Function at 0x14006db40
Capabilities:
Copy file
Extract resource via kernel32 functions
Set current directory
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x10050
call fcn.1400d7ad0
sub rsp, rax
mov r14, rcx
mov rdi, r9
mov rcx, r9
mov rbp, r8
mov rbx, rdx
call fcn.1400056a0
mov rcx, rdi
test al, al
je 0x14006db8c
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
jmp 0x14006db92
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
cmp qword [0x140113b00], 0
mov esi, eax
je 0x14006dd50
cmp eax, 1
je 0x14006dbfe
mov rcx, rbp
call fcn.140089060
test al, al
je 0x14006dbfe
mov rax, qword [0x1401101f0]
lea rdx, [0x1400f11dc]
test byte [rax + 0x140], 1
jne 0x14006dbe7
mov rcx, qword [0x140113a28]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400befb0
jmp 0x14006ddc6
lea r9, [0x1400da7a4]
xor r8d, r8d
mov rcx, r14
call fcn.140056cc0
jmp 0x14006ddc6
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14006dbb3
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x14006dc35
cmp r8, 0x104
lea rcx, [rsp + 0x50]
mov eax, 0x103
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsupr]
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14006dd45
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006dd45
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14006dd45
cmp dword [rax], 0x4034b50
jne 0x14006dd1b
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r9d, r9d
lea rdx, [rsp + 0x48]
mov r8d, eax
mov rcx, rbx
call fcn.1400be240
test eax, eax
je 0x14006dd1b
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
test eax, eax
setne dil
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006ddb6
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne dil
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006ddb6
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rcx, qword [0x140117b68]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edi, edi
lea rdx, [rsp + 0x50]
cmp esi, 1
mov rcx, rbx
setne dil
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea rcx, [0x1400da7a4]
mov rax, qword [0x140112a00]
setne dil
test rax, rax
je 0x14006ddb0
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor dil, 1
mov rcx, r14
movzx edx, dil
call fcn.140056d90
lea r11, [rsp + 0x10050]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret