Function at 0x100031ce8
Capabilities:
Extract resource via kernel32 functions
Set registry value
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor ecx, ecx
xor r12d, r12d
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, [rsp + 0x270]
test rdx, rdx
je 0x100031d41
lea rcx, [rsp + 0x270]
call fcn.100031a78
jmp 0x100031d43
xor eax, eax
test eax, eax
je 0x100032026
mov r14d, 1
mov r15d, 0x208
mov ebx, r14d
cmp ebx, 7
jg 0x100031df3
je 0x100031de3
mov ecx, ebx
sub ecx, 2
je 0x100031dd0
sub ecx, r14d
je 0x100031dbd
sub ecx, r14d
je 0x100031daa
sub ecx, r14d
je 0x100031d97
cmp ecx, r14d
jne 0x100031e0e
lea rdi, [0x10001e518]
lea r8, [0x10001e538]
jmp 0x100031e6c
lea rdi, [0x10001e4a8]
lea r8, [0x10001e4d0]
jmp 0x100031e6c
lea rdi, [0x10001e438]
lea r8, [0x10001e460]
jmp 0x100031e6c
lea rdi, [0x10001e3d8]
lea r8, [0x10001e3f8]
jmp 0x100031e6c
lea rdi, [0x10001e368]
lea r8, [0x10001e390]
jmp 0x100031e6c
lea rdi, [0x10001e578]
lea r8, [0x10001e5a0]
jmp 0x100031e6c
mov ecx, ebx
sub ecx, 8
je 0x100031e5e
sub ecx, r14d
je 0x100031e4e
sub ecx, r14d
je 0x100031e3e
sub ecx, r14d
je 0x100031e2e
cmp ecx, r14d
je 0x100031e1e
lea rdi, [0x10001e308]
lea r8, [0x10001e328]
jmp 0x100031e6c
lea rdi, [0x10001e718]
lea r8, [0x10001e738]
jmp 0x100031e6c
lea rdi, [0x10001e6d8]
lea r8, [0x10001e6f8]
jmp 0x100031e6c
lea rdi, [0x10001e698]
lea r8, [0x10001e6b8]
jmp 0x100031e6c
lea rdi, [0x10001e640]
lea r8, [0x10001e660]
jmp 0x100031e6c
lea rdi, [0x10001e5e0]
lea r8, [0x10001e600]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.10002e35c
mov rcx, qword [0x10004ce88]
mov r8d, 0x17
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x100031f57
mov rcx, qword [0x10004ce88]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x100031f57
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x270]
lea r8, [0x10001e758]
lea rcx, [rsp + 0x480]
mov rdx, r15
mov qword [rsp + 0x20], rax
call fcn.10002e5e0
test eax, eax
js 0x100031f57
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x480]
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x100031f57
mov rcx, qword [0x10004ce70]
and dword [rsp + 0x50], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, eax
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov r12d, r14d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, r14d
cmp ebx, 0xd
jl 0x100031d5a
test r12d, r12d
je 0x100032026
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x10001c750]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100032040
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
lea rdx, [0x10001e770]
mov r9d, r14d
not rcx
xor r8d, r8d
sub rcx, r14
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100032019
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x10001e7b0]
mov ecx, 2
mov r8d, eax
call fcn.10004575c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100032040
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x10001e7f8]
mov ecx, 2
mov r8d, eax
call fcn.10004575c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, r12d
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret