Function at 0x140001854
Capabilities:
Check os version
Delete file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rsi, rdx
mov dword [rbp - 0x60], 0x11c
mov r15, rcx
xor edx, edx
lea rcx, [rbp - 0x5c]
mov r8d, 0x118
call fcn.1400043d0
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r13d, r13d
cmp dword [rbp - 0x5c], 6
ja 0x1400018c4
jne 0x1400018bd
cmp dword [rbp - 0x58], r13d
ja 0x1400018c4
mov edx, 0x7d2
jmp 0x1400018c9
mov edx, 0x7d1
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000192a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], 0xe5
mov edi, 7
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x70], rdi
mov rcx, rsi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
call fcn.140002a4c
xor r8d, r8d
lea rcx, [rsp + 0x58]
mov dl, 1
call fcn.14000221c
lea eax, [rdi - 5]
jmp 0x140001b1a
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x14000194d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], 0xeb
jmp 0x1400018ed
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
jne 0x140001972
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], 0xf1
jmp 0x1400018ed
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edi, 7
mov qword [rbp - 0x78], r13
mov r12, rax
mov qword [rbp - 0x70], rdi
lea rax, [rsp + 0x78]
mov word [rsp + 0x78], r13w
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov r9, r12
mov r8d, r14d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.140001230
mov rbx, qword [rax]
mov qword [rax], r13
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400019cd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x40], r13
test rbx, rbx
jne 0x140001a62
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xfe
mov rcx, rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
call fcn.140002a4c
xor r8d, r8d
lea rcx, [rsp + 0x58]
mov dl, 1
call fcn.14000221c
lea rax, [rsp + 0x78]
mov r9, r12
mov qword [rsp + 0x30], rax
lea edx, [rbx + 1]
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x48]
mov r8d, r14d
mov qword [rsp + 0x20], r15
call fcn.140001230
mov rbx, qword [rax]
mov qword [rax], r13
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140001a4d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x48], r13
test rbx, rbx
jne 0x140001a62
mov qword [rsp + 0x50], 0x103
jmp 0x140001a89
lea rdx, str.RunInstaller
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], 0x10d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x70], rdi
mov rcx, rsi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
call fcn.140002a4c
xor r8d, r8d
lea rcx, [rsp + 0x58]
mov dl, 1
call fcn.14000221c
mov edi, 2
jmp 0x140001ac7
call rax
test al, al
mov edi, r13d
sete dil
test rbx, rbx
je 0x140001ad5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rbp - 0x78], r13
je 0x140001b09
cmp qword [rbp - 0x70], 8
lea rcx, [rsp + 0x78]
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rbp - 0x70], 8
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x78], r13
cmovae rcx, qword [rsp + 0x78]
mov word [rcx], r13w
xor r8d, r8d
lea rcx, [rsp + 0x78]
mov dl, 1
call fcn.14000221c
mov eax, edi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140002f80
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret