Function at 0x411310
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x158
cmp qword [0x004245a0], 0
mov qword [rbp - 0x130], 0
je 0x410f30
mov rax, qword [0x00424868]
lea rcx, [rbp - 0x118]
mov rdx, rbp
mov qword [0x00424868], rcx
add rcx, 0x10
mov qword [rbp - 0x118], rax
call sub.msvcrt.dll__setjmp
cdqe
test rax, rax
mov qword [rbp - 0x110], rax
jne 0x410e60
mov rbx, qword [0x004245a0]
mov rcx, rbx
call fcn.00401a70
test al, al
je 0x410f20
lea rcx, [0x0041d610]
mov qword [rbp - 0x128], 0
call fcn.0040cf10
lea r8, [rbp - 0x128]
mov rcx, rbx
lea rdx, [0x0041d680]
mov qword [rbp - 0x128], rax
call fcn.0040f420
mov qword [rbp - 0x130], rax
mov rax, qword [0x00424868]
mov rax, qword [rax]
mov qword [0x00424868], rax
cmp qword [rbp - 0x110], 0
jne 0x410f40
mov rax, qword [rbp - 0x130]
add rsp, 0x158
pop rbx
pop rbp
ret
mov rax, qword [0x00424868]
lea rdx, [0x00424560]
mov rax, qword [rax]
mov qword [0x00424868], rax
mov rax, qword [0x00424860]
mov rax, qword [rax]
cmp rax, rdx
je 0x410ea2
nop word [rax + rax]
test rax, rax
je 0x410f40
mov rax, qword [rax + 0x18]
cmp rax, rdx
jne 0x410e90
mov rbx, qword [0x004245a0]
mov qword [rbp - 0x110], 0
mov rcx, rbx
call fcn.00401a70
test al, al
je 0x410f20
lea rcx, [0x0041d610]
mov qword [rbp - 0x120], 0
call fcn.0040cf10
lea r8, [rbp - 0x120]
mov rcx, rbx
lea rdx, [0x0041d640]
mov qword [rbp - 0x120], rax
call fcn.0040f420
lea rcx, [0x00424860]
mov qword [rbp - 0x130], rax
mov rax, qword [0x00424860]
mov rdx, qword [rax + 0x28]
call fcn.00405860
jmp 0x410e32
lea rcx, [0x0041d5e0]
xor edx, edx
call fcn.0040dff0
nop
xor ecx, ecx
call fcn.00410310
jmp 0x410d95
call fcn.0040e370
nop
nop word cs:[rax + rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rcx, [0x00424500]
mov edx, 0x3f8
call fcn.00407850
mov edx, 0x1aa4256a
lea rcx, [0x0041cdc0]
mov rsi, rax
lea rax, [0x004244c0]
mov qword [rsi], rax
call fcn.004077c0
mov edx, 0x40e0d5ee
mov rcx, rax
call fcn.00407ad0
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [0x004244b0]
mov r8d, 0x1000
mov edx, 8
mov rcx, rax
call qword [0x004244a8]
mov edx, 0x5a66e5ce
mov dword [rsp + 0x30], 0
lea rbp, [rax + 0x17]
mov rbx, rax
mov qword [0x004244a0], rax
lea rdi, [rax + 0x2e]
mov qword [0x00424498], rbp
lea rcx, [0x0041cd80]
mov qword [0x00424490], rdi
call fcn.004077c0
mov edx, 0xff0c5aa
mov rcx, rax
call fcn.00407ad0
lea rcx, [section..rdata]
test rax, rax
je 0x411016
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rbx
call fcn.004084d0
mov edx, 0x1dfbc34a
lea rcx, [0x0041cd40]
call fcn.004077c0
mov edx, 0x42072a8e
mov rcx, rax
call fcn.00407ad0
lea rcx, [section..rdata]
test rax, rax
je 0x411054
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rbp
call fcn.004084d0
mov edx, 0x7d546d6e
lea rcx, [0x0041cd00]
call fcn.004077c0
mov edx, 0x7f47fd8a
mov rcx, rax
call fcn.00407ad0
lea rcx, [section..rdata]
test rax, rax
je 0x411092
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.004084d0
mov edx, 0x39e8442a
lea rcx, [0x0041ccd0]
call fcn.004077c0
mov edx, 0x6854202e
mov rcx, rax
call fcn.00407ad0
lea rdx, [rbx + 0xa1]
lea rcx, [section..rdata]
test rax, rax
je 0x4110d7
cmp qword [rax], 0
lea r8, [rax + 0x10]
cmovne rcx, r8
call fcn.004084d0
mov r8d, 0x20
mov rcx, rbx
lea r9, [rsp + 0x30]
mov edx, 0x17
call qword [0x00424488]
mov edx, 0x52a34e0e
lea rcx, [0x0041cb00]
call fcn.004077c0
mov edx, 0x6a6ea86a
mov rcx, rax
call fcn.00407ad0
mov edx, 0x2513e00a
lea rcx, [0x0041ca60]
call fcn.004077c0
mov edx, 0x76331ece
mov rcx, rax
call fcn.00407ad0
mov r8d, 0x3c8
xor edx, edx
lea rcx, [rsi + 0x30]
call sub.msvcrt.dll_memset
mov edx, 0x60797e4a
mov qword [rsi + 0x10], 0
lea rcx, [0x0041c9c0]
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 0
call fcn.00407ad0
mov edx, 0x2941ce6e
lea rcx, [0x0041c800]
call fcn.00407ad0
mov edx, 0x6097f72a
lea rcx, [0x0041c6a0]
call fcn.00407ad0
mov edx, 0x393a170e
lea rcx, [0x0041c620]
call fcn.00407ad0
mov edx, 0x24724b0a
lea rcx, [0x0041c4e0]
call fcn.00407ad0
call fcn.00409930
mov edx, 0x79eacf2e
xor ecx, ecx
call fcn.004077c0
mov rcx, rax
call fcn.00410310
mov ecx, 0x5dc
call qword [0x00424480]
call fcn.00409380
mov edx, 0x7c8cd1ae
lea rcx, [0x0041c400]
call fcn.00407ad0
mov edx, 0x3fae14ea
lea rcx, [0x0041c2e0]
call fcn.00407ad0
mov edx, 0x290aec4e
lea rcx, [0x0041c1e0]
call fcn.00407ad0
mov rbx, qword [0x00424478]
xor eax, eax
test rbx, rbx
je 0x411224
mov rax, qword [rbx]
lea rbp, [rsp + 0x40]
xor r8d, r8d
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], 0
lea rdi, [rsp + 0x38]
mov r9, rbp
mov qword [rsp + 0x40], rax
mov rdx, rdi
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
call qword [0x00424490]
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
lea r8, [rbx + 0x10]
mov qword [rsp + 0x48], 0
lea r9, [rax - 1]
call qword [0x00424498]
mov rax, qword [rsp + 0x38]
mov rcx, rsi
mov qword [0x00424470], rax
mov qword [0x00424468], rax
call fcn.0040ada0
lea rax, [rsp + 0x34]
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, 0xffffffffffffffff
call qword [0x004244a0]
test eax, eax
jne 0x4112ff
call qword [rsp + 0x38]
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [0x00424460]
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word [rax + rax]
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x00432360]
cmp rax, 0xdab
jg 0x411d6d
lea rcx, [rax + 1]
lea rdx, [0x0042b600]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
lea rsi, [0x00405cc0]
mov qword [rdx + rax*8], rsi
je 0x411d6d
lea rsi, [0x00405cb0]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 2]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405ca0]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 3]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405c90]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 4]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rbx, [0x00405c80]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 5]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405c70]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 6]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rbx, [0x00405c60]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 7]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405c50]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 8]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rbx, [0x00405c40]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 9]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405c30]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 0xa]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rbx, [0x00405c10]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 0xb]
cmp rcx, 0xdac
mov qword [0x00432360], rcx
je 0x411d6d
lea rsi, [0x00405c20]
add rax, 0xc
mov qword [rsp + 0x20], 0
mov qword [rdx + rcx*8], rsi
lea rcx, [0x00420140]
mov qword [0x00432360], rax
lea rsi, [rsp + 0x28]
call qword [0x00424160]
mov rcx, rsi
mov qword [rsp + 0x28], 0
movsxd rdx, eax
call fcn.00409d30
mov rax, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.0040d3b0
mov eax, dword [0x00420144]
cmp eax, 6
je 0x411b70
cmp eax, 5
jg 0x411528
mov dword [0x00424550], 1
lea rcx, [0x0041bfa0]
mov edx, 0x466e6bae
call fcn.004077c0
mov edx, 0x70b2aa0e
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420130]
mov rdx, rax
call fcn.00405860
mov rbx, qword [0x00420128]
mov rcx, qword [0x00420130]
call fcn.00407530
test rbx, rbx
mov qword [0x00420128], rax
je 0x41158e
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rbx - 0x10], rax
jbe 0x411ba0
lea rcx, [0x00424420]
mov edx, 0x483
call fcn.0040acc0
mov r8d, 0x483
lea rcx, [rax + 0x10]
mov rbx, rax
lea rdx, [0x0041bb10]
call sub.msvcrt.dll_memcpy
lea rcx, [0x00424478]
mov rdx, rbx
call fcn.00405860
mov rax, qword [0x00424478]
xor edx, edx
test rax, rax
je 0x4115d8
mov rdx, qword [rax]
lea rcx, [0x00424420]
call fcn.0040acc0
lea rcx, [0x00420120]
mov rdx, rax
call fcn.00405860
mov edx, 0x6cdc518a
lea rcx, [0x0041ba80]
call fcn.004077c0
mov edx, 0x5b9551ee
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420118]
mov rdx, rax
call fcn.00405860
mov edx, 0x344d1c6a
lea rcx, [0x0041ba20]
call fcn.004077c0
mov edx, 0x3126068e
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420110]
mov rdx, rax
call fcn.00405860
mov edx, 0x3f63bace
lea rcx, [0x0041b960]
call fcn.004077c0
mov edx, 0x6cdc518a
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420108]
mov rdx, rax
call fcn.00405860
mov edx, 0x1089ca6e
lea rcx, [0x0041b860]
call fcn.004077c0
mov edx, 0x344d1c6a
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420100]
mov rdx, rax
call fcn.00405860
lea rcx, [0x0041b840]
call fcn.00409290
xor edx, edx
mov rcx, rax
call fcn.00407cf0
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00408980
lea rcx, [0x0041b840]
mov qword [0x00424540], rax
call fcn.00409290
xor edx, edx
mov rcx, rax
call fcn.00407cf0
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call fcn.00408980
mov edx, 0x23f06f4e
lea rcx, [0x0041b7e0]
mov qword [0x00424548], rax
call fcn.004077c0
mov edx, 0x23bd1f0a
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x004200f8]
mov rdx, rax
call fcn.00405860
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetCurrentProcessId
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200f0], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.VirtualProtect
mov rcx, rax
call fcn.00408cf0
mov qword [0x00424488], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.OpenProcess
mov rcx, rax
call fcn.00408cf0
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetProcessHeap
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200e8], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetProcAddress
mov rcx, rax
call fcn.00408cf0
lea rcx, [0x0041b840]
mov qword [0x004200e0], rax
call fcn.00409290
mov rcx, rax
call fcn.00407fb0
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rax
call fcn.00408980
mov qword [0x004200d8], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200d0], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetThreadContext
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200c8], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200c0], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.CloseHandle
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200b8], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.OpenThread
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200b0], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetCurrentThreadId
mov rcx, rax
call fcn.00408cf0
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.WaitForSingleObject
mov rcx, rax
call fcn.00408cf0
mov qword [0x00424460], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.MultiByteToWideChar
mov rcx, rax
call fcn.00408cf0
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.Sleep
mov rcx, rax
call fcn.00408cf0
mov qword [0x00424480], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetTickCount
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200a8], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.CreateFileA
mov rcx, rax
call fcn.00408cf0
mov qword [0x004200a0], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.GetFileSize
mov rcx, rax
call fcn.00408cf0
lea rcx, [0x0041b840]
mov qword [0x00420098], rax
call fcn.00409290
xor edx, edx
mov rcx, rax
call fcn.00407cf0
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call fcn.00408980
mov qword [0x00420090], rax
call fcn.004079d0
mov rcx, rax
call fcn.00407fb0
lea rdx, str.ReadFile
mov rcx, rax
call fcn.00408cf0
mov edx, 0x1a0ff9aa
lea rcx, [0x0041cf80]
mov qword [0x00420088], rax
call fcn.004077c0
mov edx, 0x2df7164e
mov rcx, rax
call fcn.00407ad0
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x411b40
call qword [0x004200e8]
mov rbx, rax
call qword [0x004200e8]
cmp dword [rbx + 0x70], 2
jne 0x411bc0
mov eax, dword [rax + 0x74]
test eax, eax
jne 0x411bc0
call fcn.00402b40
test al, al
je 0x411ade
lea rdx, [0x00401a00]
mov ecx, 1
call qword [0x00420938]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x80000003
call qword [0x00420930]
lea rcx, [0x00401a00]
call qword [0x00420928]
lea rcx, [0x0041b7c0]
mov edx, 0x31411e2a
call fcn.004077c0
xor ecx, ecx
mov rbx, rax
mov rax, qword [0x00420130]
test rax, rax
je 0x411a9c
mov rcx, qword [rax]
test rbx, rbx
je 0x411d30
add rcx, qword [rbx]
call fcn.00407a90
mov rdx, qword [0x00420130]
mov rsi, rax
test rdx, rdx
je 0x411ac4
mov rcx, rax
call fcn.00402d40
mov rdx, rbx
mov rcx, rsi
call fcn.00402d40
lea rcx, [0x00420128]
mov rdx, rsi
call fcn.00405860
lea rcx, [0x0041b6a0]
mov edx, 0x33827c0e
call fcn.004077c0
mov edx, 0x1aa4256a
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420080]
mov rdx, rax
call fcn.00405860
call qword [0x004200a8]
mov ecx, 0x5dc
mov ebx, eax
call qword [0x00424480]
call qword [0x004200a8]
sub eax, ebx
cmp eax, 0x513
jg 0x411bd0
xor ecx, ecx
call sub.msvcrt.dll_exit
nop dword [rax + rax]
lea rcx, [0x0041b420]
mov edx, 0x32086b6e
mov qword [rsp + 0x28], 0
call fcn.004077c0
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.0040d3b0
xor ecx, ecx
call sub.msvcrt.dll_exit
nop
mov eax, dword [0x00420148]
cmp eax, 2
je 0x41151e
cmp eax, 3
je 0x41151e
test eax, eax
je 0x41151e
cmp eax, 1
je 0x41151e
jmp 0x411528
lea rcx, [0x00432388]
call fcn.004057a0
jmp 0x41158e
mov ecx, 1
call sub.msvcrt.dll_exit
nop word [rax + rax]
lea rcx, [0x0041b440]
mov edx, 0x24694a0a
call fcn.004077c0
xor ecx, ecx
mov rbx, rax
mov rax, qword [0x00420128]
test rax, rax
je 0x411bf5
mov rcx, qword [rax]
test rbx, rbx
je 0x411d50
add rcx, qword [rbx]
call fcn.00407a90
mov rdx, qword [0x00420128]
mov rsi, rax
test rdx, rdx
je 0x411c1d
mov rcx, rax
call fcn.00402d40
mov rdx, rbx
mov rcx, rsi
call fcn.00402d40
lea rcx, [0x00420128]
mov rdx, rsi
call fcn.00405860
mov edx, 0x5bbf8dae
lea rcx, [0x0041b540]
call fcn.004077c0
mov edx, 0x5a66e5ce
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420078]
mov rdx, rax
call fcn.00405860
mov edx, 0x25e7be2e
lea rcx, [0x0041b520]
call fcn.004077c0
mov edx, 0x6849afae
mov rcx, rax
call fcn.00407ad0
lea rcx, [section..rdata]
test rax, rax
je 0x411c9a
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call qword [0x004200d0]
mov edx, 0x59d0626a
lea rcx, [0x0041b4e0]
mov rbx, rax
call fcn.004077c0
mov edx, 0x59ff8eea
mov rcx, rax
call fcn.00407ad0
lea rdx, [section..rdata]
test rax, rax
je 0x411cd9
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, rbx
call qword [0x004200e0]
mov qword [0x00420070], rax
call 0x410f50
call 0x410f50
mov edx, 0x6849afae
lea rcx, [0x0041b460]
call fcn.004077c0
mov edx, 0x735ba4aa
mov rcx, rax
call fcn.00407ad0
lea rcx, [0x00420068]
mov rdx, rax
call fcn.00405860
nop
add rsp, 0x38
pop rbx
pop rsi
ret
call fcn.00407a90
mov rdx, qword [0x00420130]
mov rsi, rax
test rdx, rdx
jne 0x411ac7
jmp 0x411acf
call fcn.00407a90
mov rdx, qword [0x00420128]
mov rsi, rax
test rdx, rdx
jne 0x411c20
jmp 0x411c28
call fcn.00402ff0
nop
nop dword [rax]
nop word cs:[rax + rax]