Function at 0x14001bd40
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject pe
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push r12
push r14
lea rbp, [rsp - 0x748]
sub rsp, 0x848
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rbp + 0x720], rax
xor ebx, ebx
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x68], rbx
mov r12, rdx
mov dword [rsp + 0x60], ebx
mov r14d, 0x2bc
mov qword [rsp + 0x50], rcx
call fcn.14001bc90
cmp eax, 0x40
jne 0x14001bdd5
mov dword [rsp + 0x48], ebx
mov r14d, 0x2bd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.14001bc90
cmp eax, 0x40
je 0x14001bdd5
mov rcx, qword [0x1400e2e50]
lea r9d, [rbx + 0x10]
lea r8, [0x1400c6e70]
lea rdx, str.You_must_run_64_bit_version_of_MPQEditor_to_do_this.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x3eb
jmp 0x14001c297
mov qword [rsp + 0x880], rsi
lea r8, str.RT_BINARY
mov rsi, qword [0x1400e1228]
mov rdx, r14
mov qword [rsp + 0x840], rdi
mov rcx, rsi
mov qword [rsp + 0x838], r13
mov rdi, rbx
mov qword [rsp + 0x830], r15
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14001beb8
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, rsi
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001beb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14001beb8
cmp r15d, 4
jbe 0x14001beb8
mov eax, dword [rax]
mov edx, 8
mov rcx, qword [0x1400e1230]
mov r8d, eax
mov dword [rsp + 0x40], eax
add r15d, 0xfffffffc
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14001beb8
lea r8, [rsi + 4]
mov r9d, r15d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14004bf10
cmp eax, 1
je 0x14001beb8
mov rcx, qword [0x1400e1230]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13d, ebx
mov rdi, rbx
mov dword [rsp + 0x40], r13d
jmp 0x14001bebd
mov r13d, dword [rsp + 0x40]
mov r14, qword [0x1400e1228]
lea r8, str.RT_BINARY
movzx edx, word [rsp + 0x48]
mov rcx, r14
mov rsi, rbx
mov dword [rsp + 0x44], ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14001bf85
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r15
mov rcx, r14
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001bf85
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001bf85
mov ecx, dword [rsp + 0x48]
cmp ecx, 4
jbe 0x14001bf85
mov eax, dword [rax]
lea r15d, [rcx - 4]
mov rcx, qword [0x1400e1230]
mov r8d, eax
mov edx, 8
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14001bf85
lea r8, [r14 + 4]
mov r9d, r15d
lea rdx, [rsp + 0x44]
mov rcx, rax
call fcn.14004bf10
cmp eax, 1
je 0x14001bf85
mov rcx, qword [0x1400e1230]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, rbx
mov dword [rsp + 0x44], ebx
mov r15d, ebx
jmp 0x14001bf8a
mov r15d, dword [rsp + 0x44]
test rdi, rdi
je 0x14001c242
test rsi, rsi
je 0x14001c242
mov ecx, 0xffffff00
lea eax, [r13 + 0xff]
and rax, rcx
lea r14d, [r15 + 0xfff]
mov ecx, 0xfffff000
mov qword [rsp + 0x58], rax
and r14, rcx
mov edx, 8
mov rcx, qword [0x1400e1230]
add r14, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001c23b
mov r8, r13
mov rdx, rdi
mov rcx, rax
call fcn.1400b1500
mov rcx, qword [rsp + 0x58]
mov rdx, rsi
add rcx, qword [rsp + 0x48]
mov r8d, r15d
call fcn.1400b1500
mov rcx, qword [rsp + 0x50]
mov r9d, 0x1000
mov r8, r14
mov dword [rsp + 0x20], 0x40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x14001c1d3
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov r9, r14
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp qword [rsp + 0x68], r14
jne 0x14001c234
lea rcx, [rdi + r13]
mov rax, rdi
test r12, r12
jne 0x14001c118
cmp rdi, rcx
jae 0x14001c08e
movabs rdx, 0x636f725064726854
nop dword [rax]
cmp qword [rax], rdx
je 0x14001c0a3
add rax, 8
cmp rax, rcx
jb 0x14001c080
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, 0x7f
jmp 0x14001c1db
sub rax, rdi
lea r9, [rax + 8]
add r9, r15
je 0x14001c099
mov r12, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r14, rax
test rax, rax
je 0x14001c0f6
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001c0fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x14001c1db
cmp rdi, rcx
jae 0x14001c08e
movabs rdx, 0x636f72506e69614d
nop dword [rax + rax]
cmp qword [rax], rdx
je 0x14001c143
add rax, 8
cmp rax, rcx
jb 0x14001c130
jmp 0x14001c08e
sub rax, rdi
lea r14, [rax + 8]
add r14, r15
je 0x14001c099
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rbx
lea r9, str.Wow64SetThreadContext
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
lea rdx, str.Wow64GetThreadContext
mov qword [rsp + 0x58], rbx
lea rcx, str.kernel32.dll
call fcn.14008ef10
mov rcx, qword [rsp + 0x50]
call fcn.14008ee10
test al, al
je 0x14001c1f1
xor edx, edx
mov dword [rbp - 0x80], 0x10000b
mov r8d, 0x2c8
lea rcx, [rbp - 0x7c]
call fcn.1400b1140
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [rsp + 0x70]
test eax, eax
je 0x14001c1d3
lea rdx, [rbp - 0x80]
mov dword [rbp + 0x30], r14d
mov rcx, r12
call qword [rsp + 0x58]
test eax, eax
jne 0x14001c1db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [0x1400e1230]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001c24c
lea rdx, [rbp + 0x250]
mov dword [rbp + 0x280], 0x10001f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14001c22d
mov eax, r14d
lea rdx, [rbp + 0x250]
mov rcx, r12
mov qword [rbp + 0x2d0], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14001c1db
mov ebx, 0x78
jmp 0x14001c1db
mov ebx, 0x1d
jmp 0x14001c1db
mov ebx, 8
jmp 0x14001c24c
mov ebx, 0x138f
test rsi, rsi
je 0x14001c25e
mov rcx, qword [0x1400e1230]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [rsp + 0x830]
mov r13, qword [rsp + 0x838]
mov rsi, qword [rsp + 0x880]
test rdi, rdi
je 0x14001c28d
mov rcx, qword [0x1400e1230]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x840]
mov eax, ebx
mov rcx, qword [rbp + 0x720]
xor rcx, rsp
call fcn.140094850
add rsp, 0x848
pop r14
pop r12
pop rbx
pop rbp
ret