Function at 0x140051980
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov r14, rcx
xor r12d, r12d
xor bl, bl
lea r8, [0x140127888]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140051bed
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x140127890]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140051bed
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140051a76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140051a76
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x48]
mov r8d, r15d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140051be2
mov ecx, 0x210
call fcn.1400e1108
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140051abb
xor edx, edx
mov r8d, 0x210
mov rcx, rax
call fcn.1400e36c0
mov rcx, rbx
call fcn.14004f480
mov rdi, rax
jmp 0x140051abe
mov rdi, r12
mov rbx, rdi
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14004e4c0
test al, al
jne 0x140051af0
test rdi, rdi
je 0x140051ae9
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14004f7e0
xor bl, bl
jmp 0x140051be2
mov byte [r14 + 0x90], 0
lea rcx, [r14 + 8]
mov rax, rdi
mov rsi, rdi
lea rdx, [rsp + 0x40]
cmp rcx, rdx
je 0x140051b30
mov rbx, r12
mov qword [rsp + 0x40], rbx
mov rdx, qword [rcx]
mov qword [rcx], rdi
mov rdi, r12
mov rax, r12
mov rsi, r12
test rdx, rdx
je 0x140051b30
call fcn.14004f7e0
mov rax, r12
test rdi, rdi
je 0x140051be0
lea rcx, [rax + 0x98]
lea r9, [0x140038fd0]
mov edx, 8
lea r8d, [rdx + 0x17]
call fcn.1400e1038
mov rcx, qword [rsi + 0x90]
test rcx, rcx
je 0x140051b72
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x140051b72
mov qword [rsi + 0x90], r12
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x140051b8f
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x140051b8f
mov qword [rbx + 0x88], r12
mov rdx, qword [rbx + 8]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051bb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140051bd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov edx, 0x210
mov rcx, qword [rsp + 0x40]
call fcn.1400e0fb8
mov bl, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x280
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret