Function at 0x140004ac0
Capabilities:
Extract resource via kernel32 functions
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x2d8], 0xfffffffffffffffe
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x298], rax
cmp dword [rsp + 0x308], 0x13f0
jne 0x140004bc9
mov rax, qword [rsp + 0x300]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x2e0]
sub eax, 0x3e9
mov dword [rsp + 0x2e0], eax
cmp dword [rsp + 0x2e0], 0xa
ja case.0x140004b61.1002
mov eax, dword [rsp + 0x2e0]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x4fe4]
add rax, rcx
jmp rax
mov dword [rsp + 0x308], 0x13f1
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f4
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f5
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f6
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f7
jmp 0x140004bc9
mov dword [rsp + 0x308], 0x13f7
movzx edx, word [rsp + 0x308]
lea r8, [0x140064e68]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140004c00
xor eax, eax
jmp 0x140004fc9
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140004c28
xor eax, eax
jmp 0x140004fc9
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0
jne 0x140004c58
xor eax, eax
jmp 0x140004fc9
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140004c7a
xor eax, eax
jmp 0x140004fc9
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x310]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140003f30
mov qword [rsp + 0x278], 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140003230
nop
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x140004f2d
cmp dword [rsp + 0x4c], 0
je 0x140004d35
mov dword [rsp + 0x2c4], 0
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2c4]
jmp 0x140004fc9
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x2b0]
lea rdx, str.CreateFile_Error__d__s
lea rcx, [rsp + 0x280]
call fcn.140005820
lea rcx, [rsp + 0x280]
call fcn.140011510
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a8]
call fcn.140003250
nop
lea rcx, [rsp + 0x2a8]
call fcn.1400057f0
lea rdx, [0x140064ea8]
lea rcx, [rsp + 0x2a8]
call fcn.140003510
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0xffffffff
jne 0x140004def
mov dword [rsp + 0x2c8], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2c8]
jmp 0x140004fc9
cmp dword [rsp + 0x2b0], 0x20
jne 0x140004ee1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b8]
call fcn.140003250
nop
lea rdx, str..bak
lea rcx, [rsp + 0x2b8]
call fcn.1400034d0
mov dword [rsp + 0x2c0], 0
lea rcx, [rsp + 0x2b8]
call fcn.140011510
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140004e7d
mov dword [rsp + 0x2c0], 1
lea rcx, [rsp + 0x2b8]
call fcn.140011510
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [rsp + 0x2c0], 0
jne 0x140004ed2
mov dword [rsp + 0x2b0], 1
mov dword [rsp + 0x2cc], 0
lea rcx, [rsp + 0x2b8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2cc]
jmp 0x140004fc9
lea rcx, [rsp + 0x2b8]
call fcn.1400038a0
jmp 0x140004f1e
mov dword [rsp + 0x2b0], 2
mov dword [rsp + 0x2d0], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2d0]
jmp 0x140004fc9
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
jmp 0x140004f2f
jmp 0x140004f3a
xor eax, eax
cmp eax, 1
jne 0x140004cc1
mov dword [rsp + 0x28c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x28c]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 0
jne 0x140004f8d
mov rax, qword [rsp + 0x318]
mov dword [rax], 3
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x278], 0
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x2d4], eax
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2d4]
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x2f0
pop rdi
ret