Function at 0x140127d00
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov rdi, rdx
mov r14d, ebx
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, ebx
mov ebp, ebx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [0x1403fd7a8], rbx
mov qword [rsp + 0x98], rax
jne 0x140127d5b
lea rax, [0x1402e8fc0]
mov qword [rdi], rax
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov edx, 0x18b
mov qword [rsp + 0x88], r12
lea r8d, [rcx + 0xa]
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x1401281f2
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x1401281f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140127e00
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140128021
mov rax, qword [rsp + 0x90]
mov r14d, r12d
test r12d, r12d
jle 0x140127e00
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, r15
call fcn.140299fc8
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x1401281f2
mov edx, ebx
test r14d, r14d
jle 0x140127e90
cmp r14d, 0x20
jb 0x140127e72
mov eax, r14d
and eax, 0x8000001f
jge 0x140127e33
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x14034d010]
mov r8d, r14d
sub r8d, eax
movsxd rax, edx
movdqu xmm0, xmmword [rax + r15]
pxor xmm0, xmm1
movdqu xmmword [rax + r15], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + r15]
pxor xmm0, xmm1
movdqu xmmword [rcx + r15], xmm0
cmp edx, r8d
jl 0x140127e41
cmp edx, r14d
jge 0x140127e90
movsxd rcx, edx
mov eax, r14d
add rcx, r15
sub eax, edx
mov edx, eax
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140127e84
xor ecx, ecx
mov edx, 0x18c
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x1401281cb
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x1401281cb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140127f2b
mov rcx, qword [rsp + 0x98]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140128029
mov rax, qword [rsp + 0x90]
mov esi, r12d
test r12d, r12d
jle 0x140127f2b
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, rbp
call fcn.140299fc8
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x1401281cb
test esi, esi
jle 0x140127fbc
cmp esi, 0x20
jb 0x140127f9c
mov eax, esi
and eax, 0x8000001f
jge 0x140127f59
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x14034d010]
mov edx, esi
sub edx, eax
nop word [rax + rax]
movsxd rax, ebx
movdqu xmm0, xmmword [rax + rbp]
pxor xmm0, xmm1
movdqu xmmword [rax + rbp], xmm0
lea eax, [rbx + 0x10]
add ebx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbp]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbp], xmm0
cmp ebx, edx
jl 0x140127f70
cmp ebx, esi
jge 0x140127fbc
movsxd rcx, ebx
mov edx, esi
add rcx, rbp
sub edx, ebx
nop word [rax + rax]
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140127fb0
mov rbx, qword [rsp + 0x80]
mov eax, r14d
lea rcx, [rsp + 0x90]
movzx r8d, word [rbx + 0x54]
cdq
mov qword [rsp + 0x20], rcx
mov rcx, rbx
idiv r8d
mov r12d, eax
mov eax, esi
cdq
idiv r8d
mov edx, r8d
imul edx, eax
mov r13d, eax
mov rax, qword [rbx + 0x68]
sub rax, rdx
xor edx, edx
mov r9d, r13d
div r8
mov r8, rbp
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.140165ec0
test al, al
jne 0x140128031
lea rax, str.FS_write
jmp 0x1401281d2
xor r12b, r12b
jmp 0x140127e03
xor r12b, r12b
jmp 0x140127f2e
cmp dword [rsp + 0x90], r13d
je 0x140128047
lea rax, str.FS_write
jmp 0x1401281d2
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, r15
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140165ec0
test al, al
jne 0x140128074
lea rax, str.MBR_write
jmp 0x1401281d2
cmp dword [rsp + 0x90], r12d
je 0x14012808a
lea rax, str.MBR_write
jmp 0x1401281d2
mov ecx, esi
cmp r14d, esi
cmovg ecx, r14d
call fcn.140298640
mov rbx, rax
test rax, rax
je 0x1401281d5
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140165dd0
test al, al
jne 0x1401280e4
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
cmp dword [rsp + 0x90], r12d
je 0x140128108
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
movsxd r8, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1402a2dc0
test eax, eax
je 0x140128134
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r13d
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140165dd0
test al, al
jne 0x140128174
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
cmp dword [rsp + 0x90], r13d
je 0x140128195
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
movsxd r8, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1402a2dc0
test eax, eax
je 0x1401281be
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.140298600
jmp 0x1401281d8
mov rcx, rbx
mov dil, 1
call fcn.140298600
jmp 0x1401281d8
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
test rbp, rbp
je 0x1401281ff
mov rcx, qword [rsp + 0x98]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1401281ff
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
test r15, r15
je 0x140128221
mov rcx, qword [rsp + 0x30]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret