Function at 0x1400039a0
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate gui resources
Get system information on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [0x14002a040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rcx
mov qword [rbp - 0x71], rcx
mov rcx, qword [0x14002bf30]
lea rdx, [0x140001f00]
xor ebx, ebx
xor r8d, r8d
mov dword [rbp - 0x79], ebx
mov dword [rbp - 0x59], ebx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov rdi, qword [0x14002be98]
mov qword [rbp - 0x61], rdi
test rdi, rdi
je 0x140003dd1
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], r14
mov qword [rsp + 0xe0], r15
nop word [rax + rax]
mov r14, qword [0x14002bd78]
mov edi, dword [rdi]
test r14, r14
je 0x140003d9c
mov rbx, qword [r14]
mov r15, qword [r14 + 8]
cmp dword [rbx + 0x9c], 0
jne 0x140003a52
mov ecx, 0x714
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140003d99
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, dword [rbx + 0x98]
lea r8, [0x140026870]
add rsi, r15
mov r12d, eax
mov rdx, rsi
mov rcx, rsi
call fcn.140009150
test rax, rax
jne 0x140003a8b
mov ecx, 0x715
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140003d99
mov eax, dword [rax + 4]
mov rcx, rsi
mov edx, dword [rbx + 0x98]
btr eax, 0x1f
add rax, r15
movzx r8d, di
add rdx, rax
call fcn.140009150
test rax, rax
jne 0x140003abf
mov ecx, 0x716
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140003d99
mov eax, dword [rax + 4]
mov rcx, rsi
mov edi, dword [rbx + 0x98]
btr eax, 0x1f
add rax, r15
movzx r8d, r12w
add rdi, rax
mov rdx, rdi
call fcn.140009150
test rax, rax
jne 0x140003b00
cmp word [rdi + 0xe], ax
jne 0x140003afc
mov ecx, 0x717
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140003d99
lea rax, [rdi + 0x10]
mov eax, dword [rax + 4]
mov ecx, dword [rbx + 0x98]
btr eax, 0x1f
add rax, r15
add rcx, rax
je 0x140003d99
mov ebx, dword [rcx]
add rbx, qword [r14 + 8]
je 0x140003d99
mov eax, dword [rcx + 4]
mov ecx, eax
mov dword [rbp - 0x59], eax
call fcn.14000de0c
mov qword [rbp - 0x69], rax
mov r14, rax
test rax, rax
je 0x140003d99
mov r8d, dword [rbp - 0x59]
mov rdx, rbx
mov rcx, rax
call fcn.14001d070
movups xmm1, xmmword [r13 + 0x10]
mov rcx, qword [0x14002bf60]
lea rax, [rbp - 0x49]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r12d, r12d
mov dword [rbp - 0x51], 1
movups xmmword [rbp + 0x1f], xmm0
xor r9d, r9d
lea rdx, [rbp - 0x41]
movups xmm0, xmmword [r13]
lea r8d, [r12 + 0x2c]
mov dword [rbp - 0x41], 0x208
mov dword [rbp - 0x3d], 0x6610
movups xmmword [rbp - 0x35], xmm0
mov dword [rbp - 0x39], 0x20
movups xmmword [rbp - 0x25], xmm1
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140004521
mov rcx, qword [rbp - 0x49]
lea r8, [rbp - 0x51]
xor r9d, r9d
lea edx, [r12 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140004517
mov rcx, qword [rbp - 0x49]
lea r8, [rbp + 0x1f]
xor r9d, r9d
lea edx, [r12 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140004517
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r13d, dword [rbp - 0x59]
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x1400044ea
cmp r13d, 0x130
jb 0x1400044ea
movsxd rdx, dword [r14 + 0x3c]
cmp r13d, dword [rdx + r14 + 0x54]
jb 0x1400044ea
lea rcx, [rdx + 0x108]
cmp r13, rcx
jb 0x1400044ea
mov esi, 0x8664
cmp word [rdx + r14 + 4], si
jne 0x1400044ea
mov eax, 0x2000
test word [rdx + r14 + 0x16], ax
je 0x1400044ea
movsxd rcx, dword [r14 + 0x3c]
xorps xmm0, xmm0
lea r15, [rcx + r14]
mov ebx, r12d
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
cmp dword [r15], 0x4550
jne 0x1400044d6
cmp r13d, 0x40
jb 0x1400044e0
cmp r13d, dword [r15 + 0x54]
jb 0x1400044e0
add rcx, 0x108
cmp r13, rcx
jb 0x1400044e0
cmp word [r15 + 4], si
jne 0x1400044d6
movzx edx, word [r15 + 0x14]
movzx eax, word [r15 + 6]
add rdx, 0x24
cmp r12w, ax
jae 0x140003d1d
add rdx, r15
mov r9d, eax
nop
mov eax, dword [rdx + 4]
mov ecx, dword [rdx]
test eax, eax
jne 0x140003d02
mov r8d, dword [r15 + 0x38]
add r8d, ecx
jmp 0x140003d06
lea r8d, [rcx + rax]
mov eax, r8d
cmp rax, rbx
cmovbe rax, rbx
add rdx, 0x28
mov rbx, rax
sub r9, 1
jne 0x140003cf0
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rbp - 0xd]
lea r8d, [rdx - 1]
lea edi, [rdx - 1]
not r8d
add edi, dword [r15 + 0x50]
lea rcx, [rdx - 1]
add rcx, rbx
and rdi, r8
and rcx, r8
cmp rdi, rcx
jne 0x1400044d6
mov rcx, qword [r15 + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140003dec
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140003dec
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13, qword [rbp - 0x71]
mov ebx, dword [rbp - 0x79]
mov rdi, qword [rbp - 0x61]
mov rdi, qword [rdi + 8]
mov qword [rbp - 0x61], rdi
test rdi, rdi
jne 0x140003a20
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400092d0
add rsp, 0xe8
pop r13
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x51], rax
mov rsi, rax
test rax, rax
je 0x14000448d
mov qword [rax + 8], r12
mov r9d, 4
mov eax, dword [rbp - 0xd]
mov r8d, 0x1000
mov dword [rsi + 0x24], eax
mov rcx, r12
mov edx, dword [r15 + 0x54]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000448d
mov r8d, dword [r15 + 0x54]
mov rdx, r14
mov rcx, rax
call fcn.14001d070
movsxd rcx, dword [r14 + 0x3c]
mov rax, qword [rbp - 0x51]
add rcx, rbx
mov qword [rsi], rcx
mov qword [rcx + 0x30], r12
xor ecx, ecx
mov rax, qword [rax]
mov r14d, ecx
mov rsi, qword [rsi + 8]
movzx edi, word [rax + 0x14]
add rdi, 0x24
cmp cx, word [rax + 6]
jae 0x140003f36
add rdi, rax
mov edx, dword [rdi + 4]
test edx, edx
jne 0x140003ed0
movsxd rax, dword [r15 + 0x38]
test eax, eax
jle 0x140003f19
mov ecx, dword [rdi]
lea r9d, [rdx + 4]
add rcx, rsi
mov r8d, 0x1000
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000449a
mov ecx, dword [rdi]
mov r8, rbx
add rcx, rsi
xor edx, edx
mov dword [rdi - 4], ecx
call fcn.14001ccb0
jmp 0x140003f19
mov ecx, dword [rdi + 8]
add ecx, edx
cmp r13d, ecx
jb 0x14000449a
mov ecx, dword [rdi]
mov r9d, 4
add rcx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000449a
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, rsi
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, qword [rbp - 0x69]
call fcn.14001d070
mov dword [rdi - 4], ebx
mov rax, qword [rbp - 0x51]
inc r14d
add rdi, 0x28
mov rax, qword [rax]
movzx ecx, word [rax + 6]
cmp r14d, ecx
jl 0x140003e85
xor ecx, ecx
mov rsi, qword [rbp - 0x51]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x30]
sub rbx, qword [r15 + 0x30]
je 0x140003fdb
cmp dword [rax + 0xb4], 0
jne 0x140003f5b
mov eax, ecx
jmp 0x140003fe0
mov r11d, dword [rax + 0xb0]
mov rdi, qword [rsi + 8]
add r11, rdi
mov eax, dword [r11]
test eax, eax
je 0x140003fdb
mov edx, dword [r11 + 4]
lea r8, [r11 + 8]
mov r9d, eax
mov r10d, ecx
add r9, rdi
lea rax, [rdx - 8]
test rax, 0xfffffffffffffffe
jbe 0x140003fcf
nop dword [rax]
movzx eax, word [r8]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x140003faf
cmp eax, 0xa
jne 0x140003fb3
add qword [rcx + r9], rbx
jmp 0x140003fb3
add dword [rcx + r9], ebx
mov edx, dword [r11 + 4]
inc r10d
add r8, 2
mov eax, r10d
lea rcx, [rdx - 8]
shr rcx, 1
cmp rax, rcx
jb 0x140003f90
xor ecx, ecx
mov eax, edx
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x140003f70
mov eax, 1
mov rcx, rsi
mov dword [rsi + 0x20], eax
call fcn.1400088b0
test eax, eax
je 0x14000449e
mov rcx, rsi
call fcn.140008b60
test eax, eax
je 0x14000449e
mov rax, qword [rsi]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14000404a
mov rax, qword [rsi + 8]
mov rbx, qword [rax + rcx + 0x18]
test rbx, rbx
je 0x14000404a
mov rax, qword [rbx]
test rax, rax
je 0x14000404a
nop word [rax + rax]
mov rcx, qword [rsi + 8]
xor r8d, r8d
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140004030
mov rax, qword [rsi]
mov edx, dword [rax + 0x28]
test edx, edx
je 0x140004080
mov rcx, qword [rsi + 8]
xor r8d, r8d
lea rax, [rcx + rdx]
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x140004079
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000449e
mov dword [rsi + 0x1c], 1
mov ecx, 0x78
call fcn.14000de0c
mov r14, rax
test rax, rax
je 0x14000447f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x60], xmm0
mov qword [r14 + 0x70], rax
mov dword [r14], 0x78
mov dword [r14 + 0x10], 0x30
mov qword [r14 + 8], rsi
mov rax, qword [rsi]
cmp dword [rax + 0x8c], 0
je 0x1400041bc
mov rbx, qword [rsi + 8]
mov edi, dword [rax + 0x88]
add rdi, rbx
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x1400041bc
mov esi, dword [rdi + 0x14]
test esi, esi
je 0x1400041bc
lea r15, str.init
mov rax, r15
shr rax, 0x10
test ax, ax
jne 0x140004132
mov ecx, dword [rdi + 0x10]
movzx eax, r15w
cmp eax, ecx
jb 0x1400041bc
sub eax, ecx
xor r12d, r12d
jmp 0x140004178
mov r8d, dword [rdi + 0x20]
xor r12d, r12d
mov r10d, dword [rdi + 0x24]
add r8, rbx
add r10, rbx
mov r9d, r12d
test r11d, r11d
je 0x14000417c
nop dword [rax + rax]
mov edx, dword [r8]
mov rcx, r12
add rdx, rbx
nop dword [rax]
movzx eax, byte [r15 + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140004189
cmp rcx, 5
jne 0x140004160
movzx eax, word [r10]
cmp eax, esi
jbe 0x1400041a6
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400041ca
inc r9d
add r8, 4
add r10, 2
cmp r9d, r11d
jb 0x140004150
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400041ca
mov edx, dword [rdi + 0x1c]
lea ecx, [rax*4]
lea rax, [rbx + rdx]
mov eax, dword [rcx + rax]
add rax, rbx
jmp 0x1400041cd
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r12d, r12d
mov rax, r12
mov r15, qword [rbp - 0x51]
mov qword [r14 + 0x58], rax
mov rax, qword [r15]
cmp dword [rax + 0x8c], 0
je 0x140004292
mov rbx, qword [r15 + 8]
mov edi, dword [rax + 0x88]
add rdi, rbx
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x140004292
mov esi, dword [rdi + 0x14]
test esi, esi
je 0x140004292
lea r13, [0x140026828]
mov rax, r13
shr rax, 0x10
test ax, ax
jne 0x14000422c
mov ecx, dword [rdi + 0x10]
movzx eax, r13w
cmp eax, ecx
jb 0x140004292
sub eax, ecx
jmp 0x140004268
mov r8d, dword [rdi + 0x20]
mov r9d, r12d
mov r10d, dword [rdi + 0x24]
add r8, rbx
add r10, rbx
test r11d, r11d
je 0x140004292
mov edx, dword [r8]
mov rcx, r12
add rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140004282
cmp rcx, 4
jne 0x140004250
movzx eax, word [r10]
cmp eax, esi
ja 0x140004292
mov edx, dword [rdi + 0x1c]
lea ecx, [rax*4]
lea rax, [rbx + rdx]
mov eax, dword [rcx + rax]
add rax, rbx
jmp 0x1400042a0
inc r9d
add r8, 4
add r10, 2
cmp r9d, r11d
jb 0x140004242
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
mov qword [r14 + 0x60], rax
mov rax, qword [r15]
cmp dword [rax + 0x8c], 0
je 0x140004362
mov rbx, qword [r15 + 8]
mov edi, dword [rax + 0x88]
add rdi, rbx
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x140004362
mov esi, dword [rdi + 0x14]
test esi, esi
je 0x140004362
lea r13, str.getinfo
mov rax, r13
shr rax, 0x10
test ax, ax
jne 0x1400042fb
mov ecx, dword [rdi + 0x10]
movzx eax, r13w
cmp eax, ecx
jb 0x140004362
sub eax, ecx
jmp 0x140004338
mov r8d, dword [rdi + 0x20]
mov r9d, r12d
mov r10d, dword [rdi + 0x24]
add r8, rbx
add r10, rbx
test r11d, r11d
je 0x140004362
mov edx, dword [r8]
mov rcx, r12
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140004352
cmp rcx, 8
jne 0x140004320
movzx eax, word [r10]
cmp eax, esi
ja 0x140004362
mov edx, dword [rdi + 0x1c]
lea ecx, [rax*4]
lea rax, [rbx + rdx]
mov eax, dword [rcx + rax]
add rax, rbx
jmp 0x140004370
inc r9d
add r8, 4
add r10, 2
cmp r9d, r11d
jb 0x140004311
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
mov qword [r14 + 0x68], rax
mov rax, qword [r15]
cmp dword [rax + 0x8c], 0
je 0x140004432
mov rbx, qword [r15 + 8]
mov edi, dword [rax + 0x88]
add rdi, rbx
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x140004432
mov esi, dword [rdi + 0x14]
test esi, esi
je 0x140004432
lea r15, str.deinit
mov rax, r15
shr rax, 0x10
test ax, ax
jne 0x1400043cb
mov ecx, dword [rdi + 0x10]
movzx eax, r15w
cmp eax, ecx
jb 0x140004432
sub eax, ecx
jmp 0x140004408
mov r8d, dword [rdi + 0x20]
mov r9d, r12d
mov r10d, dword [rdi + 0x24]
add r8, rbx
add r10, rbx
test r11d, r11d
je 0x140004432
mov edx, dword [r8]
mov rcx, r12
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140004422
cmp rcx, 7
jne 0x1400043f0
movzx eax, word [r10]
cmp eax, esi
ja 0x140004432
mov edx, dword [rdi + 0x1c]
lea ecx, [rax*4]
lea rax, [rbx + rdx]
mov eax, dword [rcx + rax]
add rax, rbx
jmp 0x140004440
inc r9d
add r8, 4
add r10, 2
cmp r9d, r11d
jb 0x1400043e1
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
mov ecx, 0x10
mov qword [r14 + 0x70], rax
call fcn.14000de0c
mov rcx, rax
test rax, rax
je 0x140004477
mov ebx, dword [rbp - 0x79]
mov qword [rax], r14
mov rax, qword [0x14002bd60]
mov r14, qword [rbp - 0x69]
mov qword [rcx + 8], rax
mov qword [0x14002bd60], rcx
jmp 0x140004501
mov rcx, r14
call fcn.14000ddf8
mov rcx, qword [rbp - 0x69]
call fcn.14000ddf8
jmp 0x140003d95
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000449e
mov rsi, qword [rbp - 0x51]
test r12, r12
je 0x1400044b4
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140003d95
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140003d95
mov ecx, 0xc1
jmp 0x140003d8f
mov ecx, 0xd
jmp 0x140003d8f
lea r8, [r14 + 0x10]
mov rcx, r14
lea edx, [r13 - 0x10]
call fcn.140005780
mov ebx, dword [rbp - 0x79]
test eax, eax
jne 0x140004506
inc ebx
mov dword [rbp - 0x79], ebx
mov rcx, r14
call fcn.14000ddf8
mov r13, qword [rbp - 0x71]
jmp 0x140003d9c
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, r14
call fcn.14000ddf8
jmp 0x140003d99