Function at 0x6b4732a0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x25c
mov edi, dword [ebp + 8]
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
test eax, eax
je 0x6b4732e3
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
test eax, eax
jne 0x6b473510
mov dword [esp], edi
call sym._strlen
mov edx, eax
lea esi, [eax + 1]
lea eax, [eax + eax + 0x1d]
shr eax, 4
mov dword [ebp - 0x22c], edx
shl eax, 4
call fcn.6b5c3520
sub esp, eax
lea ebx, [esp + 0x33]
mov dword [esp + 0x14], esi
and ebx, 0xfffffff0
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x22c]
sub esp, 0x18
test eax, eax
je 0x6b473450
xor edx, edx
jmp 0x6b47334c
cmp esi, ecx
jbe 0x6b4733a0
lea eax, [edx + edx]
lea ecx, [edx + 1]
cmp word [ebx + eax], 0x25
mov edx, ecx
jne case.0x6b47337c.1
lea edi, [ebx + eax + 2]
movzx eax, word [edi]
mov edx, ecx
cmp ax, 0x63
ja 0x6b473388
cmp ax, 0x29
jbe case.0x6b47337c.1
sub eax, 0x2a
cmp ax, 0x39
ja case.0x6b47337c.1
movzx eax, ax
jmp dword [eax*4 + str.A4GkH3GkH3GkA4GkA4GkH3GkA4GkA4GkA4GkA4GkA4GkA4GkA4GkA4GkA4GkA4GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3Gk44GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3Gk4GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3GkH3Gk]
cmp ax, 0x73
jne case.0x6b47337c.1
mov eax, 0x53
mov word [edi], ax
cmp esi, ecx
ja 0x6b47334c
lea esi, [esi]
lea eax, [ebp + 0xc]
lea esi, [ebp - 0x21c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xff
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnwprintf]
xor eax, eax
mov word [ebp - 0x1e], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x6b4733df
call sym.libcrypto_1_1.dll_OPENSSL_isservice
test eax, eax
jg 0x6b473480
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b473567
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x43
mov word [edi], ax
jmp case.0x6b47337c.1
mov eax, 0x73
mov word [edi], ax
jmp case.0x6b47337c.1
mov eax, 0x63
mov word [edi], ax
jmp case.0x6b47337c.1
add edi, 2
add ecx, 1
jmp 0x6b47335f
mov eax, edi
mov ecx, ebx
lea edi, [edi + edx + 1]
lea esi, [esi]
nop
movsx dx, byte [eax]
add eax, 1
add ecx, 2
mov word [ecx - 2], dx
cmp edi, eax
jne 0x6b473460
jmp 0x6b473344
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6b473403
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
jmp 0x6b473403
lea eax, [ebp + 0xc]
lea esi, [ebp - 0x21c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x200
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov edx, 0x200
mov dword [esp + 0x10], 0
test eax, eax
mov dword [esp + 4], esi
cmovs eax, edx
lea edx, [ebp - 0x220]
mov dword [esp], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
jmp 0x6b473403
call sym.___stack_chk_fail
lea esi, [esi]