Function at 0x403f6e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb40
mov dl, byte [0x40c008]
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x31f]
mov byte [ebp - 0x320], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 4
xor ebx, ebx
push 0x1000
push 0x105
push ebx
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
mov dword [ebp - 4], eax
pop esi
push esi
push dword [ebp + 8]
call fcn.00403b87
mov edi, 0x40827c
pop ecx
cmp eax, edi
pop ecx
jne 0x403fe3
mov dword [ebp - 0xc], esi
jmp 0x403ff0
push edi
mov dword [ebp - 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 0x4083fc
push esi
push dword [ebp + 8]
push ebx
call fcn.00403be6
add esp, 0xc
mov ebx, 0x104
test eax, eax
push ebx
je 0x40402a
push 0x4083f8
push esi
push dword [ebp + 8]
call fcn.00403ccc
push esi
push dword [ebp + 8]
push 0
call fcn.00403be6
add esp, 0x1c
jmp 0x404007
lea eax, [ebp - 0x320]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 8]
lea eax, [ebp - 0x320]
push edi
push eax
call fcn.00403dc5
add esp, 0xc
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0x40c008
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
je 0x40435d
lea eax, [ebp - 0x118]
push str._startmenu_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x4040d3
mov al, byte [0x40c008]
push 0x40
mov byte [ebp - 0x424], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x423]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x424]
push eax
push str.Programs
call fcn.00403f17
pop ecx
lea eax, [ebp - 0x424]
pop ecx
push eax
push dword [ebp - 4]
call esi
mov edi, 0x40827c
jmp 0x40434b
lea eax, [ebp - 0x118]
push str._desktop_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x40410e
lea eax, [ebp - 0x834]
push eax
push str.Desktop
call fcn.00403f17
pop ecx
lea eax, [ebp - 0x834]
pop ecx
push eax
push dword [ebp - 4]
call esi
jmp 0x40434b
lea eax, [ebp - 0x118]
push str._sendto_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x404140
lea eax, [ebp - 0x62c]
push eax
push str.SendTo
call fcn.00403f17
pop ecx
lea eax, [ebp - 0x62c]
pop ecx
jmp 0x404103
lea eax, [ebp - 0x118]
push str._favorites_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x404172
lea eax, [ebp - 0xa3c]
push eax
push str.Favorites
call fcn.00403f17
pop ecx
lea eax, [ebp - 0xa3c]
pop ecx
jmp 0x404103
lea eax, [ebp - 0x118]
push str._startup_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x4041a7
lea eax, [ebp - 0x730]
push eax
push str.Startup
call fcn.00403f17
pop ecx
lea eax, [ebp - 0x730]
pop ecx
jmp 0x404103
lea eax, [ebp - 0x118]
push str._targetdir_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x4041c8
push 0x40ca80
jmp 0x404104
lea eax, [ebp - 0x118]
push 0x408374
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x4041f8
lea eax, [ebp - 0x938]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x938]
jmp 0x404103
lea eax, [ebp - 0x118]
push str._quicklaunch_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x40428a
mov al, byte [0x40c008]
push 0x40
mov byte [ebp - 0x21c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
push str.AppData
call fcn.00403f17
pop ecx
lea eax, [ebp - 0x21c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x404260
lea eax, [ebp - 0x21c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x21c]
push eax
call fcn.00403ea0
test eax, eax
pop ecx
jne 0x40427f
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
jmp 0x4040c3
lea eax, [ebp - 0x118]
push str._programfiles_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x40430b
lea eax, [ebp - 0x528]
push str.C:Program_Files
push eax
call esi
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404300
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.ProgramFilesDir
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x528]
jmp 0x404103
lea eax, [ebp - 0x118]
push str._sysdir_
push eax
call fcn.00403d7f
pop ecx
test eax, eax
pop ecx
jne 0x40433b
lea eax, [ebp - 0xb40]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xb40]
jmp 0x404103
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc dword [ebp - 8]
jmp 0x404040
cmp dword [ebp - 0xc], 0
jne 0x40437e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
push eax
push dword [ebp - 4]
call fcn.00403b87
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret