Function at 0x140134940
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov rdi, rdx
mov r14d, ebx
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, ebx
mov ebp, ebx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [0x140428b78], rbx
mov qword [rsp + 0x98], rax
jne 0x14013499b
lea rax, [0x14030a560]
mov qword [rdi], rax
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov edx, 0x18b
mov qword [rsp + 0x88], r12
lea r8d, [rcx + 0xa]
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140134e32
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x140134e32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140134a40
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140134c61
mov rax, qword [rsp + 0x90]
mov r14d, r12d
test r12d, r12d
jle 0x140134a40
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, r15
call fcn.1402b8dd0
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x140134e32
mov edx, ebx
test r14d, r14d
jle 0x140134ad0
cmp r14d, 0x20
jb 0x140134ab2
mov eax, r14d
and eax, 0x8000001f
jge 0x140134a73
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x140372310]
mov r8d, r14d
sub r8d, eax
movsxd rax, edx
movdqu xmm0, xmmword [rax + r15]
pxor xmm0, xmm1
movdqu xmmword [rax + r15], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + r15]
pxor xmm0, xmm1
movdqu xmmword [rcx + r15], xmm0
cmp edx, r8d
jl 0x140134a81
cmp edx, r14d
jge 0x140134ad0
movsxd rcx, edx
mov eax, r14d
add rcx, r15
sub eax, edx
mov edx, eax
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140134ac4
xor ecx, ecx
mov edx, 0x18c
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140134e0b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x140134e0b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140134b6b
mov rcx, qword [rsp + 0x98]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140134c69
mov rax, qword [rsp + 0x90]
mov esi, r12d
test r12d, r12d
jle 0x140134b6b
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, rbp
call fcn.1402b8dd0
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x140134e0b
test esi, esi
jle 0x140134bfc
cmp esi, 0x20
jb 0x140134bdc
mov eax, esi
and eax, 0x8000001f
jge 0x140134b99
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x140372310]
mov edx, esi
sub edx, eax
nop word [rax + rax]
movsxd rax, ebx
movdqu xmm0, xmmword [rax + rbp]
pxor xmm0, xmm1
movdqu xmmword [rax + rbp], xmm0
lea eax, [rbx + 0x10]
add ebx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbp]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbp], xmm0
cmp ebx, edx
jl 0x140134bb0
cmp ebx, esi
jge 0x140134bfc
movsxd rcx, ebx
mov edx, esi
add rcx, rbp
sub edx, ebx
nop word [rax + rax]
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140134bf0
mov rbx, qword [rsp + 0x80]
mov eax, r14d
lea rcx, [rsp + 0x90]
movzx r8d, word [rbx + 0x54]
cdq
mov qword [rsp + 0x20], rcx
mov rcx, rbx
idiv r8d
mov r12d, eax
mov eax, esi
cdq
idiv r8d
mov edx, r8d
imul edx, eax
mov r13d, eax
mov rax, qword [rbx + 0x68]
sub rax, rdx
xor edx, edx
mov r9d, r13d
div r8
mov r8, rbp
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.140175510
test al, al
jne 0x140134c71
lea rax, str.FS_write
jmp 0x140134e12
xor r12b, r12b
jmp 0x140134a43
xor r12b, r12b
jmp 0x140134b6e
cmp dword [rsp + 0x90], r13d
je 0x140134c87
lea rax, str.FS_write
jmp 0x140134e12
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, r15
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140175510
test al, al
jne 0x140134cb4
lea rax, str.MBR_write
jmp 0x140134e12
cmp dword [rsp + 0x90], r12d
je 0x140134cca
lea rax, str.MBR_write
jmp 0x140134e12
mov ecx, esi
cmp r14d, esi
cmovg ecx, r14d
call fcn.1402b7390
mov rbx, rax
test rax, rax
je 0x140134e15
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140175420
test al, al
jne 0x140134d24
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
cmp dword [rsp + 0x90], r12d
je 0x140134d48
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
movsxd r8, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1402c22d0
test eax, eax
je 0x140134d74
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r13d
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140175420
test al, al
jne 0x140134db4
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
cmp dword [rsp + 0x90], r13d
je 0x140134dd5
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
movsxd r8, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1402c22d0
test eax, eax
je 0x140134dfe
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b7350
jmp 0x140134e18
mov rcx, rbx
mov dil, 1
call fcn.1402b7350
jmp 0x140134e18
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
test rbp, rbp
je 0x140134e3f
mov rcx, qword [rsp + 0x98]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140134e3f
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
test r15, r15
je 0x140134e61
mov rcx, qword [rsp + 0x30]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret