Function at 0x140066f0c
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13d, r8d
mov rbp, rdx
mov rdi, rcx
lea r8, [0x1400f2418]
lea rdx, str.OLEAUT32.DLL
lea rcx, str.OleLoadPicture
xor r9d, r9d
call fcn.140046024
xor r12d, r12d
mov eax, 0x64
cmp rbp, r12
cmove rbp, rax
cmp rbp, 0x10000
jge 0x140066fb1
mov rbx, qword [0x1400f1ca0]
lea r8, str.IMAGE
movzx edx, bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
cmp rax, r12
jne 0x140066f8d
or eax, 0xffffffff
jmp 0x140067266
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi], eax
cmp eax, 8
jb 0x140066f85
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x140067088
cmp r13d, r12d
je 0x140066fc2
mov rax, qword [rbp]
mov dword [rdi], r13d
jmp 0x140067088
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xa8]
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rbp
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0x20], r12
call fcn.1400034e0
mov rbx, qword [rsp + 0xa8]
cmp rbx, r12
je 0x140066f85
lea r9, [rsp + 0x98]
lea rdx, [rsp + 0x48]
mov r8d, 6
mov rcx, rbx
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x98], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [rsp + 0x48]
call fcn.14004b790
cmp eax, r12d
jne 0x140067067
cmp rbx, 0xffffffffffffffff
je 0x14006705d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
jmp 0x140067266
cmp rbx, 0xffffffffffffffff
je 0x140067076
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call fcn.140056a14
mov qword [rdi + 0x40], rax
mov qword [rdi + 8], rax
mov rcx, rax
cmp rax, r12
je 0x140066f85
call fcn.14004b790
cmp eax, r12d
je 0x14006705d
mov dword [rdi + 0x28], r12d
mov dword [rdi + 0x20], r12d
mov dword [rdi + 0x2c], 0xffffff9c
mov dword [rdi + 0x24], r12d
mov qword [rdi + 0x30], r12
mov word [rsp + 0xa8], r12w
mov esi, r12d
mov dword [rsp + 0x98], r12d
cmp dword [rdi], r12d
jbe 0x140067231
mov r13d, dword [rsp + 0xa8]
mov r9, qword [rdi + 8]
mov r14d, esi
mov al, byte [r14 + r9]
cmp al, 0x2c
jne 0x1400671bc
lea eax, [rsi - 1]
cmp byte [rax + r9], r12b
jne 0x140067218
cmp dword [rdi + 0x20], r12d
jne 0x140067107
mov dword [rdi + 0x24], esi
lea eax, [rsi + 1]
mov edx, 1
movzx r8d, byte [rax + r9 + 8]
mov ecx, r8d
shr r8d, 7
and ecx, 7
inc ecx
shl edx, cl
mov rcx, r9
imul edx, r8d
lea r8d, [rdx + rdx*2 + 0xb]
lea rdx, [rsp + 0x98]
call fcn.14004b768
mov ecx, 0x10
mov r15d, eax
call fcn.1400b9688
mov r12, rax
xor eax, eax
cmp r12, rax
je 0x140067163
mov qword [r12], rax
mov dword [r12 + 8], eax
mov dword [r12 + 0xc], eax
jmp 0x140067166
mov r12, rax
mov ecx, dword [rdi + 0x20]
lea rdx, [rdi + 0x10]
mov r9d, 8
lea r8, [rdx + 8]
call fcn.14004c2bc
mov rcx, r15
mov qword [rax], r12
call fcn.1400b9688
mov r8, r15
mov qword [r12], rax
mov rcx, qword [rdi + 8]
lea rdx, [r14 + rcx]
mov rcx, rax
call fcn.1400177f8
movzx eax, r13w
mov dword [r12 + 8], r15d
mov dword [r12 + 0xc], eax
xor r12d, r12d
inc dword [rdi + 0x20]
mov r13d, r12d
lea esi, [rsi + r15 - 1]
jmp 0x140067218
cmp al, 0x21
jne 0x140067218
lea eax, [rsi + 1]
mov al, byte [rax + r9]
cmp al, 0xf9
jne 0x1400671e4
mov cx, word [r14 + r9 + 4]
movzx eax, cx
shl ax, 2
add cx, ax
add esi, 7
lea r13d, [rcx + rcx]
jmp 0x140067218
cmp al, 0xff
jne 0x1400671f0
mov r8d, 0xe
jmp 0x140067206
cmp al, 0xfe
jne 0x1400671fc
mov r8d, 2
jmp 0x140067206
cmp al, 1
jne 0x140067218
mov r8d, 0x10
lea rdx, [rsp + 0x98]
mov rcx, r9
call fcn.14004b768
add esi, eax
inc esi
mov dword [rsp + 0x98], esi
cmp esi, dword [rdi]
jb 0x1400670de
mov r13d, dword [rsp + 0xa0]
cmp dword [rdi + 0x20], 1
jle 0x140066f85
cmp r13d, r12d
je 0x14006724c
mov rax, qword [rdi + 8]
mov qword [rdi + 0x40], rax
mov qword [rbp], r12
mov edx, dword [rdi]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rdi + 0x20]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret