Function at 0x140004db0
Capabilities:
Extract resource via kernel32 functions
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov ecx, 0x68
mov r15, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
lea r12, [0x14001a970]
mov rsi, rax
test rax, rax
je 0x140004e21
mov rcx, rax
call fcn.1400022c0
xor ebx, ebx
mov qword [rsi], r12
mov qword [rsi + 0x58], rbx
mov dword [rsi + 0x60], ebx
mov qword [rsi + 0x28], rbx
mov dword [rsi + 0x20], ebx
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x40], rbx
mov qword [rsi + 0x48], rbx
mov qword [rsi + 0x50], rbx
mov dword [rsi + 0x30], ebx
jmp 0x140004e25
xor ebx, ebx
mov esi, ebx
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x140004e66
mov rcx, rax
call fcn.1400022c0
mov qword [rdi], r12
mov qword [rdi + 0x58], rbx
mov dword [rdi + 0x60], ebx
mov qword [rdi + 0x28], rbx
mov dword [rdi + 0x20], ebx
mov qword [rdi + 0x38], rbx
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x48], rbx
mov qword [rdi + 0x50], rbx
mov dword [rdi + 0x30], ebx
jmp 0x140004e69
mov rdi, rbx
mov rcx, qword [str.mhjH_Jp1uJ80iJm]
lea rdx, [rbp + 0x20]
call fcn.14000deb0
movzx eax, byte [rbp + 0x20]
lea r11, [rbp + 0x20]
lea rcx, [rsp + 0x50]
test al, al
je 0x140004ea6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140004e90
xor r9d, r9d
mov word [rcx], bx
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r13, rbx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
mov r14, rbx
mov dword [rbp + 0x470], ebx
mov dword [rbp + 0x478], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140004fa4
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov dword [rbp + 0x470], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [rbp + 0x470]
xor edx, edx
call fcn.14000e210
mov r14, rax
test rax, rax
je 0x140004fa4
mov r8d, dword [rbp + 0x470]
lea r9, [rbp + 0x470]
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004fa4
mov r9d, dword [rbp + 0x470]
mov rdx, qword [rbp + 0x460]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov r8, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140002660
mov r13, qword [rsp + 0x48]
mov ecx, ebx
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [rbp + 0x478], ecx
test r12, r12
je 0x140004fb2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140004fcc
mov rcx, qword [0x14001e780]
mov r8, r14
mov edx, 8
call qword [0x14001e798]
cmp dword [rbp + 0x478], 0
je 0x140004fea
mov r8d, dword [rsp + 0x40]
mov rdx, r13
mov rcx, rsi
call fcn.140002400
mov r12d, eax
jmp 0x140004fed
mov r12d, ebx
test r13, r13
je 0x140005007
mov rcx, qword [0x14001e780]
mov r8, r13
mov edx, 8
call qword [0x14001e798]
test r12d, r12d
jne 0x140005025
test rsi, rsi
je 0x140005022
mov rcx, rsi
call fcn.140005d80
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rsi, rbx
mov rcx, qword [str.njVSOpe]
lea rdx, [rbp + 0x20]
call fcn.14000deb0
movzx eax, byte [rbp + 0x20]
lea r11, [rbp + 0x20]
lea rcx, [rsp + 0x50]
test al, al
je 0x140005066
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140005050
mov word [rcx], bx
lea rdx, [rsp + 0x50]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400050b9
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400050b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400050b9
mov r9d, dword [rax]
mov rdx, qword [rbp + 0x460]
lea r8, [rax + 4]
mov rcx, rdi
call fcn.140002370
test eax, eax
jne 0x1400050d2
test rdi, rdi
je 0x1400050cf
mov rcx, rdi
call fcn.140005d80
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rdi, rbx
test rsi, rsi
je 0x1400050f9
test rdi, rdi
je 0x1400050e4
mov eax, dword [rdi + 0x20]
cmp dword [rsi + 0x20], eax
jbe 0x140005102
mov qword [r15], rsi
test rdi, rdi
je 0x14000511b
mov rcx, rdi
call fcn.140005d80
mov rcx, rdi
jmp 0x140005115
test rdi, rdi
je 0x140005234
mov qword [r15], rdi
test rsi, rsi
je 0x14000511b
mov rcx, rsi
call fcn.140005d80
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [r15]
call fcn.140005260
test eax, eax
jne 0x14000522d
mov rax, qword [r15]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140005171
mov edi, 0x7fffffff
mov edx, ebx
mov eax, edi
cmp word [rcx], 0
je 0x140005159
add rcx, 2
dec rax
jne 0x140005140
mov edx, 0x80070057
mov rdi, rbx
jmp 0x14000516b
test rax, rax
jne 0x140005168
mov edx, 0x80070057
mov rdi, rbx
jmp 0x14000516b
sub rdi, rax
test edx, edx
jns 0x140005181
jmp 0x140005176
mov edx, 0x80070057
mov rdi, rbx
test edx, edx
js 0x14000522d
mov rcx, qword [str._YQ09LoK9Tc1]
lea rdx, [rbp + 0x20]
call fcn.14000deb0
movzx eax, byte [rbp + 0x20]
lea r11, [rbp + 0x20]
lea rcx, [rsp + 0x50]
test al, al
je 0x1400051b8
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x1400051a2
mov rax, qword [r15]
mov word [rcx], bx
mov qword [rsp + 0x30], rbx
mov r12, qword [rax + 0x28]
mov r13d, 1
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov r8d, r13d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rbp + 0x470], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140005228
lea r8d, [rdi + rdi + 2]
lea r9, [rbp + 0x470]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
jmp 0x140005239
mov eax, 1
jmp 0x140005239
mov qword [r15], rbx
mov eax, ebx
mov rbx, qword [rsp + 0x568]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret