Function at 0x1029d8f
Capabilities:
Extract resource via kernel32 functions
Set registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x624], 0
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.01029b84
test eax, eax
je 0x1029fff
or dword [ebp - 0x620], 0xffffffff
push ebx
mov dword [ebp - 0x628], 0xc
mov esi, 0x208
push edi
mov eax, dword [ebp - 0x620]
cmp eax, 0xa
ja case.default.0x1029df4
jmp dword [eax*4 + 0x102a02f]
mov edi, 0x100403c
push 0x1003ff8
jmp 0x1029e8c
mov edi, 0x1003fd8
push 0x1003f98
jmp 0x1029e8c
mov edi, 0x1003f7c
push 0x1003f38
jmp 0x1029e8c
mov edi, 0x1003f18
push 0x1003ed0
jmp 0x1029e8c
mov edi, 0x1003eb4
push 0x1003e74
jmp 0x1029e8c
mov edi, 0x1003e58
push 0x1003e18
jmp 0x1029e8c
mov edi, 0x1003dfc
push 0x1003dbc
jmp 0x1029e8c
mov edi, 0x1003da0
push 0x1003d6c
jmp 0x1029e8c
mov edi, 0x1003d50
push 0x1003d34
jmp 0x1029e8c
mov edi, 0x1003d18
push 0x1003cf8
jmp 0x1029e8c
mov edi, 0x1003cdc
push 0x1003cc0
jmp 0x1029e8c
mov edi, 0x1003ca4
push 0x1003c64
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027ea2
push 0x17
push edi
push dword [0x10405bc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1029f56
push ebx
push dword [0x10405bc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x630], eax
test eax, eax
je 0x1029f56
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1003c50
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.01027f9f
add esp, 0x14
test eax, eax
jl 0x1029f56
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1029f56
and dword [ebp - 0x62c], 0
push ebx
push dword [0x10405b0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [ebp - 0x62c]
push ecx
push eax
push dword [ebp - 0x630]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov dword [ebp - 0x624], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x620]
dec dword [ebp - 0x628]
jne 0x1029de5
xor esi, esi
pop edi
pop ebx
cmp dword [ebp - 0x624], esi
je 0x1029fff
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10026c8
push 0x80000001
mov dword [ebp - 0x620], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102a015
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1029fa9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push esi
push 0x1002690
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1029ff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003c08
push 2
call fcn.01039f55
add esp, 0xc
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102a015
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003bcc
push 2
call fcn.01039f55
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
xor ecx, ebp
pop esi
call fcn.0102df7d
leave
ret