Function at 0x4071b6
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x422d71
call fcn.00414c98
sub esp, 0x8dc
mov eax, dword [0x431d24]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x840], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x20], si
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
lea eax, [ebp - 0x20]
push eax
push str.INSTALL_TYPE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.004039fd
mov dword [ebp - 4], esi
push dword [eax]
call fcn.0041504c
pop ecx
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x8e4]
cmp dword [ebp - 0x8e8], eax
je 0x40723a
push dword [ebp - 0x8e8]
call fcn.00414568
pop ecx
cmp edi, esi
jne 0x407434
push dword [ebp - 0x840]
call fcn.004033b3
cmp ebx, esi
pop ecx
je 0x407434
push ebx
call fcn.00413e1d
test eax, eax
pop ecx
jbe 0x407434
push str._new
lea ecx, [ebp - 0x864]
call fcn.00405bd2
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push ebx
push eax
lea eax, [ebp - 0x83c]
push eax
call fcn.00406428
add esp, 0xc
mov byte [ebp - 4], 3
push esi
push edi
lea ecx, [ebp - 0x864]
call fcn.00403d21
lea eax, [ebp - 0x844]
push eax
push 0x20019
push esi
push str.Applicationsiexplore.exe_shellopencommand
push SysReAllocStringLen
mov dword [ebp - 0x844], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4073fa
mov dword [ebp - 0x848], edi
mov word [ebp - 0x820], si
mov ecx, 0x1ff
lea edi, [ebp - 0x81e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x848]
push eax
push esi
push 0x4263c4
push dword [ebp - 0x844]
mov dword [ebp - 0x840], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4073bf
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x848], ebx
jne 0x4073bf
cmp dword [ebp - 0x840], esi
jbe 0x4073bf
cmp word [ebp - 0x820], si
lea edi, [ebp - 0x820]
je 0x407365
mov eax, dword [ebp - 0x820]
cmp ax, 0x20
jne 0x40735d
inc edi
inc edi
mov ax, word [edi]
cmp ax, si
jne 0x40734d
mov ax, word [edi]
cmp ax, si
jne 0x40737d
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x40737a
lea eax, [ebp - 0x838]
push ebx
jmp 0x4073d6
xor ecx, ecx
cmp ax, 0x22
jne 0x407389
inc edi
inc edi
mov ecx, ebx
xor eax, eax
cmp ecx, esi
setne al
lea eax, [eax + eax + 0x20]
push eax
push edi
call fcn.00414fa2
cmp eax, esi
pop ecx
pop ecx
je 0x4073a4
mov word [eax], si
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x4073b9
lea eax, [ebp - 0x838]
push ebx
push esi
push eax
push edi
jmp 0x4073dd
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x4073d4
lea eax, [ebp - 0x838]
push 1
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
jmp 0x407423
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x40740f
lea eax, [ebp - 0x838]
push edi
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x83c]
call fcn.00403d21
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041428f
leave
ret