Function at 0x140065f50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x10050
call fcn.1400ddab0
sub rsp, rax
mov rbp, rcx
mov rdi, r8
mov rcx, r9
mov rbx, rdx
call fcn.140014ec0
cmp eax, 1
je 0x140065fd5
mov rcx, rdi
call fcn.140086f80
test al, al
je 0x140065fd5
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x140065fbe
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400661ff
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
jmp 0x1400661ff
mov qword [rsp + 0x10068], r14
xor r9d, r9d
xor r14d, r14d
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140066059
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x140066042
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov r8, rdi
mov byte [rsp + 0x20], 1
call fcn.1400c3f40
jmp 0x1400661f7
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
jmp 0x1400661f7
mov qword [rsp + 0x10060], rsi
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], r14w
jne 0x140066070
cmp r8, 0x8000
lea rcx, [rsp + 0x50]
mov eax, 0x7fff
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsupr]
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400661a3
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400661a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400661a3
cmp dword [rax], 0x4034b50
jne 0x14006614a
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov r8d, eax
mov rcx, rbx
call fcn.1400c2fe0
test eax, eax
je 0x14006614a
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
test eax, eax
setne sil
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140066174
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x1400661ac
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400661ef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x1400661dd
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400661ef
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
mov rsi, qword [rsp + 0x10060]
mov r14, qword [rsp + 0x10068]
lea r11, [rsp + 0x10050]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret