Function at 0x180001fb0
Capabilities:
Extract resource via kernel32 functions
Move file
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x38], 0x181
lea rdx, [rsp + 0x50]
add rax, 0x181
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], ebx
call fcn.18000f520
cmp dword [0x18011ccd8], 0x54f301df
mov qword [rsp + 0x60], rax
jne 0x18000219f
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUserObjectSecurity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetIconInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeKeepStringHandle]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
xor r8d, r8d
lea rdx, str.Gwk5m5BYG3xT5sT3Lh6CZ8y
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OffsetRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetIconInfoExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextW]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_WinHelpW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharNextW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x38], 0x29c
lea rcx, [rsp + 0x30]
add rax, 0x29c
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.18000f6b0
add rsp, 0x40
pop rbx
ret