Function at 0x403328
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x412964
call fcn.00407f50
sub esp, 0x8dc
mov eax, dword [0x4196d0]
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x3c], si
lea edi, [ebp - 0x3a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
lea eax, [ebp - 0x3c]
push eax
push str.INSTALL_TYPE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.0040161e
mov dword [ebp - 4], esi
push dword [eax]
call fcn.00408307
pop ecx
mov edi, eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x8e4]
cmp dword [ebp - 0x8e8], eax
je 0x40339d
push dword [ebp - 0x8e8]
call fcn.0040795e
pop ecx
cmp edi, esi
jne 0x40354f
push dword [ebp + 8]
call fcn.00401223
cmp dword [ebp + 0xc], esi
pop ecx
je 0x40354f
push dword [ebp + 0xc]
call fcn.0040749d
test eax, eax
pop ecx
jbe 0x40354f
push ebx
push str._new
lea ecx, [ebp - 0x864]
call fcn.004024da
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004032d0
add esp, 0xc
mov byte [ebp - 4], 3
push esi
push ebx
lea ecx, [ebp - 0x864]
call fcn.0040163e
lea eax, [ebp - 0x840]
push eax
push 0x20019
push esi
push str.Applicationsiexplore.exe_shellopencommand
push 0x80000000
mov dword [ebp - 0x840], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403520
mov word [ebp - 0x83c], si
mov ecx, 0x1ff
lea edi, [ebp - 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x844]
push eax
push esi
push 0x413588
push dword [ebp - 0x840]
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x848], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4034f2
cmp dword [ebp - 0x844], ebx
jne 0x4034f2
cmp dword [ebp - 0x848], esi
jbe 0x4034f2
cmp word [ebp - 0x83c], si
lea edi, [ebp - 0x83c]
je 0x4034f2
mov eax, dword [ebp - 0x83c]
cmp ax, 0x20
jne 0x4034b1
inc edi
inc edi
mov ax, word [edi]
cmp ax, si
jne 0x4034a1
mov ax, word [edi]
cmp ax, si
je 0x4034f2
xor ecx, ecx
cmp ax, 0x22
jne 0x4034c5
inc edi
inc edi
mov ecx, ebx
xor eax, eax
cmp ecx, esi
setne al
lea eax, [eax + eax + 0x20]
push eax
push edi
call fcn.0040825d
cmp eax, esi
pop ecx
pop ecx
je 0x4034e0
mov word [eax], si
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4034ec
lea eax, [ebp - 0x28]
push ebx
push esi
push eax
push edi
jmp 0x403506
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4034fe
lea eax, [ebp - 0x28]
push ebx
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403540
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40352c
lea eax, [ebp - 0x28]
push ebx
push esi
push eax
push str.iexplore
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040163e
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0040763c
leave
ret