Function at 0x140185b50
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov qword [rsp + 0x140], 0xfffffffffffffffe
lea r8, [0x14033c050]
mov edx, 0x80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x140185b91
xor al, al
jmp 0x140185e25
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140185bc3
xor al, al
jmp 0x140185e25
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x48], rax
lea rdx, [0x14042f270]
lea rcx, [rsp + 0x40]
call fcn.1400021f0
nop
lea rdx, str.TEMP
lea rcx, [rsp + 0x40]
call fcn.140187630
lea rax, str.dr_lang_temp.xml
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x140185c1d
mov dword [rsp + 0xb0], 0
jmp 0x140185c41
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0xa8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0xb0], eax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.dr_lang_temp.xml
lea rcx, [rsp + 0x40]
call fcn.140002740
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x140185cbf
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140203610
movzx eax, byte [rsp + 0x70]
jmp 0x140185e25
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x160]
call fcn.140186ec0
movzx eax, al
test eax, eax
jne 0x140185d42
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [rsp + 0x71], 0
lea rcx, [rsp + 0x40]
call fcn.140203610
movzx eax, byte [rsp + 0x71]
jmp 0x140185e25
lea rdx, [0x14033c090]
lea rcx, [rsp + 0x78]
call fcn.140001eb0
nop
mov rax, qword [rsp + 0x160]
add rax, 0x50
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xe8]
call fcn.140002260
nop
lea rcx, [rsp + 0x78]
call fcn.140203610
mov rax, qword [rsp + 0x160]
add rax, 0x48
mov qword [rsp + 0x130], rax
lea rax, [0x14033c0a8]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x140185dc0
mov dword [rsp + 0x100], 0
jmp 0x140185de4
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0xf8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x100], eax
mov r8d, dword [rsp + 0x100]
lea rdx, [0x14033c0a8]
mov rcx, qword [rsp + 0x130]
call fcn.140002560
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [rsp + 0x80], 1
lea rcx, [rsp + 0x40]
call fcn.140203610
movzx eax, byte [rsp + 0x80]
add rsp, 0x150
pop rdi
ret