Function at 0x1400a0840
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x71], rcx
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x49]
call fcn.14027b2c0
mov qword [rbp - 0x41], 0xffffffffffffffff
xor esi, esi
mov qword [rbp - 0x39], rsi
lea rax, [0x14045d5e0]
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x31], rsi
mov dword [rbp - 0x29], esi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
lea rcx, vtable.TiXmlDocument.0
mov qword [rbp - 0x49], rcx
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x1b], 0xffffffffffffffff
mov dword [rbp + 0x17], 4
mov byte [rbp + 0x23], sil
mov byte [rbp + 7], sil
mov dword [rbp + 0xb], esi
xor r8d, r8d
lea rdx, [0x140340108]
lea rcx, [rbp + 0xf]
call fcn.140061140
mov qword [rbp + 0x1b], rsi
mov r12d, esi
mov dword [rbp - 0x79], esi
mov dword [rbp - 0x61], esi
mov dword [rbp - 0x69], esi
mov r13d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea r8, str.RESDATA
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400a0992
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a0992
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400a0992
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400a0990
lea rcx, [rsi + 4]
call fcn.14012a2dc
mov r13, rax
lea r8, [rsi + 4]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov r8d, esi
mov rdx, r14
mov rcx, r13
call fcn.140278ed0
mov dword [rbp - 0x61], esi
xor esi, esi
mov r15, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea r8, [0x140337578]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400a0a22
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a0a22
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400a0a22
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400a0a20
lea rcx, [rsi + 4]
call fcn.14012a2dc
mov r15, rax
lea r8, [rsi + 4]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov r8d, esi
mov rdx, r14
mov rcx, r15
call fcn.140278ed0
mov r14d, esi
xor esi, esi
jmp 0x1400a0a26
xor esi, esi
mov r14d, dword [rbp - 0x69]
test r13, r13
je 0x1400a0cb7
test r15, r15
je 0x1400a0cb7
mov edi, esi
lea rax, str.https:__yyds.cleanupsys.com_ip.txt
cmp dword [0x14045e968], r12d
jne 0x1400a0cb7
mov rbx, qword [0x14045d5a8]
test rbx, rbx
jne 0x1400a0a79
lea ecx, [rbx + 4]
call fcn.14012a618
mov rbx, rax
mov qword [rbp - 0x69], rax
mov dword [rax], esi
mov qword [0x14045d5a8], rax
lea rax, str.https:__yyds.cleanupsys.com_ip.txt
movsxd rcx, edi
imul rsi, rcx, 0x104
add rsi, rax
call fcn.14005cc30
mov rdx, rsi
call fcn.14005d130
test eax, eax
jne 0x1400a0aca
call fcn.1400655d0
mov rcx, rax
mov rdx, rsi
call fcn.140065630
test eax, eax
jne 0x1400a0ac2
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 2
jae 0x1400a0ad8
xor esi, esi
jmp 0x1400a0a3a
mov dword [rbx], 1
jmp 0x1400a0acd
mov dword [rbx], r12d
mov dword [0x14045e328], edi
call fcn.14009fe30
cmp dword [0x14045e968], r12d
jne 0x1400a0cb7
mov rax, qword [0x14045d5a8]
test rax, rax
jne 0x1400a0b07
lea ecx, [rax + 4]
call fcn.14012a618
mov qword [rbp - 0x69], rax
mov dword [rax], r12d
mov qword [0x14045d5a8], rax
movsxd rcx, dword [0x14045e328]
imul rbx, rcx, 0x104
lea rcx, str.https:__www.cleanupsys.com_config.xml
add rbx, rcx
mov ecx, dword [rax]
test ecx, ecx
jne 0x1400a0b3f
call fcn.14005cc30
lea r8, [rbp - 0x79]
mov rdx, rbx
call fcn.14005d230
mov rdi, rax
mov r12d, dword [rbp - 0x79]
jmp 0x1400a0b63
cmp ecx, 1
jne 0x1400a0b61
call fcn.1400655d0
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, rbx
call fcn.1400658a0
mov rdi, rax
mov r12d, dword [rbp - 0x79]
jmp 0x1400a0b63
xor edi, edi
cmp dword [0x14045e968], 0
jne 0x1400a0cb7
test rdi, rdi
je 0x1400a0c30
test r12d, r12d
je 0x1400a0c30
mov r8d, r12d
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.140062440
test al, al
je 0x1400a0c22
mov rbx, qword [rbp - 0x21]
test rbx, rbx
je 0x1400a0bef
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
test rax, rax
jne 0x1400a0bbf
mov rbx, qword [rbx + 0x48]
test rbx, rbx
jne 0x1400a0ba2
mov rbx, qword [rbp - 0x21]
jmp 0x1400a0bef
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rsi, qword [rbp - 0x71]
test rax, rax
je 0x1400a0be9
mov rdx, rax
mov rcx, rsi
call fcn.1400a0450
cmp dword [0x14045e968], 0
jne 0x1400a0cb7
mov rbx, qword [rbp - 0x21]
jmp 0x1400a0bf3
mov rsi, qword [rbp - 0x71]
test rbx, rbx
je 0x1400a0c16
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx + 0x48]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test rbx, rbx
jne 0x1400a0c00
xor eax, eax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
jmp 0x1400a0c26
mov rsi, qword [rbp - 0x71]
mov rcx, rdi
call fcn.14012a2d4
jmp 0x1400a0c34
mov rsi, qword [rbp - 0x71]
mov ebx, dword [rbp - 0x61]
mov edx, ebx
mov rcx, r13
call fcn.1400b14c0
cmp dword [0x14045e968], 0
jne 0x1400a0cb7
mov edx, r14d
mov rcx, r15
call fcn.1400a7960
cmp dword [0x14045e968], 0
jne 0x1400a0cb7
mov r8d, ebx
xor edx, edx
mov rcx, r13
call fcn.14027b2c0
mov r8d, r14d
xor edx, edx
mov rcx, r15
call fcn.14027b2c0
mov rcx, r13
call fcn.14012a2d4
mov rcx, r15
call fcn.14012a2d4
cmp dword [0x14045e968], 0
jne 0x1400a0cb7
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x1400929c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0xb50], rax
lea rax, vtable.TiXmlDocument.0
mov qword [rbp - 0x49], rax
mov rcx, qword [rbp + 0xf]
lea rdi, [0x14045d5e0]
cmp rcx, rdi
je 0x1400a0cd7
call fcn.14012a2d4
lea rax, vtable.TiXmlNode.0
mov qword [rbp - 0x49], rax
mov rbx, qword [rbp - 0x21]
test rbx, rbx
je 0x1400a0d06
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx + 0x48]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test rbx, rbx
jne 0x1400a0cf0
mov rcx, qword [rbp - 0x11]
cmp rcx, rdi
je 0x1400a0d14
call fcn.14012a2d4
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14012a2b0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret