I worked on an app that did this, you digitally sign the exe and the signature includes the length of the signed data but not the length of the exe - you can th

I worked on an app that did this, you digitally sign the exe and the signature includes the length of the signed data but not the length of the exe - you can the append whatever you want at the end and read it when you run the executable. It is a great way to not have to resign every app but also allow for a “one click” install experience