Function at 0x4cb5e0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x258
mov eax, dword [ecx]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], eax
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
test eax, eax
je 0x4cb62f
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
test eax, eax
jne 0x4cb9e0
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, eax
lea esi, [eax + 1]
lea eax, [eax + eax + 0x1d]
shr eax, 4
shl eax, 4
call fcn.00651990
sub esp, eax
lea ebx, [esp + 0x33]
mov dword [esp + 0x14], esi
and ebx, 0xfffffff0
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x22c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
jne 0x4cb7e9
cmp edi, 0xe
jbe 0x4cba4a
mov eax, dword [ebp - 0x22c]
mov ecx, esi
pxor xmm2, xmm2
and ecx, 0xfffffff0
mov edx, eax
add eax, ecx
mov dword [ebp - 0x234], ecx
mov ecx, eax
mov eax, ebx
lea esi, cs:[esi]
nop
movdqu xmm4, xmmword [edx]
movdqa xmm1, xmm2
add edx, 0x10
add eax, 0x20
pcmpgtb xmm1, xmm4
movdqa xmm0, xmm4
punpcklbw xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movdqa xmm0, xmm4
punpckhbw xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp edx, ecx
jne 0x4cb6c0
mov ecx, dword [ebp - 0x234]
cmp esi, ecx
je 0x4cb7e9
sub edi, ecx
lea eax, [edi + 1]
mov dword [ebp - 0x234], eax
cmp edi, 2
jbe 0x4cb7b3
mov edi, eax
mov eax, dword [ebp - 0x22c]
pxor xmm1, xmm1
movdqa xmm2, xmm1
shr edi, 2
lea edx, [eax + ecx]
lea eax, [ebx + ecx*2]
movd xmm0, dword [edx]
pcmpgtb xmm2, xmm0
movdqa xmm5, xmm0
punpcklbw xmm0, xmm2
punpcklbw xmm5, xmm2
pshufd xmm0, xmm0, 0x41
movd dword [eax], xmm5
movd dword [eax + 4], xmm0
cmp edi, 1
je 0x4cb7a1
movd xmm0, dword [edx + 4]
movdqa xmm2, xmm1
pcmpgtb xmm2, xmm0
movdqa xmm6, xmm0
punpcklbw xmm0, xmm2
punpcklbw xmm6, xmm2
pshufd xmm0, xmm0, 0x41
movd dword [eax + 8], xmm6
movd dword [eax + 0xc], xmm0
cmp edi, 2
je 0x4cb7a1
movd xmm0, dword [edx + 8]
pcmpgtb xmm1, xmm0
movdqa xmm7, xmm0
punpcklbw xmm0, xmm1
punpcklbw xmm7, xmm1
pshufd xmm0, xmm0, 0x41
movd dword [eax + 0x10], xmm7
movd dword [eax + 0x14], xmm0
mov edi, dword [ebp - 0x234]
mov eax, edi
and eax, 0xfffffffc
add ecx, eax
and edi, 3
je 0x4cb7e9
mov edi, dword [ebp - 0x22c]
lea eax, [ecx + ecx]
movsx dx, byte [edi + ecx]
mov word [ebx + ecx*2], dx
lea edx, [ecx + 1]
cmp edx, esi
jae 0x4cb7e9
movsx dx, byte [edi + ecx + 1]
mov word [ebx + eax + 2], dx
lea edx, [ecx + 2]
cmp edx, esi
jae 0x4cb7e9
movsx dx, byte [edi + ecx + 2]
mov word [ebx + eax + 4], dx
xor ecx, ecx
jmp 0x4cb7f4
cmp edx, esi
jae 0x4cb867
lea eax, [ecx + ecx]
lea edx, [ecx + 1]
cmp word [ebx + eax], 0x25
mov ecx, edx
jne 0x4cb7f0
lea edi, [ebx + eax + 2]
mov dword [ebp - 0x22c], ebx
mov ecx, edx
movzx eax, word [edi]
cmp ax, 0x53
je 0x4cb855
ja 0x4cb8e0
cmp ax, 0x39
ja 0x4cb908
cmp ax, 0x29
jbe 0x4cb938
sub eax, 0x2a
mov ebx, 0xffd9
bt ebx, eax
jae 0x4cb938
movzx eax, word [edi + 2]
add edx, 1
add edi, 2
mov ecx, edx
cmp ax, 0x53
jne 0x4cb818
mov eax, 0x73
mov ebx, dword [ebp - 0x22c]
mov word [edi], ax
cmp edx, esi
jb 0x4cb7f4
mov eax, dword [ebp - 0x230]
lea esi, [ebp - 0x218]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xff
add eax, 4
mov dword [esp], esi
mov dword [esp + 0xc], eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
xor eax, eax
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4cb8ac
call fcn.004cb480
test eax, eax
jg 0x4cb948
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov ebx, dword [ebp - 0x22c]
cmp ax, 0x63
je 0x4cb928
cmp ax, 0x73
jne 0x4cb7f0
mov eax, 0x53
mov word [edi], ax
jmp 0x4cb7f0
mov ebx, dword [ebp - 0x22c]
cmp ax, 0x43
jne 0x4cb7f0
mov eax, 0x63
mov word [edi], ax
jmp 0x4cb7f0
mov eax, 0x43
mov word [edi], ax
jmp 0x4cb7f0
mov ebx, dword [ebp - 0x22c]
jmp 0x4cb7f0
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4cb8d0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
mov dword [esp], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x230]
lea esi, [ebp - 0x218]
add eax, 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x200
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov edx, 0x200
mov dword [esp], ebx
test eax, eax
mov dword [esp + 4], esi
cmovs eax, edx
lea edx, [ebp - 0x21c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor ecx, ecx
jmp 0x4cb6fc