Function at 0x140051b30
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbc0]
sub rsp, 0xcc0
mov rax, qword [0x14013c010]
xor rax, rsp
mov qword [rbp + 0xbb0], rax
mov r15, r9
mov r12d, r8d
mov r13, rcx
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x140051fd5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x140051fca
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x370]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140051be0
mov r8d, eax
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x48]
call fcn.1400040e0
lea rdx, [0x1400fbce0]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140051c10
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140010240
lea r8, [0x1400fbd50]
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140051f4b
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x140051f4b
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140051f4b
lea rax, [0x14013c4a8]
cmp word [0x14013c4a8], 0
jne 0x140051cdb
mov ebx, 0x22
mov word [0x14013c4a8], bx
mov r8d, 0xfe
lea rdx, [0x14013c4aa]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x14013c4a8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x14013c4a8]
mov word [rax + rcx*2], bx
mov r9, rax
lea r8, str._Command___s_
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14002aeb0
mov rbx, rsi
mov edx, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1400c7c20
test rsi, rsi
jne 0x140051d1f
xor ecx, ecx
jmp 0x140051d2c
mov rcx, rdi
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x140051d22
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400040e0
lea r8, [rsp + 0x50]
lea rdx, str._Command_
lea rcx, [rsp + 0x38]
call fcn.14000ba80
mov eax, 0x88888889
mul r12d
shr edx, 5
imul eax, edx, 0x3c
sub r12d, eax
mov dword [rsp + 0x20], r12d
mov r9d, edx
lea r8, str.PT_dM_dS
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14002aeb0
lea r8, [rbp + 0x160]
lea rdx, str.PT0M30S
lea rcx, [rsp + 0x38]
call fcn.14000ba80
test r15, r15
je 0x140051dd3
mov r9, r15
lea r8, [0x1400fbd88]
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14002aeb0
lea r8, [rbp + 0x160]
lea rdx, str._Arguments__s__Arguments_
lea rcx, [rsp + 0x38]
call fcn.14000ba80
lea r8, str._GroupId_S_1_5_32_545__GroupId_
lea rdx, str._GroupId_Users__GroupId_
lea rcx, [rsp + 0x38]
call fcn.14000ba80
mov rbx, qword [rsp + 0x38]
mov r15d, dword [rbx - 0xc]
lea r8, str.ST_CPL.pkg.XML
mov edx, 0x104
lea rcx, [rbp + 0x580]
call fcn.14002aeb0
lea rdx, [0x140143a00]
mov ecx, 0x104
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
lea rax, [rbp + 0x580]
mov qword [rsp + 0x20], rax
lea r9, [0x140143a00]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14002aeb0
lea r8, [0x1400ef980]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r14d, 1
test eax, eax
jne 0x140051eac
mov dword [rsp + 0x40], 0xfeff
mov r9, qword [rsp + 0x30]
mov r8d, r14d
lea edx, [rax + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, r15d
mov r9, qword [rsp + 0x30]
lea r8d, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__flushall]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140051eba
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, str.schtasks__create__Tn__s__XML___s___F
mov edx, 0x104
lea rcx, [rbp + 0x790]
call fcn.14002aeb0
mov dword [rsp + 0x44], 0xffffffff
xor r9d, r9d
lea r8, [rsp + 0x44]
mov edx, r14d
lea rcx, [rbp + 0x790]
call fcn.140051fe0
lea r9, [rsp + 0x50]
lea r8, str.CMD__C_del___s___F
mov edx, 0x104
lea rcx, [rbp + 0x9a0]
call fcn.14002aeb0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
lea r9, str.DEL_ST_CPL
lea r8, [0x1400e36c8]
lea rdx, [rbp + 0x9a0]
lea rcx, str.DEL_ST_CPL
call fcn.1400512c0
jmp 0x140051f4e
xor r14d, r14d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051f77
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140051f9d
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140048c62.0]
mov eax, r14d
mov rcx, qword [rbp + 0xbb0]
xor rcx, rsp
call fcn.1400c17f0
mov rbx, qword [rsp + 0xd08]
add rsp, 0xcc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
int3