Function at 0x14005b020
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbc0]
sub rsp, 0xcc0
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0xbb0], rax
mov r15, r9
mov r12d, r8d
mov r13, rcx
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x14005b4c5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x14005b4ba
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x370]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005b0d0
mov r8d, eax
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x48]
call fcn.1400047f0
lea rdx, [0x140121f80]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14005b100
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140010760
lea r8, [0x140121fb0]
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14005b43b
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14005b43b
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14005b43b
lea rax, [0x1401784b8]
cmp word [0x1401784b8], 0
jne 0x14005b1cb
mov ebx, 0x22
mov word [0x1401784b8], bx
mov r8d, 0xfe
lea rdx, [0x1401784ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401784b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x1401784b8]
mov word [rax + rcx*2], bx
mov r9, rax
lea r8, str._Command___s_
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14002f3c0
mov rbx, rsi
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400e5de0
test rsi, rsi
jne 0x14005b20f
xor ecx, ecx
jmp 0x14005b21c
mov rcx, rdi
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x14005b212
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400047f0
lea r8, [rsp + 0x50]
lea rdx, str._Command_
lea rcx, [rsp + 0x38]
call fcn.14000c1d0
mov eax, 0x88888889
mul r12d
shr edx, 5
imul eax, edx, 0x3c
sub r12d, eax
mov dword [rsp + 0x20], r12d
mov r9d, edx
lea r8, str.PT_dM_dS
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14002f3c0
lea r8, [rbp + 0x160]
lea rdx, str.PT0M30S
lea rcx, [rsp + 0x38]
call fcn.14000c1d0
test r15, r15
je 0x14005b2c3
mov r9, r15
lea r8, [0x1401220d8]
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14002f3c0
lea r8, [rbp + 0x160]
lea rdx, str._Arguments__s__Arguments_
lea rcx, [rsp + 0x38]
call fcn.14000c1d0
lea r8, str._GroupId_S_1_5_32_545__GroupId_
lea rdx, str._GroupId_Users__GroupId_
lea rcx, [rsp + 0x38]
call fcn.14000c1d0
mov rbx, qword [rsp + 0x38]
mov r15d, dword [rbx - 0xc]
lea r8, str.ST_CPL.pkg.XML
mov edx, 0x104
lea rcx, [rbp + 0x580]
call fcn.14002f3c0
lea rdx, [0x140180050]
mov ecx, 0x104
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
lea rax, [rbp + 0x580]
mov qword [rsp + 0x20], rax
lea r9, [0x140180050]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14002f3c0
lea r8, [0x140111ea8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r14d, 1
test eax, eax
jne 0x14005b39c
mov dword [rsp + 0x40], 0xfeff
mov r9, qword [rsp + 0x30]
mov r8d, r14d
lea edx, [rax + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, r15d
mov r9, qword [rsp + 0x30]
lea r8d, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__flushall]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14005b3aa
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, str.schtasks__create__Tn__s__XML___s___F
mov edx, 0x104
lea rcx, [rbp + 0x790]
call fcn.14002f3c0
mov dword [rsp + 0x44], 0xffffffff
xor r9d, r9d
lea r8, [rsp + 0x44]
mov edx, r14d
lea rcx, [rbp + 0x790]
call fcn.14005b4d0
lea r9, [rsp + 0x50]
lea r8, str.CMD__C_del___s___F
mov edx, 0x104
lea rcx, [rbp + 0x9a0]
call fcn.14002f3c0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
lea r9, str.DEL_ST_CPL
lea r8, [0x140103060]
lea rdx, [rbp + 0x9a0]
lea rcx, str.DEL_ST_CPL
call fcn.14005a830
jmp 0x14005b43e
xor r14d, r14d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005b467
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005b48d
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140050923.0]
mov eax, r14d
mov rcx, qword [rbp + 0xbb0]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0xd08]
add rsp, 0xcc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
int3