Function at 0x40fee0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
sub esp, 0x684
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x67c], eax
mov eax, dword [esp + 0x688]
push ebx
push ebp
mov ebp, dword [esp + 0x694]
push esi
push edi
mov edi, dword [ebp + 0x67c]
mov ebx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], 4
cmp ebx, 4
jne 0x40ff3b
mov esi, dword [ebp + 0x318]
jmp 0x40ff48
imul ecx, ecx, 0x354
lea esi, [ecx + ebp + 0x69c]
cmp dword [edi + 8], 0
mov dword [esp + 0x14], esi
je 0x40ff6a
add esi, 0x284
mov edi, str.BEGIN_::_K7IS_Parser_Unpack_Module
call fcn.00412cb0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x28c]
mov ecx, ebp
call fcn.0040fc20
add esp, 4
test eax, eax
jne 0x410031
cmp dword [edi + 8], eax
je 0x40ffd4
mov edi, str.K7IS_Parser_Unpack_Module
mov esi, str.Break_1
call fcn.00412cb0
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
je 0x40ffd4
mov esi, dword [esp + 0x14]
add esi, 0x284
mov edi, str.K7IS_Parser_Unpack_Module
call fcn.00412cb0
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
je 0x40ffd4
mov esi, dword [esp + 0x14]
add esi, 0x84
mov edi, str.K7IS_Parser_Unpack_Module
call fcn.00412cb0
mov dword [esp + 0x20], 0
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x308], 5
jne 0x4105b3
mov ecx, str._WindowsFolder__Temp
lea eax, [edi + 0x84]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410587
test dx, dx
je 0x41002a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410587
add eax, 4
add ecx, 4
test dx, dx
jne 0x410000
xor eax, eax
jmp 0x41058c
call fcn.004148a0
test eax, eax
jne 0x41013e
mov ecx, str._WindowsFolder__Temp
lea eax, [esi + 0x84]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410076
test dx, dx
je 0x410072
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410076
add eax, 4
add ecx, 4
test dx, dx
jne 0x410050
xor eax, eax
jmp 0x41007b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4100e1
lea edx, [esp + 0x288]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebp
lea ecx, [esp + 0x28c]
call fcn.0040fa40
lea eax, [esi + 0x284]
add esp, 4
mov dword [esp + 0x24], eax
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4100b0
lea edi, [esp + 0x288]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4100d0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4100d0
jmp 0x41019c
lea edi, [esp + 0x288]
add edi, 0xfffffffe
jmp 0x4100f0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4100f0
mov eax, dword [0x42b220]
mov dword [edi], eax
lea eax, [esi + 0x284]
mov dword [esp + 0x24], eax
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410110
lea edi, [esp + 0x288]
sub eax, edx
add edi, 0xfffffffe
jmp 0x410130
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x410130
jmp 0x41019c
lea edi, [esp + 0x288]
add edi, 0xfffffffe
jmp 0x410150
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x410150
mov ecx, dword [0x42b220]
lea eax, [esi + 0x284]
mov dword [edi], ecx
mov dword [esp + 0x24], eax
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410170
lea edi, [esp + 0x288]
sub eax, edx
add edi, 0xfffffffe
jmp 0x410190
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x410190
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x308], 1
jne 0x41021f
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x288]
lea edx, [esi + 0x20]
mov ecx, eax
sub edx, ecx
jmp 0x4101d0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4101d0
lea eax, [esp + 0x288]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4101f0
sub eax, edx
sar eax, 1
mov ecx, str..uni
lea edx, [esi + eax*2 + 0x18]
sub edx, ecx
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x410210
lea esi, [edi + 0x84]
mov ecx, 0x42b764
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410256
test dx, dx
je 0x410252
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410256
add eax, 4
add ecx, 4
test dx, dx
jne 0x410230
xor eax, eax
jmp 0x41025b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410323
cmp dword [edi + 0x30c], eax
jne 0x410323
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
lea edx, [esp + 0x28]
push edx
cmp eax, 0xffffffff
push 3
sete cl
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDlls
push 0x80000002
mov dword [esp + 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410318
cmp dword [esp + 0x1c], eax
jne 0x4102ec
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
lea edx, [esp + 0x298]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4102e4
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 2
jae 0x4102ec
mov dword [esp + 0x1c], 2
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x20]
push edx
push 4
push 0
lea eax, [esp + 0x298]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x1c], 2
jae 0x40ffdc
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea eax, [esp + 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x41034c
xor ebx, ebx
jmp 0x410356
mov ebx, eax
test eax, eax
jne 0x41040c
mov ecx, 0x42b764
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410386
test dx, dx
je 0x410382
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410386
add eax, 4
add ecx, 4
test dx, dx
jne 0x410360
xor eax, eax
jmp 0x41038b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4103e7
mov ecx, str._WindowsFolder__Fonts
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4103bc
test dx, dx
je 0x4103b8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4103bc
add eax, 4
add ecx, 4
test dx, dx
jne 0x410396
xor eax, eax
jmp 0x4103c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4103e7
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 8], 0
je 0x4103e0
mov edi, str.K7IS_Parser_Unpack_Module__FileOpen_
lea esi, [esp + 0x288]
call fcn.00412cb0
xor ebp, ebp
jmp 0x40ffe0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x304]
mov edi, dword [esp + 0x2c]
push 1
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40ffdc
jmp 0x410410
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 0x304]
test esi, esi
jne 0x410443
lea ecx, [eax + 0x328]
push ecx
push 0
add eax, 0x320
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x410565
xor ebp, ebp
jmp 0x410569
cmp dword [eax + 0x310], 1
jne 0x41048a
push ebx
mov eax, edi
call fcn.0040ed10
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x410569
mov eax, dword [esp + 0x14]
lea edx, [eax + 0x328]
push edx
push 0
add eax, 0x320
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x410569
xor ebp, ebp
jmp 0x410569
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 0x318]
mov dword [eax + 0x318], 0
push 0
mov eax, esi
shr eax, 2
push eax
push edi
call fcn.00415090
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x34]
push edx
push esi
push edi
mov dword [ecx + 0x318], eax
push ebx
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4104ef
mov eax, dword [esp + 0x18]
cmp dword [eax + 8], 0
je 0x4104eb
mov edi, str.K7IS_Parser_Unpack_Module
mov esi, str.Break_11
call fcn.00412cb0
xor ebp, ebp
jmp 0x410569
cmp esi, dword [esp + 0x30]
je 0x410512
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 8], 0
je 0x41050e
mov edi, str.K7IS_Parser_Unpack_Module
mov esi, str.Break_12
call fcn.00412cb0
xor ebp, ebp
jmp 0x410569
mov eax, dword [esp + 0x14]
cmp ebp, dword [eax + 0x318]
je 0x410559
mov edx, dword [esp + 0x18]
cmp dword [edx + 8], 0
je 0x410537
mov edi, str.K7IS_Parser_Unpack_Module
mov esi, str.Break_13
call fcn.00412cb0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
push eax
add ecx, 0xe20
push str.ParserStart:_Data_Corruption_found_at_Module_Payload___s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor ebp, ebp
jmp 0x410569
lea edx, [eax + 0x328]
push edx
jmp 0x410425
mov ebp, dword [esp + 0x20]
test ebx, ebx
je 0x40ffe0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40ffe0
xor ebp, ebp
jmp 0x40ffe0
sbb eax, eax
sbb eax, 0xffffffff
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x4105b7
lea eax, [edi + 0x284]
lea edx, [esi + 0x220]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4105a2
jmp 0x4105b7
mov esi, dword [esp + 0x18]
cmp dword [edi + 0x308], 6
jne 0x41061f
mov ecx, str._WindowsFolder__Fonts
lea eax, [edi + 0x84]
jmp 0x4105d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4105f6
test dx, dx
je 0x4105f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4105f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4105d0
xor eax, eax
jmp 0x4105fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41061f
lea eax, [edi + 0x284]
lea edx, [esi + 0x420]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410610
cmp ebp, 1
jne 0x410637
cmp dword [esi + 8], 0
je 0x41064d
lea esi, [edi + 0x284]
mov edi, str.END_::_SUCCESS_::_K7IS_Parser_Unpack_Module
jmp 0x410648
cmp dword [esi + 8], 0
je 0x41064d
lea esi, [edi + 0x284]
mov edi, str.END_::_FAILURE_::_K7IS_Parser_Unpack_Module
call fcn.00412cb0
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00416a72
add esp, 0x684
ret