Function at 0x41a988
Capabilities:
Extract resource via kernel32 functions
Set registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
push ebx
mov dword [ebp - 0x624], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x418]
call fcn.0041a75a
test eax, eax
je 0x41abfa
or edi, 0xffffffff
mov dword [ebp - 0x628], 0xc
mov eax, 0x208
cmp edi, 0xa
ja case.default.0x41a9df
jmp dword [edi*4 + 0x41ac2c]
mov esi, 0x402a78
push 0x402a98
jmp 0x41aa77
mov esi, 0x402adc
push 0x402af8
jmp 0x41aa77
mov esi, 0x402b38
push 0x402b58
jmp 0x41aa77
mov esi, 0x402b9c
push 0x402bb8
jmp 0x41aa77
mov esi, 0x402c00
push 0x402c1c
jmp 0x41aa77
mov esi, 0x402c5c
push 0x402c78
jmp 0x41aa77
mov esi, 0x402cb8
push 0x402cd4
jmp 0x41aa77
mov esi, 0x402d14
push 0x402d30
jmp 0x41aa77
mov esi, 0x402d64
push 0x402d80
jmp 0x41aa77
mov esi, 0x402d9c
push 0x402db8
jmp 0x41aa77
mov esi, 0x402dd8
push 0x402df4
jmp 0x41aa77
mov esi, 0x402a1c
push 0x402a38
mov edx, eax
lea ecx, [ebp - 0x210]
call fcn.004183cc
push 0x17
push esi
push dword [0x42c79c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41ab44
push esi
push dword [0x42c79c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x62c], eax
test eax, eax
je 0x41ab44
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x402e10
lea eax, [ebp - 0x620]
push 0x208
push eax
call fcn.004184ca
add esp, 0x14
test eax, eax
js 0x41ab44
push ebx
push 0x8000080
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41ab4c
and dword [ebp - 0x630], 0
push esi
push dword [0x42c790]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [ebp - 0x630]
push ecx
push eax
push dword [ebp - 0x62c]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
inc esi
push ebx
mov dword [ebp - 0x624], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41ab52
mov esi, dword [ebp - 0x624]
jmp 0x41ab54
mov esi, dword [ebp - 0x624]
xor ebx, ebx
inc edi
mov eax, 0x208
sub dword [ebp - 0x628], 1
jne 0x41a9d6
test esi, esi
je 0x41abfa
push ebx
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], ebx
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x401558
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ac10
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41aba0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x418]
push eax
push 1
push ebx
push 0x402e24
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41abec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x402e60
push 2
call fcn.00427cda
add esp, 0xc
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ac10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x402ea8
push 2
call fcn.00427cda
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret