Function at 0x40fda0
Capabilities:
Delete file
Extract resource via kernel32 functions
Set environment variable
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], rbp
mov rax, qword [0x00413248]
mov byte [rax], 1
nop
lea rcx, [0x0040d400]
call fcn.0040b300
nop
lea rcx, [0x00418e98]
lea rdx, [0x0040cfa0]
call fcn.0040ab20
mov rax, qword [0x00413230]
mov dword [rax], 0
mov rcx, qword [0x00418d38]
lea rdx, [0x00410250]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [0x00418ea0], rax
cmp qword [0x00418ea0], 0
je 0x410189
mov rcx, qword [0x00418d38]
mov rdx, qword [0x00418ea0]
call sub.kernel32.dll_LoadResource
mov qword [0x00418ea8], rax
cmp qword [0x00418ea8], 0
je 0x410155
nop
call fcn.0040d250
mov rcx, qword [0x00418eb8]
lea rdx, [0x00418e5c]
movzx rax, byte [0x00418ef8]
mov r8, qword [0x00418ee8]
sub r8, rax
sub r8, 1
call fcn.00404c20
nop
mov rcx, qword [0x00418eb8]
call fcn.004048c0
lea rcx, [rbp + 0x88]
call fcn.0040c8c0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x88]
call fcn.0040c7e0
lea rcx, [0x00418e80]
mov rdx, qword [rbp + 0x90]
call fcn.00407e40
lea rcx, [rbp + 0x78]
lea rdx, [0x00418e5c]
call fcn.00408690
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00418e80]
mov r8, qword [rbp + 0x78]
call fcn.0040c470
lea rcx, [0x00418e88]
mov rdx, qword [rbp + 0x80]
call fcn.00407e40
mov rcx, qword [0x00418d38]
lea rdx, [0x0041025a]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [0x00418ea0], rax
cmp qword [0x00418ea0], 0
je 0x410121
mov rcx, qword [0x00418d38]
mov rdx, qword [0x00418ea0]
call sub.kernel32.dll_LoadResource
mov qword [0x00418ea8], rax
cmp qword [0x00418ea8], 0
je 0x4100ed
lea rcx, [rbp + 0x70]
mov rax, qword [0x00413240]
mov rdx, qword [rax]
call fcn.004085e0
lea rcx, [0x00418e98]
mov edx, 5
lea r8, [0x00410274]
mov r9, qword [0x00418e88]
lea rax, [0x0041029c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [0x004102b0]
mov qword [rsp + 0x30], rax
call fcn.00408990
mov rcx, qword [0x00418e88]
call fcn.00408560
mov rcx, rax
mov edx, 0x40000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x102
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [0x00418ef0], rax
nop
call fcn.0040d250
mov rcx, qword [0x00418ef0]
mov rdx, qword [0x00418eb8]
movzx rax, byte [0x00418ef8]
mov r8d, dword [0x00418ee8]
sub r8d, eax
sub r8d, 1
lea r9, [0x00418efc]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
nop
mov rcx, qword [0x00418ef0]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [0x00418eb8]
call fcn.004048c0
lea rcx, [rbp + 0x68]
lea rdx, [0x0040cf90]
call fcn.0040ab20
mov rcx, qword [rbp + 0x68]
call fcn.00408560
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.0040ca60
mov rcx, qword [rbp + 0x60]
call fcn.00408560
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_SetEnvironmentVariableW
mov rcx, qword [0x00418e98]
call fcn.0040d0d0
mov rcx, qword [0x00413230]
mov dword [rcx], eax
mov rcx, qword [0x00418e88]
call fcn.00408560
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x41018e
lea rcx, [rbp + 0x58]
lea rdx, [0x0040cfb0]
call fcn.0040ab20
mov rcx, qword [rbp + 0x58]
call fcn.00408560
xor rcx, rcx
mov rdx, rax
lea r8, [0x004102b4]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x41018e
lea rcx, [rbp + 0x50]
lea rdx, [0x0040cfc0]
call fcn.0040ab20
mov rcx, qword [rbp + 0x50]
call fcn.00408560
xor rcx, rcx
mov rdx, rax
lea r8, [0x004102b4]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x41018e
lea rcx, [rbp + 0x48]
lea rdx, [0x0040cfd0]
call fcn.0040ab20
mov rcx, qword [rbp + 0x48]
call fcn.00408560
xor rcx, rcx
mov rdx, rax
lea r8, [0x004102b4]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x41018e
call fcn.0040d010
nop
lea rcx, [rbp + 0x48]
mov edx, 0xa
call fcn.00407a60
call fcn.004076a0
jmp 0x4101ad
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret