Function at 0x140001450
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
lea rcx, [rsp + 0x70]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x7a]
lea rcx, [rsp + 0x58]
imul esi, eax, 0x3c
add si, word [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x62]
lea rdx, str.Warte
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
imul edi, eax, 0x3c
sub di, si
add di, word [rsp + 0x64]
call fcn.140001a10
mov rcx, rax
lea edx, [r12 + 0x1e]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, str._Sekunden
call fcn.140001a10
cmp di, 0x1e
je 0x14000152f
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x58]
movzx ebx, di
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x62]
imul ecx, eax, 0x3c
sub cx, si
add cx, word [rsp + 0x64]
movzx edi, cx
cmp cx, bx
jbe 0x140001529
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x14000349c]
call fcn.140001a10
cmp di, 0x1e
jne 0x1400014f0
mov qword [rsp + 0x4e0], r13
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x4e8], r14
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x4f0], r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, 0x68
mov rcx, rax
mov rbx, rax
lea r8d, [rdx - 0x5e]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
mov edi, 1
test rax, rax
je 0x14000175a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000175a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x14000175a
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nkeySize:
mov ebx, eax
movzx esi, byte [rbx + r15 - 4]
call fcn.140001a10
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.loadSize:
sub ebx, esi
sub ebx, 4
call fcn.140001a10
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movsxd r13, ebx
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
jne 0x140001666
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.could_not_allocate_Memory_for_lpDecrypted
call fcn.140001a10
mov rcx, rax
lea rdx, [0x140001c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, edi
jmp 0x140001968
mov rcx, rsi
mov r14, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x1400016b7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.could_not_allocate_Memory_for_Key
call fcn.140001a10
mov rcx, rax
lea rdx, [0x140001c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
jmp 0x140001968
test r14, r14
je 0x1400016fa
lea rdx, [r15 + r13]
mov r8, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Key:
call fcn.140001a10
xor ebx, ebx
movzx edx, byte [rbx + rsi]
lea rcx, str._02X
call fcn.140001020
inc rbx
cmp rbx, r14
jl 0x1400016e0
jmp 0x14000170d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Key:
call fcn.140001a10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140001c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r13, r13
jle 0x14000175a
xor r8d, r8d
mov rdx, r12
sub r15, r12
nop
movzx ecx, byte [r15 + rdx]
cmp r8, r14
jge 0x140001745
lea rax, [r8 + rsi]
inc r8
xor cl, byte [rax]
jmp 0x14000174a
xor cl, byte [rsi]
mov r8, rdi
mov byte [rdx], cl
inc rdx
mov rax, rdx
sub rax, r12
cmp rax, r13
jl 0x140001730
mov rcx, r12
call fcn.140001320
mov rsi, rax
test rax, rax
jne 0x140001771
mov eax, edi
jmp 0x140001968
movsxd r15, dword [rax + 0x3c]
xor r14d, r14d
add r15, rsi
mov qword [rsp + 0x68], r14
xor r12d, r12d
cmp dword [r15 + 0x98], r12d
je 0x1400018a0
movzx edx, di
mov r8d, 0x18
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
jne 0x1400017b6
inc edi
cmp edi, 3
jle 0x140001790
jmp 0x14000184e
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, r14
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000189d
test edi, edi
je 0x14000189d
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [0x1400034a0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14000189d
lea r8, [0x1400034bc]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], r12d
jne 0x14000189d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x38
xor eax, eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x54], eax
lea rax, [rbp - 0x80]
movups xmmword [rsp + 0x24], xmm0
mov qword [rsp + 0x28], rax
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov r14, rax
test rax, rax
je 0x1400018a0
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov r12d, eax
jmp 0x1400018a0
xor r14d, r14d
mov rdx, r15
mov rcx, rsi
call fcn.140001210
mov eax, dword [r15 + 0xb0]
test eax, eax
je 0x14000193c
mov rbx, rsi
sub rbx, qword [r15 + 0x30]
je 0x14000193c
cmp dword [rsi + rax], 0
lea r10, [rsi + rax]
je 0x14000193c
mov edi, 0xf000
mov r13d, 0xa000
nop dword [rax]
mov eax, dword [r10 + 4]
lea r9, [r10 + 8]
mov r8d, 0
lea r11, [rax - 8]
shr r11, 1
je 0x140001933
nop word [rax + rax]
movzx eax, word [r9]
movzx ecx, ax
and cx, di
cmp r13w, cx
jne 0x140001920
mov edx, dword [r10]
and eax, 0xfff
lea rcx, [rsi + rax]
add qword [rdx + rcx], rbx
inc r8d
add r9, 2
movsxd rax, r8d
cmp rax, r11
jb 0x140001900
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], 0
jne 0x1400018e0
mov eax, dword [r15 + 0x28]
add rax, rsi
call rax
test r12d, r12d
je 0x140001960
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov r15, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x4e8]
mov r13, qword [rsp + 0x4e0]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140001e20
add rsp, 0x4b0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret