Function at 0x1401154d0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r13, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1402df9b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402dfa00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1401157f4
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x60], rax
xor edi, edi
mov dword [rsp + 0x68], edi
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15, rax
mov qword [rsp + 0x78], rax
mov edx, 0x132
xor ecx, ecx
lea r8d, [rdi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1401157d5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rsi, eax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x1401157d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test esi, esi
je 0x140115602
mov r8, rsi
lea edx, [rdi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401155e8
mov edi, esi
mov dword [rsp + 0x68], esi
jmp 0x1401155ed
xor sil, sil
jmp 0x140115605
test esi, esi
jle 0x140115602
mov r9, rsi
movsxd rdx, edi
mov r8, r12
mov rcx, rbx
call fcn.140299fc8
mov sil, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test sil, sil
je 0x1401157d5
xor esi, esi
mov edx, esi
test edi, edi
jle 0x14011568d
cmp edi, 0x20
jb 0x14011566f
mov eax, edi
and eax, 0x8000001f
jge 0x140115634
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, edi
sub r8d, eax
movdqa xmm1, xmmword [0x14034d010]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm1
movdqu xmmword [rax + rbx], xmm0
lea eax, [rdx + 0x10]
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbx], xmm0
add edx, 0x20
cmp edx, r8d
jl 0x140115642
cmp edx, edi
jge 0x14011568d
movsxd r8, edx
add r8, rbx
mov r9d, edi
sub r9d, edx
nop
xor byte [r8], 0xee
lea r8, [r8 + 1]
dec r9
jne 0x140115680
mov qword [rsp + 0x30], rsi
movsxd rdx, edi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x1402dfa10]
call qword [rax]
test eax, eax
js 0x1401157d5
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
call qword [rax + 0x28]
test eax, eax
js 0x1401157ca
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x1402df9c0]
call qword [rax]
test eax, eax
js 0x1401157ca
lea r8, [0x1403fd788]
lea rdx, [0x140115830]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140133f10
test eax, eax
jne 0x1401157bf
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140134610
test eax, eax
jne 0x1401157bf
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1403fd798], eax
mov byte [0x1403fd719], sil
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
call qword [rax + 0x18]
mov dword [0x1403fd798], esi
test eax, eax
js 0x1401157b3
movzx eax, byte [0x1403fd719]
mov byte [r13], al
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140134740
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x1401157f4
mov r8, rbx
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret