Function at 0x140002ce0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov r15, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1400071d0], r15
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x1400071d8], rax
mov edx, 0x6f
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov ebx, dword [rsp + 0x34]
mov rcx, rbx
call fcn.140002ae0
mov rdi, rax
mov ecx, 0x1000
call fcn.140002ae0
mov rsi, rax
mov ecx, 4
mov edx, 0xd
mov r8d, 0xec
mov r9d, ebp
call fcn.140002ae0
xor ecx, ecx
mov rdx, rdi
mov r8d, esi
mov r9d, eax
call r15
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rdx, r14
mov r8, rbx
call fcn.140002ab0
mov rsi, qword [rsp + 0x38]
xor ecx, ecx
mov edx, ebp
call fcn.140002ae0
mov ecx, dword [rsp + 0x34]
test rsi, rsi
je 0x140003195
cmp ecx, eax
je 0x140003195
mov ecx, 5
mov edx, 0x1171be13
call fcn.140002ae0
mov ecx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rdx
cmp ecx, eax
jbe 0x1400031ef
mov rax, qword [rsp + 0x38]
mov esi, dword [rax]
mov ecx, 0x2e786f72
mov r8d, 0x4f7646
mov edx, esi
call fcn.140002ae0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rcx
cmp esi, eax
jne 0x1400031ef
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x33]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov dword [rsp + 0x4c], ecx
movzx edx, byte [rsp + 0x33]
mov r8d, 7
xor ecx, ecx
call fcn.140002ae0
mov rsi, rax
movzx ebx, byte [rsp + 0x33]
movzx r9d, byte [rsp + 0x33]
mov ecx, 4
mov edx, 0xf6
mov r8d, 0x3bfa2d
call fcn.140002ae0
mov ecx, dword [rsp + 0x4c]
cmp bl, sil
je 0x140003200
cmp ecx, eax
jle 0x140003200
movzx eax, byte [rsp + 0x33]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov ecx, 4
mov r8, rdx
mov r9, rdx
call fcn.140002ae0
add rax, qword [rsp + 0x40]
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
mov ecx, 0xfffffffb
mov r8d, 0x4669b0
call fcn.140002ae0
mov rsi, rax
add esi, dword [rsp + 0x4c]
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x20], r8
mov ecx, 2
mov edx, 0xffca66
mov r9, r8
call fcn.140002ae0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
cmp esi, eax
jb 0x1400031ef
mov qword [rsp + 0x20], 0x440704
mov ecx, 0xfffffffc
mov edx, 0x8d
mov r8d, 0x322425a0
mov r9d, 0xcc
call fcn.140002ae0
mov rsi, rax
add esi, dword [rsp + 0x4c]
mov qword [rsp + 0x98], rsi
mov dword [rsp + 0x20], esi
mov ecx, 1
mov r8d, 0x36
mov r9d, 0x1c03bd
mov edx, esi
call fcn.140002ae0
xor ecx, ecx
cmp al, byte [rsp + 0x33]
adc rcx, 1
mov qword [rsp + 0xa0], rcx
mov ecx, 1
mov edx, 0xe8
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
and rax, qword [rsp + 0x98]
mov qword [rsp + 0xb0], rax
mov ecx, 3
mov edx, 0xc0
mov r8d, 0x68
call fcn.140002ae0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], 2
cmp esi, eax
je 0x14000313c
mov edx, 0xdc021b
mov rcx, 0xfffffffffffffffe
call fcn.140002ae0
mov rsi, rax
add rsi, qword [rsp + 0x98]
mov qword [rsp + 0x20], rsi
mov edx, 0xd4
mov rcx, 0xfffffffffffffffe
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
and rax, rsi
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 2
mov qword [rsp + 0x78], 0
xor r14d, r14d
nop dword [rax]
mov r15, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rsi, qword [rsp + 0x40]
mov ebx, 0
cmovb rbx, rsi
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rax + rbp]
mov rdx, qword [rsp + 0x60]
xor cl, byte [rdx + rbx]
mov byte [rax + rbp], cl
mov ecx, 1
mov edx, 4
mov r8d, 0x7c
mov r9d, 0xba68b1
call fcn.140002ae0
mov rdi, rax
add rdi, rbx
mov ecx, 1
mov edx, 0xf9
mov r8, rsi
call fcn.140002ae0
or rax, rbp
cmp rdi, qword [rsp + 0x40]
cmovae rdi, r14
mov rcx, qword [rsp + 0x50]
movzx edx, byte [rcx + rax]
mov rbx, qword [rsp + 0x60]
xor dl, byte [rbx + rdi]
mov byte [rcx + rax], dl
mov ecx, 1
mov edx, 0xc5cf56
mov r8d, 0x2e036f
call fcn.140002ae0
mov rbx, rax
add rbx, rdi
mov ecx, 2
mov edx, 0x97
mov r8, rsi
call fcn.140002ae0
mov rsi, rax
add rsi, rbp
mov ecx, 2
mov edx, 0x3b
call fcn.140002ae0
add rax, r15
cmp rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rsi
jne 0x140003040
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa8], rax
mov edx, 0x81
xor ecx, ecx
call fcn.140002ae0
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdx
cmp rcx, rax
je 0x1400031ef
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
jae 0x1400031c6
mov rax, qword [rsp + 0xa8]
jmp 0x1400031c8
mov edx, 0xd86216
xor ecx, ecx
call fcn.140002ae0
lea rdx, [0x1400061b3]
xor ecx, ecx
xor r8d, r8d
mov r9d, eax
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xc0]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x60]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
lea rdx, str.rrGzva6ytb2up69rrGxqaevp6f
call fcn.140001000
mov rcx, qword [rsp + 0x90]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_FreeResource]
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
mov ah, byte [rcx + 8]
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
invalid
invalid
invalid
invalid
invalid
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
invalid
invalid
mov ah, byte [rcx + 8]
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
add byte [rdx + rcx*4 - 0x5bfff79f], 0x11
mov ah, byte [rcx + 8]
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
or dl, byte [0xe134731a]
lodsb al, byte [rsi]
jnp 0x14000c992
add ecx, esi
mov ah, byte [rcx + 8]
add byte [rcx + rdx + 0x618a8480], ah
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
invalid
or byte [rax], al
movsb byte [rdi], byte [rsi]
adc dword [rax + 0x8618a84], eax
add byte [rcx + rdx + 0x618a8480], ah
mov ah, byte [rcx + 0xa]
or dl, byte [0xe134731a]
adc eax, 0xa133a980
lodsb al, byte [rsi]
jnp 0x14000c992
add ecx, esi
jg 0x14000c9e9
outsd dx, dword [rsi]
movsd dword [rdi], dword [rsi]
invalid
or dword [rcx], eax
push 0x5a400080
invalid
pop rdi
out dx, eax
pop rbp
add byte [rdx], bl
and byte [rax], al
add byte [rax - 0x56ffdc1a], dl
rcr dword [rsi + 0x1c6f731e], 0x82
invalid
add byte [rax - 0x56ffdc1a], dl
rcr dword [rsi + 0x1c6f731e], 0x82
invalid
invalid
jb 0x14000c9c4
stosd dword [rdi], eax
retf
lodsd eax, dword [rsi]
push rsp
sub cl, byte [0x18f28a5c4]
invalid
sahf
xor al, 0x83
add dword [rbx - 0x790db85f], 0
xchg byte [rax], al
xchg byte [rax], al
call 0xd600fddb
or byte [rax + 3], al
int1
adc eax, eax
stc
clc
sal dword [rsi], cl
jnp 0x14000ca0b
invalid
jmp 0x14000c9ec
add byte [rsi], 0x8e
sbb eax, 0x5ca6763b
invalid
in al, dx
test eax, 0x22a747f
sub al, byte [rdx]
sub al, byte [rdx]
movabs eax, dword [0xd00201d3d2046d0]
sub al, byte [r8]
xchg esi, eax
mov ebp, 0xfd77f026
jge case.0x140003217.21
fild dword [rax + riz*4]
xor ecx, 0xae81f1f1
invalid
scasb al, byte [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
retf
sub dword [rsi - 0x16345152], 0x3e4e8075
invalid
invalid
or eax, 0x483a0020
invalid
out dx, eax
stosb byte [rdi], al
adc al, byte [rax + 0x28f893b]
cmpsb byte [rsi], byte [rdi]
loop 0x14000ca32
adc byte [rbx - 0xa], 0xb6
mov ebp, 0x31313808
or byte [rax], bh
xor dword [rcx], esi
push rcx
invalid