Function at 0x140074310
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x218
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12, qword [rsp + 0x280]
mov ebx, r9d
mov r14, r8
mov qword [rsp + 0xb0], r8
mov rdi, rdx
mov qword [rsp + 0x98], rdx
mov byte [rsp + 0x60], cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx r11d, byte [rsp + 0x60]
mov r13, rax
mov qword [rsp + 0xa0], rax
lea r8d, [rdi + r11]
lea r10d, [r12 + r11]
movzx r9d, bl
mov qword [rsp + 0xd8], 0x40
imul eax, r8d
mov rcx, qword [rsp + 0xd8]
inc eax
sub r9b, r12b
lea ebp, [rax + rax*4]
shr rcx, 0x20
add r9b, r11b
add r9b, dil
movzx eax, r12b
mov dword [rsp + 0x68], r8d
movsx edi, r9b
mov byte [rsp + 0x62], r9b
mov r15d, r12d
imul r14b
mov esi, r11d
mov dword [rsp + 0x70], r10d
imul ecx, edi
imul r15d, r11d
sub ebp, ecx
movzx ecx, al
mov al, 0x19
sub ebp, r10d
sub r15d, ebp
imul r13b
movzx edx, al
movzx eax, cl
sub dl, r9b
sub dl, 7
add dl, r10b
add dl, bpl
imul r11b
sub al, r9b
add dl, r11b
mov r9d, r15d
add dl, cl
add al, 9
movsxd rcx, r10d
add al, r8b
mov byte [rsp + 0x63], dl
movsx edx, dl
add al, r10b
mov byte [rsp + 0x61], al
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edx
lea r8, str.chard
lea rdx, str.tyvek
mov ecx, r11d
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx rdx, byte [rsp + 0x63]
mov ecx, r14d
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x68]
sub ecx, edx
lea r8d, [rax + rax*4]
movsx rax, byte [rsp + 0x62]
mov qword [rsp + 0x80], rdx
sub ecx, r8d
mov dword [rsp + 0x78], r8d
add ecx, eax
imul edi, ebp
add ecx, esi
add ecx, r13d
lea r13d, [r15 + 9]
lea edi, [rdi + rdi*8]
add r13d, ecx
sub edi, edx
sub edi, r14d
sub edi, r15d
add edi, esi
add edi, r13d
mov dword [rsp + 0x74], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x90], rax
movzx eax, byte [rsp + 0x68]
imul r15b
movzx ecx, al
movzx eax, byte [rsp + 0x70]
imul cl
movzx ecx, al
movzx eax, bpl
imul cl
movzx ecx, al
movzx eax, bl
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x60]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x63]
imul cl
movzx ecx, al
shl cl, 3
add al, cl
sub al, dil
sub al, 4
add al, r13b
movzx esi, al
mov ecx, esi
mov dword [rsp + 0x88], esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, 1
mov qword [rsp + 0xb8], rax
movzx eax, byte [rsp + 0x61]
cmp r13d, eax
jne 0x140074582
lea r8d, [rdi + 0x1b]
mov edx, 0x164
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov ecx, r15d
lea r8, str.bank
lea rdx, str.hardboard
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ebp
mov r9d, edi
mov ecx, edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, r14d
movsx r14d, byte [rsp + 0x60]
mov eax, r12d
lea rcx, str.hardboard
add r14d, 0xffffffc0
imul eax, dword [rsp + 0x68]
imul edx, ebx
lea r8d, [rax + rax*4]
sub r8d, edx
movzx edx, byte [rsp + 0x61]
sub r8d, ebp
add r8d, dword [rsp + 0x80]
add r8d, edx
movsx rdx, byte [rsp + 0x62]
add r8d, edx
add r14d, r8d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, dword [rsp + 0x74]
mov qword [rsp + 0x68], rax
cmp esi, 9
jl 0x14007460b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
sub edi, dword [rsp + 0x68]
movzx r11d, byte [rsp + 0x61]
mov r9, qword [rsp + 0x98]
movsx r10d, byte [rsp + 0x60]
mov r8, rax
mov ecx, r11d
imul ecx, esi
lea esi, [rdi + rdi*4]
add ecx, ebp
lea edx, [rcx + rcx*8]
mov rcx, qword [rsp + 0xb8]
sub esi, edx
mov rdx, qword [rsp + 0xb0]
sub esi, r9d
sub esi, ebx
sub esi, eax
movzx eax, byte [rsp + 0x90]
sub esi, r14d
sub esi, ecx
add esi, edx
add esi, r10d
mov r10, qword [rsp + 0xa8]
imul cl
lea ecx, [rax + 4]
movzx eax, r10b
add esi, r10d
add esi, r15d
imul cl
movzx edi, al
mov al, 0x1b
xor ecx, ecx
imul bpl
add dil, al
sub dil, r14b
sub dil, r12b
sub dil, r9b
sub dil, r8b
sub dil, r11b
sub dil, byte [rsp + 0x63]
dec dil
add dil, r15b
add dil, dl
add dil, byte [rsp + 0x60]
add dil, byte [rsp + 0xa0]
add dil, byte [rsp + 0x62]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
cmp byte [rsp + 0x61], dil
ja 0x1400746fb
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
mov edx, 0x39c
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x23d
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0x88]
sub r14d, dword [rsp + 0x70]
imul r12d, dword [rsp + 0xa0]
movsx rdx, byte [rsp + 0x62]
movsx r10d, byte [rsp + 0x60]
imul eax, dword [rsp + 0xb8]
sub r13d, eax
movzx eax, byte [rsp + 0x61]
add eax, eax
sub eax, dword [rsp + 0x68]
imul r13d, dword [rsp + 0xa8]
lea ecx, [rax*2]
lea eax, [r14 + r14*4]
add ecx, r13d
add ecx, eax
movsx eax, byte [rsp + 0x63]
imul eax, r15d
sub ecx, eax
movsx rax, dil
add ecx, r12d
add ecx, eax
lea eax, [rbp + 9]
sub ecx, ebx
sub ecx, edx
sub ecx, dword [rsp + 0x90]
sub ecx, dword [rsp + 0x74]
add ecx, dword [rsp + 0xb0]
add ecx, dword [rsp + 0x98]
add ecx, dword [rsp + 0x78]
add ecx, dword [rsp + 0x80]
add ecx, esi
add ecx, r10d
add eax, ecx
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret