Function at 0x10032d5f
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x10032f57
push esi
push edi
xor edi, edi
cmp dword [0x100709c8], 0xffffffff
jne 0x10032e7b
mov dword [ebp - 0x2a0], edi
push 0x10
pop ecx
mov esi, 0x10007890
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x100078d4
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x100078e0
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2a0]
push eax
push 0x20019
xor edi, edi
push edi
lea eax, [ebp - 0x84]
push eax
push Ordinal_4
mov dword [ebp - 0x2a4], 0x16
mov dword [0x100709c8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10032e75
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032e61
mov eax, dword [ebp - 0x2a4]
shr eax, 1
mov ecx, edi
test eax, eax
jle 0x10032e52
movzx edx, word [ebp + ecx*2 - 0x40]
test dx, dx
je 0x10032e52
cmp dx, word [ebp + ecx*2 - 0x28]
jne 0x10032e52
inc ecx
cmp ecx, eax
jl 0x10032e3c
xor eax, eax
cmp word [ebp + ecx*2 - 0x40], di
sete al
mov dword [0x100709c8], eax
cmp dword [ebp - 0x2a0], edi
je 0x10032e75
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x29c]
cmp dword [0x100709c8], 0
je 0x10032f18
push 0x104
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x10032f18
lea edx, [ebp - 0x298]
lea eax, [edx + eax*2]
push 0x2e
pop edx
cmp word [eax], dx
je 0x10032ece
lea ecx, [ebp - 0x296]
cmp eax, ecx
jbe 0x10032ec9
sub eax, 2
cmp word [eax], dx
jne 0x10032eb7
cmp word [eax], dx
jne 0x10032f18
mov esi, 0x100078d4
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov si, word [ebp - 0x10]
xor edi, edi
mov ecx, edi
test si, si
je 0x10032eff
mov edx, edi
movzx esi, si
inc ecx
mov word [edx + eax + 2], si
lea edx, [ecx + ecx]
movzx esi, word [ebp + edx - 0x10]
test si, si
jne 0x10032eec
xor edx, edx
mov word [eax + ecx*2 + 2], dx
lea eax, [ebp - 0x298]
push eax
mov ecx, ebx
call fcn.10032cf7
test eax, eax
jne 0x10032f52
mov esi, dword [ebp - 0x29c]
push 0xea
push 1
push esi
mov dword [ebx], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x14], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10032f44
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10032f48
xor eax, eax
jmp 0x10032f55
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10048c09
leave
ret 4