Function at 0x140274030
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
lea rbp, [rsp + 0x80]
mov ecx, 0xfffffff4
mov qword [rbp + 0x218], rdx
mov qword [rbp + 0x220], r8
mov qword [rbp + 0x228], r9
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x14027407c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x140274291
lea rdi, str._s:_d:_OpenSSL_internal_error:__s_n
xor r9d, r9d
mov rax, rdi
jmp 0x140274099
cmp r9d, 0x80000000
je 0x1402740a6
add rax, 1
add r9d, 1
cmp byte [rax], 0
jne 0x140274090
and r9d, 0x7fffffff
lea esi, [r9 + 1]
lea rax, [rsi + rsi + 0xf]
mov r9, rsi
shr rax, 4
shl rax, 4
call fcn.1403423d0
xor edx, edx
xor ecx, ecx
lea r8, str._s:_d:_OpenSSL_internal_error:__s_n
sub rsp, rax
lea rbx, [rsp + 0x50]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14027420f
xor ecx, ecx
lea r9, [0x14045cc54]
jmp 0x140274105
cmp rdx, rsi
jae 0x140274172
lea rax, [rcx + rcx]
lea rdx, [rcx + 1]
cmp word [rbx + rax], 0x25
mov rcx, rdx
jne case.0x140274142.1
lea r8, [rbx + rax + 2]
mov rcx, rdx
movzx eax, word [r8]
cmp ax, 0x63
ja 0x14027415e
cmp ax, 0x29
jbe case.0x140274142.1
sub eax, 0x2a
cmp ax, 0x39
ja case.0x140274142.1
movzx eax, ax
movsxd rax, dword [r9 + rax*4]
add rax, r9
jmp rax
movzx eax, word [r8 + 2]
add rdx, 1
add r8, 2
mov rcx, rdx
cmp ax, 0x63
jbe 0x140274129
cmp ax, 0x73
jne case.0x140274142.1
mov eax, 0x53
mov word [r8], ax
cmp rdx, rsi
jb 0x140274105
lea r9, [rbp + 0x218]
lea rsi, [rbp - 0x20]
mov r8, rbx
mov edx, 0xff
mov qword [rbp - 0x30], r9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__vsnwprintf]
xor r8d, r8d
mov word [rbp + 0x1de], r8w
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1402741b0
call fcn.14023cfe0
test eax, eax
jg 0x14027422f
mov r9d, 0x10
lea r8, str.OpenSSL:_FATAL
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rsp, [rbp + 0x1e8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r11d, 0x43
mov word [r8], r11w
jmp case.0x140274142.1
mov edi, 0x73
mov word [r8], di
jmp case.0x140274142.1
mov r10d, 0x63
mov word [r8], r10w
jmp case.0x140274142.1
xor eax, eax
nop dword [rax]
movsx dx, byte [rdi + rax]
mov word [rbx + rax*2], dx
add rax, 1
cmp rsi, rax
jne 0x140274218
jmp 0x1402740f0
lea rdx, str.OpenSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1402741c9
xor eax, eax
mov qword [rbp - 0x28], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], edx
mov edx, 1
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 1
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1402741c9
lea r9, [rbp + 0x218]
lea rsi, [rbp - 0x20]
mov edx, 0x200
lea r8, str._s:_d:_OpenSSL_internal_error:__s_n
mov qword [rbp - 0x30], r9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__vsnprintf]
mov r8d, eax
test eax, eax
jns 0x1402742c2
mov r8d, 0x200
xor eax, eax
lea r9, [rbp - 0x28]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1402741c9