Function at 0x402914
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0xc]
call fcn.00401bad
cmp dword [ebp + 8], 0
jne 0x402930
xor eax, eax
jmp 0x402955
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.004036a0
mov eax, esp
push esi
push dword [ebp + 8]
push eax
call fcn.00402adb
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
je 0x40298a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40298a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4029ac
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4029a8
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4029f0
xor esi, esi
jmp 0x4029f0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x4029df
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.004036a0
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.00403ab0
add esp, 0xc
and byte [edi + esi], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.0040265b
mov edi, dword [ebp + 8]
mov esi, eax
test edi, edi
je 0x4029fb
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x402eb7
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x402ede
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0xf003f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00402e45
mov edi, eax
cmp edi, esi
je 0x402f18
lea ecx, [ebp - 4]
call fcn.00402de0
mov eax, edi
jmp 0x402fa2
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x402f83
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.00402ede
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x402f76
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x402f3b
lea ecx, [ebp - 4]
call fcn.00402de0
mov eax, dword [ebp - 0xc]
jmp 0x402fa2
lea ecx, [ebp - 4]
call fcn.00402de0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00402de0
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4