Function at 0x1400040c0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with md5
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x420], rbx
mov rax, qword [0x140253530]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov r15d, r8d
mov ebx, edx
mov qword [rsp + 0x28], rcx
call fcn.14005b1a4
mov rdi, qword [rax + 0x18]
test rdi, rdi
jne 0x140004117
or rax, 0xffffffffffffffff
jmp 0x140004833
movzx edx, bx
lea r8, str.SKIN
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000413a
lea eax, [rbx - 2]
jmp 0x140004833
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x140004156
lea eax, [rsi - 3]
jmp 0x140004833
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov byte [rsp + 0x190], 0x44
mov byte [rsp + 0x191], 0x33
mov byte [rsp + 0x192], 0x66
mov byte [rsp + 0x193], 0x61
mov byte [rsp + 0x194], 0x55
mov byte [rsp + 0x195], 0x6c
mov byte [rsp + 0x196], 0x74
mov byte [rsp + 0x197], 0x30
mov byte [rsp + 0x198], 0
xor eax, eax
mov qword [rsp + 0x199], rax
mov dword [rsp + 0x1a1], eax
mov word [rsp + 0x1a5], ax
mov byte [rsp + 0x1a7], al
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
xor ebp, ebp
mov dword [rsp + 0x84], ebp
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x70], 0x67452301
mov dword [rsp + 0x74], 0xefcdab89
mov dword [rsp + 0x78], 0x98badcfe
mov dword [rsp + 0x7c], 0x10325476
lea r8d, [rax + 8]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140002280
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
call fcn.140002390
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xd0]
call section..text
lea rdx, [rsp + 0x180]
mov rax, qword [r14 + 7]
mov qword [rdx], rax
mov rax, qword [r14 + 0xf]
mov qword [rdx + 8], rax
mov ecx, 0xa000
call fcn.140009810
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400042ca
lea eax, [rbp - 3]
jmp 0x140004833
movsx ebx, word [r14 + 0x18]
lea eax, [rbx + 1]
movsxd rcx, eax
call fcn.140009810
mov rdi, rax
test rax, rax
jne 0x1400042ea
lea eax, [rdi - 3]
jmp 0x140004833
movsx r13, bx
mov qword [rsp + 0x38], r13
lea rdx, [r14 + 0x1a]
mov r8, r13
mov rcx, rax
call fcn.140187370
mov byte [r13 + rdi], bpl
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
mov r12d, eax
mov ecx, eax
call fcn.140009810
mov rbx, rax
test rax, rax
jne 0x140004339
mov rcx, rdi
call fcn.140009818
lea eax, [rbx - 3]
jmp 0x140004833
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, rdi
call fcn.140009818
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x5c
jne 0x14000444f
mov rbp, rbx
xor ecx, ecx
call fcn.140185240
mov rcx, rax
call fcn.1401851fc
call fcn.140185214
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
inc edi
movsxd r13, edi
lea rdi, [r12 + r13]
lea rax, [rdi + 4]
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.140009810
mov rbx, rax
test rax, rax
jne 0x1400043cd
mov rcx, rbp
call fcn.140009818
lea eax, [rsi - 2]
jmp 0x140004833
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140186b30
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call fcn.140187370
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov byte [rcx + rbx - 1], 0x5c
xor esi, esi
test r13, r13
je 0x140004432
lea r12, [rcx + rbx]
call fcn.140185214
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
add dil, 0x61
mov byte [r12 + rsi], dil
inc rsi
cmp rsi, r13
jb 0x140004405
lea r8, str..exe
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401852a0
mov r13, qword [rsp + 0x38]
or rsi, 0xffffffffffffffff
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140007b30
nop
mov rcx, rbx
call fcn.140009818
test rbp, rbp
je 0x140004483
mov rcx, rbp
call fcn.140009818
test r15d, r15d
je 0x1400046c1
mov rcx, qword [rsp + 0x20]
cmp dword [rcx - 0x10], 4
jge 0x1400044b7
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x20]
jmp 0x1400044bc
mov rbp, qword [rsp + 0x28]
cmp dword [rcx - 0x10], 0
jle 0x1400044e4
mov edx, 0x5c
call fcn.140185d6c
test rax, rax
je 0x1400044e4
mov rdx, qword [rsp + 0x20]
sub rax, rdx
sar rax, 1
test eax, eax
jns 0x14000464f
xor ebx, ebx
mov word [rsp + 0x1b0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1b2]
call fcn.140186b30
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x1b0]
call fcn.14018532c
mov rdi, rax
lea rax, [rsp + 0x1b0]
sub rdi, rax
sar rdi, 1
inc edi
call fcn.140013f60
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000455b
mov ecx, 0x80004005
call fcn.140001f40
int3
mov rax, qword [rax]
mov r8d, 2
mov edx, edi
mov rcx, r11
call qword [rax]
test rax, rax
jne 0x140004576
call fcn.140001d30
int3
lea rcx, [rax + 0x18]
mov qword [rsp + 0x28], rcx
test edi, edi
js 0x1400046b6
cmp edi, dword [rcx - 0xc]
jg 0x1400046b6
mov dword [rcx - 0x10], edi
movsxd rax, edi
lea rdx, [rax + rax]
mov word [rdx + rcx], bx
mov r9, rdx
lea r8, [rsp + 0x1b0]
call fcn.140184db0
nop
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140008a50
mov rdx, qword [rsp + 0x28]
lea rdi, [rdx - 0x18]
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x14000462a
cmp dword [rbx + 0x10], 0
jl 0x14000461b
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x14000461b
mov rcx, rdi
call fcn.140008930
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000460c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x20], rax
or rsi, 0xffffffffffffffff
jmp 0x14000462a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140008840
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000464a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x20]
jmp 0x14000464f
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp + 0x6e0]
sub rdi, 0x18
cmp rcx, rdi
je 0x1400046c1
cmp dword [rdi + 0x10], 0
jl 0x1400046a4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400046a4
call fcn.140008930
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140004693
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rbp + 0x6e0], rax
or rsi, 0xffffffffffffffff
jmp 0x1400046c1
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x6e0]
call fcn.140008840
jmp 0x1400046c1
mov ecx, 0x80070057
call fcn.140001f40
int3
lea rcx, [rsp + 0x48]
call fcn.14005b868
nop
xor r9d, r9d
mov r8d, 0x1001
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.14005c144
test eax, eax
jne 0x14000471a
lea rcx, [rsp + 0x48]
call fcn.14005bc14
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140004710
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0xfffffffc
jmp 0x140004833
mov r12d, dword [r13 + r14 + 0x1a]
lea r13, [r13 + r14 + 0x1e]
mov r14, qword [rsp + 0x30]
nop dword [rax]
mov ebp, 0xa000
cmp r12d, ebp
cmovb ebp, r12d
sub r12d, ebp
mov edi, ebp
mov ebx, ebp
shr rbx, 4
test bpl, 0xf
je 0x140004750
inc rbx
xor edx, edx
mov r8d, 0xa000
mov rcx, r14
call fcn.140186b30
mov rsi, r13
add r13, rdi
test bl, 1
jne 0x140004770
mov r8, rbx
jmp 0x140004774
lea r8, [rbx + 1]
shl r8, 4
mov rdx, rsi
lea rcx, [rsp + 0xd0]
call fcn.140001770
xor eax, eax
mov r11, rax
test rbx, rbx
je 0x1400047e3
mov r9, r14
lea r8, [rsi - 0x10]
nop dword [rax]
test r11b, 1
jne 0x1400047ac
lea rdi, [r8 + 0x20]
jmp 0x1400047af
mov rdi, r8
mov rcx, r9
sub rdi, r9
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
sub al, 0x3c
xor al, 0xcb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400047c0
inc r11
add r9, 0x10
add r8, 0x10
cmp r11, rbx
jb 0x1400047a0
mov r8d, ebp
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.14005b4e8
test r12d, r12d
jne 0x140004730
mov rcx, r14
call fcn.140009818
nop
lea rcx, [rsp + 0x48]
call fcn.14005bc14
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140004831
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140184d90
mov rbx, qword [rsp + 0x420]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret