Function at 0x140117380
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r13, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x140306a10]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140306a60]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1401176a4
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x60], rax
xor edi, edi
mov dword [rsp + 0x68], edi
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15, rax
mov qword [rsp + 0x78], rax
mov edx, 0x132
xor ecx, ecx
lea r8d, [rdi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140117685
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rsi, eax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140117685
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test esi, esi
je 0x1401174b2
mov r8, rsi
lea edx, [rdi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140117498
mov edi, esi
mov dword [rsp + 0x68], esi
jmp 0x14011749d
xor sil, sil
jmp 0x1401174b5
test esi, esi
jle 0x1401174b2
mov r9, rsi
movsxd rdx, edi
mov r8, r12
mov rcx, rbx
call fcn.1402beb60
mov sil, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test sil, sil
je 0x140117685
xor esi, esi
mov edx, esi
test edi, edi
jle 0x14011753d
cmp edi, 0x20
jb 0x14011751f
mov eax, edi
and eax, 0x8000001f
jge 0x1401174e4
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, edi
sub r8d, eax
movdqa xmm1, xmmword [0x1403796f0]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm1
movdqu xmmword [rax + rbx], xmm0
lea eax, [rdx + 0x10]
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm1
movdqu xmmword [rcx + rbx], xmm0
add edx, 0x20
cmp edx, r8d
jl 0x1401174f2
cmp edx, edi
jge 0x14011753d
movsxd r8, edx
add r8, rbx
mov r9d, edi
sub r9d, edx
nop
xor byte [r8], 0xee
lea r8, [r8 + 1]
dec r9
jne 0x140117530
mov qword [rsp + 0x30], rsi
movsxd rdx, edi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x140306a70]
call qword [rax]
test eax, eax
js 0x140117685
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
call qword [rax + 0x28]
test eax, eax
js 0x14011767a
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x140306a20]
call qword [rax]
test eax, eax
js 0x14011767a
lea r8, [0x140430c20]
lea rdx, [0x1401176e0]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.1401438b0
test eax, eax
jne 0x14011766f
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140143fb0
test eax, eax
jne 0x14011766f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140430c28], eax
mov byte [0x140430b99], sil
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
call qword [rax + 0x18]
mov dword [0x140430c28], esi
test eax, eax
js 0x140117663
movzx eax, byte [0x140430b99]
mov byte [r13], al
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.1401440e0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x1401176a4
mov r8, rbx
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret