Function at 0x140135bc0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov rdi, rdx
mov r14d, ebx
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, ebx
mov ebp, ebx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [0x14042bb58], rbx
mov qword [rsp + 0x98], rax
jne 0x140135c1b
lea rax, [0x14030c520]
mov qword [rdi], rax
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov edx, 0x18b
mov qword [rsp + 0x88], r12
lea r8d, [rcx + 0xa]
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x1401360b2
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x1401360b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140135cc0
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140135ee1
mov rax, qword [rsp + 0x90]
mov r14d, r12d
test r12d, r12d
jle 0x140135cc0
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, r15
call fcn.1402bb6a0
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x1401360b2
mov edx, ebx
test r14d, r14d
jle 0x140135d50
cmp r14d, 0x20
jb 0x140135d32
mov eax, r14d
and eax, 0x8000001f
jge 0x140135cf3
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x140374b20]
mov r8d, r14d
sub r8d, eax
movsxd rax, edx
movdqu xmm0, xmmword [rax + r15]
pxor xmm0, xmm1
movdqu xmmword [rax + r15], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + r15]
pxor xmm0, xmm1
movdqu xmmword [rcx + r15], xmm0
cmp edx, r8d
jl 0x140135d01
cmp edx, r14d
jge 0x140135d50
movsxd rcx, edx
mov eax, r14d
add rcx, r15
sub eax, edx
mov edx, eax
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140135d44
xor ecx, ecx
mov edx, 0x18c
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14013608b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x14013608b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x140135deb
mov rcx, qword [rsp + 0x98]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140135ee9
mov rax, qword [rsp + 0x90]
mov esi, r12d
test r12d, r12d
jle 0x140135deb
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, rbp
call fcn.1402bb6a0
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x14013608b
test esi, esi
jle 0x140135e7c
cmp esi, 0x20
jb 0x140135e5c
mov eax, esi
and eax, 0x8000001f
jge 0x140135e19
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x140374b20]
mov edx, esi
sub edx, eax
nop word [rax + rax]
movsxd rax, ebx
movdqu xmm0, xmmword [rax + rbp]
pxor xmm0, xmm1
movdqu xmmword [rax + rbp], xmm0
lea eax, [rbx + 0x10]
add ebx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbp]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbp], xmm0
cmp ebx, edx
jl 0x140135e30
cmp ebx, esi
jge 0x140135e7c
movsxd rcx, ebx
mov edx, esi
add rcx, rbp
sub edx, ebx
nop word [rax + rax]
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140135e70
mov rbx, qword [rsp + 0x80]
mov eax, r14d
lea rcx, [rsp + 0x90]
movzx r8d, word [rbx + 0x54]
cdq
mov qword [rsp + 0x20], rcx
mov rcx, rbx
idiv r8d
mov r12d, eax
mov eax, esi
cdq
idiv r8d
mov edx, r8d
imul edx, eax
mov r13d, eax
mov rax, qword [rbx + 0x68]
sub rax, rdx
xor edx, edx
mov r9d, r13d
div r8
mov r8, rbp
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.1401768e0
test al, al
jne 0x140135ef1
lea rax, str.FS_write
jmp 0x140136092
xor r12b, r12b
jmp 0x140135cc3
xor r12b, r12b
jmp 0x140135dee
cmp dword [rsp + 0x90], r13d
je 0x140135f07
lea rax, str.FS_write
jmp 0x140136092
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, r15
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401768e0
test al, al
jne 0x140135f34
lea rax, str.MBR_write
jmp 0x140136092
cmp dword [rsp + 0x90], r12d
je 0x140135f4a
lea rax, str.MBR_write
jmp 0x140136092
mov ecx, esi
cmp r14d, esi
cmovg ecx, r14d
call fcn.1402b9c60
mov rbx, rax
test rax, rax
je 0x140136095
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1401767f0
test al, al
jne 0x140135fa4
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
cmp dword [rsp + 0x90], r12d
je 0x140135fc8
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
movsxd r8, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1402c4b40
test eax, eax
je 0x140135ff4
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r13d
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.1401767f0
test al, al
jne 0x140136034
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
cmp dword [rsp + 0x90], r13d
je 0x140136055
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
movsxd r8, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1402c4b40
test eax, eax
je 0x14013607e
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402b9c20
jmp 0x140136098
mov rcx, rbx
mov dil, 1
call fcn.1402b9c20
jmp 0x140136098
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
test rbp, rbp
je 0x1401360bf
mov rcx, qword [rsp + 0x98]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1401360bf
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
test r15, r15
je 0x1401360e1
mov rcx, qword [rsp + 0x30]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret