Function at 0x140115990
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
cli
jg 0x140050557
and al, 0x60
vpshufb xmm5, xmm12, xmm0
vmovdqu xmmword [rsp + 0x50], xmm4
vpshufb xmm6, xmm13, xmm0
vmovdqu xmmword [rsp + 0x40], xmm5
vpshufb xmm7, xmm14, xmm0
clc
vmovdqu xmmword [rsp + 0x30], xmm6
call fcn.140050280
vmovdqu xmm8, xmmword [r9]
lea r9, [r9 + 0x40]
sub rdx, 0xc
mov r10d, 0xc0
vpshufb xmm8, xmm8, xmm0
call fcn.14004fb00
vmovdqu xmm7, xmmword [rsp + 0x20]
vmovdqu xmm0, xmmword [r11]
vmovdqu xmm3, xmmword [r9 - 0x20]
vpunpckhqdq xmm1, xmm7, xmm7
vmovdqu xmm15, xmmword [r9]
vmovups xmmword [rsi - 0x60], xmm9
vpshufb xmm9, xmm9, xmm0
vpxor xmm1, xmm1, xmm7
vmovups xmmword [rsi - 0x50], xmm10
vpshufb xmm10, xmm10, xmm0
vmovups xmmword [rsi - 0x40], xmm11
vpshufb xmm11, xmm11, xmm0
vmovups xmmword [rsi - 0x30], xmm12
vpshufb xmm12, xmm12, xmm0
vmovups xmmword [rsi - 0x20], xmm13
vpshufb xmm13, xmm13, xmm0
vmovups xmmword [rsi - 0x10], xmm14
vpshufb xmm14, xmm14, xmm0
vmovdqu xmmword [rsp + 0x10], xmm9
vmovdqu xmm6, xmmword [rsp + 0x30]
vmovdqu xmm0, xmmword [r9 - 0x10]
vpunpckhqdq xmm2, xmm6, xmm6
vpclmulqdq xmm5, xmm7, xmm3, 0
vpxor xmm2, xmm2, xmm6
vpclmulqdq xmm7, xmm7, xmm3, 0x11
vpclmulqdq xmm1, xmm1, xmm15, 0
vmovdqu xmm9, xmmword [rsp + 0x40]
pop rcx
loopne 0x14005051f
shr dword [rbp - 0x31], 0xc4
jp 0x1400505d0
cmp ebp, eax
js 0x140050576
movabs al, byte [0xeff1c5c8003162c4]
iretd
invalid
outsd dx, dword [rsi]
and al, 0x40
vpclmulqdq xmm4, xmm6, xmm0, 0
vmovdqu xmm3, xmmword [r9 + 0x10]
vpxor xmm4, xmm4, xmm5
vpunpckhqdq xmm5, xmm9, xmm9
vpclmulqdq xmm6, xmm6, xmm0, 0x11
vpxor xmm5, xmm5, xmm9
vpxor xmm6, xmm6, xmm7
vpclmulqdq xmm2, xmm2, xmm15, 0x10
vmovdqu xmm15, xmmword [r9 + 0x30]
vpxor xmm2, xmm2, xmm1
vmovdqu xmm1, xmmword [rsp + 0x50]
vpclmulqdq xmm7, xmm9, xmm3, 0
vmovdqu xmm0, xmmword [r9 + 0x20]
vpxor xmm7, xmm7, xmm4
vpunpckhqdq xmm4, xmm1, xmm1
vpclmulqdq xmm9, xmm9, xmm3, 0x11
vpxor xmm4, xmm4, xmm1
vpxor xmm9, xmm9, xmm6
vpclmulqdq xmm5, xmm5, xmm15, 0
vpxor xmm5, xmm5, xmm2
vmovdqu xmm2, xmmword [rsp + 0x60]
vpclmulqdq xmm6, xmm1, xmm0, 0
vmovdqu xmm3, xmmword [r9 + 0x40]
vpxor xmm6, xmm6, xmm7
vpunpckhqdq xmm7, xmm2, xmm2
vpclmulqdq xmm1, xmm1, xmm0, 0x11
vpxor xmm7, xmm7, xmm2
vpxor xmm1, xmm1, xmm9
vpclmulqdq xmm4, xmm4, xmm15, 0x10
vmovdqu xmm15, xmmword [r9 + 0x60]
vpxor xmm4, xmm4, xmm5
vpxor xmm8, xmm8, xmmword [rsp + 0x70]
vpclmulqdq xmm5, xmm2, xmm3, 0
vmovdqu xmm0, xmmword [r9 + 0x50]
vpunpckhqdq xmm9, xmm8, xmm8
vpxor xmm5, xmm5, xmm6
vpclmulqdq xmm2, xmm2, xmm3, 0x11
vpxor xmm9, xmm9, xmm8
vpxor xmm2, xmm2, xmm1
vpclmulqdq xmm7, xmm7, xmm15, 0
vpxor xmm4, xmm7, xmm4
vpclmulqdq xmm6, xmm8, xmm0, 0
vmovdqu xmm3, xmmword [r9 - 0x20]
vpunpckhqdq xmm1, xmm14, xmm14
vpclmulqdq xmm8, xmm8, xmm0, 0x11
vpxor xmm1, xmm1, xmm14
vpxor xmm5, xmm6, xmm5
vpclmulqdq xmm9, xmm9, xmm15, 0x10
vmovdqu xmm15, xmmword [r9]
vpxor xmm7, xmm8, xmm2
vpxor xmm6, xmm9, xmm4
vmovdqu xmm0, xmmword [r9 - 0x10]
vpxor xmm9, xmm7, xmm5
vpclmulqdq xmm4, xmm14, xmm3, 0
vpxor xmm6, xmm6, xmm9
vpunpckhqdq xmm2, xmm13, xmm13
vpclmulqdq xmm14, xmm14, xmm3, 0x11
vpxor xmm2, xmm2, xmm13
vpslldq xmm9, xmm6, 8
vpclmulqdq xmm1, xmm1, xmm15, 0
vpxor xmm8, xmm5, xmm9
vpsrldq xmm6, xmm6, 8
vpxor xmm7, xmm7, xmm6
vpclmulqdq xmm5, xmm13, xmm0, 0
vmovdqu xmm3, xmmword [r9 + 0x10]
vpxor xmm5, xmm5, xmm4
vpunpckhqdq xmm9, xmm12, xmm12
vpclmulqdq xmm13, xmm13, xmm0, 0x11
vpxor xmm9, xmm9, xmm12
vpxor xmm13, xmm13, xmm14
vpalignr xmm14, xmm8, xmm8, 8
vpclmulqdq xmm2, xmm2, xmm15, 0x10
vmovdqu xmm15, xmmword [r9 + 0x30]
vpxor xmm2, xmm2, xmm1
vpclmulqdq xmm4, xmm12, xmm3, 0
vmovdqu xmm0, xmmword [r9 + 0x20]
vpxor xmm4, xmm4, xmm5
vpunpckhqdq xmm1, xmm11, xmm11
vpclmulqdq xmm12, xmm12, xmm3, 0x11
vpxor xmm1, xmm1, xmm11
vpxor xmm12, xmm12, xmm13
vxorps xmm7, xmm7, xmmword [rsp + 0x10]
vpclmulqdq xmm9, xmm9, xmm15, 0
vpxor xmm9, xmm9, xmm2
vpclmulqdq xmm8, xmm8, xmmword [r11 + 0x10], 0x10
vxorps xmm8, xmm8, xmm14
vpclmulqdq xmm5, xmm11, xmm0, 0
vmovdqu xmm3, xmmword [r9 + 0x40]
vpxor xmm5, xmm5, xmm4
vpunpckhqdq xmm2, xmm10, xmm10
vpclmulqdq xmm11, xmm11, xmm0, 0x11
vpxor xmm2, xmm2, xmm10
vpalignr xmm14, xmm8, xmm8, 8
vpxor xmm11, xmm11, xmm12
vpclmulqdq xmm1, xmm1, xmm15, 0x10
vmovdqu xmm15, xmmword [r9 + 0x60]
vpxor xmm1, xmm1, xmm9
vxorps xmm14, xmm14, xmm7
vpclmulqdq xmm8, xmm8, xmmword [r11 + 0x10], 0x10
vxorps xmm8, xmm8, xmm14
vpclmulqdq xmm4, xmm10, xmm3, 0
vmovdqu xmm0, xmmword [r9 + 0x50]
vpxor xmm4, xmm4, xmm5
vpunpckhqdq xmm9, xmm8, xmm8
vpclmulqdq xmm10, xmm10, xmm3, 0x11
vpxor xmm9, xmm9, xmm8
vpxor xmm10, xmm10, xmm11
vpclmulqdq xmm2, xmm2, xmm15, 0
vpxor xmm2, xmm2, xmm1
vpclmulqdq xmm5, xmm8, xmm0, 0
vpclmulqdq xmm7, xmm8, xmm0, 0x11
vpxor xmm5, xmm5, xmm4
vpclmulqdq xmm6, xmm9, xmm15, 0x10
vpxor xmm7, xmm7, xmm10
vpxor xmm6, xmm6, xmm2
vpxor xmm4, xmm7, xmm5
vpxor xmm6, xmm6, xmm4
vpslldq xmm1, xmm6, 8
vmovdqu xmm3, xmmword [r11 + 0x10]
vpsrldq xmm6, xmm6, 8
vpxor xmm8, xmm5, xmm1
vpxor xmm7, xmm7, xmm6
vpalignr xmm2, xmm8, xmm8, 8
vpclmulqdq xmm8, xmm8, xmm3, 0x10
vpxor xmm8, xmm8, xmm2
vpalignr xmm2, xmm8, xmm8, 8
vpclmulqdq xmm8, xmm8, xmm3, 0x10
vpxor xmm2, xmm2, xmm7
vpxor xmm8, xmm8, xmm2
vpshufb xmm8, xmm8, xmmword [r11]
vmovdqu xmmword [r9 - 0x40], xmm8
vzeroupper
movaps xmm6, xmmword [rax - 0xd8]
movaps xmm7, xmmword [rax - 0xc8]
movaps xmm8, xmmword [rax - 0xb8]
movaps xmm9, xmmword [rax - 0xa8]
movaps xmm10, xmmword [rax - 0x98]
movaps xmm11, xmmword [rax - 0x88]
movaps xmm12, xmmword [rax - 0x78]
movaps xmm13, xmmword [rax - 0x68]
movaps xmm14, xmmword [rax - 0x58]
movaps xmm15, xmmword [rax - 0x48]
mov r15, qword [rax - 0x30]
mov r14, qword [rax - 0x28]
mov r13, qword [rax - 0x20]
mov r12, qword [rax - 0x18]
mov rbp, qword [rax - 0x10]
mov rbx, qword [rax - 8]
lea rsp, [rax]
mov rax, r10
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov eax, 0x278
call fcn.14022d770
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x140670008]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x140115a54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x140115a54
lea rdi, [rbp + 0x268]
call fcn.140093c80
mov r9, qword [rbp + 0x260]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov edi, 0x200
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
mov r8d, edi
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, 0xffffffff
mov qword [rsp + 0x20], rsi
test eax, eax
lea r9, [rbp]
lea rdx, [rbp + 0x10]
cmovs eax, ecx
mov rcx, rbx
test eax, eax
cmovs eax, edi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140115cce
mov r8, qword [rbp + 0x260]
mov rcx, r8
call fcn.140115d60
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov ebx, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140115a81
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14022d770
sub rsp, rcx
xor esi, esi
lea rdi, [rsp + 0x50]
test rdi, rdi
jne 0x140115aa8
lea rdi, str.no_stack_
jmp 0x140115c1b
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140115b9d
mov rcx, rsi
test rbx, rbx
je 0x140115c1b
cmp rbx, 0x20
jb 0x140115b82
mov rdx, qword [rbp + 0x260]
lea r8, [rbx - 1]
lea r8, [rdi + r8*2]
lea rax, [rdx - 1]
add rax, rbx
cmp rdi, rax
ja 0x140115afe
cmp r8, rdx
jae 0x140115b90
mov r8, rbx
and r8, 0xffffffffffffffe0
mov rax, qword [rbp + 0x260]
lea rdx, [rdi + 0x20]
add rax, 0x10
nop dword [rax]
nop dword [rax + rax]
movq xmm0, qword [rax - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rax - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rax - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rcx, r8
jb 0x140115b20
cmp rcx, rbx
jae 0x140115ba2
mov rdx, qword [rbp + 0x260]
nop dword [rax]
movsx eax, byte [rcx + rdx]
mov word [rdi + rcx*2], ax
inc rcx
jmp 0x140115b7d
test rbx, rbx
je 0x140115c1b
mov r10d, 0x53
lea r9, [0x140000000]
mov r8, rsi
lea r11d, [r10 + 0x20]
lea r14d, [r10 - 0x10]
lea r15d, [r10 + 0x10]
nop
cmp word [rdi + r8*2], 0x25
jne case.0x140115bf2.47
lea rdx, [rdi + 2]
lea rdx, [rdx + r8*2]
movzx eax, word [rdx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x140115bf2.47
movsxd rcx, eax
movzx eax, byte [r9 + rcx + 0x115d08]
mov ecx, dword [r9 + rax*4 + 0x115cf0]
add rcx, r9
jmp rcx
inc r8
add rdx, 2
jmp 0x140115bd0
mov word [rdx], r10w
jmp case.0x140115bf2.47
mov word [rdx], r11w
jmp case.0x140115bf2.47
mov word [rdx], r14w
jmp case.0x140115bf2.47
mov word [rdx], r15w
inc r8
cmp r8, rbx
jb 0x140115bc0
lea rbx, [rbp + 0x268]
call fcn.140093c80
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 0x10]
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8d, 0xff
mov rcx, qword [rax]
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov word [rbp + 0x20e], si
call fcn.140115820
xor ecx, ecx
test eax, eax
jle 0x140115cb7
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140115cce
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x10]
mov ecx, 1
mov qword [rbp], rax
lea rax, [rbp]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x140115cce
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.14022d1e0
lea rsp, [rbp + 0x228]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret