lea eax, [ebp - 0x3a4]
push eax
push ebx
push 2
push ebx
push 0xc00003e8
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
push 5
pop eax
mov dword [ebp - 0x328], eax
mov esi, 0x76aa25c8
cmp dword [0x76aae4f0], 1
jb 0x76aa6825
push ebx
push eax
push ebx
push 0xb
push 0x335
push esi
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aa6825
mov esi, 0x76aa25c8
cmp dword [ebp - 0x328], ebx
jne 0x76aa6e3d
cmp dword [0x76aae3ac], ebx
je 0x76aa68d8
push ebx
push 0x1c
lea eax, [ebp - 0x3c0]
push eax
push ebx
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
cmp eax, ebx
jl 0x76aa6862
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x32c], eax
jmp 0x76aa6885
cmp dword [0x76aae4f0], 3
jb 0x76aa687e
push ebx
push eax
push ebx
push 0xb
push 0x34b
push esi
call fcn.76aa5e47
add esp, 0x18
or dword [ebp - 0x32c], 0xffffffff
push 0xf
pop eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x32c], ebx
jle 0x76aa68d1
cmp dword [ebp - 0x32c], eax
jge 0x76aa68d1
push 4
lea eax, [ebp - 0x348]
push eax
push 2
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jge 0x76aa68d8
cmp dword [0x76aae4f0], 3
jb 0x76aa68d1
push ebx
push eax
push ebx
push 0xb
push 0x360
push esi
call fcn.76aa5e47
add esp, 0x18
or dword [ebp - 0x32c], 0xffffffff
push dword [ebp - 0x33c]
call fcn.76aa783a
mov edi, eax
mov dword [ebp - 0x360], edi
cmp dword [0x76aae4f0], 4
jb 0x76aa6907
push ebx
push edi
push ebx
push 0xb
push 0x382
push esi
call fcn.76aa5e47
add esp, 0x18
cmp edi, 5
je 0x76aa6c55
cmp edi, 6
je 0x76aa6c55
cmp edi, 7
je 0x76aa6c55
cmp edi, 8
je 0x76aa6c55
mov dword [ebp - 0x390], ebx
mov dword [ebp - 0x38c], ebx
mov dword [ebp - 0x388], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x35c], 0xfeced300
or dword [ebp - 0x358], 0xffffffff
lea eax, [ebp - 0x35c]
push eax
push ebx
push dword [0x76aae51c]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, ebx
je 0x76aa69b5
mov dword [ebp - 0x330], 0xaa
xor edi, edi
cmp dword [0x76aae4f0], 1
jb 0x76aa6be8
push ebx
push eax
push ebx
push 0xb
push 0x3da
push esi
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aa6be8
cmp dword [0x76aae4f0], 4
jb 0x76aa69d1
push ebx
push ebx
push ebx
push 0xb
push 0x3dd
push esi
call fcn.76aa5e47
add esp, 0x18
push 0x7a
pop edi
mov dword [ebp - 0x364], edi
cmp dword [ebp - 0x354], edi
jae 0x76aa6a19
mov dword [ebp - 0x330], 0xea
cmp dword [0x76aae4f0], 2
jb 0x76aa6bdc
push ebx
push 4
push dword [ebp - 0x350]
push edi
push ebx
push 0xb
push 0x3e7
push esi
call fcn.76aa5e47
add esp, 0x20
jmp 0x76aa6bdc
mov dword [ebp - 4], 1
cmp dword [ebp - 0x360], 3
jne 0x76aa6a58
cmp dword [ebp - 0x338], ebx
jne 0x76aa6a3d
mov dword [ebp - 0x330], 0xea
jmp 0x76aa6a78
mov edi, dword [ebp - 0x338]
mov dword [ebp - 0x344], edi
push 0x16
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x364]
jmp 0x76aa6a78
cmp dword [ebp - 0x338], ebx
je 0x76aa6a31
push 0xee
push ebx
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x338]
call fcn.76aa7a31
or dword [ebp - 4], 0xffffffff
jmp 0x76aa6aaa
cmp dword [ebp - 0x330], ebx
jne 0x76aa6be8
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x384], eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
cmp dword [0x76aae508], ebx
jne 0x76aa6b1d
lea eax, [ebp - 0x390]
push eax
call fcn.76aaadcc
jmp 0x76aa6bd6
push dword [0x76aae4d8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
push dword [0x76aae4e0]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call edi
mov ecx, 0x102
cmp eax, ecx
jne 0x76aa6bc4
xor eax, eax
inc eax
mov dword [0x76aae50c], eax
cmp dword [0x76aae4f0], eax
jb 0x76aa6b68
push ebx
push ecx
push ebx
push 0xb
push 0x436
push esi
call fcn.76aa5e47
add esp, 0x18
cmp dword [0x76aae538], 1
jl 0x76aa6baf
mov eax, dword [ebp - 0x37c]
cmp eax, ebx
je 0x76aa6b86
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x39c], eax
jmp 0x76aa6b90
mov dword [ebp - 0x39c], 0x76aa6ef4
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
push 1
push ebx
push 0xc00003f7
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventA
push dword [ebp - 0x37c]
call fcn.76aa7fe3
push 0xffffffffffffffff
push dword [0x76aae4e0]
call edi
mov dword [0x76aae50c], ebx
mov eax, dword [ebp - 0x378]
mov edi, dword [ebp - 0x364]
mov dword [ebp - 0x330], eax
push dword [0x76aae51c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 0x330]
cmp edx, ebx
je 0x76aa6bfc
cmp dword [ebp - 0x354], edi
jb 0x76aa6c28
jmp 0x76aa6c2a
mov eax, dword [ebp - 0x338]
mov edi, dword [ebp - 0x344]
sub edi, eax
cmp dword [ebp - 0x354], edi
jb 0x76aa6c23
mov ecx, dword [ebp - 0x350]
cmp ecx, ebx
je 0x76aa6c1e
mov dword [ecx], edi
mov dword [eax + 0x14], edi
jmp 0x76aa6c2a
mov edx, 0xea
xor edi, edi
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x368]
cmp eax, ebx
je 0x76aa6c3c
mov dword [eax], edi
mov eax, dword [ebp - 0x36c]
cmp eax, ebx
je 0x76aa6e3d
mov dword [eax], 3
jmp 0x76aa6e3d
mov dword [ebp - 0x35c], 0xfeced300
or dword [ebp - 0x358], 0xffffffff
lea eax, [ebp - 0x35c]
push eax
push ebx
push dword [0x76aae51c]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, ebx
je 0x76aa6cad
mov dword [ebp - 0x328], 0xaa
cmp dword [0x76aae4f0], 1
jb 0x76aa6e3d
push ebx
push eax
push ebx
push 0xb
push 0x393
push esi
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aa6e3d
cmp dword [0x76aae4f0], 4
jb 0x76aa6cc9
push ebx
push ebx
push ebx
push 0xb
push 0x396
push esi
call fcn.76aa5e47
add esp, 0x18
cmp dword [ebp - 0x334], 0x80000004
jne 0x76aa6cdd
mov dword [ebp - 0x34c], ebx
jmp 0x76aa6d1a
cmp dword [ebp - 0x334], 0x80000050
jne 0x76aa6cf5
mov dword [ebp - 0x34c], 0x76aae4a4
jmp 0x76aa6d1a
cmp dword [ebp - 0x334], 0x80000060
jne 0x76aa6d1a
xor eax, eax
mov ecx, 0x76aae4f8
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34c], ecx
push ecx
call fcn.76aaa1c2
push dword [ebp - 0x34c]
push dword [ebp - 0x368]
push dword [ebp - 0x350]
push dword [ebp - 0x338]
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x360]
call fcn.76aaa77a
mov edi, eax
cmp dword [0x76aae4f0], 4
jb 0x76aa6d6b
push ebx
push 4
lea eax, [ebp - 0x334]
push eax
push edi
push ebx
push 0xb
push 0x3ab
push esi
call fcn.76aa5e47
add esp, 0x20
cmp edi, ebx
jge 0x76aa6e04
cmp dword [ebp - 0x334], 0x80000060
jne 0x76aa6de4
cmp dword [0x76aae4f0], 3
jb 0x76aa6d9b
push ebx
push edi
push ebx
push 0xb
push 0x3b1
push esi
call fcn.76aa5e47
add esp, 0x18
xor eax, eax
mov ecx, 0x76aae4f8
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.76aaa149
push dword [ebp - 0x34c]
push dword [ebp - 0x368]
push dword [ebp - 0x350]
push dword [ebp - 0x338]
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x360]
call fcn.76aaa77a
mov edi, eax
cmp edi, ebx
jge 0x76aa6e04
cmp dword [0x76aae4f0], 1
jb 0x76aa6e04
push ebx
push edi
push ebx
push 0xb
push 0x3be
push esi
call fcn.76aa5e47
add esp, 0x18
push edi
call fcn.76aa7e50
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x36c], ebx
je 0x76aa6e24
mov eax, dword [ebp - 0x36c]
mov dword [eax], 7
push dword [0x76aae51c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x76aa6e3d
mov dword [ebp - 0x328], edi
mov esi, 0x76aa25c8
cmp dword [0x76aae3ac], ebx
je 0x76aa6e6a
mov eax, dword [ebp - 0x32c]
cmp eax, ebx
jle 0x76aa6e6a
cmp eax, dword [ebp - 0x348]
je 0x76aa6e6a
push 4
lea eax, [ebp - 0x32c]
push eax
push 2
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp dword [ebp - 0x33c], ebx
je 0x76aa6ebb
mov eax, dword fs:[0x18]
add eax, 0xbf8
cmp dword [ebp - 0x370], eax
jne 0x76aa6ebb
movzx ecx, word [ebp - 0x33e]
mov esi, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x370]
mov edi, dword [eax + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov esi, 0x76aa25c8
cmp dword [0x76aae4f0], 4
jb 0x76aa6edc
push ebx
push dword [ebp - 0x328]
push ebx
push 0xb
push 0x4b2
push esi
call fcn.76aa5e47
add esp, 0x18
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x1c]
call fcn.76aac8aa
call fcn.76aa16ac
ret 0x1c