Function at 0x140004ad0
Capabilities:
Extract resource via kernel32 functions
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x2d8], 0xfffffffffffffffe
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x298], rax
cmp dword [rsp + 0x308], 0x13f0
jne 0x140004bd9
mov rax, qword [rsp + 0x300]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x2e0]
sub eax, 0x3e9
mov dword [rsp + 0x2e0], eax
cmp dword [rsp + 0x2e0], 0xa
ja case.0x140004b71.1002
mov eax, dword [rsp + 0x2e0]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x4ff4]
add rax, rcx
jmp rax
mov dword [rsp + 0x308], 0x13f1
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f3
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f4
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f5
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f6
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f7
jmp 0x140004bd9
mov dword [rsp + 0x308], 0x13f7
movzx edx, word [rsp + 0x308]
lea r8, [0x140064e68]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140004c10
xor eax, eax
jmp 0x140004fd9
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140004c38
xor eax, eax
jmp 0x140004fd9
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0
jne 0x140004c68
xor eax, eax
jmp 0x140004fd9
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140004c8a
xor eax, eax
jmp 0x140004fd9
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x310]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140003f30
mov qword [rsp + 0x278], 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140003230
nop
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x140004f3d
cmp dword [rsp + 0x4c], 0
je 0x140004d45
mov dword [rsp + 0x2c4], 0
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2c4]
jmp 0x140004fd9
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2b0], eax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x2b0]
lea rdx, str.CreateFile_Error__d__s
lea rcx, [rsp + 0x280]
call fcn.140005730
lea rcx, [rsp + 0x280]
call fcn.140011190
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a8]
call fcn.140003250
nop
lea rcx, [rsp + 0x2a8]
call fcn.140005700
lea rdx, [0x140064ea8]
lea rcx, [rsp + 0x2a8]
call fcn.140003510
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0xffffffff
jne 0x140004dff
mov dword [rsp + 0x2c8], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2c8]
jmp 0x140004fd9
cmp dword [rsp + 0x2b0], 0x20
jne 0x140004ef1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b8]
call fcn.140003250
nop
lea rdx, str..bak
lea rcx, [rsp + 0x2b8]
call fcn.1400034d0
mov dword [rsp + 0x2c0], 0
lea rcx, [rsp + 0x2b8]
call fcn.140011190
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140004e8d
mov dword [rsp + 0x2c0], 1
lea rcx, [rsp + 0x2b8]
call fcn.140011190
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [rsp + 0x2c0], 0
jne 0x140004ee2
mov dword [rsp + 0x2b0], 1
mov dword [rsp + 0x2cc], 0
lea rcx, [rsp + 0x2b8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2cc]
jmp 0x140004fd9
lea rcx, [rsp + 0x2b8]
call fcn.1400038a0
jmp 0x140004f2e
mov dword [rsp + 0x2b0], 2
mov dword [rsp + 0x2d0], 0
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2d0]
jmp 0x140004fd9
lea rcx, [rsp + 0x2a8]
call fcn.1400038a0
jmp 0x140004f3f
jmp 0x140004f4a
xor eax, eax
cmp eax, 1
jne 0x140004cd1
mov dword [rsp + 0x28c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x28c]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 0
jne 0x140004f9d
mov rax, qword [rsp + 0x318]
mov dword [rax], 3
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x278], 0
mov eax, dword [rsp + 0x288]
mov dword [rsp + 0x2d4], eax
lea rcx, [rsp + 0x280]
call fcn.1400038a0
mov eax, dword [rsp + 0x2d4]
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.14004c9e0
add rsp, 0x2f0
pop rdi
ret