Function at 0x401700
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Get file size
Move file
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
mov r12, rdx
push rdi
push rsi
mov edi, r8d
push rbx
mov rbx, rcx
sub rsp, 0x270
test r8d, r8d
js 0x401863
movzx edx, r8w
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbp
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbp, rbp
je 0x40187d
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, eax
mov rdx, r12
lea rcx, [rbx + rax*2]
call sub.ntdll.dll_wcscpy
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov dword [rsp + 0x54], eax
call fcn.00401100
test rax, rax
mov r12, rax
je 0x4017ba
movsxd r8, dword [rsp + 0x58]
cmp r8d, dword [rsp + 0x5c]
je 0x40188c
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r8d, 1
mov edx, 2
mov rcx, rbx
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rsi
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x4018bb
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x5c]
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401881
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x5c], eax
jne 0x401881
test r12, r12
je 0x401847
mov rcx, r12
call sub.msvcrt.dll_free
test edi, edi
mov eax, esi
js 0x40197f
add rsp, 0x270
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rsi, [rsp + 0x60]
xor ecx, ecx
mov r8d, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4018a6
xor eax, eax
jmp 0x401851
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40183a
mov rdx, rbp
mov rcx, rax
call sub.ntdll.dll_memcmp
test eax, eax
jne 0x4017ba
mov esi, 1
jmp 0x40183f
lea rdx, [rsp + 0x5c]
mov rcx, rsi
call fcn.00401100
mov rbp, rax
jmp 0x401761
lea r13, [rsp + 0x60]
lea r8, str._s.new
mov r9, rbx
mov edx, 0x104
mov rcx, r13
call fcn.004015a0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r8d, 1
mov edx, 2
mov rcx, r13
call rsi
cmp rax, 0xffffffffffffffff
mov r14, rax
je 0x401994
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x5c]
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov rcx, r13
je 0x401884
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x5c], eax
jne 0x401884
mov r8d, 5
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov esi, eax
jne 0x40183a
mov rcx, r13
jmp 0x401884
mov rcx, rbp
mov dword [rsp + 0x4c], esi
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x4c]
jmp 0x401851
xor esi, esi
jmp 0x40183a