Function at 0x140001fe0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140041080]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov r13d, r9d
mov r15, r8
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x28], rdx
movzx edi, cx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edx, edi
lea r8, [0x14003b530]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
jne 0x14000206f
lea rdx, str.Resource_not_found:
lea rcx, [0x1400424d0]
call fcn.1400064f0
mov rcx, rax
movzx edx, di
call fcn.140002ac0
mov rcx, rax
call fcn.1400067a0
xor eax, eax
jmp 0x1400023bf
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000208b
lea rdx, str.Failed_to_load_resource:
jmp 0x140002049
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
jne 0x1400020a6
lea rdx, str.Resource_size_is_zero:
jmp 0x140002049
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400020c5
lea rdx, str.Failed_to_lock_resource:
jmp 0x140002049
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x50]
call fcn.14002ea90
lea rax, [0x14003b620]
mov qword [rsp + 0x50], rax
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
mov dword [rbp + 0x10], ebx
mov qword [rbp + 0x18], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x50], bl
mov dword [rsp + 0x20], 1
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0x98
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 8]
call fcn.1400061d0
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.1400055b0
nop
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400053e0
mov edx, 2
mov r12d, 6
test rax, rax
jne 0x1400021b7
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov eax, r12d
cmp qword [rbp + rcx - 0x68], 0
cmovne eax, edx
or eax, dword [rsp + rcx + 0x60]
and eax, 0x17
mov dword [rsp + rcx + 0x60], eax
mov edx, dword [rsp + rcx + 0x64]
and edx, eax
jne 0x140002439
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
test byte [rsp + rcx + 0x60], 6
je 0x1400021f2
lea rdx, str.Failed_to_open_output_file:
lea rcx, [0x1400424d0]
call fcn.1400064f0
mov rcx, rax
mov rdx, rdi
call fcn.1400028c0
mov rcx, rax
call fcn.1400067a0
jmp 0x14000234f
test r15, r15
je 0x1400022f8
test r13d, r13d
jle 0x1400022f8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rbx
cmp r14, 0x1000
jb 0x140002242
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x14000248b
call fcn.14000bb88
test rax, rax
je 0x140002491
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000224d
mov rcx, r14
call fcn.14000bb88
mov rdi, rax
mov qword [rbp + 0x60], rdi
lea rsi, [rdi + r14]
mov qword [rbp + 0x70], rsi
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.14002ea90
mov qword [rbp + 0x68], rsi
mov r8, r14
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14002e3f0
test rdi, rdi
je 0x1400022ad
test r14d, r14d
jle 0x1400022ad
mov r8, rdi
mov r9, qword [rsp + 0x38]
nop dword [rax]
xor edx, edx
mov eax, ebx
div r13d
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor byte [r8], cl
inc ebx
lea r8, [r8 + 1]
cmp ebx, r14d
jl 0x140002290
mov r8, r14
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140002720
nop
test rdi, rdi
je 0x140002308
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x1400022eb
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002491
mov rdx, rsi
mov rcx, rdi
call fcn.14000bb80
jmp 0x140002308
mov r8, r14
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002720
lea rcx, [rsp + 0x58]
call fcn.1400052e0
test rax, rax
jne 0x14000234a
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx - 0x68], 0
mov eax, 2
cmovne r12d, eax
or r12d, dword [rsp + rcx + 0x60]
and r12d, 0x17
mov dword [rsp + rcx + 0x60], r12d
mov eax, dword [rsp + rcx + 0x64]
and eax, r12d
jne 0x1400023e9
mov ebx, 1
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.140003a50
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x10]
mov dword [rsp + rdx + 0x4c], r8d
lea rax, vtable.std::ios_base.0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14000b240
nop
mov eax, ebx
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14000bb60
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test al, 4
je 0x1400023f6
lea rbx, str.ios_base::badbit_set
jmp 0x14000240a
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140001510
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140001e80
lea rdx, [0x1400400d0]
lea rcx, [rbp + 0x60]
call fcn.14000db00
nop
test dl, 4
je 0x140002447
lea rbx, str.ios_base::badbit_set
jmp 0x14000245c
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140001510
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140001e80
lea rdx, [0x1400400d0]
lea rcx, [rbp + 0x60]
call fcn.14000db00
nop
call fcn.1400013a0
int3
call fcn.140018b20
int3