Function at 0x140002180
Capabilities:
Check if file exists
Create thread
Delete file
Enumerate process modules
Extract resource via kernel32 functions
Get file attributes
Inject dll
Inject thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140021040]
xor rax, rsp
mov qword [rbp + 0x410], rax
call fcn.140001ac0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea r8, [0x14001bcc8]
mov edx, 0x65
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov ecx, eax
call fcn.1400090b8
mov r15, rax
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call fcn.1400126d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsp + 0x48]
call fcn.140001930
mov rdi, rax
mov r12d, 1
mov edx, r12d
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x78], rax
mov rcx, qword [rdi]
mov edx, dword [rcx - 8]
add edx, 9
lea rcx, [rsp + 0x78]
call fcn.140001680
mov rdx, qword [rdi]
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400126d0
mov rax, qword [rdi]
movsxd rcx, dword [rax - 8]
movups xmm0, xmmword [str.3dmb1.dll]
movups xmmword [rbx + rcx*2], xmm0
movzx eax, word [0x14001bce0]
mov word [rbx + rcx*2 + 0x10], ax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400022b7
lea rcx, [rax - 8]
call fcn.140008c88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r13, 0xffffffffffffffff
lea rdi, vtable.SFile.0
cmp eax, 0xffffffff
je 0x14000231d
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x40], rax
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x40]
call fcn.140001680
mov eax, dword [rbx - 8]
add eax, eax
movsxd r8, eax
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.1400126d0
lea rcx, [rsp + 0x40]
call fcn.140001c20
cmp eax, esi
je 0x14000240c
mov rcx, rbx
call fcn.140001b70
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x40], rax
mov rdx, r13
nop
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140002340
lea rcx, [rsp + 0x40]
call fcn.140001680
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
mov rdx, rbx
call fcn.1400126d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400012d0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140002399
lea rcx, [rax - 8]
call fcn.140008c88
mov qword [rsp + 0x60], rdi
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x70], rax
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140001560
mov rdi, qword [rsp + 0x68]
test esi, esi
je 0x1400023eb
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rdi, rdi
je 0x1400023f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000240c
add rcx, 0xfffffffffffffff8
call fcn.140008c88
mov rcx, r15
call fcn.140008c88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
lea r8, [0x14001bcc8]
mov edx, 0x66
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
mov ecx, eax
call fcn.1400090b8
mov qword [rsp + 0x50], rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1400126d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rbp - 0x80]
call fcn.140001930
mov rsi, rax
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x48], rax
mov rcx, qword [rsi]
mov edx, dword [rcx - 8]
add edx, 8
lea rcx, [rsp + 0x48]
call fcn.140001680
mov rdx, qword [rsi]
mov ecx, dword [rdx - 8]
add ecx, ecx
movsxd r8, ecx
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400126d0
mov rax, qword [rsi]
movsxd rcx, dword [rax - 8]
movups xmm0, xmmword [str.3dm.sogp]
movups xmmword [rdi + rcx*2], xmm0
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x1400024fd
lea rcx, [rax - 8]
call fcn.140008c88
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002556
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x40], rax
mov edx, dword [rdi - 8]
lea rcx, [rsp + 0x40]
call fcn.140001680
mov eax, dword [rdi - 8]
add eax, eax
movsxd r8, eax
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call fcn.1400126d0
lea rcx, [rsp + 0x40]
call fcn.140001c20
cmp eax, r14d
je 0x140002662
mov rcx, rdi
call fcn.140001b70
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x40], rax
mov rdx, r13
nop word [rax + rax]
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140002580
lea rcx, [rsp + 0x40]
call fcn.140001680
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
mov rdx, rdi
call fcn.1400126d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400012d0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1400025d9
lea rcx, [rax - 8]
call fcn.140008c88
lea rax, vtable.SFile.0
mov qword [rsp + 0x60], rax
mov rdx, r12
mov ecx, 0xa
call fcn.1400087e0
add rax, 8
mov qword [rsp + 0x70], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140001560
mov rsi, qword [rsp + 0x68]
test r14d, r14d
je 0x14000263a
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, r14d
mov r14, qword [rsp + 0x50]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000263f
mov r14, qword [rsp + 0x50]
test rsi, rsi
je 0x14000264d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140002667
add rcx, 0xfffffffffffffff8
call fcn.140008c88
jmp 0x140002667
mov r14, qword [rsp + 0x50]
mov rcx, r14
call fcn.140008c88
call fcn.140001df0
mov r15d, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3e0], xmm1
mov r8, r13
inc r8
cmp word [rbx + r8*2], 0
jne 0x140002693
mov rdx, rbx
lea rcx, [rbp + 0x3d0]
call fcn.140002c40
nop
mov r8d, r15d
xor edx, edx
mov ecx, 0x100c3a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov r8, qword [rbp + 0x3d0]
mov rdx, qword [rbp + 0x3e8]
test rax, rax
je 0x140002a2e
lea rcx, [rbp + 0x3d0]
cmp rdx, 7
cmova rcx, r8
mov r9, qword [rbp + 0x3e0]
lea r10, [rcx + r9*2]
lea rax, [rbp + 0x3d0]
cmova rax, r8
cmp rax, r10
je 0x14000272b
cmp word [rax], 0x2f
jne 0x14000270d
mov word [rax], 0x5c
add rax, 2
cmp rax, r10
jne 0x140002702
mov rdx, qword [rbp + 0x3e8]
mov r9, qword [rbp + 0x3e0]
mov r8, qword [rbp + 0x3d0]
lea r11, [rbp + 0x3d0]
cmp rdx, 7
cmova r11, r8
xor esi, esi
test r9, r9
je 0x140002a30
mov rax, r9
mov rcx, r11
mov r10d, esi
cmp word [r11], 0x5c
je 0x140002768
cmp rax, 1
je 0x14000276b
dec rax
add rcx, 2
cmp word [rcx], 0x5c
jne 0x140002755
mov r10, rcx
test r10, r10
je 0x140002a30
sub r10, r11
sar r10, 1
cmp r10, 0xffffffffffffffff
je 0x140002a30
lea r10, [rbp + 0x3d0]
cmp rdx, 7
cmova r10, r8
test r9, r9
je 0x1400027c7
lea rcx, [r9 - 1]
mov rax, r13
cmp rcx, rax
cmovb rax, rcx
lea rcx, [r10 + rax*2]
cmp word [rcx], 0x5c
je 0x1400027bf
cmp rcx, r10
je 0x1400027c7
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400027b0
sub rcx, r10
sar rcx, 1
jmp 0x1400027ca
mov rcx, r13
inc rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rsi
mov qword [rbp + 0x408], rsi
cmp r9, rcx
jb 0x140002ad7
sub r9, rcx
cmp r9, 0xffffffffffffffff
cmovb r13, r9
lea rax, [rbp + 0x3d0]
cmp rdx, 7
cmova rax, r8
lea rdx, [rax + rcx*2]
mov r8, r13
lea rcx, [rbp + 0x3f0]
call fcn.140002c40
lea rdx, [rbp + 0x3f0]
mov ecx, r15d
call fcn.140001d20
test rax, rax
jne 0x1400029bf
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
xor r13b, r13b
test rax, rax
je 0x1400029b6
mov rcx, qword [rbp + 0x3e0]
lea r9, [rcx*2 + 2]
lea r8, [rbp + 0x3d0]
cmp qword [rbp + 0x3e8], 7
cmova r8, qword [rbp + 0x3d0]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000290e
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029b6
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r15, rax
test rax, rax
je 0x140002909
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13b, 1
mov r15d, dword [rsp + 0x40]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test r13b, r13b
je 0x1400029b6
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov edx, r15d
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400029b6
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400029a8
nop dword [rax + rax]
lea rcx, [rbp + 0x3f0]
cmp qword [rbp + 0x408], 7
cmova rcx, qword [rbp + 0x3f0]
lea rdx, [rbp - 0x40]
call fcn.1400088c4
test eax, eax
cmove rsi, qword [rbp - 0x48]
lea rdx, [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140002970
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
jne 0x1400029bd
xor esi, esi
mov r12d, esi
jmp 0x1400029bf
xor esi, esi
mov rdx, qword [rbp + 0x408]
cmp rdx, 7
jbe 0x140002a05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002add
call fcn.1400034a8
mov qword [rbp + 0x400], rsi
mov qword [rbp + 0x408], 7
mov word [rbp + 0x3f0], si
mov rdx, qword [rbp + 0x3e8]
mov r8, qword [rbp + 0x3d0]
jmp 0x140002a33
xor esi, esi
mov r12d, esi
cmp rdx, 7
jbe 0x140002a6a
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140002a62
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ad1
mov rcx, r8
call fcn.1400034a8
movdqa xmm0, xmmword [0x14001d790]
movdqu xmmword [rbp + 0x3e0], xmm0
mov word [rbp + 0x3d0], si
test rdi, rdi
je 0x140002a90
lea rcx, [rdi - 8]
call fcn.140008c88
nop
test rbx, rbx
je 0x140002a9e
lea rcx, [rbx - 8]
call fcn.140008c88
mov eax, r12d
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140003090
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009040
nop
call fcn.140002c20
int3
call fcn.140009040
int3