Function at 0x140001600
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x278
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebx, cx
lea r14, [0x140000000]
xor edx, edx
nop dword [rax]
movzx eax, word [rdx + r14 + 0x1ee00]
mov word [rsp + rdx + 0x50], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140001630
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rdx, qword [0x14001f410]
mov r8, rdx
mov rax, qword [rdx + 8]
movzx r9d, byte [rax + 0x19]
test r9b, r9b
jne 0x140001688
mov rcx, rax
nop dword [rax]
cmp word [rcx + 0x20], bx
jae 0x14000167c
mov rcx, qword [rcx + 0x10]
jmp 0x140001682
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140001670
cmp byte [r8 + 0x19], 0
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x270], rdi
jne 0x140001855
cmp bx, word [r8 + 0x20]
jb 0x140001855
test r9b, r9b
jne 0x1400016d8
nop dword [rax + rax]
cmp word [rax + 0x20], bx
jae 0x1400016cc
mov rax, qword [rax + 0x10]
jmp 0x1400016d2
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400016c0
cmp byte [rdx + 0x19], 0
jne 0x14000188a
cmp bx, word [rdx + 0x20]
jb 0x14000188a
add rdx, 0x28
cmp qword [rdx + 0x18], 8
jb 0x1400016fa
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov r8d, 0xa
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140001855
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001855
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140001855
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x140001855
mov ecx, ebp
call fcn.140008980
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.140007df0
xor ecx, ecx
test ebp, ebp
je 0x1400017af
mov r8, qword [0x14001f420]
xor edx, edx
mov rax, rcx
div r8
movzx eax, byte [rdx + r14 + 0x1f010]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, rbp
jb 0x140001793
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001855
add ebp, 0xfffffff0
mov qword [rsp + 0x20], 0
mov r8d, ebp
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x140001844
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x10
lea rdx, [0x14001edf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001855
mov al, 1
jmp 0x140001857
xor al, al
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140002370
add rsp, 0x278
pop r14
pop rbx
ret
lea rcx, str.invalid_map_K__T__key
call fcn.140002334
int3