Function at 0x140017fc8
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea r14, [rcx + 0xa1c]
mov rbp, rcx
lea r9, [rcx + 0x61c]
mov esi, edx
mov r15d, 0x200
lea rcx, [rsp + 0x50]
lea r8, [0x1401cec2c]
mov rdx, r15
mov qword [rsp + 0x20], r14
call fcn.140044464
xor edi, edi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140018080
lea rdx, str._bExtract_VXD__File_already_present_n
mov rcx, rbp
call fcn.140016c48
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140018286
mov ecx, esi
call fcn.140017fbc
cmp eax, edi
jne 0x140018095
mov eax, 0x5007
jmp 0x140018286
lea r8, [rbp + 0x81c]
cmp byte [r8], dil
je 0x14001820d
lea rcx, [rsp + 0x250]
mov rdx, r15
call fcn.140158644
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
cmp rax, rdi
je 0x140018228
movzx edx, word [rbp + 0xd68]
mov r8d, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
cmp rax, rdi
je 0x140018228
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rdi
je 0x140018228
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, edi
je 0x140018228
mov eax, 2
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140018240
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [rsi + 3]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140018240
lea rcx, [rsp + 0x50]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [0x1401cec70]
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.14004453c
lea rcx, [rsp + 0x50]
mov r8, r14
mov rdx, r15
call fcn.14004453c
lea eax, [rsi + 3]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140018230
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018079
lea rdx, [rsp + 0x250]
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, edi
jne 0x1400180b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018286
lea rcx, [rbp + 0x61c]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsp + 0x40]
lea rdx, str._bExtract_VXD__WriteFile_returned__d_bytes._n
mov rcx, rbp
mov ebx, eax
call fcn.140016c48
cmp ebx, edi
jne 0x14001827b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140156fd0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret