Function at 0x140053220
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get common file path
Get file attributes
Write file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x100a0
call fcn.140237890
sub rsp, rax
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x100d0], rbx
mov qword [rsp + 0x100d8], rbp
mov qword [rsp + 0x100e0], rsi
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0x10090], rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14005374a
bt dword [rax + 0x84], 0x11
jae 0x14005374a
call fcn.1401e9268
mov rdx, rax
xor ebp, ebp
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400532a9
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea r15, [0x140260b08]
or rsi, 0xffffffffffffffff
test r15, 0xffffffffffff0000
jne 0x1400532f6
movzx edi, r15w
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x14005331a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400074b0
mov rbx, qword [rsp + 0x58]
jmp 0x14005331a
xor eax, eax
mov rcx, rsi
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140007720
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x90]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x8c], 0x5c
jne 0x140053353
mov word [rsp + rcx*2 + 0x8c], ax
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140053376
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.RtkBtMnt.exe
mov edx, 0x7fff
lea rcx, [rsp + 0x90]
call fcn.1402175a0
xor r9d, r9d
lea r8, str.ADRExtracted
lea rdx, str.General
lea rcx, [0x1403149a0]
call fcn.1401ee9b4
mov edi, eax
mov r13d, 1
test eax, eax
jne 0x1400533d5
mov r9d, r13d
lea r8, str.ADRExtracted
lea rdx, str.General
lea rcx, [0x1403149a0]
call fcn.1401eea54
mov r12d, ebp
test edi, edi
sete r12b
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
cmove r12d, r13d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
call fcn.1401e9268
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x140053426
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x140264a04]
test rdx, 0xffffffffffff0000
jne 0x140053469
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140053486
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400074b0
jmp 0x140053486
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.140007720
nop
call fcn.1401e9268
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400534a5
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
lea r14, [rsp + 0x90]
shr r14, 0x10
jne 0x1400534ee
movzx edi, ax
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140053518
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400074b0
jmp 0x140053518
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140007720
nop
mov r8d, r13d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14003e210
test r12d, r12d
je 0x140053677
call fcn.1401dc36c
lea r8, str.Binary
mov edx, 0x143
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140053578
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14005374a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005374a
call fcn.1401dc36c
mov rdx, rdi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
jne 0x1400535b3
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14005374a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005374a
call fcn.1401dc36c
mov rdx, rdi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
test rax, rax
jne 0x1400535f8
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14005374a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005374a
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140053651
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, eax
test esi, esi
jg 0x14005374a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005374a
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov r8d, r12d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.1400073d0
mov r12, rax
call fcn.1401e9268
mov rcx, rax
test rax, rax
setne bpl
test ebp, ebp
jne 0x1400536b9
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
test r14, r14
jne 0x1400536f6
movzx edi, ax
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x140053720
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400074b0
jmp 0x140053720
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140007720
nop
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.14003e210
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14005374a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x10090]
xor rcx, rsp
call fcn.140216200
lea r11, [rsp + 0x100a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret