Function at 0x140016f40
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov r14, rcx
xor r12d, r12d
xor bl, bl
lea r8, [0x1400f6d80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400171ad
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x1400f6d88]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400171ad
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140017036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140017036
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x48]
mov r8d, r15d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400171a2
mov ecx, 0x210
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001707b
xor edx, edx
mov r8d, 0x210
mov rcx, rax
call fcn.1400b88a0
mov rcx, rbx
call fcn.140014070
mov rdi, rax
jmp 0x14001707e
mov rdi, r12
mov rbx, rdi
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140012fb0
test al, al
jne 0x1400170b0
test rdi, rdi
je 0x1400170a9
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140014520
xor bl, bl
jmp 0x1400171a2
mov byte [r14 + 0x90], 0
lea rcx, [r14 + 8]
mov rax, rdi
mov rsi, rdi
lea rdx, [rsp + 0x40]
cmp rcx, rdx
je 0x1400170f0
mov rbx, r12
mov qword [rsp + 0x40], rbx
mov rdx, qword [rcx]
mov qword [rcx], rdi
mov rdi, r12
mov rax, r12
mov rsi, r12
test rdx, rdx
je 0x1400170f0
call fcn.140014520
mov rax, r12
test rdi, rdi
je 0x1400171a0
lea rcx, [rax + 0x98]
lea r9, [0x1400141f0]
mov edx, 8
lea r8d, [rdx + 0x17]
call fcn.1400b5cd8
mov rcx, qword [rsi + 0x90]
test rcx, rcx
je 0x140017132
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x140017132
mov qword [rsi + 0x90], r12
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x14001714f
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x14001714f
mov qword [rbx + 0x88], r12
mov rdx, qword [rbx + 8]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017171
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140017191
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov edx, 0x210
mov rcx, qword [rsp + 0x40]
call fcn.1400b56bc
mov bl, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400b5660
add rsp, 0x280
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret