Function at 0x140002ca0
Capabilities:
Check if file exists
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get program files directory
Impersonate user
Query environment variable
Set current directory
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xfb8]
mov eax, 0x1090
call fcn.140257aa0
sub rsp, rax
mov rax, qword [0x1403eab08]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rcx, qword [0x1403f32b0]
mov edx, 4
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov rbx, rax
test rax, rax
je 0x1400035d0
mov rcx, qword [0x1403f32b0]
mov rdx, rax
mov r14d, r13d
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400035d0
mov esi, 0x114
lea rcx, [rbp]
mov r8d, esi
xor edx, edx
call fcn.14025a2f0
lea rcx, [rbp]
mov dword [rbp], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x10], 2
lea eax, [r13 + 1]
lea ecx, [rax + 4]
jne 0x140002d55
cmp dword [rbp + 4], ecx
cmovae r14d, eax
cmp word [0x1403f35d2], 0x3a
lea r12, [0x1403f35d0]
jne 0x140002d83
movzx ecx, word [0x1403f35d0]
call fcn.1402817c4
lea ecx, [rax - 0x40]
call fcn.140286830
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [0x1403f32b0]
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea ecx, [rsi + 2]
mov ebx, ecx
call fcn.140006d94
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.14025a2f0
mov r8d, esi
mov rdx, rdi
mov rcx, r15
call fcn.140259ee0
lea r8, str.BC373ACA27924EBEA29D2A22E348ACB4
mov edx, esi
mov rcx, r15
call fcn.140003fa4
lea rbx, [0x1403f39e0]
mov rcx, rbx
lea rdx, str.CScript__Windows_Script_Host_
call fcn.14025a5a8
mov edi, 0x104
cmp rax, rbx
jne 0x140002e03
lea rdx, str._windir__system32CScript.exe
jmp 0x140002e1e
lea rdx, str.WScript__Windows_Script_Host_
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002e34
lea rdx, str._windir__system32WScript.exe
lea rcx, [rbp + 0x330]
call fcn.140281940
mov ebx, 1
jmp 0x140002ff8
lea rdx, str.Microsoft_HTA
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002e65
lea rdx, str._windir__system32MSHTA.exe
lea rcx, [rbp + 0x330]
call fcn.140281940
mov ebx, 2
jmp 0x140002ff8
lea rdx, str.Microsoft_Windows_PowerShell__Command_line__Native
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002ec2
lea rbx, str._windir__sysnativeWindowsPowerShell_v1.0powershell.exe
mov rdx, rbx
lea rcx, [rbp + 0x330]
call fcn.140281940
mov r8d, edi
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x750]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea rdx, str._windir__system32WindowsPowerShell_v1.0powershell.exe
cmovne rdx, rbx
jmp 0x140002edd
lea rdx, str.Microsoft_Windows_PowerShell__Command_line_
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002ef3
lea rdx, str._windir__system32WindowsPowerShell_v1.0powershell.exe
lea rcx, [rbp + 0x330]
call fcn.140281940
mov ebx, 3
jmp 0x140002ff8
lea rdx, str.PowerShell_Core__Command_line_
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002f8f
xor r9d, r9d
lea rax, [rbp + 0x540]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.PowerShell
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0xd70]
lea rcx, [rbp + 0x540]
call fcn.140003638
lea rcx, [rbp + 0x330]
test eax, eax
je 0x140002f69
lea rdx, [rbp + 0xd70]
call fcn.140281940
jmp 0x140002f88
lea rdx, [rbp + 0x540]
call fcn.140281940
lea rdx, str.6pwsh.exe
lea rcx, [rbp + 0x330]
call fcn.1402818dc
mov ebx, 7
jmp 0x140002ff8
lea rdx, [0x1402e0b38]
mov rcx, rbx
call fcn.14025a5a8
cmp rax, rbx
jne 0x140002fbd
lea rdx, str._windir__system32CMD.exe
lea rcx, [rbp + 0x330]
call fcn.140281940
mov ebx, 4
jmp 0x140002ff8
lea rdx, str.SAPIEN_Script_Host
mov rcx, rbx
call fcn.14025a5a8
lea rcx, [rbp + 0x330]
cmp rax, rbx
jne 0x140002feb
lea rdx, [0x1402e045c]
call fcn.140281940
mov ebx, 5
jmp 0x140002ff8
mov rdx, rbx
call fcn.140281940
mov ebx, 6
mov r8d, edi
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x1402e0464]
lea rcx, [rbp + 0x330]
call fcn.140281940
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0x330]
call fcn.1402818dc
lea rax, [0x1402e0bb8]
cmp ebx, 1
lea rdx, str.____noLogo
cmovne rdx, rax
lea rcx, [rbp + 0x330]
call fcn.1402818dc
cmp ebx, 4
jne 0x14000306e
lea rdx, str.__c
lea rcx, [rbp + 0x330]
call fcn.1402818dc
mov qword [rsp + 0x68], r13
test r14d, r14d
jne 0x1400030ba
lea rcx, [0x1403f3bfc]
call fcn.1402823bc
test rax, rax
je 0x1400030ba
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [r14 + 2]
lea r8, [0x1403f3c7c]
mov dword [rsp + 0x20], r13d
lea rcx, [0x1403f3bfc]
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x140003602
mov edx, 0x2e
lea rcx, [0x1403f3d14]
call fcn.14025a4fc
mov rdi, rax
test rax, rax
je 0x1400030f9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8, r12
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea rdx, [0x1402e0c10]
lea rcx, [rbp + 0x120]
call fcn.140004054
jmp 0x14000312e
mov rdx, r12
lea rcx, [rbp + 0x120]
call fcn.140281940
lea rdx, [0x1402e0458]
lea rcx, [rbp + 0x120]
call fcn.1402818dc
lea rdx, [rbp + 0xb70]
lea rcx, [rbp + 0x120]
call fcn.1402818dc
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.140283630
test eax, eax
mov r12d, r13d
sete r12b
test eax, eax
jne 0x140003168
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffc
lea rcx, [rbp + 0x120]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
shr esi, 1
lea r8, [rbp + 0x120]
mov rcx, r15
mov edx, esi
cmp ebx, 4
jne 0x140003182
call fcn.140003e18
jmp 0x14000319c
lea eax, [rbx - 3]
test eax, 0xfffffffb
je 0x140003194
mov r9d, 1
jmp 0x140003197
xor r9d, r9d
call fcn.140003d20
xor edx, edx
lea rcx, [rbp + 0x120]
mov edi, eax
call fcn.140283630
test eax, eax
je 0x140003290
mov edx, 0x2e
lea rcx, [0x1403f3d14]
call fcn.14025a4fc
lea rdx, [0x1403f35d0]
mov ecx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test rdi, rdi
je 0x140003209
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [0x1403f35d0]
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea rdx, str._s_lX_s
lea rcx, [rbp + 0x120]
call fcn.140004054
jmp 0x14000322f
lea rdx, [0x1403f35d0]
lea rcx, [rbp + 0x120]
call fcn.140281940
lea rdx, [rbp + 0xb70]
lea rcx, [rbp + 0x120]
call fcn.1402818dc
lea r8, [rbp + 0x120]
mov edx, esi
mov rcx, r15
cmp ebx, 4
jne 0x140003247
call fcn.140003e18
jmp 0x140003261
lea eax, [rbx - 3]
test eax, 0xfffffffb
je 0x140003259
mov r9d, 1
jmp 0x14000325c
xor r9d, r9d
call fcn.140003d20
xor edx, edx
lea rcx, [rbp + 0x120]
mov edi, eax
call fcn.140283630
test eax, eax
je 0x140003290
test edi, edi
jne 0x140003617
lea rdx, [rbp + 0x120]
lea rcx, str.Could_not_create_Script__s_n
call fcn.140004290
test edi, edi
jne 0x140003617
test r12d, r12d
jne 0x1400032ad
lea edx, [rdi + 2]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [rbx - 3]
test eax, 0xfffffffb
lea rdx, [0x1402e0464]
lea rax, str._NoLogo__ExecutionPolicy_bypass__File__
cmove rdx, rax
lea rcx, [rbp + 0x750]
call fcn.140281940
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x750]
call fcn.1402818dc
lea rdx, [0x1402e0464]
lea rcx, [rbp + 0x750]
call fcn.1402818dc
lea rcx, [0x1403f32c0]
call fcn.1402823bc
test rax, rax
je 0x140003330
lea rdx, [0x1402e0460]
lea rcx, [rbp + 0x750]
call fcn.1402818dc
lea rdx, [0x1403f32c0]
lea rcx, [rbp + 0x750]
call fcn.1402818dc
mov ebx, reloc.OLEAUT32.dll_VarCyFromDisp
lea rcx, [rbp - 0x70]
mov r8d, ebx
xor edx, edx
call fcn.14025a2f0
lea eax, [rbx - 0x63]
mov dword [rbp - 0x70], ebx
lea edi, [rbx - 0x67]
mov word [rbp - 0x30], ax
lea rdx, [rbp + 0x330]
mov dword [rbp - 0x34], edi
lea rcx, [rbp + 0x960]
call fcn.140281940
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0x960]
call fcn.1402818dc
lea rcx, [0x1403f3bfc]
call fcn.1402823bc
test rax, rax
lea rbx, [0x1403f35d0]
lea rax, [rsp + 0x70]
je 0x140003553
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], SafeArrayDestroyDescriptor
test r14d, r14d
je 0x1400034f5
lea rax, [rbp + 0x960]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea r8, [0x1403f3c7c]
lea rcx, [0x1403f3bfc]
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x1400034d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x540]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov r9d, 0x400
mov qword [rsp + 0x20], rcx
mov r8d, eax
mov ecx, 0x1200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rcx, [rbp + 0x540]
call fcn.1402823bc
test rax, rax
lea rcx, str.Unknown_error
lea rdx, [rbp + 0x540]
cmove rdx, rcx
lea rcx, str.Cannot_run_Script__error:__s_n
call fcn.140004290
cmp dword [0x1403f32bc], r13d
je 0x140003476
mov r8, rbx
lea rdx, [rbp + 0x960]
lea rcx, str.Attempted_to_run__s_in__s_n
call fcn.140004290
or dword [0x1403f32b8], 0xffffffff
test r12d, r12d
jne 0x1400034b6
cmp dword [0x1403f3bf4], r13d
jne 0x1400034b6
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffc
lea rcx, [rbp + 0x120]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x120]
call fcn.140003b74
mov eax, edi
jmp 0x1400035d2
cmp eax, 0x103
jne 0x1400035c5
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x1403f3bf4], r13d
mov eax, dword [rsp + 0x60]
je 0x1400034bd
jmp 0x1400035c5
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x960]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400033f5
jmp 0x140003534
cmp eax, 0x103
jne 0x1400035c5
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x1403f3bf4], r13d
mov eax, dword [rsp + 0x60]
je 0x14000351e
jmp 0x1400035c5
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x960]
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], SafeArrayDestroyDescriptor
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400033f5
jmp 0x1400035a8
cmp eax, 0x103
jne 0x1400035c5
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x1403f3bf4], r13d
mov eax, dword [rsp + 0x60]
je 0x140003596
mov dword [0x1403f32b8], eax
jmp 0x14000347d
xor eax, eax
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.140257b10
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, str.Could_not_authenticate_user._n
call fcn.140268420
or ecx, 0xffffffff
call fcn.1402859ec
int3
mov r8d, edi
lea rdx, [rbp + 0x120]
lea rcx, str.Cannot_write_Script__s__error:__lX_n
call fcn.140004290
or ecx, 0xffffffff
call fcn.1402859ec
int3