Function at 0x401676
Capabilities:
Encrypt data using salsa20 or chacha
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc40], xmm13
movaps xmmword [rbp + 0xc30], xmm12
movaps xmmword [rbp + 0xc20], xmm11
movaps xmmword [rbp + 0xc10], xmm10
movaps xmmword [rbp + 0xc00], xmm9
movdqa xmmword [rbp + 0xbf0], xmm8
movaps xmmword [rbp + 0xbe0], xmm7
movaps xmmword [rbp + 0xbd0], xmm6
and rsp, 0xffffffffffffffe0
lea rax, [0x00450e30]
mov rcx, rax
shr rcx, 0x38
mov byte [rsp + 0x4a7], cl
mov rcx, rax
shr rcx, 0x28
mov word [rsp + 0x4a5], cx
mov rcx, rax
shr rcx, 8
mov dword [rsp + 0x4a1], ecx
push 0x20
pop rbx
mov qword [rsp + 0x4a8], rbx
lea r14, [0x00450e5c]
mov qword [rsp + 0x4b0], r14
mov qword [rsp + 0x4b8], rbx
lea rdi, str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm
mov qword [rsp + 0x4c0], rdi
and qword [rsp + 0x4c8], 0
mov qword [rsp + 0x4d0], rdi
and qword [rsp + 0x4d8], 0
movdqa xmm0, xmmword [section..rdata]
movdqu xmmword [rsp + 0x4e0], xmm0
mov word [rsp + 0x4f0], 0x113
movabs rcx, 0x100000001000
mov qword [rsp + 0x4f8], rcx
mov dword [rsp + 0x500], 0x400
mov byte [rsp + 0x4a0], al
mov byte [rsp + 0x4f2], 0
mov ecx, 0x400000
call fcn.004037e8
test rax, rax
je 0x403036
mov rsi, rax
xor r15d, r15d
lea rcx, [rsi + r15]
cmp r15, 0x3ffc00
je 0x4017d4
mov r8d, 0x400
xor edx, edx
call sub.ntdll.dll_memset
add r15, 0x400
jmp 0x4017b1
xor r15d, r15d
mov r8d, 0x400
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0x90], 1
mov eax, 0x1000
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rax
push 1
pop r11
lea rax, [rsp + 0x1a0]
mov dword [rax], r11d
push 0x20
pop rcx
lea rdx, [rsp + 0x1e0]
mov dword [rdx], ecx
lea r9, [rsp + 0x260]
mov dword [r9], ecx
lea r10, [rsp + 0x2a0]
mov dword [r10], ecx
lea r8, [rsp + 0x840]
mov qword [r8], rax
push 4
pop rax
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rdx
lea rcx, [rsp + 0x200]
mov dword [rcx], 0x1000
mov qword [r8 + 0x18], rax
mov qword [r8 + 0x20], rcx
lea rcx, [rsp + 0x220]
mov dword [rcx], 3
mov qword [r8 + 0x28], rax
mov qword [r8 + 0x30], rcx
lea rcx, [rsp + 0x240]
mov dword [rcx], 0x13
mov qword [r8 + 0x38], rax
mov qword [r8 + 0x40], rcx
lea rcx, [rsp + 0x180]
mov qword [r8 + 0x48], rax
mov qword [r8 + 0x50], rcx
mov qword [r8 + 0x58], rax
mov qword [r8 + 0x60], r9
mov rdx, qword [rsp + 0x4a0]
mov qword [r8 + 0x68], rax
mov qword [r8 + 0x70], rdx
mov qword [r8 + 0x78], rbx
mov qword [r8 + 0x80], r10
lea rdx, [rsp + 0x2e0]
and dword [rdx], 0
mov qword [r8 + 0x88], rax
mov qword [r8 + 0x90], r14
mov qword [r8 + 0x98], rbx
mov qword [r8 + 0xa0], rdx
lea rdx, [rsp + 0x100]
and dword [rdx], 0
mov qword [r8 + 0xa8], rax
mov qword [r8 + 0xb0], rdi
and qword [r8 + 0xb8], 0
mov dword [rcx], r11d
mov qword [r8 + 0xc0], rdx
mov qword [r8 + 0xc8], rax
mov qword [r8 + 0xd0], rdi
and qword [r8 + 0xd8], 0
pxor xmm0, xmm0
lea rdi, [rsp + 0x730]
movdqa xmmword [rdi + 0x30], xmm0
movdqa xmmword [rdi + 0x20], xmm0
movdqa xmmword [rdi + 0x10], xmm0
movdqa xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
push 0x40
pop rdx
push 0xe
pop r9
mov rcx, rdi
call fcn.00404439
movdqa xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movaps xmm3, xmmword [rdi + 0x30]
lea rdi, [rsp + 0x370]
movaps xmmword [rdi + 0x30], xmm3
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
push 0x48
pop rbx
cmp r15, 1
je 0x4019eb
lea r14, [r15 + 1]
and dword [rsp + 0x3b0], 0
mov dword [rsp + 0x3b4], r15d
mov edx, 0x400
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.00404776
mov dword [rsp + 0x3b0], 1
lea rcx, [rsi + 0x400]
mov edx, 0x400
mov r8, rdi
mov r9, rbx
call fcn.00404776
add rsi, 0x400000
mov r15, r14
jmp 0x401990
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
xor r15d, r15d
lea rbx, [rsp + 0x4a0]
lea r14, [rsp + 0x840]
cmp r15d, 3
je 0x401a66
xor r12d, r12d
cmp r12d, 4
je 0x401a61
xor r13d, r13d
cmp r13d, 1
je 0x401a5c
mov dword [rsp + 0x840], r15d
mov dword [rsp + 0x844], r13d
inc r13d
mov dword [rsp + 0x848], r12d
and dword [rsp + 0x84c], 0
mov rcx, rbx
mov rdx, r14
mov r8, rsi
mov r9, rdi
call fcn.00403803
jmp 0x401a20
inc r12d
jmp 0x401a17
inc r15d
jmp 0x401a0e
cmp qword [rsp + 0x88], 0xfff
jbe 0x403036
mov edx, 0x3ffc00
add rdx, qword [rsp + 0x80]
lea rsi, [rsp + 0x840]
mov r8d, 0x400
mov rcx, rsi
call sub.ntdll.dll_memcpy
push 0x20
pop rdi
mov rcx, rdi
mov dl, 1
call fcn.00403513
mov r14, rax
mov r15, rdx
mov r9d, 0x400
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call fcn.00404776
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x401ae3
shl r8, 0xa
mov rcx, qword [rsp + 0x80]
push 8
pop rdx
call fcn.0040c1e6
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
lea rsi, [rsp + 0x370]
movaps xmmword [rsi - 0x10], xmm1
movaps xmmword [rsi - 0x20], xmm0
mov ecx, 0x39610
call fcn.0040c206
mov rdi, rax
mov qword [rsp + 0x60], rdx
lea rdx, [0x00417820]
mov r8d, 0x39610
mov rcx, rax
call sub.ntdll.dll_memcpy
lea rdx, [rsp + 0x740]
xorps xmm0, xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x350]
lea r9, [rsp + 0x100]
mov qword [r9], rax
mov qword [r9 + 8], 0x20
mov qword [r9 + 0x10], rsi
and qword [r9 + 0x18], 0
movdqu xmm0, xmmword [str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm]
movdqa xmmword [rdx - 0x10], xmm0
mov qword [r9 + 0x20], 4
lea r8, [rsp + 0x760]
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
call fcn.00408fee
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x401bb9
cmp rdx, 4
jne 0x403036
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x401b9d
lea rax, [0x00450e50]
lea r9, [rsp + 0x80]
mov qword [r9], rax
mov qword [r9 + 8], 0xc
lea rax, [0x00450e5c]
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
mov qword [r9 + 0x20], 4
lea rdx, [rsp + 0x764]
lea r8, [rsp + 0x770]
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
call fcn.00408fee
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x401c3a
cmp rdx, 4
jne 0x403036
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x401c1e
mov al, byte [0x00416010]
cmp al, 0xff
mov qword [rsp + 0x58], rdi
jne 0x401d0f
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.004078dc
lea rbx, [rsp + 0x4a0]
mov rcx, rbx
call fcn.004078fe
mov esi, dword [rsi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x00451026]
lea rdx, [0x00451029]
call fcn.00408a95
mov ebx, esi
not ebx
test al, al
je 0x401ca2
test ebx, 0xc000000
jne 0x401cf9
call fcn.00409d43
and eax, 2
shr eax, 1
jmp 0x401cfb
lea rcx, [0x00451026]
mov rdx, rcx
call fcn.00408a95
test al, al
je 0x401cc8
test ebx, 0xc000000
jne 0x401cf9
call fcn.00409d43
not eax
test al, 6
jmp 0x401cf4
lea rcx, [0x00451026]
lea rdx, [0x0045102c]
call fcn.00408a95
mov ecx, eax
mov al, 1
test cl, cl
je 0x401cfb
test ebx, 0xc000000
jne 0x401cf9
call fcn.00409d43
not eax
test al, 0xe6
sete al
jmp 0x401cfb
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x00416010], sil
movaps xmm0, xmmword [rsp + 0x730]
movaps xmm1, xmmword [rsp + 0x740]
movaps xmm2, xmmword [rsp + 0x750]
movaps xmm3, xmmword [rsp + 0x760]
lea rsi, [rsp + 0x3b0]
movaps xmmword [rsi - 0x10], xmm3
movaps xmmword [rsi - 0x20], xmm2
movaps xmmword [rsi - 0x30], xmm1
movaps xmmword [rsi - 0x40], xmm0
mov rcx, rsi
call fcn.00408fdb
mov byte [rsi + 0x40], 0
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x370]
push 0x20
pop r8
call fcn.004093e6
mov al, byte [0x00416011]
cmp al, 0xff
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r15
je 0x40242b
cmp al, 1
jne 0x4024f3
lea rsi, [rsp + 0x4a0]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.0040bf2b
movaps xmm6, xmmword [rsi]
movaps xmm7, xmmword [rsi + 0x10]
movaps xmm0, xmmword [rsi + 0x20]
movaps xmm1, xmmword [rsi + 0x30]
lea rdx, [rsp + 0x100]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rsi + 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsi + 0x50]
movaps xmmword [rdx + 0x30], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov r8, rdx
call fcn.0040a042
movaps xmm10, xmmword [rsi]
movaps xmm11, xmmword [rsi + 0x10]
movaps xmm8, xmmword [rsi + 0x20]
movaps xmm9, xmmword [rsi + 0x30]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x6e0]
push 0xffffffffffffffff
pop rdx
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rbx
call fcn.0040a5c5
lea rdx, [rsp + 0x400]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rsi, [rsp + 0x460]
mov rcx, rsi
mov r8, rbx
call fcn.0040a865
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rbx, [rsp + 0x700]
push 0x40
pop rdx
mov rcx, rbx
mov r9, r8
call fcn.0040a5c5
lea rdx, [rsp + 0x420]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea r15, [rsp + 0x440]
mov rcx, r15
mov r8, rbx
call fcn.0040bfa9
lea rdi, [rsp + 0x480]
mov rcx, rdi
mov rdx, r15
call fcn.0040a876
lea r14, [rsp + 0x4a0]
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.0040a616
movaps xmm10, xmmword [r14]
movaps xmm11, xmmword [r14 + 0x10]
lea rsi, [rsp + 0x1a0]
movaps xmmword [rsi + 0x10], xmm11
movaps xmmword [rsi], xmm10
lea r13, [rsp + 0x1e0]
mov rcx, r13
mov rdx, rsi
call fcn.0040beaa
lea r14, [rsp + 0x220]
mov rcx, r14
mov rdx, r13
call fcn.0040a876
lea rdx, [rsp + 0x200]
movaps xmmword [rdx + 0x10], xmm9
movaps xmmword [rdx], xmm8
lea rcx, [rsp + 0x4a0]
mov r8, r14
call fcn.0040a616
or qword [rsp + 0x20], 0xffffffffffffffff
lea r12, [rsp + 0x180]
mov edx, 0x3ffffff
mov rcx, r12
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.0040a5c5
lea r14, [rsp + 0x240]
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
lea rbx, [rsp + 0x4c0]
mov rcx, rbx
mov rdx, r14
mov r8, r12
call fcn.0040a865
movaps xmm8, xmmword [rbx - 0x20]
movaps xmm9, xmmword [rbx - 0x10]
movaps xmm10, xmmword [rbx]
movaps xmm11, xmmword [rbx + 0x10]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x460]
mov rcx, rbx
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.0040a5c5
movaps xmmword [r15 + 0x10], xmm9
movaps xmmword [r15], xmm8
lea r15, [rsp + 0x4a0]
lea rdx, [rsp + 0x440]
mov rcx, r15
mov r8, rbx
call fcn.0040bfa9
movaps xmm12, xmmword [r15]
movaps xmm13, xmmword [r15 + 0x10]
movaps xmmword [rdi + 0x10], xmm11
movaps xmmword [rdi], xmm10
movaps xmmword [rsi + 0x10], xmm13
movaps xmmword [rsi], xmm12
lea rbx, [rsp + 0x200]
lea rdx, [rsp + 0x480]
lea r8, [rsp + 0x1a0]
mov rcx, rbx
call fcn.0040a616
movaps xmmword [r13 + 0x10], xmm13
movaps xmmword [r13], xmm12
lea rsi, [rsp + 0x220]
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
call fcn.0040bfba
lea r12, [rsp + 0x4a0]
mov rcx, r12
mov rdx, rbx
mov r8, rsi
call fcn.0040a616
movaps xmm10, xmmword [r12]
movaps xmm11, xmmword [r12 + 0x10]
mov edi, 0x3ffffff
mov qword [rsp + 0x20], rdi
xor r13d, r13d
lea rsi, [rsp + 0x180]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.0040a5c5
movaps xmmword [r14 + 0x10], xmm9
movaps xmmword [r14], xmm8
lea r14, [rsp + 0x4a0]
lea r15, [rsp + 0x240]
mov rcx, r14
mov rdx, r15
mov r8, rsi
call fcn.0040a865
movaps xmm8, xmmword [r14]
movaps xmm9, xmmword [r14 + 0x10]
mov qword [rsp + 0x20], rdi
lea r14, [rsp + 0x6e0]
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, r14
push 0xffffffffffffffff
pop rdi
mov rdx, rdi
call fcn.0040a5c5
lea rax, [rsp + 0x400]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rsi, [rsp + 0x460]
lea rdx, [rsp + 0x400]
mov rcx, rsi
mov r8, r14
call fcn.0040a865
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x700]
mov rcx, r14
push 0x40
pop rdx
mov r9, r8
call fcn.0040a5c5
lea rax, [rsp + 0x420]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r12, [rsp + 0x440]
lea rdx, [rsp + 0x420]
mov rcx, r12
mov r8, r14
call fcn.0040bfa9
lea r14, [rsp + 0x480]
mov rcx, r14
mov rdx, r12
call fcn.0040a876
lea r12, [rsp + 0x4a0]
mov rcx, r12
mov rdx, rsi
mov r8, r14
call fcn.0040a616
movaps xmm10, xmmword [r12]
movaps xmm11, xmmword [r12 + 0x10]
lea rax, [rsp + 0x1a0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r14, [rsp + 0x1e0]
lea rdx, [rsp + 0x1a0]
mov rcx, r14
call fcn.0040beaa
lea rsi, [rsp + 0x220]
mov rcx, rsi
mov rdx, r14
call fcn.0040a876
movaps xmmword [rbx + 0x10], xmm9
movaps xmmword [rbx], xmm8
lea rcx, [rsp + 0x4a0]
lea rdx, [rsp + 0x200]
mov r8, rsi
call fcn.0040a616
or qword [rsp + 0x20], 0xffffffffffffffff
lea rbx, [rsp + 0x180]
mov edx, 0x3ffffff
mov rcx, rbx
mov r8, rdi
mov r9, rdi
call fcn.0040a5c5
movaps xmmword [r15 + 0x10], xmm11
movaps xmmword [r15], xmm10
lea r15, [rsp + 0x4c0]
lea rdx, [rsp + 0x240]
mov rcx, r15
mov r8, rbx
call fcn.0040a865
movdqa xmm8, xmmword [r15 - 0x20]
movaps xmm9, xmmword [r15 - 0x10]
movaps xmm10, xmmword [r15]
movaps xmm11, xmmword [r15 + 0x10]
push 2
pop rdi
mov dword [rsp + 0x38], edi
push 4
pop rbx
mov dword [rsp + 0x30], ebx
push 6
pop r15
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r12, [rsp + 0x200]
mov rcx, r12
xor edx, edx
mov r8d, r15d
mov r9d, ebx
call fcn.00409fd1
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
lea r14, [rsp + 0x180]
lea rdx, [rsp + 0x1e0]
mov rcx, r14
mov r8, r12
call fcn.0040a011
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r12, [rsp + 0x240]
mov rcx, r12
xor edx, edx
mov r8d, r15d
mov r9d, ebx
call fcn.00409fd1
movaps xmmword [rsi + 0x10], xmm9
movdqa xmmword [rsi], xmm8
lea rsi, [rsp + 0x4a0]
lea rdx, [rsp + 0x220]
mov rcx, rsi
mov r8, r12
call fcn.0040a011
lea rbx, [rsp + 0x1a0]
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call fcn.0040bfcb
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.0040bd6c
lea rcx, [rsp + 0x180]
call fcn.00409f65
cmp r13, 0x40
je 0x40231b
movdqu xmm0, xmmword [rsp + 0x180]
movdqu xmmword [rsp + r13 + 0x4a0], xmm0
add r13, 0x10
jmp 0x4022fc
movaps xmm0, xmmword [rsp + 0x100]
movaps xmm1, xmmword [rsp + 0x110]
movaps xmm2, xmmword [rsp + 0x120]
movaps xmm3, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x2e0], xmm0
movaps xmmword [rsp + 0x2f0], xmm1
movaps xmmword [rsp + 0x300], xmm2
movaps xmmword [rsp + 0x310], xmm3
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmm2, xmmword [rsp + 0xa0]
movaps xmm3, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x2a0], xmm0
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmmword [rsp + 0x2c0], xmm2
movaps xmmword [rsp + 0x2d0], xmm3
lea rdx, [rsp + 0x4a0]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x290], xmm3
movaps xmmword [rsp + 0x280], xmm2
movaps xmmword [rsp + 0x270], xmm1
movaps xmmword [rsp + 0x260], xmm0
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0xd0], eax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xc0], xmm0
lea rcx, [rsp + 0x730]
mov r8d, 0x108
call sub.ntdll.dll_memcpy
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
mov rax, qword [rsp + 0x8f]
mov qword [rsp + 0x1cf], rax
xor r13d, r13d
jmp 0x40257d
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.004078dc
lea rbx, [rsp + 0x4a0]
mov rcx, rbx
call fcn.004078fe
mov esi, dword [rsi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x00451026]
lea rdx, [0x00451029]
call fcn.00408a95
mov ebx, esi
not ebx
test al, al
je 0x402480
test ebx, 0xc000000
jne 0x4024d7
call fcn.00409d43
and eax, 2
shr eax, 1
jmp 0x4024d9
lea rcx, [0x00451026]
mov rdx, rcx
call fcn.00408a95
test al, al
je 0x4024a6
test ebx, 0xc000000
jne 0x4024d7
call fcn.00409d43
not eax
test al, 6
jmp 0x4024d2
lea rcx, [0x00451026]
lea rdx, [0x0045102c]
call fcn.00408a95
mov ecx, eax
mov al, 1
test cl, cl
je 0x4024d9
test ebx, 0xc000000
jne 0x4024d7
call fcn.00409d43
not eax
test al, 0xe6
sete al
jmp 0x4024d9
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x00416011], sil
jne 0x401d96
xorps xmm0, xmm0
and dword [rsp + 0xd0], 0
movaps xmmword [rsp + 0xc0], xmm0
mov edi, 0x3ffffff
and edi, dword [rsp + 0xe0]
mov ebx, dword [rsp + 0xe3]
mov r14d, dword [rsp + 0xe6]
shr ebx, 2
and ebx, 0x3ffff03
shr r14d, 4
and r14d, 0x3ffc0ff
mov r15d, dword [rsp + 0xe9]
shr r15d, 6
and r15d, 0x3f03fff
mov r12d, dword [rsp + 0xec]
shr r12d, 8
and r12d, 0xfffff
movdqa xmm8, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x340], xmm8
mov r13b, byte [rsp + 0x340]
psrldq xmm8, 1
mov eax, dword [rsp + 0xd0]
lea rsi, [rsp + 0x878]
mov dword [rsi - 4], eax
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi - 0x14], xmm0
lea rdx, [rsp + 0x730]
mov r8d, 0x108
mov rcx, rsi
call sub.ntdll.dll_memcpy
movaps xmm0, xmmword [rsp + 0x2e0]
movaps xmm1, xmmword [rsp + 0x2f0]
movaps xmm2, xmmword [rsp + 0x300]
movaps xmm3, xmmword [rsp + 0x310]
movaps xmmword [rsi + 0x128], xmm0
movaps xmmword [rsi + 0x138], xmm1
movaps xmmword [rsi + 0x148], xmm2
movaps xmmword [rsi + 0x158], xmm3
movaps xmm0, xmmword [rsp + 0x2a0]
movaps xmm1, xmmword [rsp + 0x2b0]
movaps xmm2, xmmword [rsp + 0x2c0]
movaps xmm3, xmmword [rsp + 0x2d0]
movaps xmmword [rsi + 0x168], xmm0
movaps xmmword [rsi + 0x178], xmm1
movaps xmmword [rsi + 0x188], xmm2
movaps xmmword [rsi + 0x198], xmm3
movaps xmm0, xmmword [rsp + 0x260]
movaps xmm1, xmmword [rsp + 0x270]
movaps xmm2, xmmword [rsp + 0x280]
movaps xmm3, xmmword [rsp + 0x290]
movaps xmmword [rsi + 0x1a8], xmm0
movaps xmmword [rsi + 0x1b8], xmm1
movaps xmmword [rsi + 0x1c8], xmm2
movaps xmmword [rsi + 0x1d8], xmm3
mov rax, qword [rsp + 0x1cf]
mov qword [rsi + 0x200], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movups xmmword [rsi + 0x1f1], xmm0
mov byte [rsi - 0x38], r13b
movdqa xmmword [rsp + 0x330], xmm8
movq qword [rsi - 0x37], xmm8
pshufd xmm0, xmm8, 0xee
movd dword [rsi - 0x2f], xmm0
pextrw eax, xmm8, 6
mov word [rsi - 0x2b], ax
mov al, byte [rsp + 0x33e]
mov byte [rsi - 0x29], al
mov dword [rsi - 0x28], edi
mov dword [rsi - 0x24], ebx
mov dword [rsi - 0x20], r14d
mov dword [rsi - 0x1c], r15d
mov dword [rsi - 0x18], r12d
movaps xmmword [rsi + 0x108], xmm6
movaps xmmword [rsi + 0x118], xmm7
and qword [rsi + 0x1e8], 0
xor edi, edi
mov byte [rsi + 0x1f0], dil
lea rcx, [rsp + 0xe0]
push 0x20
pop rdx
call fcn.0040dee5
lea rdx, [rsp + 0x370]
mov dword [rdx + 0x30], 1
mov byte [rdx + 0x80], dil
lea r12, [rsp + 0xa80]
mov r8d, 0x84
mov rcx, r12
call sub.ntdll.dll_memcpy
lea rdx, str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm
lea rbx, [rsp + 0x840]
mov rcx, rbx
xor r8d, r8d
call fcn.00409384
mov r8d, 0x39600
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
call fcn.00409384
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.00409f65
and qword [rsi], 0
mov qword [rsi + 8], 0x39600
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x4a0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
push 1
pop r14
mov rcx, rbx
mov r8, r14
call fcn.00409048
lea rcx, [rsp + 0x4a0]
mov r8d, 0x240
mov rdx, rbx
call sub.ntdll.dll_memcpy
mov al, byte [0x00416011]
cmp al, 1
jne 0x4027ce
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x4a0]
call fcn.0040a884
jmp 0x40294c
mov esi, dword [rsp + 0x4c8]
mov eax, esi
shr eax, 0x1a
mov edx, 0x3ffffff
and esi, edx
add eax, dword [rsp + 0x4cc]
mov ecx, eax
shr ecx, 0x1a
and eax, edx
add ecx, dword [rsp + 0x4d0]
mov r9d, ecx
shr r9d, 0x1a
add r9d, dword [rsp + 0x4d4]
and ecx, edx
mov r10d, r9d
shr r10d, 0x1a
mov r8d, r9d
and r8d, edx
lea r11d, [r10 + r10*4]
add r11d, dword [rsp + 0x4c4]
mov r10d, r11d
shr r10d, 0x1a
add r10d, esi
and r11d, edx
lea ebx, [r11 + 5]
mov esi, ebx
shr esi, 0x1a
add esi, r10d
mov edi, esi
shr edi, 0x1a
add edi, eax
mov r13d, edi
shr r13d, 0x1a
add r13d, ecx
mov r12d, r13d
shr r12d, 0x1a
lea r15d, [r12 + r8]
add r15d, 0xfc000000
add r12d, r8d
mov r8d, r15d
sar r8d, 0x1f
shr r15d, 0x1f
dec r15d
and edx, r15d
and ebx, edx
and esi, edx
and edi, edx
and edx, r13d
and r15d, r12d
and r11d, r8d
or r11d, ebx
and r10d, r8d
or r10d, esi
and eax, r8d
or eax, edi
and ecx, r8d
or ecx, edx
and r8d, r9d
or r8d, r15d
mov edi, r10d
shl edi, 0x1a
or edi, r11d
shr r10d, 6
mov edx, eax
shl edx, 0x14
or edx, r10d
shr eax, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, eax
shr ecx, 0x12
shl r8d, 8
or r8d, ecx
add edi, dword [rsp + 0x4a0]
mov ebx, dword [rsp + 0x4a4]
mov eax, dword [rsp + 0x4a8]
adc rbx, rdx
add rax, r9
mov r15, rbx
shr r15, 0x20
add r8d, dword [rsp + 0x4ac]
add r15, rax
mov r12, r15
shr r12, 0x20
add r12d, r8d
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.00409f65
mov dword [rsi], edi
mov rdi, qword [rsp + 0x58]
mov dword [rsi + 4], ebx
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], r12d
lea r12, [rsp + 0xa80]
mov eax, dword [rsi]
mov dword [rsp + 0x370], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x374], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x378], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x37c], eax
mov r15, qword [rsp + 0x68]
mov bl, 1
xor eax, eax
cmp rax, 0x10
je 0x402984
lea rsi, [rax + 1]
mov dl, byte [rdi + rax + 0x39600]
xor dl, byte [rsp + rax + 0x370]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.0040deda
and bl, al
mov rax, rsi
jmp 0x402955
mov ecx, ebx
call fcn.0040deda
test al, al
je 0x4029c8
mov r8d, 0x39600
mov rcx, r12
mov rdx, rdi
call fcn.004093e6
lea rcx, [rsp + 0x840]
call fcn.004098d4
mov rsi, qword [rsp + 0x60]
and rsi, 0xffffffffffffff00
lea rcx, [rsp + 0x350]
call fcn.00409d50
jmp 0x4029fb
lea rcx, [rsp + 0x840]
call fcn.004098d4
mov rcx, rdi
mov rdx, qword [rsp + 0x60]
call fcn.004034ff
lea rcx, [rsp + 0x350]
call fcn.00409d50
push 0x13
pop rax
mov qword [rsp + 0x60], rax
xor esi, esi
xor edi, edi
mov rcx, qword [rsp + 0x70]
mov rdx, r15
call fcn.004034ff
test rdi, rdi
je 0x403036
cmp word [rdi], 0x5a4d
jne 0x403036
mov eax, dword [rdi + 0x3c]
test eax, eax
je 0x403036
cmp eax, 0x40
jb 0x403036
cmp eax, 0x39600
ja 0x403036
movsxd rbx, eax
movzx eax, word [rbx + rdi + 0x18]
cmp eax, 0x20b
je 0x402a86
cmp eax, 0x10b
jne 0x403036
cmp dword [rdi + rbx], 0x4550
jne 0x403036
lea rcx, [rdi + rbx]
cmp word [rcx + 4], 0x14c
jne 0x403036
test byte [rcx + 0x16], 2
je 0x403036
mov eax, 0xf8
xor r14d, r14d
jmp 0x402ab2
cmp dword [rdi + rbx], 0x4550
jne 0x403036
lea rcx, [rdi + rbx]
cmp word [rcx + 4], 0x8664
jne 0x403036
mov eax, 0x108
test byte [rcx + 0x16], 2
je 0x403036
mov qword [rsp + 0x50], rcx
add rbx, rax
cmp rbx, 0x39601
jae 0x403036
mov eax, 0x39600
sub rax, rbx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + 6]
mov qword [rsp + 0x78], rcx
imul rcx, rcx, 0x28
cmp rcx, rax
ja 0x403036
test r14, r14
mov rdx, qword [rsp + 0x50]
je 0x403036
test byte [rdx + 0x17], 0x20
jne 0x403036
cmp dword [rdx + 0xfc], 0
je 0x402b18
cmp dword [rdx + 0xf8], 0
jne 0x403036
mov eax, dword [rdx + 0x28]
mov qword [rsp + 0x178], rax
test rax, rax
je 0x403036
mov rax, qword [rdx + 0x30]
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov eax, dword [rdx + 0x50]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
call fcn.00409e8f
cmp eax, 0xb
je 0x402b75
lea rcx, [rsp + 0x100]
and qword [rcx], 0
lea rdx, [rsp + 0x80]
call fcn.00409e8f
cmp eax, 0xb
jne 0x402fcc
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x168], rbx
add rbx, rdi
mov rcx, qword [rsp + 0x78]
movzx eax, cl
shr ecx, 8
imul rsi, rcx, 0x2800
imul rax, rax, 0x28
mov qword [rsp + 0x160], rax
add rsi, rax
mov rax, rbx
test rsi, rsi
je 0x402bdf
lea rdi, [rax + 0x28]
mov edx, dword [rax + 0x14]
add rdx, qword [rsp + 0x58]
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 0x10]
add rcx, qword [rsp + 0x100]
call sub.ntdll.dll_memcpy
add rsi, 0xffffffffffffffd8
mov rax, rdi
jmp 0x402bb1
mov r15, qword [rsp + 0x100]
mov rcx, r15
mov rdx, qword [rsp + 0x50]
sub rcx, qword [rdx + 0x30]
mov qword [rsp + 0x170], rbx
je 0x402c97
mov eax, dword [rdx + 0xb0]
test eax, eax
je 0x402c97
cmp dword [rdx + 0xb4], 0
je 0x402c97
push 2
pop r8
xor r9d, r9d
mov r11, r15
mov esi, eax
lea r10, [r11 + rsi]
mov eax, dword [r11 + rsi + 4]
test rax, rax
jne 0x402c38
cmp dword [r10], 0
je 0x402c8a
add rax, 0xfffffffffffffff8
cqo
idiv r8
test rax, rax
cmovle rax, r9
lea rdx, [r11 + rsi]
add rdx, 8
xor r11d, r11d
cmp rax, r11
je 0x402c81
movzx esi, word [rdx + r11*2]
mov edi, esi
and edi, 0xf000
cmp di, 0xa000
jne 0x402c7c
mov edi, dword [r10]
and esi, 0xfff
add rsi, rdi
add qword [r15 + rsi], rcx
inc r11
jmp 0x402c53
mov eax, dword [r10 + 4]
mov r11, r10
jmp 0x402c22
mov r15, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x50]
cmp dword [rdx + 0x94], 0
je 0x402e14
mov rax, qword [rsp + 0x50]
mov r12d, dword [rax + 0x90]
test r12d, r12d
je 0x402e14
add r12, r15
lea rdi, [r15 + 2]
lea rsi, [rsp + 0x840]
lea rbx, [rsp + 0x4a0]
mov qword [rsp + 0x68], r15
mov ecx, dword [r12 + 0xc]
test rcx, rcx
jne 0x402d02
cmp dword [r12 + 0x10], 0
jne 0x402d02
cmp dword [r12], 0
jne 0x402d02
cmp dword [r12 + 4], 0
jne 0x402d02
cmp dword [r12 + 8], 0
je 0x402e14
add rcx, r15
call fcn.00409f4b
mov r8, rdx
mov rcx, rsi
mov rdx, rax
call fcn.004086c3
cmp qword [rsp + 0x840], 0
jne 0x403036
mov rdx, qword [rsp + 0x848]
mov r8, qword [rsp + 0x850]
mov rcx, rsi
call fcn.00409d5a
cmp dword [rsp + 0x840], 0
jne 0x403036
mov r14, qword [rsp + 0x848]
mov eax, dword [r12]
mov qword [rsp + 0x70], r12
mov r12d, dword [r12 + 0x10]
add r12, r15
add r15, rax
test rax, rax
cmove r15, r12
xor r13d, r13d
mov rcx, qword [r15 + r13]
test rcx, rcx
je 0x402e01
js 0x402de0
cmp byte [rdi + rcx], 0
je 0x402e01
add rcx, rdi
call fcn.00409f4b
mov r8, rdx
mov rcx, rsi
mov rdx, rax
call fcn.004086c3
cmp qword [rsp + 0x840], 0
jne 0x403036
mov r8, qword [rsp + 0x848]
mov r9, qword [rsp + 0x850]
mov rcx, rbx
mov rdx, r14
call fcn.00409e07
cmp dword [rsp + 0x4a0], 0
jne 0x403036
mov rax, qword [rsp + 0x4a8]
jmp 0x402df4
movzx edx, cx
mov rcx, r14
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x403036
mov qword [r12 + r13], rax
add r13, 8
jmp 0x402d73
mov r12, qword [rsp + 0x70]
add r12, 0x14
mov r15, qword [rsp + 0x68]
jmp 0x402cd5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x168]
lea rdi, [rax + rcx]
add rdi, 0x24
mov rax, qword [rsp + 0x78]
shr eax, 8
imul r13, rax, 0x2800
add r13, qword [rsp + 0x160]
xor r14d, r14d
lea rsi, [rsp + 0x370]
mov r15, qword [rsp + 0x170]
cmp r13, r14
je 0x402f6b
mov eax, dword [r15 + 0x10]
mov qword [rsp + 0x370], rax
test rax, rax
je 0x402f5e
mov eax, dword [rdi + r14 - 0x18]
add rax, qword [rsp + 0x100]
mov qword [rsp + 0x730], rax
mov eax, dword [rdi + r14]
bt eax, 0x1d
jb 0x402ea5
bt eax, 0x1e
push 1
pop rbx
jae 0x402eb9
shr eax, 0x1f
lea ebx, [rax*2 + 2]
jmp 0x402eb9
bt eax, 0x1e
push 0x10
pop rbx
jae 0x402eb9
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov ebx, eax
mov r12, qword [0x00455038]
test r12, r12
jne 0x402f28
lea rcx, [rsp + 0x840]
lea rdx, [0x00450ff0]
push 9
pop r8
call fcn.00409d5a
cmp dword [rsp + 0x840], 0
jne 0x403036
mov rdx, qword [rsp + 0x848]
lea rcx, [rsp + 0x4a0]
lea r8, [0x00451010]
push 0x16
pop r9
call fcn.00409e07
cmp dword [rsp + 0x4a0], 0
jne 0x403036
mov r12, qword [rsp + 0x4a8]
mov qword [0x00455038], r12
and dword [rsp + 0x840], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rcx, [rsp + 0x840]
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea rdx, [rsp + 0x730]
mov r8, rsi
mov r9d, ebx
call r12
test eax, eax
jne 0x403036
add r15, 0x28
add r14, 0x28
jmp 0x402e53
mov rsi, qword [rsp + 0x100]
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xd4], 0
je 0x402fb3
mov eax, dword [rax + 0xd0]
test eax, eax
je 0x402fb3
mov rdi, qword [rsi + rax + 0x18]
push 1
pop rbx
mov rax, qword [rdi]
test rax, rax
je 0x402fab
mov rcx, rsi
mov edx, ebx
xor r8d, r8d
call rax
add rdi, 8
jmp 0x402f93
mov rsi, qword [rsp + 0x100]
add rsi, qword [rsp + 0x178]
call rsi
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x158]
jmp 0x402fd1
cmp eax, 0xe
jne 0x403036
movzx eax, byte [rsp + 0x60]
or rsi, rax
mov rcx, rdi
mov rdx, rsi
call fcn.004034ff
movaps xmm6, xmmword [rbp + 0xbd0]
movaps xmm7, xmmword [rbp + 0xbe0]
movaps xmm8, xmmword [rbp + 0xbf0]
movaps xmm9, xmmword [rbp + 0xc00]
movaps xmm10, xmmword [rbp + 0xc10]
movaps xmm11, xmmword [rbp + 0xc20]
movaps xmm12, xmmword [rbp + 0xc30]
movaps xmm13, xmmword [rbp + 0xc40]
lea rsp, [rbp + 0xc58]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2