Function at 0x180008820
Capabilities:
Extract resource via kernel32 functions
Get common file path
Read .ini file
Set environment variable

Disassembly:
sub rsp, 0x58
cmp edx, 1
jne 0x180008a1e
mov dword [rsp + 0x48], 0x20d
lea rax, [0x180004e90]
add rax, 0x20d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d720
mov dword [rsp + 0x48], 0x23d
lea rax, [0x180007950]
add rax, 0x23d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d720
cmp dword [0x1800d8574], 0x4b4477d3
jne 0x1800089ef
xor edx, edx
mov qword [rsp + 0x50], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastActivePopup]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InflateRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r8d, r8d
lea rdx, str.C7t76V42Gf9UbdWBR9cUuQhmYli
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageCallbackW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirListW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_InSendMessageEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x48], 0x244
lea rax, [0x180006df0]
add rax, 0x244
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000d720
mov eax, 1
add rsp, 0x58
ret