Function at 0x14006ad90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x10050
call fcn.1400fe470
sub rsp, rax
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov r10, r9
movzx eax, word [r10]
cmp ax, 0x20
je 0x14006adc4
cmp ax, 9
jne 0x14006adca
add r10, 2
jmp 0x14006adb4
test ax, ax
je 0x14006ae1c
cmp ax, 0x2d
je 0x14006addb
cmp ax, 0x2b
jne 0x14006ade5
lea rax, [r10 + 2]
mov r10, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x14006ae1c
movzx eax, word [r10 + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14006ae1c
movzx ecx, word [r10 + 4]
call fcn.1400ea440
test eax, eax
je 0x14006ae1c
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x10]
call fcn.1400ea654
jmp 0x14006ae24
mov rcx, rdi
call fcn.1400e9e88
cmp eax, 1
je 0x14006ae80
mov rcx, rsi
call fcn.1400895e0
test al, al
je 0x14006ae80
mov rax, qword [0x140145a80]
lea rdx, [0x14012296c]
test byte [rax + 0x140], 1
jne 0x14006ae69
mov rcx, qword [0x14014a3b0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x14006b050
lea r9, [0x14010d28c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050010
jmp 0x14006b050
mov qword [rsp + 0x10070], r14
xor r9d, r9d
xor r14d, r14d
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006b005
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x14006aec5
cmp r8, 0x8000
lea rcx, [rsp + 0x50]
mov eax, 0x7fff
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call fcn.1400e1c80
lea rcx, [rsp + 0x50]
call fcn.1400efb9c
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14006affc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006affc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14006affc
cmp dword [rax], 0x4034b50
jne 0x14006afa0
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov r8d, eax
mov rcx, rbx
call fcn.1400c5b30
test eax, eax
je 0x14006afa0
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x10088]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
test eax, eax
setne sil
call fcn.1400e89fc
jmp 0x14006afcd
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x10088]
mov qword [rsp + 0x20], r14
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x14006b005
mov rcx, qword [0x14014a3b0]
lea rdx, [0x14010d31c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x14006b048
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140145a80]
lea rdx, [0x14012296c]
test byte [rax + 0x140], 1
jne 0x14006b036
mov rcx, qword [0x14014a3b0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x14006b048
lea r9, [0x14010d28c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050010
mov r14, qword [rsp + 0x10070]
mov rbx, qword [rsp + 0x10078]
add rsp, 0x10050
pop rdi
pop rsi
pop rbp
ret