Function at 0x140115990
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r13, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1403029b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140302a00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140115cb4
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x60], rax
xor edi, edi
mov dword [rsp + 0x68], edi
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15, rax
mov qword [rsp + 0x78], rax
mov edx, 0x132
xor ecx, ecx
lea r8d, [rdi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140115c95
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rsi, eax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140115c95
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test esi, esi
je 0x140115ac2
mov r8, rsi
lea edx, [rdi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140115aa8
mov edi, esi
mov dword [rsp + 0x68], esi
jmp 0x140115aad
xor sil, sil
jmp 0x140115ac5
test esi, esi
jle 0x140115ac2
mov r9, rsi
movsxd rdx, edi
mov r8, r12
mov rcx, rbx
call fcn.1402bb6a0
mov sil, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test sil, sil
je 0x140115c95
xor esi, esi
mov edx, esi
test edi, edi
jle 0x140115b4d
cmp edi, 0x20
jb 0x140115b2f
mov eax, edi
and eax, 0x8000001f
jge 0x140115af4
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, edi
sub r8d, eax
movdqa xmm1, xmmword [0x140374b20]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm1
movdqu xmmword [rax + rbx], xmm0
lea eax, [rdx + 0x10]
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbx], xmm0
add edx, 0x20
cmp edx, r8d
jl 0x140115b02
cmp edx, edi
jge 0x140115b4d
movsxd r8, edx
add r8, rbx
mov r9d, edi
sub r9d, edx
nop
xor byte [r8], 0xee
lea r8, [r8 + 1]
dec r9
jne 0x140115b40
mov qword [rsp + 0x30], rsi
movsxd rdx, edi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x140302a10]
call qword [rax]
test eax, eax
js 0x140115c95
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
call qword [rax + 0x28]
test eax, eax
js 0x140115c8a
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x1403029c0]
call qword [rax]
test eax, eax
js 0x140115c8a
lea r8, [0x14042bb38]
lea rdx, [0x140115cf0]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140141e60
test eax, eax
jne 0x140115c7f
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140142560
test eax, eax
jne 0x140115c7f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14042bb40], eax
mov byte [0x14042bab9], sil
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
call qword [rax + 0x18]
mov dword [0x14042bb40], esi
test eax, eax
js 0x140115c73
movzx eax, byte [0x14042bab9]
mov byte [r13], al
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140142690
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x140115cb4
mov r8, rbx
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret