Function at 0x140049c70
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp byte [0x140081450], 0
mov r14, rcx
mov rbp, rdx
mov rsi, r8
je 0x140049d08
lea rdx, [0x14007360a]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14004a6e0
mov rbx, qword [0x140081448]
jmp 0x140049cbd
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov edi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test edi, edi
jne 0x140049cb8
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, r14
mov rdx, rbp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400480d0
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12d, dword [rax + 4]
lea r8, [rax + 8]
mov ebx, dword [rax]
mov eax, 0xffffffff
mov qword [0x140081448], r8
cmp r12, 0x2e
jbe 0x14004a37e
test r8b, 7
je 0x14004a780
mov ecx, 0xffffffff
lea r13, [0x140075760]
jmp 0x140049d7a
test r8b, 7
je 0x14004a748
add r8, 1
mov eax, ecx
xor cl, byte [r8 - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [r13 + rcx*4]
mov ecx, eax
sub r12, 1
jne 0x140049d70
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x28], r12
mov r15, r8
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x30], r8
xor r10d, r10d
xor r11d, r11d
lea rax, [0x140073760]
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x48], r14
mov r14, rdi
nop dword [rax + rax]
xor rcx, qword [r15]
xor r9, qword [r15 + 0x18]
add r15, 0x28
mov rbx, qword [r15 - 8]
mov r8, r9
mov r9, rcx
movzx esi, ch
shr r9, 0x38
xor r11, qword [r15 - 0x20]
mov rdi, qword [r15 - 0x18]
xor rbx, rdx
movzx edx, cl
mov r12, r11
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r9*4 + 0x1c00]
mov r9, rcx
xor rdi, r10
shr r9, 0x10
xor edx, dword [rax + rsi*4 + 0x400]
movzx esi, bh
movzx r9d, r9b
xor edx, dword [rax + r9*4 + 0x800]
mov r9, rcx
shr r9, 0x18
movzx r9d, r9b
xor edx, dword [rax + r9*4 + 0xc00]
mov r9, rcx
shr r9, 0x20
movzx r9d, r9b
xor edx, dword [rax + r9*4 + 0x1000]
mov r9, rcx
shr rcx, 0x30
shr r9, 0x28
movzx ecx, cl
movzx r9d, r9b
xor edx, dword [rax + r9*4 + 0x1400]
xor edx, dword [rax + rcx*4 + 0x1800]
movzx r9d, r11b
mov ecx, edx
mov rdx, r11
mov r11d, dword [rax + r9*4]
movzx r9d, dil
shr rdx, 0x38
mov r10d, dword [rax + r9*4]
movzx r9d, r8b
xor r11d, dword [rax + rdx*4 + 0x1c00]
mov rdx, r12
mov r9d, dword [rax + r9*4]
movzx edx, dh
xor r11d, dword [rax + rdx*4 + 0x400]
mov rdx, r12
shr rdx, 0x10
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x800]
mov rdx, r12
shr rdx, 0x18
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0xc00]
mov rdx, r12
shr rdx, 0x20
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1000]
mov rdx, r12
shr r12, 0x30
shr rdx, 0x28
movzx r12d, r12b
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1400]
mov rdx, rdi
xor r11d, dword [rax + r12*4 + 0x1800]
shr rdx, 0x38
xor r10d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rdi
movzx edx, dh
xor r10d, dword [rax + rdx*4 + 0x400]
mov rdx, rdi
shr rdx, 0x10
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x800]
mov rdx, rdi
shr rdx, 0x18
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0xc00]
mov rdx, rdi
shr rdx, 0x20
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1000]
mov rdx, rdi
shr rdi, 0x30
shr rdx, 0x28
movzx edi, dil
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1400]
mov rdx, r8
xor r10d, dword [rax + rdi*4 + 0x1800]
shr rdx, 0x38
xor r9d, dword [rax + rdx*4 + 0x1c00]
mov rdx, r8
movzx edx, dh
xor r9d, dword [rax + rdx*4 + 0x400]
mov rdx, r8
shr rdx, 0x10
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x800]
mov rdx, r8
shr rdx, 0x18
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0xc00]
mov rdx, r8
shr rdx, 0x20
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1000]
mov rdx, r8
shr r8, 0x30
shr rdx, 0x28
movzx r8d, r8b
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1400]
xor r9d, dword [rax + r8*4 + 0x1800]
mov r8, rbx
movzx edx, bl
shr r8, 0x38
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rbx
xor edx, dword [rax + rsi*4 + 0x400]
shr r8, 0x10
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rbx
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rbx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rbx
shr rbx, 0x30
shr r8, 0x28
movzx ebx, bl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
xor edx, dword [rax + rbx*4 + 0x1800]
sub r14, 1
jne 0x140049dd8
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x3c]
lea rax, [rdi + rdi*4]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x20]
mov edi, r11d
lea r8, [r8 + rax*8]
mov eax, ecx
xor rax, qword [r8]
xor rdi, qword [r8 + 8]
movzx ecx, al
shr rax, 8
mov ecx, dword [r13 + rcx*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdi, rax
movzx eax, dil
shr rdi, 8
mov eax, dword [r13 + rax*4]
xor rax, rdi
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor r10, qword [r8 + 0x10]
xor r9, qword [r8 + 0x18]
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor r10, rax
movzx eax, r10b
shr r10, 8
mov eax, dword [r13 + rax*4]
xor rax, r10
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor r9, rax
movzx eax, r9b
shr r9, 8
mov eax, dword [r13 + rax*4]
xor rax, r9
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, qword [r8 + 0x20]
add r8, 0x28
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, rax
movzx eax, dl
shr rdx, 8
mov eax, dword [r13 + rax*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r13 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r13 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r13 + rdx*4]
cmp r12, 7
jbe 0x14004a62b
mov ecx, eax
xor al, byte [r8]
lea rdx, [0x140075760]
movzx eax, al
shr ecx, 8
lea r9, [r12 - 8]
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 1]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 3]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 5]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 6]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 7]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
cmp r9, 7
jbe 0x14004a61e
mov ecx, eax
xor al, byte [r8 + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 9]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0xa]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0xb]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0xc]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0xd]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0xe]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0xf]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [r12 - 0x10]
cmp rcx, 7
jbe 0x14004a61e
mov ecx, eax
xor al, byte [r8 + 0x10]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x11]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x12]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x13]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x14]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x15]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x16]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x17]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [r12 - 0x18]
cmp rcx, 7
jbe 0x14004a61e
mov ecx, eax
xor al, byte [r8 + 0x18]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x19]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x1a]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x1b]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x1c]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x1d]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x1e]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x1f]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [r12 - 0x20]
cmp rcx, 7
jbe 0x14004a61e
mov ecx, eax
xor al, byte [r8 + 0x20]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x21]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x22]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x23]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x24]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x25]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r8 + 0x26]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r8 + 0x27]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
shr r9, 3
and r12d, 7
lea r8, [r8 + r9*8 + 8]
test r12, r12
je 0x14004a6c9
mov ecx, eax
xor al, byte [r8]
lea rdx, [0x140075760]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 1
je 0x14004a6c9
xor al, byte [r8 + 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 2
je 0x14004a6c9
xor al, byte [r8 + 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 3
je 0x14004a6c9
xor al, byte [r8 + 3]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 4
je 0x14004a6c9
xor al, byte [r8 + 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 5
je 0x14004a6c9
xor al, byte [r8 + 5]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp r12, 6
je 0x14004a6c9
xor al, byte [r8 + 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
not eax
cmp ebx, eax
jne 0x14004a7b6
mov byte [0x140081450], 1
jmp 0x140049c92
cmp byte [0x140081440], 0
jne 0x140049ca9
mov rbx, qword [sym.imp.python312.dll_PyDict_New]
call rbx
mov qword [0x140081498], rax
call rbx
mov qword [0x140081490], rax
call rbx
mov qword [0x140081488], rax
call rbx
mov qword [0x1400814c8], rax
call rbx
mov qword [0x1400814c0], rax
call rbx
mov qword [0x1400814b8], rax
call rbx
mov qword [0x1400814a8], rax
call rbx
mov byte [0x140081440], 1
mov qword [0x1400814a0], rax
jmp 0x140049ca9
movabs rax, 0xcccccccccccccccd
mul r12
shr rdx, 5
lea rax, [rdx + rdx*4]
lea rdi, [rdx - 1]
shl rax, 3
sub r12, rax
mov eax, ecx
test rdi, rdi
jne 0x140049d9e
xor edx, edx
xor r9d, r9d
xor r10d, r10d
jmp 0x14004a09a
movabs rax, 0xcccccccccccccccd
mov ecx, 0xffffffff
lea r13, [0x140075760]
mul r12
mov rax, rdx
shr rax, 5
lea rdx, [rax + rax*4]
lea rdi, [rax - 1]
mov eax, 0xffffffff
shl rdx, 3
sub r12, rdx
jmp 0x14004a76a
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]