Function at 0x404148
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb40
mov dl, byte [0x40df90]
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x31f]
mov byte [ebp - 0x320], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 4
xor ebx, ebx
push 0x1000
push 0x105
push ebx
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
call dword [sym.imp._VirtualAlloc]
push 1
mov dword [ebp - 4], eax
pop esi
push esi
push dword [ebp + 8]
call fcn.00403ce9
mov edi, 0x40a27c
pop ecx
cmp eax, edi
pop ecx
jne 0x4041bd
mov dword [ebp - 0xc], esi
jmp 0x4041ca
push edi
mov dword [ebp - 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp._lstrcatA]
mov esi, 0x40a40c
push esi
push dword [ebp + 8]
push ebx
call fcn.00403d48
add esp, 0xc
mov ebx, 0x104
test eax, eax
push ebx
je 0x404204
push 0x40a408
push esi
push dword [ebp + 8]
call fcn.00403e2e
push esi
push dword [ebp + 8]
push 0
call fcn.00403d48
add esp, 0x1c
jmp 0x4041e1
lea eax, [ebp - 0x320]
push eax
push dword [ebp + 8]
call dword [sym.imp._ExpandEnvironmentStringsA]
mov esi, dword [sym.imp._lstrcpyA]
push dword [ebp - 8]
lea eax, [ebp - 0x320]
push edi
push eax
call fcn.00403f27
add esp, 0xc
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0x40df90
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
je 0x404537
lea eax, [ebp - 0x118]
push str._startmenu_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x4042ad
mov al, byte [0x40df90]
push 0x40
mov byte [ebp - 0x424], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x423]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x424]
push eax
push str.Programs
call fcn.00404079
pop ecx
lea eax, [ebp - 0x424]
pop ecx
push eax
push dword [ebp - 4]
call esi
mov edi, 0x40a27c
jmp 0x404525
lea eax, [ebp - 0x118]
push str._desktop_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x4042e8
lea eax, [ebp - 0x834]
push eax
push str.Desktop
call fcn.00404079
pop ecx
lea eax, [ebp - 0x834]
pop ecx
push eax
push dword [ebp - 4]
call esi
jmp 0x404525
lea eax, [ebp - 0x118]
push str._sendto_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x40431a
lea eax, [ebp - 0x62c]
push eax
push str.SendTo
call fcn.00404079
pop ecx
lea eax, [ebp - 0x62c]
pop ecx
jmp 0x4042dd
lea eax, [ebp - 0x118]
push str._favorites_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x40434c
lea eax, [ebp - 0xa3c]
push eax
push str.Favorites
call fcn.00404079
pop ecx
lea eax, [ebp - 0xa3c]
pop ecx
jmp 0x4042dd
lea eax, [ebp - 0x118]
push str._startup_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x404381
lea eax, [ebp - 0x730]
push eax
push str.Startup
call fcn.00404079
pop ecx
lea eax, [ebp - 0x730]
pop ecx
jmp 0x4042dd
lea eax, [ebp - 0x118]
push str._targetdir_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x4043a2
push 0x40ea00
jmp 0x4042de
lea eax, [ebp - 0x118]
push 0x40a384
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x4043d2
lea eax, [ebp - 0x938]
push eax
push ebx
call dword [sym.imp._GetCurrentDirectoryA]
lea eax, [ebp - 0x938]
jmp 0x4042dd
lea eax, [ebp - 0x118]
push str._quicklaunch_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x404464
mov al, byte [0x40df90]
push 0x40
mov byte [ebp - 0x21c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
push str.AppData
call fcn.00404079
pop ecx
lea eax, [ebp - 0x21c]
pop ecx
push eax
call dword [sym.imp._lstrlenA]
test eax, eax
jle 0x40443a
lea eax, [ebp - 0x21c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call dword [sym.imp._lstrcatA]
lea eax, [ebp - 0x21c]
push eax
call fcn.00404002
test eax, eax
pop ecx
jne 0x404459
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp._GetTempPathA]
lea eax, [ebp - 0x21c]
jmp 0x40429d
lea eax, [ebp - 0x118]
push str._programfiles_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x4044e5
lea eax, [ebp - 0x528]
push str.C:Program_Files
push eax
call esi
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp._RegOpenKeyExA]
test eax, eax
jne 0x4044da
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.ProgramFilesDir
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
call dword [sym.imp._RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp._RegCloseKey]
lea eax, [ebp - 0x528]
jmp 0x4042dd
lea eax, [ebp - 0x118]
push str._sysdir_
push eax
call fcn.00403ee1
pop ecx
test eax, eax
pop ecx
jne 0x404515
lea eax, [ebp - 0xb40]
push ebx
push eax
call dword [sym.imp._GetSystemDirectoryA]
lea eax, [ebp - 0xb40]
jmp 0x4042dd
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 4]
call dword [sym.imp._lstrcatA]
push edi
push dword [ebp - 4]
call dword [sym.imp._lstrcatA]
inc dword [ebp - 8]
jmp 0x40421a
cmp dword [ebp - 0xc], 0
jne 0x404558
push dword [ebp - 4]
call dword [sym.imp._lstrlenA]
dec eax
push eax
push dword [ebp - 4]
call fcn.00403ce9
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret