Function at 0x140002b90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, r8
mov rdi, rdx
mov ebp, ecx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140002c71
lea rcx, [0x14003b858]
call fcn.140001160
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140002c1f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002c1a
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f4c
mov rcx, r8
call fcn.140009e10
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002c6a
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140002c65
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f58
mov rcx, r8
call fcn.140009e10
xor al, al
jmp 0x140002f19
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140002c7e
mov r8, qword [rdi]
movzx edx, bp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
jne 0x140002cab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14003b868]
call fcn.140001160
jmp 0x140002be5
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140002cc8
lea rcx, [0x14003b880]
jmp 0x140002bdf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
jne 0x140002ce5
lea rcx, [0x14003b890]
jmp 0x140002bdf
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x140002d03
lea rcx, [0x14003b8a0]
jmp 0x140002bdf
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002d10
mov rcx, qword [rbx]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140002e68
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0xf
lea r8d, [rsi + 0x32]
lea rdx, [0x14003b8b8]
lea rcx, [rsp + 0x58]
call fcn.1400063c0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
xor r9d, r9d
lea r8, [0x14003b8f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002dcd
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f5e
call fcn.140009e10
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140002e1a
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140002e15
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f64
mov rcx, r8
call fcn.140009e10
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002c6a
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002c65
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f52
jmp 0x140002c62
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [rsp + 0x50]
sete bpl
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140002ed0
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140002ecb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f4c
mov rcx, r8
call fcn.140009e10
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002f15
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002f10
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f58
mov rcx, r8
call fcn.140009e10
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140009df0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140012b7c
nop
call fcn.140012b7c
int3
call fcn.140012b7c
nop
call fcn.140012b7c
nop
call fcn.140012b7c
int3