Function at 0x14000c690
Capabilities:
Create pipe
Create thread
Delete file
Extract resource via kernel32 functions
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x890], rax
call fcn.14000c350
xor edx, edx
lea rcx, str._simple1.zip
call fcn.140007a00
lea r8, str._simple.bmp
mov rcx, rax
lea rdx, str.znsimple.bmp
mov rbx, rax
call fcn.140007fd0
lea r8, str._simple.txt
mov rcx, rbx
lea rdx, str.znsimple.txt
call fcn.140007fd0
mov rcx, rbx
call fcn.140001b30
mov rcx, rbx
test al, al
je 0x14000c71d
call fcn.140001000
jmp 0x14000c722
call fcn.1400078c0
lea rcx, str.Created__simple1.zip_n
call fcn.14000caa0
xor edx, edx
lea rcx, str._simple1.zip
call fcn.140001d50
lea rdx, [0x140026f30]
mov rcx, rax
mov rdi, rax
call fcn.140001e90
lea r8, [rsp + 0x70]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.140001ad0
mov esi, dword [rsp + 0x70]
xor r14d, r14d
mov ebx, r14d
test esi, esi
jle 0x14000c794
nop
lea r8, [rsp + 0x70]
mov edx, ebx
mov rcx, rdi
call fcn.140001ad0
lea r8, [rsp + 0x74]
mov edx, ebx
mov rcx, rdi
call fcn.140002480
inc ebx
cmp ebx, esi
jl 0x14000c770
mov rcx, rdi
call fcn.140001b30
mov rcx, rdi
test al, al
je 0x14000c7aa
call fcn.140001000
jmp 0x14000c7af
call fcn.1400078c0
lea rcx, str.Unzipped_znsimple.bmp_and_znsimple.txt_from_simple1.zip_n
call fcn.14000caa0
lea r8, str.password
mov edx, 0x186a0
xor ecx, ecx
call fcn.1400079f0
lea r8, str._simple.txt
mov rcx, rax
lea rdx, str.znsimple.txt
mov rdi, rax
call fcn.140007fd0
mov edx, r14d
lea r8, [rbp + 0xa0]
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
lea r8, [r8 + 1]
and cl, 0x7f
inc edx
mov byte [r8 - 1], cl
cmp edx, 0x3e8
jl 0x14000c800
mov r9d, 0x3e8
lea r8, [rbp + 0xa0]
lea rdx, str.simple.dat
mov rcx, rdi
call fcn.140008030
xor r9d, r9d
lea rdx, [rsp + 0x58]
xor r8d, r8d
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov r9, qword [rsp + 0x58]
lea r8, [0x14000c600]
xor edx, edx
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0x48]
lea rdx, str.simple3.dat
mov r9d, 0x3e8
mov rcx, rdi
mov rbx, rax
call fcn.140008090
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x44]
mov rcx, rdi
lea rdx, [rsp + 0x60]
call fcn.1400080f0
mov qword [rsp + 0x30], r14
lea rcx, str._simple3___pwd_is_password.zip
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140001b30
mov rcx, rdi
test al, al
je 0x14000c927
call fcn.140001000
jmp 0x14000c92c
call fcn.1400078c0
lea rcx, str.Created_simple3.zip_via_pagefile_n
call fcn.14000caa0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 1
mov rcx, rax
mov rsi, rax
lea r8d, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r8d, r8d
mov rcx, rbx
mov edx, eax
call fcn.140001d40
lea rdx, [0x140026f30]
mov rcx, rax
mov rdi, rax
call fcn.140001e90
lea rax, [rsp + 0x70]
mov r8b, 1
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [0x140027990]
mov rcx, rdi
call fcn.140001280
mov edx, dword [rsp + 0x40]
lea r8, [rsp + 0x74]
mov rcx, rdi
call fcn.140002480
movsxd rcx, dword [rbp + 0x98]
call fcn.14000cb38
mov r9d, dword [rbp + 0x98]
mov r8, rax
mov edx, dword [rsp + 0x40]
mov rcx, rdi
mov rbx, rax
call fcn.140002420
mov rcx, rbx
call fcn.14000cb30
nop word [rax + rax]
mov edx, dword [rsp + 0x40]
lea r8, [rbp + 0x490]
mov r9d, 0x400
mov rcx, rdi
call fcn.140002420
cmp eax, 0x600
je 0x14000ca00
mov rcx, rdi
call fcn.140001b30
mov rcx, rdi
test al, al
je 0x14000ca36
call fcn.140001000
jmp 0x14000ca3b
call fcn.1400078c0
lea rcx, str.Unzipped_simple.jpg_from_resource_zipfile_n
call fcn.14000caa0
lea rcx, str._simple.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str._simple.bmp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.Deleted_simple.txt_and_simple.bmp_n
call fcn.14000caa0
xor eax, eax
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.14000ce70
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret