Function at 0x1800061c0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18002f008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x1800062a7
movsd xmm0, qword [0x18002a5b8]
call fcn.18000f4d8
cvttsd2si edx, xmm0
movsxd rbx, edx
movsd xmm0, qword [0x18002a518]
call fcn.18000f4d8
cvttsd2si ecx, xmm0
movsxd rdx, ecx
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1800062a7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1800062a7
mov ecx, dword [rax + 0x30]
mov dword [0x180030eb0], ecx
movsd xmm0, qword [0x18002a5c8]
call fcn.18000f4d8
cvttsd2si ecx, xmm0
mov edx, dword [rbx + 0x34]
shr edx, cl
mov word [0x180030eb4], dx
movzx eax, word [rbx + 0x34]
mov word [0x180030eb6], ax
movsd xmm0, qword [0x18002a5a0]
call fcn.18000f4d8
cvttsd2si ecx, xmm0
movzx edx, byte [0x180030eb2]
shl dx, cl
movzx eax, byte [0x180030eb0]
or dx, ax
mov word [rsi], dx
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si ecx, xmm0
movzx eax, word [rsi]
cmp eax, ecx
mov ecx, dword [0x180030258]
mov rax, qword gs:[0x58]
mov rbx, qword [rax + rcx*8]
jne 0x1800063cc
movdqa xmm0, xmmword [0x18002aa20]
movdqa xmm1, xmmword [0x18002aab0]
movdqa xmm2, xmmword [0x18002aa30]
mov dword [rbp - 0x10], 0x9cf0f22a
mov ecx, 0x858
mov eax, dword [rcx + rbx]
test al, 1
jne 0x18000635a
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x860
mov edi, eax
lea rcx, [rax + rbx]
mov byte [rcx + 0x34], 1
lea rax, [rcx + 0x33]
lea rdx, [rbp - 0xd]
cmp rcx, rdx
ja 0x18000633a
lea rdx, [rbp - 0x40]
cmp rax, rdx
jb 0x18000633a
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov eax, dword [rbp - 0x10]
mov dword [rcx + 0x30], eax
jmp 0x18000634b
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov eax, dword [rbp - 0x10]
mov dword [rcx + 0x30], eax
lea rcx, [0x1800215c0]
call fcn.1800095b0
nop
jmp 0x18000635f
mov edi, 0x860
lea r9, [rbx + rdi]
cmp byte [r9 + 0x34], 0
je 0x1800063bd
lea r8, [r9 + 1]
mov r10, r9
not r10
movabs r11, 0xf9a4fa19cfaff44
nop
lea ecx, [r8 + r10]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, r9b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r10 + r8]
cmp rax, 0x34
jb 0x180006380
mov byte [r9 + 0x34], 0
mov rcx, r9
call fcn.180009270
xor al, al
jmp 0x1800064e9
movdqa xmm0, xmmword [0x18002a800]
mov dword [rbp - 0x30], 0x46f4bdba
mov dword [rbp - 0x2c], 0x48b2a7b
mov word [rbp - 0x28], 0x93d4
mov ecx, 0x898
mov eax, dword [rcx + rbx]
test al, 1
jne 0x18000645a
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x8a0
mov edi, eax
lea rcx, [rax + rbx]
mov byte [rcx + 0x1a], 1
lea rax, [rcx + 0x19]
lea rdx, [rbp - 0x27]
cmp rcx, rdx
ja 0x180006436
lea rdx, [rbp - 0x40]
cmp rax, rdx
jb 0x180006436
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x30]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp - 0x28]
mov word [rcx + 0x18], ax
jmp 0x18000644b
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x30]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp - 0x28]
mov word [rcx + 0x18], ax
lea rcx, [0x180021590]
call fcn.1800095b0
nop
jmp 0x18000645f
mov edi, 0x8a0
lea r10, [rbx + rdi]
cmp byte [r10 + 0x1a], 0
je 0x1800064bd
lea r8, [r10 + 1]
mov r9, r10
not r9
movabs r11, 0x9ef0f5522d193de
nop
lea ecx, [r8 + r9]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, r10b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r9 + r8]
cmp rax, 0x1a
jb 0x180006480
mov byte [r10 + 0x1a], 0
movzx eax, word [0x180030eb6]
movzx r9d, word [0x180030eb4]
movzx r8d, word [0x180030eb0]
movzx edx, word [0x180030eb2]
mov dword [rsp + 0x20], eax
mov rcx, r10
call fcn.180009160
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180009470
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret