Function at 0x140004ab0
Capabilities:
Extract resource via kernel32 functions
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x140065840]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x298], rax
cmp dword [rsp + 0x308], 0x13f0
jne 0x140004bad
mov rax, qword [rsp + 0x300]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x2d8], eax
mov eax, dword [rsp + 0x2d8]
sub eax, 0x3e9
mov dword [rsp + 0x2d8], eax
cmp dword [rsp + 0x2d8], 0xa
ja case.0x140004b45.1002
mov eax, dword [rsp + 0x2d8]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x4fc0]
add rax, rcx
jmp rax
mov dword [rsp + 0x308], 0x13f1
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f4
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f5
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f6
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f7
jmp 0x140004bad
mov dword [rsp + 0x308], 0x13f7
movzx edx, word [rsp + 0x308]
lea r8, [0x140058dd0]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140004be4
xor eax, eax
jmp 0x140004fa6
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140004c0c
xor eax, eax
jmp 0x140004fa6
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0
jne 0x140004c3c
xor eax, eax
jmp 0x140004fa6
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140004c5e
xor eax, eax
jmp 0x140004fa6
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x310]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140003f30
mov qword [rsp + 0x278], 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140003220
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x140004f0a
cmp dword [rsp + 0x4c], 0
je 0x140004d18
mov dword [rsp + 0x2c4], 0
lea rcx, [rsp + 0x280]
call fcn.1400038b0
mov eax, dword [rsp + 0x2c4]
jmp 0x140004fa6
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x2b0]
lea rdx, str.CreateFile_Error__d__s
lea rcx, [rsp + 0x280]
call fcn.1400057e0
lea rcx, [rsp + 0x280]
call fcn.1400329e0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a8]
call fcn.140003240
lea rcx, [rsp + 0x2a8]
call fcn.1400057b0
lea rdx, [0x140058e10]
lea rcx, [rsp + 0x2a8]
call fcn.140003520
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0xffffffff
jne 0x140004dd0
mov dword [rsp + 0x2c8], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038b0
lea rcx, [rsp + 0x280]
call fcn.1400038b0
mov eax, dword [rsp + 0x2c8]
jmp 0x140004fa6
cmp dword [rsp + 0x2b0], 0x20
jne 0x140004ebf
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b8]
call fcn.140003240
lea rdx, str..bak
lea rcx, [rsp + 0x2b8]
call fcn.1400034e0
mov dword [rsp + 0x2c0], 0
lea rcx, [rsp + 0x2b8]
call fcn.1400329e0
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140004e5d
mov dword [rsp + 0x2c0], 1
lea rcx, [rsp + 0x2b8]
call fcn.1400329e0
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [rsp + 0x2c0], 0
jne 0x140004eb0
mov dword [rsp + 0x2b0], 1
mov dword [rsp + 0x2cc], 0
lea rcx, [rsp + 0x2b8]
call fcn.1400038b0
lea rcx, [rsp + 0x2a8]
call fcn.1400038b0
lea rcx, [rsp + 0x280]
call fcn.1400038b0
mov eax, dword [rsp + 0x2cc]
jmp 0x140004fa6
lea rcx, [rsp + 0x2b8]
call fcn.1400038b0
jmp 0x140004efb
mov dword [rsp + 0x2b0], 2
mov dword [rsp + 0x2d0], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038b0
lea rcx, [rsp + 0x280]
call fcn.1400038b0
mov eax, dword [rsp + 0x2d0]
jmp 0x140004fa6
lea rcx, [rsp + 0x2a8]
call fcn.1400038b0
jmp 0x140004f0c
jmp 0x140004f17
xor eax, eax
cmp eax, 1
jne 0x140004ca4
mov dword [rsp + 0x28c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x28c]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 0
jne 0x140004f6a
mov rax, qword [rsp + 0x318]
mov dword [rax], 3
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x278], 0
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x2d4], eax
lea rcx, [rsp + 0x280]
call fcn.1400038b0
mov eax, dword [rsp + 0x2d4]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140043800
add rsp, 0x2f0
pop rdi
ret