Function at 0x1401375b0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov rdi, rdx
mov r14d, ebx
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, ebx
mov ebp, ebx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [0x140430c10], rbx
mov qword [rsp + 0x98], rax
jne 0x14013760b
lea rax, [0x140310580]
mov qword [rdi], rax
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov edx, 0x18b
mov qword [rsp + 0x88], r12
lea r8d, [rcx + 0xa]
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140137aa2
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x140137aa2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x1401376b0
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1401378d1
mov rax, qword [rsp + 0x90]
mov r14d, r12d
test r12d, r12d
jle 0x1401376b0
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, r15
call fcn.1402beb60
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x140137aa2
mov edx, ebx
test r14d, r14d
jle 0x140137740
cmp r14d, 0x20
jb 0x140137722
mov eax, r14d
and eax, 0x8000001f
jge 0x1401376e3
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x1403796f0]
mov r8d, r14d
sub r8d, eax
movsxd rax, edx
movdqu xmm0, xmmword [rax + r15]
pxor xmm0, xmm1
movdqu xmmword [rax + r15], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + r15]
pxor xmm0, xmm1
movdqu xmmword [rcx + r15], xmm0
cmp edx, r8d
jl 0x1401376f1
cmp edx, r14d
jge 0x140137740
movsxd rcx, edx
mov eax, r14d
add rcx, r15
sub eax, edx
mov edx, eax
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140137734
xor ecx, ecx
mov edx, 0x18c
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140137a7b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
xor ecx, ecx
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x140137a7b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
test r12d, r12d
je 0x1401377db
mov rcx, qword [rsp + 0x98]
mov r8, r12
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1401378d9
mov rax, qword [rsp + 0x90]
mov esi, r12d
test r12d, r12d
jle 0x1401377db
mov r9, r12
movsxd rdx, r12d
mov r8, rax
mov rcx, rbp
call fcn.1402beb60
mov r12b, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12b, r12b
je 0x140137a7b
test esi, esi
jle 0x14013786c
cmp esi, 0x20
jb 0x14013784c
mov eax, esi
and eax, 0x8000001f
jge 0x140137809
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x1403796f0]
mov edx, esi
sub edx, eax
nop word [rax + rax]
movsxd rax, ebx
movdqu xmm0, xmmword [rax + rbp]
pxor xmm0, xmm1
movdqu xmmword [rax + rbp], xmm0
lea eax, [rbx + 0x10]
add ebx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbp]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbp], xmm0
cmp ebx, edx
jl 0x140137820
cmp ebx, esi
jge 0x14013786c
movsxd rcx, ebx
mov edx, esi
add rcx, rbp
sub edx, ebx
nop word [rax + rax]
xor byte [rcx], 0xee
lea rcx, [rcx + 1]
dec rdx
jne 0x140137860
mov rbx, qword [rsp + 0x80]
mov eax, r14d
lea rcx, [rsp + 0x90]
movzx r8d, word [rbx + 0x54]
cdq
mov qword [rsp + 0x20], rcx
mov rcx, rbx
idiv r8d
mov r12d, eax
mov eax, esi
cdq
idiv r8d
mov edx, r8d
imul edx, eax
mov r13d, eax
mov rax, qword [rbx + 0x68]
sub rax, rdx
xor edx, edx
mov r9d, r13d
div r8
mov r8, rbp
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.140178520
test al, al
jne 0x1401378e1
lea rax, str.FS_write
jmp 0x140137a82
xor r12b, r12b
jmp 0x1401376b3
xor r12b, r12b
jmp 0x1401377de
cmp dword [rsp + 0x90], r13d
je 0x1401378f7
lea rax, str.FS_write
jmp 0x140137a82
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, r15
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140178520
test al, al
jne 0x140137924
lea rax, str.MBR_write
jmp 0x140137a82
cmp dword [rsp + 0x90], r12d
je 0x14013793a
lea rax, str.MBR_write
jmp 0x140137a82
mov ecx, esi
cmp r14d, esi
cmovg ecx, r14d
call fcn.1402bd120
mov rbx, rax
test rax, rax
je 0x140137a85
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140178430
test al, al
jne 0x140137994
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
cmp dword [rsp + 0x90], r12d
je 0x1401379b8
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
movsxd r8, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1402c8000
test eax, eax
je 0x1401379e4
lea rax, str.MBR_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov r9d, r13d
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140178430
test al, al
jne 0x140137a24
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
cmp dword [rsp + 0x90], r13d
je 0x140137a45
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
movsxd r8, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1402c8000
test eax, eax
je 0x140137a6e
lea rax, str.FS_verify
mov rcx, rbx
mov qword [rdi], rax
xor dil, dil
call fcn.1402bd0e0
jmp 0x140137a88
mov rcx, rbx
mov dil, 1
call fcn.1402bd0e0
jmp 0x140137a88
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
test rbp, rbp
je 0x140137aaf
mov rcx, qword [rsp + 0x98]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140137aaf
lea rax, str.decoder
mov qword [rdi], rax
xor dil, dil
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
test r15, r15
je 0x140137ad1
mov rcx, qword [rsp + 0x30]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret