Function at 0x140004435
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
jmp 0x1400165a0
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r14, rcx
lea rcx, str.ENTER_CreateINF___n
call fcn.140003224
mov edx, 0x69
xor ecx, ecx
lea r8d, [rdx - 0x5f]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400165fa
xor al, al
jmp 0x1400167d9
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400165f3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400165f3
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
test eax, eax
je 0x1400165f3
xor r12d, r12d
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x21], 0x44
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
lea edx, [r12 + 0x44]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x29], rax
mov edx, dword [rbp - 0x21]
lea ecx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x19], rax
xor ecx, ecx
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rcx
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], rcx
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rcx
mov qword [rbp + 0x27], rcx
mov qword [rbp + 0x2f], rcx
mov qword [rbp + 0x37], rcx
mov r8, qword [rbp - 0x29]
test r8, r8
je 0x1400167b6
test rax, rax
je 0x1400167b6
lea r9, [rbp - 0x21]
xor edx, edx
lea ecx, [rdx + 0x16]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1400167b6
mov dword [rbp - 9], 0x1fffff
mov qword [rbp - 5], 2
mov dword [rbp + 0x13], r12d
mov dword [rbp + 0x17], 5
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0x1f], rax
lea r9, [rbp - 0x11]
xor r8d, r8d
lea rdx, [rbp - 9]
lea ecx, [r12 + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1400167b6
lea edx, [rax + 1]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400167b6
xor r9d, r9d
mov r8, qword [rbp - 0x11]
lea edx, [r12 + 1]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1400167b6
mov dword [rbp + 0x27], 0x18
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x2f], rax
mov dword [rbp + 0x37], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x27]
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140016835
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, eax
lea rcx, str.Create_INF_File_Failed:__d
call fcn.140003224
cmp ebx, 0x50
jne 0x1400167b6
lea rcx, str.Delete_previous_INF_file_n
call fcn.140003224
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400167fa
lea rcx, str.Delete_FILE_FAILED.
call fcn.140003224
xor bl, bl
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, bl
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r9, [rbp + 0x27]
cmp dword [rbp + 0x27], 0
cmove r9, r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400167b6
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002018
lea rcx, str.EXIT_CreateINF__
call fcn.140003224
test ebx, ebx
setne bl
jmp 0x1400167b8