Function at 0x1400cf56f
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
jmp 0x1400ea4f0
push rbp
push rdi
sub rsp, 0xf68
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x3da
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402eb038]
xor rax, rbp
mov qword [rbp + 0xf10], rax
lea rcx, [0x140309080]
call fcn.1400d07c6
lea r8, [0x14027bcf8]
mov edx, 0x6d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400ea588
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0xef4], eax
lea rdx, str.FindResourceW___failed.
lea rcx, [0x1402edb20]
call fcn.1400cb974
mov ecx, dword [rbp + 0xef4]
mov edx, ecx
mov rcx, rax
call fcn.1400cd021
lea rdx, [0x14027bd04]
mov rcx, rax
call fcn.1400cb974
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400ea5dd
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0xef4], eax
lea rdx, str.LoadResource___failed.
lea rcx, [0x1402edb20]
call fcn.1400cb974
mov ecx, dword [rbp + 0xef4]
mov edx, ecx
mov rcx, rax
call fcn.1400cd021
lea rdx, [0x14027bd04]
mov rcx, rax
call fcn.1400cb974
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400ea630
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0xef4], eax
lea rdx, str.LockResource___failed.
lea rcx, [0x1402edb20]
call fcn.1400cb974
mov ecx, dword [rbp + 0xef4]
mov edx, ecx
mov rcx, rax
call fcn.1400cd021
lea rdx, [0x14027bd04]
mov rcx, rax
call fcn.1400cb974
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1400ea683
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0xef4], eax
lea rdx, str.SizeofResource___failed.
lea rcx, [0x1402edb20]
call fcn.1400cb974
mov ecx, dword [rbp + 0xef4]
mov edx, ecx
mov rcx, rax
call fcn.1400cd021
lea rdx, [0x14027bd04]
mov rcx, rax
call fcn.1400cb974
mov r8d, 3
lea rdx, [rbp + 0x84]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea rdx, [rbp + 0x84]
lea rcx, [rbp + 0xa8]
call fcn.1400cd7ec
nop
lea r8, str.WindowsServicePack.zip
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xe8]
call fcn.1400cf466
nop
lea rax, [rbp + 0xc48]
mov qword [rbp + 0xc78], rax
lea rax, [rbp + 0xc98]
mov qword [rbp + 0xcc8], rax
lea rcx, [rbp + 0xc24]
call fcn.1400cdf0d
mov qword [rbp + 0xef8], rax
mov rdx, qword [rbp + 0xc78]
lea rcx, [rbp + 0xe8]
call fcn.1400cbacd
mov qword [rbp + 0xf00], rax
mov rdx, qword [rbp + 0xcc8]
lea rcx, [rbp + 0xe8]
call fcn.1400d09e2
mov qword [rbp + 0xf08], rax
mov rax, qword [rbp + 0xef8]
mov r9, rax
mov r8, qword [rbp + 0xf00]
mov rdx, qword [rbp + 0xf08]
lea rcx, [rbp + 0x128]
call fcn.1400cf722
nop
lea rcx, [rbp + 0x128]
call fcn.1400cce1e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x800
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0xffffffffffffffff
jne 0x1400ea7d7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0xef4], eax
lea rdx, str.CreateFileW___failed.
lea rcx, [0x1402edb20]
call fcn.1400cb974
mov ecx, dword [rbp + 0xef4]
mov edx, ecx
mov rcx, rax
call fcn.1400cd021
lea rdx, [0x14027bd04]
mov rcx, rax
call fcn.1400cb974
mov dword [rbp + 0x184], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x184]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.DLL_FreeResource]
lea rcx, [rbp + 0x128]
call fcn.1400cce1e
xor edx, edx
mov rcx, rax
call fcn.1400ce976
mov qword [rbp + 0x1a8], rax
lea r8, [rbp + 0x1d0]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x1a8]
call fcn.1400cf2db
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x414], eax
mov dword [rbp + 0x434], 0
jmp 0x1400ea878
mov eax, dword [rbp + 0x434]
inc eax
mov dword [rbp + 0x434], eax
mov eax, dword [rbp + 0x414]
cmp dword [rbp + 0x434], eax
jge 0x1400ea9c1
lea r8, [rbp + 0x460]
mov edx, dword [rbp + 0x434]
mov rcx, qword [rbp + 0x1a8]
call fcn.1400cf2db
lea rax, [rbp + 0xd08]
mov qword [rbp + 0xd38], rax
lea rax, [rbp + 0xd58]
mov qword [rbp + 0xd88], rax
lea rcx, [rbp + 0xce4]
call fcn.1400cdf0d
mov qword [rbp + 0xef8], rax
mov rdx, qword [rbp + 0xd38]
lea rcx, [rbp + 0xa8]
call fcn.1400cbacd
mov qword [rbp + 0xf00], rax
mov rdx, qword [rbp + 0xd88]
lea rcx, [rbp + 0xa8]
call fcn.1400d09e2
mov qword [rbp + 0xf08], rax
mov rax, qword [rbp + 0xef8]
mov r9, rax
mov r8, qword [rbp + 0xf00]
mov rdx, qword [rbp + 0xf08]
lea rcx, [rbp + 0x6a8]
call fcn.1400cf722
nop
lea r8, [0x14027bdc4]
lea rdx, [rbp + 0x6a8]
lea rcx, [rbp + 0xda8]
call fcn.1400cfc18
mov qword [rbp + 0xef8], rax
mov rax, qword [rbp + 0xef8]
mov qword [rbp + 0xf00], rax
lea r8, [rbp + 0x464]
mov rdx, qword [rbp + 0xf00]
lea rcx, [rbp + 0x6e8]
call fcn.1400ce3d1
nop
lea rcx, [rbp + 0xda8]
call fcn.1400cfa83
lea rcx, [rbp + 0x6e8]
call fcn.1400cce1e
mov r8, rax
mov edx, dword [rbp + 0x434]
mov rcx, qword [rbp + 0x1a8]
call fcn.1400cc725
nop
lea rcx, [rbp + 0x6e8]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0x6a8]
call fcn.1400cfa83
jmp 0x1400ea86a
mov rcx, qword [rbp + 0x1a8]
call fcn.1400d009b
lea rcx, [rbp + 0x128]
call fcn.1400cce1e
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea rax, [rbp + 0xe08]
mov qword [rbp + 0xe38], rax
lea rax, [rbp + 0xe58]
mov qword [rbp + 0xe88], rax
lea rcx, [rbp + 0xde4]
call fcn.1400cdf0d
mov qword [rbp + 0xef8], rax
mov rdx, qword [rbp + 0xe38]
lea rcx, [rbp + 0xa8]
call fcn.1400cbacd
mov qword [rbp + 0xf00], rax
mov rdx, qword [rbp + 0xe88]
lea rcx, [rbp + 0xa8]
call fcn.1400d09e2
mov qword [rbp + 0xf08], rax
mov rax, qword [rbp + 0xef8]
mov r9, rax
mov r8, qword [rbp + 0xf00]
mov rdx, qword [rbp + 0xf08]
lea rcx, [rbp + 0x728]
call fcn.1400cf722
nop
lea r8, [0x14027bdc8]
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0x768]
call fcn.1400cfc18
nop
lea rax, [rbp + 0xea8]
mov qword [rbp + 0xee8], rax
lea rdx, [rbp + 0x768]
mov rcx, qword [rbp + 0xee8]
call fcn.1400cb136
mov qword [rbp + 0xef8], rax
mov rcx, qword [rbp + 0xef8]
call fcn.1400d04a1
nop
lea rcx, [rbp + 0x768]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0x728]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cc045
nop
lea rcx, [rbp + 0xa8]
call fcn.1400cc045
lea rcx, [rbp - 0x40]
lea rdx, [0x1402785c0]
call fcn.1400cf82b
mov rcx, qword [rbp + 0xf10]
xor rcx, rbp
call fcn.1400cda58
lea rsp, [rbp + 0xf28]
pop rdi
pop rbp
ret