Function at 0x401f09
Capabilities:
Delete file
Extract resource via kernel32 functions
Move file
Write file on windows

Disassembly:
push rbp
push rdi
push rbx
mov rbp, rsp
sub rsp, 0x70
lea r8, str.Error
mov edx, 0x5bd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeResource]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00408048]
mov rcx, rax
call sym.strdup
mov r10, rax
mov rax, r10
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
sub rax, 1
add rax, r10
mov dword [rax], 0x706d742e
mov byte [rax + 4], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x106
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 2
mov rcx, r10
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
je 0x402054
mov ecx, dword [rbp - 0xc]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
jne 0x40205b
mov eax, 1
jmp 0x402060
mov eax, 0
test al, al
je 0x40208a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Unable_To_Create_Resource_Files:_Error_number__d_n
call sym.printf
mov eax, dword [0x00408058]
add eax, 0xa
mov dword [0x00408058], eax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00408048]
mov rcx, rax
call sym.strdup
mov r9, rax
mov rax, r9
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
sub rax, 1
add rax, r9
mov dword [rax], 0x706d742e
mov byte [rax + 4], 0
mov r8d, 4
mov edx, 0
mov rcx, r9
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileExA]
call rax
mov rbx, qword [0x00408048]
mov rax, qword [0x00408048]
mov rcx, rax
call sym.strdup
mov r9, rax
mov rax, r9
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
sub rax, 1
add rax, r9
mov dword [rax], 0x706d742e
mov byte [rax + 4], 0
lea r8, str.Unable_To_Read_Resources_:_Error_number
mov rdx, rbx
mov rcx, r9
call sym.DecryptFileA_char__char__char_
xor eax, 1
test al, al
je 0x402177
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Unable_To_Read_Resources_:_Error_number__d_n
call sym.printf
mov eax, dword [0x00408058]
add eax, 1
mov dword [0x00408058], eax
mov rax, qword [0x00408048]
mov rcx, rax
call sym.strdup
mov rdx, rax
mov rax, rdx
mov rcx, 0xffffffffffffffff
mov r8, rax
mov eax, 0
mov rdi, r8
repne scasb al, byte [rdi]
mov rax, rcx
not rax
sub rax, 1
add rax, rdx
mov dword [rax], 0x706d742e
mov byte [rax + 4], 0
mov rcx, rdx
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [0x00408048]
mov r8d, 4
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileExA]
call rax
nop
add rsp, 0x70
pop rbx
pop rdi
pop rbp
ret