Function at 0x140065e80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x10050
call fcn.1400ddd60
sub rsp, rax
mov rbp, rcx
mov rdi, r8
mov rcx, r9
mov rbx, rdx
call fcn.140014e00
cmp eax, 1
je 0x140065f05
mov rcx, rdi
call fcn.140086eb0
test al, al
je 0x140065f05
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d5c]
test byte [rax + 0x140], 1
jne 0x140065eee
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c4200
jmp 0x14006612f
lea r9, [0x1400e0674]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d3c0
jmp 0x14006612f
mov qword [rsp + 0x10068], r14
xor r9d, r9d
xor r14d, r14d
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140065f89
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d5c]
test byte [rax + 0x140], 1
jne 0x140065f72
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov r8, rdi
mov byte [rsp + 0x20], 1
call fcn.1400c4200
jmp 0x140066127
lea r9, [0x1400e0674]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d3c0
jmp 0x140066127
mov qword [rsp + 0x10060], rsi
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], r14w
jne 0x140065fa0
cmp r8, 0x8000
lea rcx, [rsp + 0x50]
mov eax, 0x7fff
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsupr]
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400660d3
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400660d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400660d3
cmp dword [rax], 0x4034b50
jne 0x14006607a
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov r8d, eax
mov rcx, rbx
call fcn.1400c32a0
test eax, eax
je 0x14006607a
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
test eax, eax
setne sil
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400660a4
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x1400660dc
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0704]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c4200
jmp 0x14006611f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d5c]
test byte [rax + 0x140], 1
jne 0x14006610d
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c4200
jmp 0x14006611f
lea r9, [0x1400e0674]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d3c0
mov rsi, qword [rsp + 0x10060]
mov r14, qword [rsp + 0x10068]
lea r11, [rsp + 0x10050]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret