Function at 0x140004000
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with md5
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x420], rbx
mov rax, qword [0x14024f530]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov r15d, r8d
mov ebx, edx
mov qword [rsp + 0x28], rcx
call fcn.140058dec
mov rdi, qword [rax + 0x18]
test rdi, rdi
jne 0x140004057
or rax, 0xffffffffffffffff
jmp 0x140004773
movzx edx, bx
lea r8, str.SKIN
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000407a
lea eax, [rbx - 2]
jmp 0x140004773
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x140004096
lea eax, [rsi - 3]
jmp 0x140004773
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov byte [rsp + 0x190], 0x44
mov byte [rsp + 0x191], 0x33
mov byte [rsp + 0x192], 0x66
mov byte [rsp + 0x193], 0x61
mov byte [rsp + 0x194], 0x55
mov byte [rsp + 0x195], 0x6c
mov byte [rsp + 0x196], 0x74
mov byte [rsp + 0x197], 0x30
mov byte [rsp + 0x198], 0
xor eax, eax
mov qword [rsp + 0x199], rax
mov dword [rsp + 0x1a1], eax
mov word [rsp + 0x1a5], ax
mov byte [rsp + 0x1a7], al
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
xor ebp, ebp
mov dword [rsp + 0x84], ebp
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x70], 0x67452301
mov dword [rsp + 0x74], 0xefcdab89
mov dword [rsp + 0x78], 0x98badcfe
mov dword [rsp + 0x7c], 0x10325476
lea r8d, [rax + 8]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140002230
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
call fcn.140002340
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xd0]
call section..text
lea rdx, [rsp + 0x180]
mov rax, qword [r14 + 7]
mov qword [rdx], rax
mov rax, qword [r14 + 0xf]
mov qword [rdx + 8], rax
mov ecx, 0xa000
call fcn.1400071f8
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14000420a
lea eax, [rbp - 3]
jmp 0x140004773
movsx ebx, word [r14 + 0x18]
lea eax, [rbx + 1]
movsxd rcx, eax
call fcn.1400071f8
mov rdi, rax
test rax, rax
jne 0x14000422a
lea eax, [rdi - 3]
jmp 0x140004773
movsx r13, bx
mov qword [rsp + 0x38], r13
lea rdx, [r14 + 0x1a]
mov r8, r13
mov rcx, rax
call fcn.140184df0
mov byte [r13 + rdi], bpl
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
mov r12d, eax
mov ecx, eax
call fcn.1400071f8
mov rbx, rax
test rax, rax
jne 0x140004279
mov rcx, rdi
call fcn.1400071f0
lea eax, [rbx - 3]
jmp 0x140004773
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, rdi
call fcn.1400071f0
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x5c
jne 0x14000438f
mov rbp, rbx
xor ecx, ecx
call fcn.140182b70
mov rcx, rax
call fcn.140182b2c
call fcn.140182b44
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
inc edi
movsxd r13, edi
lea rdi, [r12 + r13]
lea rax, [rdi + 4]
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.1400071f8
mov rbx, rax
test rax, rax
jne 0x14000430d
mov rcx, rbp
call fcn.1400071f0
lea eax, [rsi - 2]
jmp 0x140004773
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1401845b0
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call fcn.140184df0
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov byte [rcx + rbx - 1], 0x5c
xor esi, esi
test r13, r13
je 0x140004372
lea r12, [rcx + rbx]
call fcn.140182b44
mov edi, eax
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub edi, edx
add dil, 0x61
mov byte [r12 + rsi], dil
inc rsi
cmp rsi, r13
jb 0x140004345
lea r8, str..eXe
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140182bd0
mov r13, qword [rsp + 0x38]
or rsi, 0xffffffffffffffff
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400060b0
nop
mov rcx, rbx
call fcn.1400071f0
test rbp, rbp
je 0x1400043c3
mov rcx, rbp
call fcn.1400071f0
test r15d, r15d
je 0x140004601
mov rcx, qword [rsp + 0x20]
cmp dword [rcx - 0x10], 4
jge 0x1400043f7
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x20]
jmp 0x1400043fc
mov rbp, qword [rsp + 0x28]
cmp dword [rcx - 0x10], 0
jle 0x140004424
mov edx, 0x5c
call fcn.14018369c
test rax, rax
je 0x140004424
mov rdx, qword [rsp + 0x20]
sub rax, rdx
sar rax, 1
test eax, eax
jns 0x14000458f
xor ebx, ebx
mov word [rsp + 0x1b0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1b2]
call fcn.1401845b0
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x1b0]
call fcn.140182c5c
mov rdi, rax
lea rax, [rsp + 0x1b0]
sub rdi, rax
sar rdi, 1
inc edi
call fcn.140011920
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000449b
mov ecx, 0x80004005
call fcn.140001f40
int3
mov rax, qword [rax]
mov r8d, 2
mov edx, edi
mov rcx, r11
call qword [rax]
test rax, rax
jne 0x1400044b6
call fcn.140001d30
int3
lea rcx, [rax + 0x18]
mov qword [rsp + 0x28], rcx
test edi, edi
js 0x1400045f6
cmp edi, dword [rcx - 0xc]
jg 0x1400045f6
mov dword [rcx - 0x10], edi
movsxd rax, edi
lea rdx, [rax + rax]
mov word [rdx + rcx], bx
mov r9, rdx
lea r8, [rsp + 0x1b0]
call fcn.1401829d4
nop
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.1400067d0
mov rdx, qword [rsp + 0x28]
lea rdi, [rdx - 0x18]
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x14000456a
cmp dword [rbx + 0x10], 0
jl 0x14000455b
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x14000455b
mov rcx, rdi
call fcn.1400066b0
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000454c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x20], rax
or rsi, 0xffffffffffffffff
jmp 0x14000456a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400065c0
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000458a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x20]
jmp 0x14000458f
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp + 0x6e0]
sub rdi, 0x18
cmp rcx, rdi
je 0x140004601
cmp dword [rdi + 0x10], 0
jl 0x1400045e4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400045e4
call fcn.1400066b0
mov rsi, rax
or ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400045d3
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rbp + 0x6e0], rax
or rsi, 0xffffffffffffffff
jmp 0x140004601
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x6e0]
call fcn.1400065c0
jmp 0x140004601
mov ecx, 0x80070057
call fcn.140001f40
int3
lea rcx, [rsp + 0x48]
call fcn.1400594b0
nop
xor r9d, r9d
mov r8d, 0x1001
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.140059d8c
test eax, eax
jne 0x14000465a
lea rcx, [rsp + 0x48]
call fcn.14005985c
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140004650
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0xfffffffc
jmp 0x140004773
mov r12d, dword [r13 + r14 + 0x1a]
lea r13, [r13 + r14 + 0x1e]
mov r14, qword [rsp + 0x30]
nop dword [rax]
mov ebp, 0xa000
cmp r12d, ebp
cmovb ebp, r12d
sub r12d, ebp
mov edi, ebp
mov ebx, ebp
shr rbx, 4
test bpl, 0xf
je 0x140004690
inc rbx
xor edx, edx
mov r8d, 0xa000
mov rcx, r14
call fcn.1401845b0
mov rsi, r13
add r13, rdi
test bl, 1
jne 0x1400046b0
mov r8, rbx
jmp 0x1400046b4
lea r8, [rbx + 1]
shl r8, 4
mov rdx, rsi
lea rcx, [rsp + 0xd0]
call fcn.140001770
xor eax, eax
mov r11, rax
test rbx, rbx
je 0x140004723
mov r9, r14
lea r8, [rsi - 0x10]
nop dword [rax]
test r11b, 1
jne 0x1400046ec
lea rdi, [r8 + 0x20]
jmp 0x1400046ef
mov rdi, r8
mov rcx, r9
sub rdi, r9
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
sub al, 0x3c
xor al, 0xcb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140004700
inc r11
add r9, 0x10
add r8, 0x10
cmp r11, rbx
jb 0x1400046e0
mov r8d, ebp
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140059130
test r12d, r12d
jne 0x140004670
mov rcx, r14
call fcn.1400071f0
nop
lea rcx, [rsp + 0x48]
call fcn.14005985c
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140004771
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140182850
mov rbx, qword [rsp + 0x420]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret