Function at 0x140022e50
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [0x140055188], 0
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x140022f10
lea rdx, [0x14004901a]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400238d0
mov rbp, qword [0x140055180]
jmp 0x140022ea5
lea rbp, [r8 + rax + 4]
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcmp
mov rcx, rbp
mov r12d, eax
call sub.msvcrt.dll_strlen
lea r8, [rbp + rax + 1]
mov eax, dword [r8]
test r12d, r12d
jne 0x140022ea0
movzx edx, word [r8 + 4]
add r8, 6
lea rsi, [rbx + rdx*8]
test dx, dx
je 0x140022ef7
nop word [rax + rax]
mov rdx, rbx
mov rcx, rdi
add rbx, 8
call fcn.1400212d0
mov r8, rax
cmp rbx, rsi
jne 0x140022ee0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, dword [rax + 4]
lea r11, [rax + 8]
mov r10d, dword [rax]
mov eax, 0xffffffff
mov qword [0x140055180], r11
cmp rbp, 0x2e
jbe 0x14002356f
test r11b, 7
je 0x140023970
mov ecx, 0xffffffff
lea r12, [0x14004b160]
jmp 0x140022f7a
test r11b, 7
je 0x140023938
add r11, 1
mov eax, ecx
xor cl, byte [r11 - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [r12 + rcx*4]
mov ecx, eax
sub rbp, 1
jne 0x140022f70
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x20], rbp
mov r13, r15
mov r14, r11
xor edx, edx
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
lea rax, [0x140049160]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0x34], r10d
xor r10d, r10d
mov qword [rsp + 0x38], r15
mov r15, rbx
nop dword [rax]
xor rcx, qword [r14]
xor r8, qword [r14 + 8]
add r14, 0x28
mov rbx, qword [r14 - 8]
mov rbp, r8
mov r8, rcx
movzx esi, ch
shr r8, 0x38
mov rdi, qword [r14 - 0x18]
xor r9, qword [r14 - 0x10]
xor rbx, rdx
movzx edx, cl
mov r11, r9
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rcx
xor rdi, r10
shr r8, 0x10
xor edx, dword [rax + rsi*4 + 0x400]
movzx r9d, dil
movzx esi, bh
movzx r8d, r8b
mov r10d, dword [rax + r9*4]
movzx r9d, r11b
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rcx
mov r9d, dword [rax + r9*4]
shr r8, 0x18
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rcx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rcx
shr rcx, 0x30
shr r8, 0x28
movzx ecx, cl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
xor edx, dword [rax + rcx*4 + 0x1800]
movzx r8d, bpl
mov ecx, edx
mov rdx, rbp
mov r8d, dword [rax + r8*4]
shr rdx, 0x38
xor r8d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rbp
movzx edx, dh
xor r8d, dword [rax + rdx*4 + 0x400]
mov rdx, rbp
shr rdx, 0x10
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x800]
mov rdx, rbp
shr rdx, 0x18
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0xc00]
mov rdx, rbp
shr rdx, 0x20
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1000]
mov rdx, rbp
shr rbp, 0x30
shr rdx, 0x28
movzx ebp, bpl
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1400]
mov rdx, rdi
xor r8d, dword [rax + rbp*4 + 0x1800]
shr rdx, 0x38
xor r10d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rdi
movzx edx, dh
xor r10d, dword [rax + rdx*4 + 0x400]
mov rdx, rdi
shr rdx, 0x10
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x800]
mov rdx, rdi
shr rdx, 0x18
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0xc00]
mov rdx, rdi
shr rdx, 0x20
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1000]
mov rdx, rdi
shr rdi, 0x30
shr rdx, 0x28
movzx edi, dil
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1400]
mov rdx, r11
xor r10d, dword [rax + rdi*4 + 0x1800]
shr rdx, 0x38
xor r9d, dword [rax + rdx*4 + 0x1c00]
mov rdx, r11
movzx edx, dh
xor r9d, dword [rax + rdx*4 + 0x400]
mov rdx, r11
shr rdx, 0x10
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x800]
mov rdx, r11
shr rdx, 0x18
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0xc00]
mov rdx, r11
shr rdx, 0x20
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1000]
mov rdx, r11
shr r11, 0x30
shr rdx, 0x28
movzx r11d, r11b
movzx edx, dl
xor r9d, dword [rax + rdx*4 + 0x1400]
xor r9d, dword [rax + r11*4 + 0x1800]
mov r11, rbx
movzx edx, bl
shr r11, 0x38
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + r11*4 + 0x1c00]
mov r11, rbx
xor edx, dword [rax + rsi*4 + 0x400]
shr r11, 0x10
movzx r11d, r11b
xor edx, dword [rax + r11*4 + 0x800]
mov r11, rbx
shr r11, 0x18
movzx r11d, r11b
xor edx, dword [rax + r11*4 + 0xc00]
mov r11, rbx
shr r11, 0x20
movzx r11d, r11b
xor edx, dword [rax + r11*4 + 0x1000]
mov r11, rbx
shr rbx, 0x30
shr r11, 0x28
movzx ebx, bl
movzx r11d, r11b
xor edx, dword [rax + r11*4 + 0x1400]
xor edx, dword [rax + rbx*4 + 0x1800]
sub r13, 1
jne 0x140022fe0
mov rbx, r15
mov r15, qword [rsp + 0x38]
mov r11, qword [rsp + 0x28]
mov r14d, r10d
mov rbp, qword [rsp + 0x20]
mov r10d, dword [rsp + 0x34]
mov r13d, ecx
lea rax, [r15 + r15*4]
mov rdi, qword [rsp + 0x90]
mov r15d, r8d
mov rsi, qword [rsp + 0xa0]
lea r11, [r11 + rax*8]
mov eax, r14d
xor r13, qword [r11]
xor r15, qword [r11 + 8]
movzx ecx, r13b
shr r13, 8
mov ecx, dword [r12 + rcx*4]
xor rcx, r13
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
xor r15, rcx
movzx ecx, r15b
shr r15, 8
mov ecx, dword [r12 + rcx*4]
xor rcx, r15
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
xor rax, qword [r11 + 0x10]
xor r9, qword [r11 + 0x18]
mov r8, rcx
movzx ecx, cl
mov ecx, dword [r12 + rcx*4]
shr r8, 8
xor rcx, r8
xor rax, rcx
movzx ecx, al
shr rax, 8
mov ecx, dword [r12 + rcx*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor r9, rax
movzx eax, r9b
shr r9, 8
mov eax, dword [r12 + rax*4]
xor rax, r9
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, qword [r11 + 0x20]
add r11, 0x28
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, rax
movzx eax, dl
shr rdx, 8
mov eax, dword [r12 + rax*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r12 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r12 + rdx*4]
cmp rbp, 7
jbe 0x140023817
mov ecx, eax
lea rdx, [0x14004b160]
lea r8, [rbp - 8]
xor al, byte [r11]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 1]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 3]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 5]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 6]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 7]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
cmp r8, 7
jbe 0x14002380b
mov ecx, eax
xor al, byte [r11 + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 9]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0xa]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0xb]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0xc]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0xd]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0xe]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0xf]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x10]
cmp rcx, 7
jbe 0x14002380b
mov ecx, eax
xor al, byte [r11 + 0x10]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x11]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x12]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x13]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x14]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x15]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x16]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x17]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x18]
cmp rcx, 7
jbe 0x14002380b
mov ecx, eax
xor al, byte [r11 + 0x18]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x19]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x1a]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x1b]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x1c]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x1d]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x1e]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x1f]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x20]
cmp rcx, 7
jbe 0x14002380b
mov ecx, eax
xor al, byte [r11 + 0x20]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x21]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x22]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x23]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x24]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x25]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r11 + 0x26]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r11 + 0x27]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
shr r8, 3
and ebp, 7
lea r11, [r11 + r8*8 + 8]
test rbp, rbp
je 0x1400238b5
mov ecx, eax
xor al, byte [r11]
lea rdx, [0x14004b160]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 1
je 0x1400238b5
xor al, byte [r11 + 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 2
je 0x1400238b5
xor al, byte [r11 + 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 3
je 0x1400238b5
xor al, byte [r11 + 3]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 4
je 0x1400238b5
xor al, byte [r11 + 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 5
je 0x1400238b5
xor al, byte [r11 + 5]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 6
je 0x1400238b5
xor al, byte [r11 + 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
not eax
cmp r10d, eax
jne 0x1400239a7
mov byte [0x140055188], 1
jmp 0x140022e76
cmp byte [0x140055178], 0
jne 0x140022e8d
mov rbp, qword [sym.imp.python311.dll_PyDict_New]
call rbp
mov qword [0x1400551d0], rax
call rbp
mov qword [0x1400551c8], rax
call rbp
mov qword [0x1400551c0], rax
call rbp
mov qword [0x140055200], rax
call rbp
mov qword [0x1400551f8], rax
call rbp
mov qword [0x1400551f0], rax
call rbp
mov qword [0x1400551e0], rax
call rbp
mov byte [0x140055178], 1
mov qword [0x1400551d8], rax
jmp 0x140022e8d
movabs rax, 0xcccccccccccccccd
mov r13d, ecx
mul rbp
shr rdx, 5
lea rax, [rdx + rdx*4]
lea r15, [rdx - 1]
shl rax, 3
sub rbp, rax
test r15, r15
jne 0x140022f9d
xor edx, edx
xor r9d, r9d
xor eax, eax
jmp 0x1400232b3
movabs rax, 0xcccccccccccccccd
mov r13d, 0xffffffff
mov ecx, 0xffffffff
mul rbp
lea r12, [0x14004b160]
mov rax, rdx
shr rax, 5
lea rdx, [rax + rax*4]
lea r15, [rax - 1]
shl rdx, 3
sub rbp, rdx
jmp 0x14002395b
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]