Function at 0x401260
Capabilities:
Check if file exists
Delete directory
Get common file path
Get program files directory
Persist via app paths registry key
Persist via default file association registry key
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x20]
push edi
push eax
push 1
push 0
push str.SOFTWARESIEMENSSIGRA
push 0x80000002
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0x200
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4012d0
push 0x400
call fcn.004018e9
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push 0
push 0x414058
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x10], ebx
call edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
push 1
push 0
push str.SOFTWARESIEMENSDIGSI4USERINFO
push 0x80000002
mov dword [ebp - 0x30], 0x200
call esi
test eax, eax
jne 0x40132b
push 0x400
call fcn.004018e9
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push ebx
push 0
push 0
push str.VERSION
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x18], ebx
call edi
push 0x400
call fcn.004018e9
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 4
mov ebx, eax
push ebx
push 0
push 0
push 0x16
push 0
call esi
push str.Siemens_EnergyDIGSISIGRA_4.3
push 0x200
push ebx
call fcn.00404f4c
push 0x400
call fcn.004018e9
push 0x200
push 0
push eax
mov dword [ebp - 0x1c], eax
call fcn.00402980
add esp, 0x1c
push dword [ebp - 0x1c]
push 0
push 0
push 0x26
push 0
call esi
push 0x400
call fcn.004018e9
push dword [ebp - 0x1c]
mov esi, eax
push 0x200
push esi
call fcn.00404f57
push str.SiemensEnergyComtradeViewerV4_58Siemens.Energy.ComtradeViewerV4_58.exe
push 0x200
push esi
call fcn.00404f4c
add esp, 0x1c
cmp dword [ebp - 0x18], 0
je 0x401860
cmp dword [ebp - 0x10], 0
je 0x4017f5
push 0x400
call fcn.004018e9
push dword [ebp - 0x10]
mov edi, eax
push 0x200
push edi
call fcn.00404f57
push str.Sigra4.exe
push 0x200
push edi
call fcn.00404f4c
add esp, 0x1c
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401769
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARESIEMENSDIGSI4PROGRAMME
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40145a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x10]
push 1
push 0
push str.Sigra
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARESIEMENSDIGSI4STOERSCHRIEB
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4014ae
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push str.GRAFPROG
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x400
call fcn.004018e9
push 0x4140ac
push 0x200
push eax
mov dword [ebp - 4], eax
call fcn.00404f57
push edi
push 0x200
push dword [ebp - 4]
call fcn.00404f4c
push 0x4140ac
push 0x200
push dword [ebp - 4]
call fcn.00404f4c
push 0x4140b0
push 0x200
push dword [ebp - 4]
call fcn.00404f4c
add esp, 0x34
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SIGRA4.Document_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401555
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 4]
push 1
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x400
call fcn.004018e9
push 0x4140ac
push 0x200
push eax
mov dword [ebp - 8], eax
call fcn.00404f57
push edi
push 0x200
push dword [ebp - 8]
call fcn.00404f4c
push 0x4140ac
push 0x200
push dword [ebp - 8]
call fcn.00404f4c
push str.__p___1_
push 0x200
push dword [ebp - 8]
call fcn.00404f4c
add esp, 0x34
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SIGRA4.Document_shellprintcommand
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4015fc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 8]
push 1
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x400
call fcn.004018e9
push 0x4140ac
push 0x200
push eax
mov dword [ebp - 0xc], eax
call fcn.00404f57
push edi
push 0x200
push dword [ebp - 0xc]
call fcn.00404f4c
push 0x4140ac
push 0x200
push dword [ebp - 0xc]
call fcn.00404f4c
push str.__pt___1____2____3____4_
push 0x200
push dword [ebp - 0xc]
call fcn.00404f4c
add esp, 0x34
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SIGRA4.Document_shellprinttocommand
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4016a3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0xc]
push 1
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x400
call fcn.004018e9
push 0x4140ac
push 0x200
push eax
mov dword [ebp - 0x14], eax
call fcn.00404f57
push edi
push 0x200
push dword [ebp - 0x14]
call fcn.00404f4c
push 0x4140ac
push 0x200
push dword [ebp - 0x14]
call fcn.00404f4c
add esp, 0x28
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsSIGRA4.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401738
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x14]
push 1
push 0
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call fcn.004018f2
push dword [ebp - 8]
call fcn.004018f2
push dword [ebp - 0xc]
call fcn.004018f2
push dword [ebp - 0x14]
call fcn.004018f2
add esp, 0x10
push edi
call fcn.004018f2
add esp, 4
jmp 0x401874
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4017d6
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARESIEMENSDIGSI4STOERSCHRIEB
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4017ea
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.GRAFPROG
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004018f2
add esp, 4
jmp 0x401874
push 0x10
push str.ERROR
push str.There_is_no_fault_record_application_found_to_be_assoicated_with_the_DIGSI_4_software
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.004018f2
add esp, 4
jmp 0x401874
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401852
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARESIEMENSDIGSI4STOERSCHRIEB
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401874
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.GRAFPROG
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call edi
jmp 0x401874
push 0x10
push str.ERROR
push str.There_is_no_fault_record_application_found_to_be_assoicated_with_the_DIGSI_4_software
jmp 0x40186c
push 0x10
push str.ERROR
push str.There_is_no_DIGSI_4_software_found_to_be_associated_with_the_fault_record_application
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40189d
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40189d
mov ecx, ebx
call section..text
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 0x10]
call fcn.004018f2
push dword [ebp - 0x18]
call fcn.004018f2
push ebx
call fcn.004018f2
push dword [ebp - 0x1c]
call fcn.004018f2
push esi
call fcn.004018f2
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret