Function at 0x2e004f4d
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x2e006e74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x2a0], eax
cmp eax, edx
je 0x2e00a68d
cmp dword [0x2e013288], 0xffffffff
push esi
push edi
jne 0x2e005034
push 0x10
pop ecx
mov esi, 0x2e0050b8
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x2e0050fc
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x2e00509c
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x29c]
push eax
push 0x20019
push edx
lea eax, [ebp - 0x84]
push eax
push SysReAllocString
mov dword [ebp - 0x29c], edx
mov dword [ebp - 0x2a4], 0x16
mov dword [0x2e013288], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2e005034
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x28]
push eax
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x2e00a694
cmp dword [ebp - 0x29c], esi
je 0x2e005034
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x2e013288], 0
jne 0x2e00a6cb
push 0xea
xor eax, eax
push 1
push dword [ebp - 0x2a0]
mov dword [ebx], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x2e005097
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x2e005097
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.2e005b14
leave
ret 4
test eax, eax
je 0x2e005041
jmp 0x2e00507d
xor eax, eax
jmp 0x2e005080
xor eax, eax
jmp 0x2e005082
mov ecx, dword [ebp - 0x2a4]
shr ecx, 1
cmp ecx, esi
jle 0x2e00a6b6
movzx edx, word [ebp + eax*2 - 0x40]
cmp dx, si
je 0x2e00a6b6
cmp dx, word [ebp + eax*2 - 0x28]
jne 0x2e00a6b6
inc eax
cmp eax, ecx
jl 0x2e00a6a0
xor ecx, ecx
cmp word [ebp + eax*2 - 0x40], si
sete cl
mov dword [0x2e013288], ecx
jmp 0x2e005020
push 0x104
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x2e005041
lea eax, [ebp + eax*2 - 0x298]
cmp word [eax], 0x2e
je 0x2e00a71b
lea ecx, [ebp - 0x296]
cmp eax, ecx
jbe 0x2e00a711
dec eax
dec eax
cmp word [eax], 0x2e
jne 0x2e00a6ff
cmp word [eax], 0x2e
jne 0x2e005041
mov esi, 0x2e0050fc
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
inc eax
xor esi, esi
inc eax
cmp word [ebp - 0x10], si
je 0x2e00a749
movzx ecx, word [ebp - 0x10]
xor edx, edx
inc esi
mov word [edx + eax], cx
lea edx, [esi + esi]
movzx ecx, word [ebp + edx - 0x10]
test cx, cx
jne 0x2e00a737
xor ecx, ecx
mov word [eax + esi*2], cx
lea eax, [ebp - 0x298]
push eax
mov ecx, ebx
call fcn.2e01044b
jmp 0x2e005091