Function at 0x1400c7810
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x460
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea r13, [rcx + 0xa1c]
mov rbx, rcx
lea r9, [rcx + 0x61c]
lea rcx, [rsp + 0x50]
lea r8, str._s_s
mov edx, 0x200
mov qword [rsp + 0x20], r13
call fcn.14002c260
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1400c78b6
lea rdx, str._bExtract_VXD__File_already_present_n
mov rcx, rbx
call fcn.1400c3fb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r14 + 1]
jmp 0x1400c7aef
mov ecx, dword [rbx + 0xd98]
call fcn.1400c7800
test eax, eax
je 0x1400c7961
lea r8, [rbx + 0x81c]
cmp byte [r8], r14b
je 0x1400c7941
lea rcx, [rsp + 0x250]
mov edx, 0x200
call fcn.1400f27f0
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rdi, rax
je 0x1400c795b
movzx edx, word [rbx + 0xd98]
mov r8d, 0xa
mov rcx, rax
mov qword [rsp + 0x4a0], rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rsi, rax
je 0x1400c7934
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400c7968
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1400c7ae7
lea rdx, [rsp + 0x250]
mov r8d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1400c78e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1400c7aef
mov rcx, rax
mov qword [rsp + 0x498], rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov esi, eax
je 0x1400c7a7f
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x1400c7a9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x1400c7a9b
lea rcx, [rsp + 0x50]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [0x140113ae4]
lea rcx, [rsp + 0x50]
mov edx, 0x200
call fcn.14002c340
lea rcx, [rsp + 0x50]
mov r8, r13
mov edx, 0x200
call fcn.14002c340
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x1400c7a89
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1400c7adf
lea rcx, [rbx + 0x61c]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsp + 0x40]
lea rdx, str._bExtract_VXD__WriteFile_returned__d_bytes._n
mov rcx, rbx
mov esi, eax
call fcn.1400c3fb0
test esi, esi
jne 0x1400c7ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbp, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400efff0
add rsp, 0x460
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret