Function at 0x76aabf71
Capabilities:
Access the windows event log

Disassembly:
push 0x6c8
push 0x76aac710
call fcn.76aa13c1
mov eax, dword [0x76aae004]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68c], esi
xor ebx, ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x654], ebx
mov dword [ebp - 0x658], ebx
test byte [esi + 0x140], 0x10
je 0x76aabfbe
mov eax, 0x422
jmp 0x76aac6f5
cmp dword [esi + 0x30], ebx
jne 0x76aac6de
mov dword [ebp - 0x660], ebx
push 4
pop edi
mov dword [ebp - 0x688], edi
mov dword [ebp - 0x65c], ebx
push 1
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x660]
push eax
push ebx
push 0x76aa2684
push dword [esi + 0x38]
call fcn.76aa7e91
mov dword [ebp - 0x644], eax
cmp eax, ebx
jne 0x76aac025
cmp dword [ebp - 0x660], edi
jne 0x76aac025
cmp dword [ebp - 0x65c], 1
jne 0x76aac025
or dword [esi + 0x140], 0x10
jmp 0x76aac032
mov dword [ebp - 0x644], ebx
and dword [esi + 0x140], 0xffffffef
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x648], eax
cmp eax, ebx
jne 0x76aac051
mov eax, 0x76aac708
mov dword [ebp - 0x648], eax
cmp eax, ebx
je 0x76aac064
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
mov dword [ebp - 0x64c], eax
jmp 0x76aac06a
mov dword [ebp - 0x64c], ebx
cmp dword [esi + 0x164], ebx
jl 0x76aac16a
jg 0x76aac084
cmp dword [esi + 0x160], ebx
jbe 0x76aac16a
push dword [esi + 0x148]
call fcn.76aabde2
test eax, eax
je 0x76aac09f
or dword [esi + 0x140], 0x20
jmp 0x76aac16a
xor eax, eax
lea edi, [ebp - 0x6a0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x6a0]
push eax
push dword [esi + 0x34]
call fcn.76aa7d28
mov dword [ebp - 0x644], eax
cmp eax, ebx
jne 0x76aac16a
mov eax, dword [esi + 0x158]
cmp eax, dword [ebp - 0x6a0]
jne 0x76aac100
mov eax, dword [esi + 0x15c]
cmp eax, dword [ebp - 0x69c]
jne 0x76aac100
mov eax, dword [esi + 0x160]
cmp eax, dword [ebp - 0x698]
jne 0x76aac100
mov eax, dword [esi + 0x164]
cmp eax, dword [ebp - 0x694]
je 0x76aac093
cmp dword [0x76aae538], 1
jl 0x76aac16a
cmp dword [0x76aae4f0], 3
jb 0x76aac136
push ebx
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 1
push 0x16
push 0x133
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x20
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x67c], eax
push ebx
lea eax, [ebp - 0x680]
push eax
push ebx
push 2
push ebx
push 0x800007d3
push ebx
push 2
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
cmp dword [ebp - 0x644], ebx
jne 0x76aac6ef
test byte [esi + 0x140], 0x10
jne 0x76aac6ef
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x690], eax
push 8
push ebx
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x76aac6c4
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x76aac285
cmp dword [0x76aae4f0], 1
jb 0x76aac206
mov edi, dword [esi + 0xc]
cmp edi, ebx
je 0x76aac1de
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x76aac1d2
sub eax, edx
inc eax
jmp 0x76aac1e0
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x159
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x28
cmp dword [0x76aae538], 1
jl 0x76aac27f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x228]
push eax
push dword [esi + 0xc]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x228]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ed
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.76aa7fe3
cmp dword [ebp - 0x644], ebx
jne 0x76aac45e
push dword [esi + 0x1c]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x76aac373
cmp dword [0x76aae4f0], 1
jb 0x76aac2f4
mov edi, dword [esi + 0x1c]
cmp edi, ebx
je 0x76aac2cc
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x76aac2c0
sub eax, edx
inc eax
jmp 0x76aac2ce
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x187
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x28
cmp dword [0x76aae538], 1
jl 0x76aac36d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x434]
push eax
push dword [esi + 0x1c]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x434]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ee
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.76aa7fe3
cmp dword [ebp - 0x644], ebx
jne 0x76aac45e
push dword [esi + 0x2c]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x76aac45e
cmp dword [0x76aae4f0], 1
jb 0x76aac3df
mov edi, dword [esi + 0x2c]
cmp edi, ebx
je 0x76aac3b7
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x76aac3ab
sub eax, edx
inc eax
jmp 0x76aac3b9
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push ebx
push 0x21
push 0x16
push 0x1af
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x28
cmp dword [0x76aae538], 1
jl 0x76aac458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x6d8], eax
push 0x104
lea eax, [ebp - 0x640]
push eax
push dword [esi + 0x1c]
call sub.msvcrt.dll_wcstombs
add esp, 0xc
lea eax, [ebp - 0x640]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 3
push ebx
push 0xc00003ef
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
push esi
call fcn.76aa7fe3
xor eax, eax
inc eax
test byte [0x76aae3a8], 4
jne 0x76aac473
test byte [esi + 0x140], 0x20
je 0x76aac475
xor eax, eax
cmp dword [ebp - 0x644], ebx
jne 0x76aac682
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6b8], ebx
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x6b4], ecx
mov ecx, dword [esi + 0x148]
mov dword [ebp - 0x6b0], ecx
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], 0x800007d2
mov dword [ebp - 0x6a4], esi
cmp eax, ebx
je 0x76aac4f4
lea eax, [ebp - 0x6b8]
push eax
call fcn.76aa827f
mov dword [ebp - 0x658], eax
cmp eax, ebx
jne 0x76aac4fa
cmp dword [0x76aae4f0], 3
jb 0x76aac4fa
push ebx
push ebx
push ebx
push 0x16
push 0x1eb
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aac4fa
mov dword [ebp - 0x658], ebx
push dword [esi + 0x10]
call dword [esi + 8]
mov dword [ebp - 0x650], eax
cmp eax, ebx
je 0x76aac562
cmp dword [0x76aae4f0], 1
jb 0x76aac556
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x76aac527
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
jmp 0x76aac529
xor eax, eax
push ebx
push eax
push dword [esi + 0x10]
push dword [ebp - 0x64c]
push dword [ebp - 0x648]
push dword [ebp - 0x650]
push 0x11
push 0x16
push 0x1fa
push 0x76aa25c8
call fcn.76aa5e47
add esp, 0x28
mov dword [ebp - 0x654], 0xc00003f0
jmp 0x76aac56f
lea eax, [esi + 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
or dword [ebp - 4], 0xffffffff
jmp 0x76aac5e2
cmp dword [ebp - 0x658], ebx
je 0x76aac5fb
push dword [ebp - 0x658]
call fcn.76aa7af8
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x650], ebx
je 0x76aac67b
xor edi, edi
inc edi
cmp dword [ebp - 0x654], 0xc00003f1
jne 0x76aac61a
push esi
call fcn.76aa7fe3
jmp 0x76aac624
push 1
push esi
call fcn.76aa8020
mov edi, eax
cmp edi, ebx
jbe 0x76aac682
cmp dword [0x76aae538], 1
jl 0x76aac682
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x6d8], eax
mov eax, dword [esi + 0x148]
mov dword [ebp - 0x680], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x67c], eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x680]
push eax
push 4
push 2
push ebx
push dword [ebp - 0x654]
push ebx
push 1
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
jmp 0x76aac682
push ebx
push esi
call fcn.76aa8020
mov edi, dword [ebp - 0x650]
cmp edi, ebx
je 0x76aac6b1
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x76aac6a9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x30], ebx
mov dword [ebp - 0x644], edi
jmp 0x76aac6d0
call fcn.76aaac77
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], edx
jmp 0x76aac6d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
push dword [ebp - 0x690]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x76aac6ef
call fcn.76aaac77
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], edx
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x1c]
call fcn.76aac8aa
call fcn.76aa16ac
ret 4