Function at 0x140114710
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r13, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1403009f0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140300a40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140114a34
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x60], rax
xor edi, edi
mov dword [rsp + 0x68], edi
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15, rax
mov qword [rsp + 0x78], rax
mov edx, 0x132
xor ecx, ecx
lea r8d, [rdi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140114a15
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rsi, eax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140114a15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test esi, esi
je 0x140114842
mov r8, rsi
lea edx, [rdi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140114828
mov edi, esi
mov dword [rsp + 0x68], esi
jmp 0x14011482d
xor sil, sil
jmp 0x140114845
test esi, esi
jle 0x140114842
mov r9, rsi
movsxd rdx, edi
mov r8, r12
mov rcx, rbx
call fcn.1402b8dd0
mov sil, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test sil, sil
je 0x140114a15
xor esi, esi
mov edx, esi
test edi, edi
jle 0x1401148cd
cmp edi, 0x20
jb 0x1401148af
mov eax, edi
and eax, 0x8000001f
jge 0x140114874
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, edi
sub r8d, eax
movdqa xmm1, xmmword [0x140372310]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm1
movdqu xmmword [rax + rbx], xmm0
lea eax, [rdx + 0x10]
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbx], xmm0
add edx, 0x20
cmp edx, r8d
jl 0x140114882
cmp edx, edi
jge 0x1401148cd
movsxd r8, edx
add r8, rbx
mov r9d, edi
sub r9d, edx
nop
xor byte [r8], 0xee
lea r8, [r8 + 1]
dec r9
jne 0x1401148c0
mov qword [rsp + 0x30], rsi
movsxd rdx, edi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x140300a50]
call qword [rax]
test eax, eax
js 0x140114a15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
call qword [rax + 0x28]
test eax, eax
js 0x140114a0a
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x140300a00]
call qword [rax]
test eax, eax
js 0x140114a0a
lea r8, [0x140428b60]
lea rdx, [0x140114a70]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140140ba0
test eax, eax
jne 0x1401149ff
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.1401412a0
test eax, eax
jne 0x1401149ff
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140428b68], eax
mov byte [0x140428ad9], sil
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
call qword [rax + 0x18]
mov dword [0x140428b68], esi
test eax, eax
js 0x1401149f3
movzx eax, byte [0x140428ad9]
mov byte [r13], al
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.1401413d0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x140114a34
mov r8, rbx
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret