Function at 0x1400583a0
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get common file path
Get file attributes
Write file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x100a0
call fcn.140248980
sub rsp, rax
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x100d0], rbx
mov qword [rsp + 0x100d8], rbp
mov qword [rsp + 0x100e0], rsi
mov rax, qword [0x140315d90]
xor rax, rsp
mov qword [rsp + 0x10090], rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400588ca
bt dword [rax + 0x84], 0x11
jae 0x1400588ca
call fcn.1401fa4b0
mov rdx, rax
xor ebp, ebp
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140058429
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea r15, [0x140273028]
or rsi, 0xffffffffffffffff
test r15, 0xffffffffffff0000
jne 0x140058476
movzx edi, r15w
mov ecx, edi
call fcn.1401fc234
test rax, rax
je 0x14005849a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140007610
mov rbx, qword [rsp + 0x58]
jmp 0x14005849a
xor eax, eax
mov rcx, rsi
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140007880
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x90]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x8c], 0x5c
jne 0x1400584d3
mov word [rsp + rcx*2 + 0x8c], ax
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400584f6
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.RtkBtMnt.exe
mov edx, 0x7fff
lea rcx, [rsp + 0x90]
call fcn.140228690
xor r9d, r9d
lea r8, str.ADRExtracted
lea rdx, str.General
lea rcx, [0x14032a360]
call fcn.1401ffa54
mov edi, eax
mov r13d, 1
test eax, eax
jne 0x140058555
mov r9d, r13d
lea r8, str.ADRExtracted
lea rdx, str.General
lea rcx, [0x14032a360]
call fcn.1401ffaf4
mov r12d, ebp
test edi, edi
sete r12b
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
cmove r12d, r13d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
call fcn.1401fa4b0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400585a6
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x1402774d4]
test rdx, 0xffffffffffff0000
jne 0x1400585e9
movzx edi, dx
mov ecx, edi
call fcn.1401fc234
test rax, rax
je 0x140058606
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140007610
jmp 0x140058606
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.140007880
nop
call fcn.1401fa4b0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140058625
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
lea r14, [rsp + 0x90]
shr r14, 0x10
jne 0x14005866e
movzx edi, ax
mov ecx, edi
call fcn.1401fc234
test rax, rax
je 0x140058698
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140007610
jmp 0x140058698
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140007880
nop
mov r8d, r13d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14003e4c0
test r12d, r12d
je 0x1400587f7
call fcn.1401ed45c
lea r8, str.Binary
mov edx, 0x143
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400586f8
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400588ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400588ca
call fcn.1401ed45c
mov rdx, rdi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
jne 0x140058733
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400588ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400588ca
call fcn.1401ed45c
mov rdx, rdi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
test rax, rax
jne 0x140058778
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400588ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400588ca
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400587d1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, eax
test esi, esi
jg 0x1400588ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400588ca
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov r8d, r12d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140007530
mov r12, rax
call fcn.1401fa4b0
mov rcx, rax
test rax, rax
setne bpl
test ebp, ebp
jne 0x140058839
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
test r14, r14
jne 0x140058876
movzx edi, ax
mov ecx, edi
call fcn.1401fc234
test rax, rax
je 0x1400588a0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140007610
jmp 0x1400588a0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140007880
nop
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.14003e4c0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400588ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x10090]
xor rcx, rsp
call fcn.1402272f0
lea r11, [rsp + 0x100a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret