Function at 0x140001550
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x140
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
lea rcx, [r11 - 0x38]
mov rax, qword [str.c:_vssfix.reg]
mov qword [rcx], rax
mov rax, qword [0x14003a908]
mov qword [rcx + 8], rax
mov rax, qword [0x14003a910]
mov qword [rcx + 0x10], rax
mov eax, dword [0x14003a918]
mov dword [rcx + 0x18], eax
call fcn.1400113ec
mov rcx, qword [rax + 8]
lea r8, [0x14003a920]
mov edx, 0x83
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
call fcn.1400113ec
mov rcx, qword [rax + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
call fcn.1400113ec
mov rcx, qword [rax + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea ecx, [rdi + 1]
call fcn.140002228
mov rbp, rax
mov r8, rdi
mov byte [rdi + rax], 0
mov rdx, rbx
mov rcx, rax
call fcn.14001b0a0
lea rcx, [rsp + 0x78]
call fcn.1400119a0
nop
xor r9d, r9d
mov r8d, 0x1001
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call fcn.1400122d4
test eax, eax
jne 0x14000168d
mov edx, 0x3e9
mov rcx, rsi
call fcn.140007634
mov rcx, rax
lea rdx, str.Error_creating_.reg_file
call fcn.1400077b0
nop
lea rcx, [rsp + 0x78]
call fcn.140011c0c
jmp 0x140001863
mov r8d, edi
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.140011620
lea rcx, [rsp + 0x78]
call fcn.140011918
call fcn.1400124c8
mov r11, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400016c8
mov ecx, 0x80004005
call fcn.140001fe0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x110]
lea rdx, str.regedit__i__s__s
lea rcx, [rsp + 0x58]
call fcn.1400020b0
mov dword [rsp + 0x50], edi
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.140019990
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r11
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 1
mov word [rsp + 0xe0], r11w
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 8], 1
jle 0x140001758
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001f20
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400017f1
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x50], 0x103
jne 0x1400017f1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [rsi + 0x138]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x50], 0x103
je 0x1400017b4
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140001812
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov edi, ecx
test ecx, ecx
js 0x140001858
cmp edi, dword [rbx - 0xc]
jg 0x140001858
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14000184c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x78]
call fcn.140011c0c
jmp 0x140001863
mov ecx, 0x80070057
call fcn.140001fe0
nop
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140018f50
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret