Function at 0x1400696d0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbc0]
sub rsp, 0xcc0
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rbp + 0xbb0], rax
mov r15, r9
mov r12d, r8d
mov r13, rcx
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x140069b75
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x140069b6a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x370]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140069780
mov r8d, eax
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x48]
call fcn.14000c750
lea rdx, [0x14013d7a0]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400697b0
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.1400193f0
lea r8, [0x14013d7d0]
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140069aeb
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x140069aeb
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140069aeb
lea rax, [0x1401aa4b8]
cmp word [0x1401aa4b8], 0
jne 0x14006987b
mov ebx, 0x22
mov word [0x1401aa4b8], bx
mov r8d, 0xfe
lea rdx, [0x1401aa4ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401aa4b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x1401aa4b8]
mov word [rax + rcx*2], bx
mov r9, rax
lea r8, str._Command___s_
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140039da0
mov rbx, rsi
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400faeb0
test rsi, rsi
jne 0x1400698bf
xor ecx, ecx
jmp 0x1400698cc
mov rcx, rdi
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x1400698c2
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14000c750
lea r8, [rsp + 0x50]
lea rdx, str._Command_
lea rcx, [rsp + 0x38]
call fcn.140014b20
mov eax, 0x88888889
mul r12d
shr edx, 5
imul eax, edx, 0x3c
sub r12d, eax
mov dword [rsp + 0x20], r12d
mov r9d, edx
lea r8, str.PT_dM_dS
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.140039da0
lea r8, [rbp + 0x160]
lea rdx, str.PT0M30S
lea rcx, [rsp + 0x38]
call fcn.140014b20
test r15, r15
je 0x140069973
mov r9, r15
lea r8, [0x14013d8f8]
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.140039da0
lea r8, [rbp + 0x160]
lea rdx, str._Arguments__s__Arguments_
lea rcx, [rsp + 0x38]
call fcn.140014b20
lea r8, str._GroupId_S_1_5_32_545__GroupId_
lea rdx, str._GroupId_Users__GroupId_
lea rcx, [rsp + 0x38]
call fcn.140014b20
mov rbx, qword [rsp + 0x38]
mov r15d, dword [rbx - 0xc]
lea r8, str.ST_CPL.pkg.XML
mov edx, 0x104
lea rcx, [rbp + 0x580]
call fcn.140039da0
lea rdx, [0x1401b2440]
mov ecx, 0x104
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
lea rax, [rbp + 0x580]
mov qword [rsp + 0x20], rax
lea r9, [0x1401b2440]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140039da0
lea r8, [0x14012bac0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r14d, 1
test eax, eax
jne 0x140069a4c
mov dword [rsp + 0x40], 0xfeff
mov r9, qword [rsp + 0x30]
mov r8d, r14d
lea edx, [rax + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, r15d
mov r9, qword [rsp + 0x30]
lea r8d, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__flushall]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140069a5a
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, str.schtasks__create__Tn__s__XML___s___F
mov edx, 0x104
lea rcx, [rbp + 0x790]
call fcn.140039da0
mov dword [rsp + 0x44], 0xffffffff
xor r9d, r9d
lea r8, [rsp + 0x44]
mov edx, r14d
lea rcx, [rbp + 0x790]
call fcn.140069b80
lea r9, [rsp + 0x50]
lea r8, str.CMD__C_del___s___F
mov edx, 0x104
lea rcx, [rbp + 0x9a0]
call fcn.140039da0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
lea r9, str.DEL_ST_CPL
lea r8, [0x14011c160]
lea rdx, [rbp + 0x9a0]
lea rcx, str.DEL_ST_CPL
call fcn.140068ee0
jmp 0x140069aee
xor r14d, r14d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140069b17
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140069b3d
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14005eeb3.0]
mov eax, r14d
mov rcx, qword [rbp + 0xbb0]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0xd08]
add rsp, 0xcc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
int3