Function at 0x428220
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x469ea0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SOFTWAREClasses360seURLDefaultIcon
lea ecx, [ebp - 0x10c]
call fcn.004085c0
push 0x45bbc0
lea ecx, [ebp - 0x108]
call fcn.00408300
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 0x104
test eax, eax
jne 0x428371
lea edx, [ebp - 0x118]
push edx
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
push edx
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x118], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [0x469cb4]
mov edx, dword [eax + 0xc]
mov ecx, 0x469cb4
call edx
add eax, 0x10
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x114]
call fcn.00402b80
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x108]
call fcn.00402e10
mov eax, dword [ebp - 0x114]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428317
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x108]
mov edx, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, edi
or ecx, edx
jge 0x428340
push edi
lea ecx, [ebp - 0x108]
call fcn.00401b60
mov esi, dword [ebp - 0x108]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call ebx
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, edi
or eax, ecx
jge 0x42836c
push edi
lea ecx, [ebp - 0x108]
call fcn.00401b60
mov esi, dword [ebp - 0x108]
push esi
call ebx
jmp 0x428377
mov esi, dword [ebp - 0x108]
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, edi
or edx, eax
jge 0x42839a
push edi
lea ecx, [ebp - 0x108]
call fcn.00401b60
mov esi, dword [ebp - 0x108]
push esi
lea ecx, [ebp - 0x108]
push str._sUser_DataDefaultWeb_Data
push ecx
call fcn.00414da0
mov esi, dword [ebp - 0x108]
add esp, 0xc
cmp dword [esi - 8], edi
jl 0x42858f
xor edx, edx
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
push esi
push edx
mov dword [esi - 0xc], edi
push edx
mov word [esi + 0x208], dx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x110], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4283e4
sub eax, edx
sar eax, 1
lea ebx, [eax + eax + 1]
push ebx
call fcn.0043d95e
mov edi, eax
add esp, 4
test edi, edi
jne 0x428466
push ebx
call fcn.0043d95e
mov edi, eax
add esp, 4
test edi, edi
jne 0x428466
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428431
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [ebp - 0x10c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428453
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043eb21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x110]
push 0
push 0
push ecx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x45bb74
push 0xde
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x4284b9
add esi, 0xfffffff0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x428425
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x110], eax
test eax, eax
jne 0x4284f1
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428431
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x428431
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4284cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x428534
lea ecx, [ebp - 0x108]
call fcn.00402220
lea ecx, [ebp - 0x10c]
call fcn.00402220
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043eb21
mov esp, ebp
pop ebp
ret
push 0x20
call fcn.0043f1c7
push 0x45bb70
push edi
call fcn.00441756
mov esi, eax
add esp, 0xc
test esi, esi
je 0x428568
mov ecx, dword [ebp - 0x110]
push esi
push 1
push ecx
push ebx
call fcn.00440fe6
push esi
call fcn.0044127e
add esp, 0x14
lea ecx, [ebp - 0x108]
call fcn.00402220
lea ecx, [ebp - 0x10c]
call fcn.00402220
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043eb21
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004011e0
int3