Function at 0x40ee90
Capabilities:
Delete file
Extract resource via kernel32 functions
Set environment variable
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], rbp
nop
lea rcx, [0x0040c4f0]
call fcn.0040a390
nop
lea rcx, [0x00417e98]
lea rdx, [0x0040c030]
call fcn.00409bf0
mov rax, qword [0x00412090]
mov dword [rax], 0
mov rcx, qword [0x00417d38]
lea rdx, [0x0040f3b0]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [0x00417ea0], rax
cmp qword [0x00417ea0], 0
je 0x40f2e7
mov rcx, qword [0x00417d38]
mov rdx, qword [0x00417ea0]
call sub.kernel32.dll_LoadResource
mov qword [0x00417ea8], rax
cmp qword [0x00417ea8], 0
je 0x40f2b3
nop
call fcn.0040c340
mov rcx, qword [0x00417eb8]
lea rdx, [0x00417e5c]
movzx rax, byte [0x00417ef8]
mov r8, qword [0x00417ee8]
sub r8, rax
sub r8, 1
call fcn.00404b30
nop
mov rcx, qword [0x00417eb8]
call fcn.00404810
lea rcx, [rbp + 0x98]
call fcn.0040b950
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
call fcn.0040b870
lea rcx, [0x00417e80]
mov rdx, qword [rbp + 0xa0]
call fcn.00406f70
lea rcx, [rbp + 0x88]
lea rdx, [0x00417e5c]
call fcn.00407760
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00417e80]
mov r8, qword [rbp + 0x88]
call fcn.0040b500
lea rcx, [0x00417e88]
mov rdx, qword [rbp + 0x90]
call fcn.00406f70
mov rcx, qword [0x00417d38]
lea rdx, [0x0040f3ba]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [0x00417ea0], rax
cmp qword [0x00417ea0], 0
je 0x40f27f
cmp dword [0x00417e64], 0x8000
jne 0x40f0d0
lea rcx, [rbp + 0x80]
lea rdx, [0x0040c0a0]
call fcn.00409bf0
mov rcx, qword [rbp + 0x80]
call fcn.00407660
mov rbx, rax
lea rcx, [rbp + 0x78]
lea rdx, [0x0040c0b0]
call fcn.00409bf0
mov rcx, qword [rbp + 0x78]
call fcn.00407660
xor rcx, rcx
mov rdx, rbx
mov r8, rax
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
mov rcx, qword [0x00417d38]
mov rdx, qword [0x00417ea0]
call sub.kernel32.dll_LoadResource
mov qword [0x00417ea8], rax
cmp qword [0x00417ea8], 0
je 0x40f24b
lea rcx, [rbp + 0x70]
mov rax, qword [0x00412098]
mov rdx, qword [rax]
call fcn.004076e0
lea rcx, [0x00417e98]
mov edx, 5
lea r8, [0x0040f3d4]
mov r9, qword [0x00417e88]
lea rax, [0x0040f3fc]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [0x0040f410]
mov qword [rsp + 0x30], rax
call fcn.00407a60
mov rcx, qword [0x00417e88]
call fcn.00407660
mov rcx, rax
mov edx, 0x40000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x102
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [0x00417ef0], rax
nop
call fcn.0040c340
mov rcx, qword [0x00417ef0]
mov rdx, qword [0x00417eb8]
movzx rax, byte [0x00417ef8]
mov r8d, dword [0x00417ee8]
sub r8d, eax
sub r8d, 1
lea r9, [0x00417efc]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
nop
mov rcx, qword [0x00417ef0]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [0x00417eb8]
call fcn.00404810
lea rcx, [rbp + 0x68]
lea rdx, [0x0040c020]
call fcn.00409bf0
mov rcx, qword [rbp + 0x68]
call fcn.00407660
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.0040baf0
mov rcx, qword [rbp + 0x60]
call fcn.00407660
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_SetEnvironmentVariableW
mov rcx, qword [0x00417e98]
call fcn.0040c1b0
mov rcx, qword [0x00412090]
mov dword [rcx], eax
mov rcx, qword [0x00417e88]
call fcn.00407660
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x40f2ec
lea rcx, [rbp + 0x58]
lea rdx, [0x0040c040]
call fcn.00409bf0
mov rcx, qword [rbp + 0x58]
call fcn.00407660
xor rcx, rcx
mov rdx, rax
lea r8, [0x0040f414]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40f2ec
lea rcx, [rbp + 0x50]
lea rdx, [0x0040c050]
call fcn.00409bf0
mov rcx, qword [rbp + 0x50]
call fcn.00407660
xor rcx, rcx
mov rdx, rax
lea r8, [0x0040f414]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40f2ec
lea rcx, [rbp + 0x48]
lea rdx, [0x0040c060]
call fcn.00409bf0
mov rcx, qword [rbp + 0x48]
call fcn.00407660
xor rcx, rcx
mov rdx, rax
lea r8, [0x0040f414]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40f2ec
call fcn.0040c0c0
nop
lea rcx, [rbp + 0x48]
mov edx, 0xc
call fcn.00406c90
call fcn.004068d0
jmp 0x40f30b
lea rsp, [rbp + 0xb8]
pop rbx
pop rbp
ret