Function at 0x61c830
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov esi, dword [ebp + 8]
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
test eax, eax
je 0x61c869
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
test eax, eax
jne 0x61ca10
mov dword [esp], esi
call sym._strlen
lea edi, [eax + 1]
lea eax, [edi + edi + 0x1e]
shr eax, 4
shl eax, 4
call fcn.006f9d60
sub esp, eax
lea ebx, [esp + 0x33]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
and ebx, 0xfffffff0
mov dword [esp], 0
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x61c9f0
xor edx, edx
jmp 0x61c8c6
cmp edi, eax
mov edx, eax
jbe 0x61c8f0
cmp word [ebx + edx*2], 0x25
lea ecx, [edx + edx]
lea eax, [edx + 1]
jne case.0x61c8e6.1
lea ecx, [ebx + ecx + 2]
movzx esi, word [ecx]
lea edx, [esi - 0x2a]
cmp dx, 0x49
ja case.0x61c8e6.1
movzx edx, dx
jmp dword [edx*4 + 0x843450]
lea eax, [ebp + 0xc]
lea esi, [ebp - 0x218]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xff
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnwprintf]
xor eax, eax
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x61c9c0
call sym._OPENSSL_isservice
test eax, eax
jle 0x61c9c0
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x61c9e4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
mov dword [esp], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
movsx ax, byte [esi + edx]
mov word [ebx + edx*2], ax
add edx, 1
cmp edi, edx
jne 0x61c9f2
jmp 0x61c8bc
lea eax, [ebp + 0xc]
mov dword [esp + 8], esi
lea esi, [ebp - 0x218]
mov dword [esp + 4], 0x200
mov dword [esp], esi
mov dword [esp + 0xc], eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov edx, 0x200
test eax, eax
mov dword [esp + 4], esi
cmovs eax, edx
lea edx, [ebp - 0x21c]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x53
mov word [ecx], si
jmp case.0x61c8e6.1
add ecx, 2
add eax, 1
jmp 0x61c8d7
mov edx, 0x63
mov word [ecx], dx
jmp case.0x61c8e6.1
mov edx, 0x73
mov word [ecx], dx
jmp case.0x61c8e6.1
mov esi, 0x43
mov word [ecx], si
jmp case.0x61c8e6.1