Function at 0x1400264a0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp byte [0x140057400], 0
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x140026560
lea rdx, [0x14004b69a]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140026908
mov rbp, qword [0x1400573f8]
jmp 0x1400264f5
lea rbp, [r8 + rax + 4]
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_strcmp
mov rcx, rbp
mov r12d, eax
call sub.msvcrt.dll_strlen
lea r8, [rbp + rax + 1]
mov eax, dword [r8]
test r12d, r12d
jne 0x1400264f0
movzx edx, word [r8 + 4]
add r8, 6
lea rsi, [rbx + rdx*8]
test dx, dx
je 0x140026547
nop word [rax + rax]
mov rdx, rbx
mov rcx, rdi
add rbx, 8
call fcn.140024b50
mov r8, rax
cmp rbx, rsi
jne 0x140026530
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, dword [rax + 4]
lea r9, [rax + 8]
mov r14d, dword [rax]
mov eax, 0xffffffff
mov qword [0x1400573f8], r9
cmp rbp, 0x2e
ja 0x140026998
cmp rbp, 7
jbe 0x14002684f
mov ecx, eax
lea rdx, [0x14004d7c0]
lea r8, [rbp - 8]
xor al, byte [r9]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 1]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 3]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 5]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 6]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 7]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
cmp r8, 7
jbe 0x140026843
mov ecx, eax
xor al, byte [r9 + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 9]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0xa]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0xb]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0xc]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0xd]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0xe]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0xf]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x10]
cmp rcx, 7
jbe 0x140026843
mov ecx, eax
xor al, byte [r9 + 0x10]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x11]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x12]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x13]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x14]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x15]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x16]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x17]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x18]
cmp rcx, 7
jbe 0x140026843
mov ecx, eax
xor al, byte [r9 + 0x18]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x19]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x1a]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x1b]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x1c]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x1d]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x1e]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x1f]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
lea rcx, [rbp - 0x20]
cmp rcx, 7
jbe 0x140026843
mov ecx, eax
xor al, byte [r9 + 0x20]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x21]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x22]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x23]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x24]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x25]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
mov ecx, eax
xor al, byte [r9 + 0x26]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
xor cl, byte [r9 + 0x27]
movzx ecx, cl
shr eax, 8
xor eax, dword [rdx + rcx*4]
and r8, 0xfffffffffffffff8
and ebp, 7
lea r9, [r9 + r8 + 8]
test rbp, rbp
je 0x1400268ed
mov ecx, eax
xor al, byte [r9]
lea rdx, [0x14004d7c0]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 1
je 0x1400268ed
xor al, byte [r9 + 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 2
je 0x1400268ed
xor al, byte [r9 + 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 3
je 0x1400268ed
xor al, byte [r9 + 3]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 4
je 0x1400268ed
xor al, byte [r9 + 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 5
je 0x1400268ed
xor al, byte [r9 + 5]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
cmp rbp, 6
je 0x1400268ed
xor al, byte [r9 + 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov eax, ecx
not eax
cmp r14d, eax
jne 0x14002701d
mov byte [0x140057400], 1
jmp 0x1400264c6
cmp byte [0x1400573f0], 0
jne 0x1400264dd
mov rbp, qword [sym.imp.python39.dll_PyDict_New]
call rbp
mov qword [0x140057448], rax
call rbp
mov qword [0x140057440], rax
call rbp
mov qword [0x140057438], rax
call rbp
mov qword [0x140057478], rax
call rbp
mov qword [0x140057470], rax
call rbp
mov qword [0x140057468], rax
call rbp
mov qword [0x140057458], rax
call rbp
mov rdx, qword [0x14004f440]
mov byte [0x1400573f0], 1
mov qword [0x140057450], rax
mov rax, qword [sym.imp.python39.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rax, qword [rax + 0x10]
add rax, 0xdc0
mov qword [rdx], rax
jmp 0x1400264dd
mov ecx, 0xffffffff
lea r12, [0x14004d7c0]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word [rax + rax]
test r9b, 7
je 0x140026fdf
add r9, 1
mov eax, ecx
xor cl, byte [r9 - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [r12 + rcx*4]
mov ecx, eax
sub rbp, 1
jne 0x1400269c0
mov qword [rsp + 0x28], 0xffffffffffffffff
mov r11, r9
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x40], rbp
xor r13d, r13d
xor edx, edx
xor r10d, r10d
mov dword [rsp + 0x34], r14d
mov r14, qword [rsp + 0x28]
xor r8d, r8d
lea rax, [0x14004b7c0]
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x38], r15
mov r15, rbx
mov qword [rsp + 0x48], r11
mov r11d, r13d
nop word [rax + rax]
mov rbx, qword [r9 + 0x20]
mov ecx, ecx
mov r8d, r8d
xor rcx, qword [r9]
xor r8, qword [r9 + 0x10]
mov edx, edx
movzx esi, ch
mov r11d, r11d
mov rbp, r8
mov r8, rcx
xor rbx, rdx
movzx edx, cl
shr r8, 0x38
mov edx, dword [rax + rdx*4]
xor r11, qword [r9 + 8]
mov r10d, r10d
xor edx, dword [rax + r8*4 + 0x1c00]
mov r8, rcx
mov r13, r11
mov rdi, qword [r9 + 0x18]
shr r8, 0x10
xor edx, dword [rax + rsi*4 + 0x400]
add r9, 0x28
movzx r8d, r8b
xor rdi, r10
xor edx, dword [rax + r8*4 + 0x800]
mov r8, rcx
movzx r10d, dil
shr r8, 0x18
mov r10d, dword [rax + r10*4]
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0xc00]
mov r8, rcx
shr r8, 0x20
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1000]
mov r8, rcx
shr rcx, 0x30
shr r8, 0x28
movzx ecx, cl
movzx r8d, r8b
xor edx, dword [rax + r8*4 + 0x1400]
xor edx, dword [rax + rcx*4 + 0x1800]
movzx r8d, r11b
mov ecx, edx
mov rdx, r11
mov r11d, dword [rax + r8*4]
movzx r8d, bpl
shr rdx, 0x38
mov r8d, dword [rax + r8*4]
xor r11d, dword [rax + rdx*4 + 0x1c00]
mov rdx, r13
movzx edx, dh
xor r11d, dword [rax + rdx*4 + 0x400]
mov rdx, r13
shr rdx, 0x10
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x800]
mov rdx, r13
shr rdx, 0x18
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0xc00]
mov rdx, r13
shr rdx, 0x20
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1000]
mov rdx, r13
shr r13, 0x30
shr rdx, 0x28
movzx r13d, r13b
movzx edx, dl
xor r11d, dword [rax + rdx*4 + 0x1400]
mov rdx, rbp
xor r11d, dword [rax + r13*4 + 0x1800]
shr rdx, 0x38
xor r8d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rbp
movzx edx, dh
xor r8d, dword [rax + rdx*4 + 0x400]
mov rdx, rbp
shr rdx, 0x10
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x800]
mov rdx, rbp
shr rdx, 0x18
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0xc00]
mov rdx, rbp
shr rdx, 0x20
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1000]
mov rdx, rbp
shr rbp, 0x30
shr rdx, 0x28
movzx ebp, bpl
movzx edx, dl
xor r8d, dword [rax + rdx*4 + 0x1400]
mov rdx, rdi
xor r8d, dword [rax + rbp*4 + 0x1800]
shr rdx, 0x38
xor r10d, dword [rax + rdx*4 + 0x1c00]
mov rdx, rdi
movzx edx, dh
xor r10d, dword [rax + rdx*4 + 0x400]
mov rdx, rdi
shr rdx, 0x10
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x800]
mov rdx, rdi
shr rdx, 0x18
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0xc00]
mov rdx, rdi
shr rdx, 0x20
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1000]
mov rdx, rdi
shr rdi, 0x30
shr rdx, 0x28
movzx edi, dil
movzx edx, dl
xor r10d, dword [rax + rdx*4 + 0x1400]
xor r10d, dword [rax + rdi*4 + 0x1800]
mov rdi, rbx
movzx edx, bl
shr rdi, 0x38
mov edx, dword [rax + rdx*4]
xor edx, dword [rax + rdi*4 + 0x1c00]
movzx edi, bh
xor edx, dword [rax + rdi*4 + 0x400]
mov rdi, rbx
shr rdi, 0x10
movzx edi, dil
xor edx, dword [rax + rdi*4 + 0x800]
mov rdi, rbx
shr rdi, 0x18
movzx edi, dil
xor edx, dword [rax + rdi*4 + 0xc00]
mov rdi, rbx
shr rdi, 0x20
movzx edi, dil
xor edx, dword [rax + rdi*4 + 0x1000]
mov rdi, rbx
shr rbx, 0x30
shr rdi, 0x28
movzx ebx, bl
movzx edi, dil
xor edx, dword [rax + rdi*4 + 0x1400]
xor edx, dword [rax + rbx*4 + 0x1800]
sub r14, 1
jne 0x140026a40
mov rbx, r15
mov r15, qword [rsp + 0x38]
mov r13d, r11d
mov r11, qword [rsp + 0x48]
mov r14d, dword [rsp + 0x34]
mov rbp, qword [rsp + 0x40]
lea rax, [r15 + r15*4]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb0]
lea r9, [r11 + rax*8]
mov eax, r13d
mov qword [rsp + 0x28], rax
xor rcx, qword [r9]
movzx eax, cl
shr rcx, 8
mov eax, dword [r12 + rax*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov r11d, dword [r12 + rax*4]
shr rcx, 8
mov rax, qword [rsp + 0x28]
xor rax, qword [r9 + 8]
xor rcx, r11
xor rax, rcx
movzx ecx, al
shr rax, 8
mov ecx, dword [r12 + rcx*4]
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor r8, qword [r9 + 0x10]
xor r10, qword [r9 + 0x18]
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor r8, rax
movzx eax, r8b
shr r8, 8
mov eax, dword [r12 + rax*4]
xor rax, r8
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor r10, rax
movzx eax, r10b
shr r10, 8
mov eax, dword [r12 + rax*4]
xor rax, r10
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, qword [r9 + 0x20]
add r9, 0x28
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rcx, 8
xor rax, rcx
xor rdx, rax
movzx eax, dl
shr rdx, 8
mov eax, dword [r12 + rax*4]
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rdx, rax
movzx eax, al
mov eax, dword [r12 + rax*4]
shr rdx, 8
xor rax, rdx
mov rcx, rax
movzx eax, al
mov edx, dword [r12 + rax*4]
shr rcx, 8
xor rdx, rcx
mov rax, rdx
movzx edx, dl
shr rax, 8
xor eax, dword [r12 + rdx*4]
jmp 0x1400265a7
movabs rax, 0xcccccccccccccccd
mov r11, r9
mul rbp
shr rdx, 5
lea rax, [rdx + rdx*4]
shl rax, 3
sub rbp, rax
sub rdx, 1
mov qword [rsp + 0x28], rdx
mov r15, rdx
jne 0x1400269f9
xor edx, edx
xor r10d, r10d
xor r8d, r8d
jmp 0x140026d1a
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop