Function at 0x4028c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0xc]
call fcn.00401b5c
cmp dword [ebp + 8], 0
jne 0x4028df
xor eax, eax
jmp 0x402904
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00403530
mov eax, esp
push esi
push dword [ebp + 8]
push eax
call fcn.00402a8a
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
je 0x402939
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402939
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40295b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x402957
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40299f
xor esi, esi
jmp 0x40299f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x40298e
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.00403530
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.00403a60
add esp, 0xc
and byte [edi + esi], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.0040260a
mov edi, dword [ebp + 8]
mov esi, eax
test edi, edi
je 0x4029aa
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x402e66
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x402e8d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0xf003f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00402df4
mov edi, eax
cmp edi, esi
je 0x402ec7
lea ecx, [ebp - 4]
call fcn.00402d8f
mov eax, edi
jmp 0x402f51
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x402f32
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.00402e8d
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x402f25
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x402eea
lea ecx, [ebp - 4]
call fcn.00402d8f
mov eax, dword [ebp - 0xc]
jmp 0x402f51
lea ecx, [ebp - 4]
call fcn.00402d8f
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00402d8f
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4