Function at 0x4070d7
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x422861
call fcn.00414798
sub esp, 0x8dc
mov eax, dword [0x431d24]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x840], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x20], si
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
lea eax, [ebp - 0x20]
push eax
push str.INSTALL_TYPE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.004039af
mov dword [ebp - 4], esi
push dword [eax]
call fcn.00414b4c
pop ecx
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x8e4]
cmp dword [ebp - 0x8e8], eax
je 0x40715b
push dword [ebp - 0x8e8]
call fcn.00414068
pop ecx
cmp edi, esi
jne 0x407355
push dword [ebp - 0x840]
call fcn.00403365
cmp ebx, esi
pop ecx
je 0x407355
push ebx
call fcn.0041391d
test eax, eax
pop ecx
jbe 0x407355
push str._new
lea ecx, [ebp - 0x864]
call fcn.00405af3
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push ebx
push eax
lea eax, [ebp - 0x83c]
push eax
call fcn.00406349
add esp, 0xc
mov byte [ebp - 4], 3
push esi
push edi
lea ecx, [ebp - 0x864]
call fcn.00403c42
lea eax, [ebp - 0x844]
push eax
push 0x20019
push esi
push str.Applicationsiexplore.exe_shellopencommand
push SysReAllocStringLen
mov dword [ebp - 0x844], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40731b
mov dword [ebp - 0x848], edi
mov word [ebp - 0x820], si
mov ecx, 0x1ff
lea edi, [ebp - 0x81e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x848]
push eax
push esi
push 0x4263b4
push dword [ebp - 0x844]
mov dword [ebp - 0x840], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4072e0
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x848], ebx
jne 0x4072e0
cmp dword [ebp - 0x840], esi
jbe 0x4072e0
cmp word [ebp - 0x820], si
lea edi, [ebp - 0x820]
je 0x407286
mov eax, dword [ebp - 0x820]
cmp ax, 0x20
jne 0x40727e
inc edi
inc edi
mov ax, word [edi]
cmp ax, si
jne 0x40726e
mov ax, word [edi]
cmp ax, si
jne 0x40729e
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x40729b
lea eax, [ebp - 0x838]
push ebx
jmp 0x4072f7
xor ecx, ecx
cmp ax, 0x22
jne 0x4072aa
inc edi
inc edi
mov ecx, ebx
xor eax, eax
cmp ecx, esi
setne al
lea eax, [eax + eax + 0x20]
push eax
push edi
call fcn.00414aa2
cmp eax, esi
pop ecx
pop ecx
je 0x4072c5
mov word [eax], si
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x4072da
lea eax, [ebp - 0x838]
push ebx
push esi
push eax
push edi
jmp 0x4072fe
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x4072f5
lea eax, [ebp - 0x838]
push 1
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
jmp 0x407344
cmp dword [ebp - 0x824], 8
mov eax, dword [ebp - 0x838]
jae 0x407330
lea eax, [ebp - 0x838]
push edi
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x83c]
call fcn.00403c42
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413d8f
leave
ret