Function at 0x6da18670
Capabilities:
Access the windows event log

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x218], rdx
mov qword [rbp + 0x220], r8
mov rdi, rcx
mov qword [rbp + 0x228], r9
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x6da186bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x6da18a65
cmp byte [rdi], 0
je 0x6da18abc
mov r9, rdi
xor eax, eax
jmp 0x6da186d4
test eax, eax
js 0x6da186e1
add r9, 1
add eax, 1
cmp byte [r9], 0
jne 0x6da186d0
and eax, 0x7fffffff
mov r9d, eax
add r9d, 1
mov esi, r9d
lea rax, [rsi + rsi]
add rax, 0x1e
shr rax, 4
shl rax, 4
call fcn.6da361e0
xor edx, edx
xor ecx, ecx
sub rsp, rax
mov r8, rdi
lea rbx, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x6da188f9
test rsi, rsi
mov edx, 1
lea rax, [rsi + rsi]
cmovne rdx, rsi
mov ecx, 2
test rsi, rsi
cmove rax, rcx
add rax, rbx
cmp rdi, rax
lea rax, [rdi + rdx]
setae cl
cmp rbx, rax
setae al
or cl, al
je 0x6da18aa3
cmp rsi, 0xf
jbe 0x6da18aa3
mov rcx, rdx
shr rcx, 4
mov rax, rcx
shl rax, 4
test rax, rax
je 0x6da18a92
pxor xmm1, xmm1
xor r8d, r8d
xor r9d, r9d
movdqu xmm0, xmmword [rdi + r8]
add r9, 1
movdqa xmm2, xmm1
movdqa xmm4, xmm0
pcmpgtb xmm2, xmm0
punpcklbw xmm4, xmm2
punpckhbw xmm0, xmm2
movdqa xmmword [rbx + r8*2], xmm4
movdqa xmmword [rbx + r8*2 + 0x10], xmm0
add r8, 0x10
cmp rcx, r9
ja 0x6da1878e
cmp rax, rdx
je 0x6da188f9
movsx dx, byte [rdi + rax]
mov word [rbx + rax*2], dx
add rax, 1
cmp rax, rsi
jae 0x6da188f9
movsx dx, byte [rdi + rax]
mov word [rbx + rax*2], dx
lea rdx, [rax + 1]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 1]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 2]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 2]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 3]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 3]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 4]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 4]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 5]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 5]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 6]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 6]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 7]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 7]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 8]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 8]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 9]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 9]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 0xa]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 0xa]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 0xb]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 0xb]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 0xc]
cmp rsi, rdx
jbe 0x6da188f9
movsx cx, byte [rdi + rax + 0xc]
mov word [rbx + rdx*2], cx
lea rdx, [rax + 0xd]
cmp rsi, rdx
jbe 0x6da188f9
movsx ax, byte [rdi + rax + 0xd]
mov word [rbx + rdx*2], ax
xor eax, eax
lea r9, [0x6db31ee8]
jmp 0x6da1890d
add rax, 1
cmp rsi, rax
jbe 0x6da1894f
cmp word [rbx + rax*2], 0x25
lea rdx, [rax + rax]
jne 0x6da18904
lea rcx, [rbx + rdx + 2]
movzx edi, word [rcx]
add rax, 1
lea edx, [rdi - 0x2a]
cmp dx, 0x49
ja case.0x6da18937.1
movzx edx, dx
movsxd rdx, dword [r9 + rdx*4]
add rdx, r9
jmp rdx
mov r11d, 0x53
cmp rsi, rax
mov word [rcx], r11w
ja 0x6da1890d
lea r9, [rbp + 0x218]
lea rsi, [rbp - 0x20]
mov r8, rbx
mov edx, 0xff
mov qword [rbp - 0x30], r9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__vsnwprintf]
xor eax, eax
mov word [rbp + 0x1de], ax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x6da18a40
call fcn.6da18510
test eax, eax
nop dword [rax]
jle 0x6da18a40
xor ecx, ecx
lea rdx, str.OPENSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
lea rax, [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rbx
mov qword [rbp - 0x28], rsi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
lea rsp, [rbp + 0x1e8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x43
mov word [rcx], r8w
jmp case.0x6da18937.1
mov r10d, 0x73
mov word [rcx], r10w
jmp case.0x6da18937.1
mov edx, 0x63
mov word [rcx], dx
jmp case.0x6da18937.1
add rcx, 2
jmp 0x6da1891d
lea r8, str.OpenSSL:_FATAL
mov r9d, 0x10
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rsp, [rbp + 0x1e8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbx, [rbp + 0x218]
mov qword [rbp - 0x30], rbx
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_vfprintf
nop
lea rsp, [rbp + 0x1e8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
movsx ax, byte [rdi]
mov word [rbx], ax
mov eax, 1
jmp 0x6da187e1
xor eax, eax
movsx dx, byte [rdi + rax]
mov word [rbx + rax*2], dx
add rax, 1
cmp rax, rsi
jb 0x6da18aa5
jmp 0x6da188f9
mov r9d, 1
mov eax, 2
mov esi, 1
jmp 0x6da186f4