Function at 0x1800110f0
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x438
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rcx, [rsp + 0xf1]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x458], rdi
mov byte [rsp + 0xf0], 0
call fcn.180055310
xor eax, eax
lea rcx, [rsp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov byte [rsp + 0x70], al
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
mov byte [rsp + 0x200], al
call fcn.180055310
lea rcx, [rsp + 0x311]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x310], 0
call fcn.180055310
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x180011225
lea rdx, [rsp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x180011275
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasb al, byte [rdi]
mov eax, dword [str._tmep_]
lea rcx, [rsp + 0xf0]
mov dword [rdi - 1], eax
movzx eax, word [0x1800830e8]
mov word [rdi + 3], ax
movzx eax, byte [0x1800830ea]
mov byte [rdi + 5], al
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x180011275
lea rcx, [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
lea rcx, [rsp + 0xb0]
mov byte [rsp + 0xb0], 0
mov qword [rsp + 0xb1], rax
mov qword [rsp + 0xb9], rax
mov qword [rsp + 0xc1], rax
mov qword [rsp + 0xc9], rax
mov qword [rsp + 0xd1], rax
mov qword [rsp + 0xd9], rax
mov qword [rsp + 0xe1], rax
mov dword [rsp + 0xe9], eax
mov word [rsp + 0xed], ax
mov byte [rsp + 0xef], al
call fcn.180034630
xor ebx, ebx
mov rcx, rbx
nop
movzx eax, byte [rsp + rcx + 0xb0]
inc rcx
mov byte [rsp + rcx + 0x2f], al
test al, al
jne 0x1800112e0
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0xb0]
inc rcx
mov byte [rsp + rcx + 0x6f], al
test al, al
jne 0x180011300
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
mov rax, qword [str.old.exe]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
mov eax, dword [0x1800803c0]
mov rcx, rbx
mov dword [rdi - 1], eax
movzx eax, byte [0x1800803c4]
mov byte [rdi + 3], al
nop
movzx eax, byte [rsp + rcx + 0xf0]
inc rcx
mov byte [rsp + rcx + 0x30f], al
test al, al
jne 0x180011350
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x70]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180011380
mov rcx, qword [0x1800a2978]
lea r8, [0x180082bdc]
mov edx, 0x68
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x18001149a
mov rcx, qword [0x1800a2978]
mov qword [rsp + 0x450], rbp
mov rdx, rax
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x430], r13
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x1800a2978]
mov rdx, rdi
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
mov rax, rbx
movzx edx, byte [rsp + rax + 0xf0]
inc rax
mov byte [rsp + rax + 0x1ff], dl
test dl, dl
jne 0x180011403
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x200]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180011430
lea rdx, [0x180080678]
lea rcx, [rsp + 0x200]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x180011479
mov esi, 1
mov rdx, r12
mov r9, rax
mov r8, rsi
mov rcx, r13
call fcn.180050ccc
mov rcx, rdi
call fcn.1800511e8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r13, qword [rsp + 0x430]
mov r12, qword [rsp + 0x460]
mov rbp, qword [rsp + 0x450]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x200]
call fcn.1800505c4
mov rdi, qword [rsp + 0x458]
lea rax, [0x1800a5ac0]
nop
movzx ecx, byte [rsp + rbx + 0x310]
inc rbx
mov byte [rbx + rax - 1], cl
test cl, cl
jne 0x1800114c0
mov eax, esi
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180050540
add rsp, 0x438
pop rsi
pop rbx
ret