Function at 0x41ece0
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8d60
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x504e20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5067fc]
mov dword [ebp - 0x30], 0
test al, 1
jne 0x41ed47
or eax, 1
mov dword [0x5067fc], eax
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4bfaf0
mov dword [0x5067f8], eax
call fcn.00496701
mov eax, dword [0x5067fc]
add esp, 4
test al, 2
jne 0x41ed7a
or eax, 2
mov dword [0x5067fc], eax
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4bfb20
mov dword [0x506800], eax
call fcn.00496701
mov eax, dword [0x5067fc]
add esp, 4
test al, 4
jne 0x41edad
or eax, 4
mov dword [0x5067fc], eax
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4bfb50
mov dword [0x506804], eax
call fcn.00496701
mov eax, dword [0x5067fc]
add esp, 4
test al, 8
jne 0x41eddb
or eax, 8
mov dword [0x5067fc], eax
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
add eax, 0x10
push 0x4bfac0
mov dword [0x506808], eax
call fcn.00496701
add esp, 4
mov eax, dword [0x506800]
cmp dword [eax - 0xc], 0
je 0x41ee00
push 0x5067f0
push 0x506808
call fcn.0041e6a0
add esp, 8
test al, al
je 0x41f4f5
push 0x5067f0
mov ecx, 0x506808
call fcn.00402500
mov ecx, 0x5067f8
call fcn.00404ea0
mov ecx, 0x506800
call fcn.00404ea0
mov ecx, 0x506804
call fcn.00404ea0
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
mov dword [ebp - 4], 0
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.Volatile_Environment
push SysReAllocStringLen
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 1
test eax, eax
jne 0x41f061
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f051
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x82
or eax, ecx
jge 0x41eedf
push 0x82
lea ecx, [ebp - 0x1c]
call fcn.00406af0
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ef26
push dword [esi - 8]
push esi
call fcn.00497a03
add esp, 8
test eax, eax
js 0x41ef1c
cmp eax, dword [esi - 8]
jg 0x41ef1c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x41ef31
push 0x80070057
call fcn.00402e10
lea ecx, [ebp - 0x1c]
call fcn.00404ea0
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x5067f8]
mov dword [ebp - 0x18], 0x104
mov ecx, dword [eax - 8]
mov edx, ebx
sub edx, dword [eax - 4]
sub ecx, 0x82
or ecx, edx
jge 0x41ef63
push 0x82
mov ecx, 0x5067f8
call fcn.00406af0
mov eax, dword [0x5067f8]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41efb6
mov eax, dword [0x5067f8]
push dword [eax - 8]
push eax
call fcn.00497a03
mov edx, eax
add esp, 8
test edx, edx
js 0x41ef1c
mov ecx, dword [0x5067f8]
cmp edx, dword [ecx - 8]
jg 0x41ef1c
mov dword [ecx - 0xc], edx
mov eax, dword [0x5067f8]
xor ecx, ecx
mov word [eax + edx*2], cx
jmp 0x41efc0
mov ecx, 0x5067f8
call fcn.00404ea0
mov dword [ebp - 0x18], 0x104
mov eax, dword [edi - 8]
mov ecx, ebx
sub ecx, dword [edi - 4]
sub eax, 0x82
or eax, ecx
jge 0x41efe8
push 0x82
lea ecx, [ebp - 0x20]
call fcn.00406af0
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f036
push dword [edi - 8]
push edi
call fcn.00497a03
add esp, 8
test eax, eax
js 0x41ef1c
cmp eax, dword [edi - 8]
jg 0x41ef1c
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f061
push 0x5067f8
lea ecx, [ebp - 0x20]
call fcn.00402500
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f061
push 0x5067f8
lea ecx, [ebp - 0x20]
call fcn.00402500
mov edi, dword [ebp - 0x20]
call fcn.0041f540
test al, al
je 0x41f2a2
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov byte [ebp - 0xd], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f1c3
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, 0x82
or eax, ebx
jge 0x41f0ba
push 0x82
lea ecx, [ebp - 0x1c]
call fcn.00406af0
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.Isolation
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f17a
push dword [esi - 8]
push esi
call fcn.00497a03
add esp, 8
test eax, eax
js 0x41ef1c
cmp eax, dword [esi - 8]
jg 0x41ef1c
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov ebx, dword [0x506280]
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 7
idiv ecx
cmp edx, 6
jne 0x41f151
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub ebx, ecx
xor ecx, ecx
lea eax, [ebx + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00495ce0
push eax
call fcn.00497933
add esp, 8
cmp dword [esi - 0xc], 0
mov byte [ebp - 0xd], 0
jl 0x41f17a
push str.PMIL
push esi
call fcn.00497a22
add esp, 8
test eax, eax
je 0x41f17a
sub eax, esi
sar eax, 1
jne 0x41f17a
mov dword [ebp - 0x24], 1
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp byte [ebp - 0xd], 0
jne 0x41f1c9
mov eax, dword [ebp - 0x24]
or ebx, 0xffffffff
cmp dword [0x500128], 0x80000002
jne 0x41f2a9
push 0x5067f0
mov ecx, 0x506800
call fcn.00402500
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x5067f8
call fcn.00402500
jmp 0x41f35b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f298
lea eax, [ebp - 0x18]
push eax
push 0x82
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x104
call fcn.00405110
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.DefaultValue
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp - 0x1c]
push dword [esi - 8]
push esi
call fcn.00497a03
add esp, 8
test eax, eax
js 0x41ef1c
cmp eax, dword [esi - 8]
jg 0x41ef1c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.00420170
test al, al
jne 0x41f269
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push dword [ebp - 0x14]
call ebx
cmp dword [esi - 0xc], 0
jl 0x41f18b
push str.PMIL
push esi
call fcn.00497a22
add esp, 8
test eax, eax
je 0x41f18b
sub eax, esi
sar eax, 1
jne 0x41f18b
mov eax, 1
jmp 0x41f18e
mov eax, ebx
jmp 0x41f18e
test eax, eax
je 0x41f2ff
call fcn.0041f560
test al, al
je 0x41f1a1
cmp byte [0x50675c], 0
jne 0x41f1a1
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401b70
push eax
mov ecx, 0x506800
mov byte [ebp - 4], 2
call fcn.00402500
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00401fa0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x5067f8
call fcn.00402500
jmp 0x41f35b
push 0x5067f8
call fcn.0041e770
add esp, 4
test al, al
jne 0x41f31f
push str.Packageswindows_ie_ac_001AC
mov ecx, 0x5067f8
call fcn.00402bb0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401b70
push eax
mov ecx, 0x506800
mov byte [ebp - 4], 3
call fcn.00402500
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f35b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x506800]
cmp dword [eax - 0xc], 0
jl 0x41f395
push str.windows_ie_ac_001
push eax
call fcn.00497a22
add esp, 8
test eax, eax
je 0x41f395
sub eax, dword [0x506800]
sar eax, 1
test eax, eax
jle 0x41f395
push 0x5067f0
mov ecx, 0x506804
call fcn.00402500
jmp 0x41f3f6
call fcn.0041f560
test al, al
je 0x41f3ba
cmp byte [0x50675c], 0
jne 0x41f3ba
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401b70
mov byte [ebp - 4], 5
jmp 0x41f3cb
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401b70
mov byte [ebp - 4], 4
push eax
mov ecx, 0x506804
call fcn.00402500
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
mov byte [ebp - 4], 1
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f3f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x500128], reloc.OLEAUT32.dll_SysReAllocString
je 0x41f493
cmp byte [0x50012c], 0
je 0x41f493
lea eax, [ebp - 0x24]
push eax
call fcn.0041fb00
add esp, 4
mov eax, dword [eax]
mov ecx, 0x506800
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.00402c30
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f453
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041fb00
add esp, 4
mov eax, dword [eax]
mov ecx, 0x506804
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.00402c30
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f493
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push dword [0x500128]
push 0x506800
call fcn.0041e700
push 1
push dword [0x500128]
push 0x506804
call fcn.0041e700
add edi, 0xfffffff0
add esp, 0x18
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f4d7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41f4f5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x10], 0
je 0x41f50f
cmp byte [ebp + 0xc], 0
je 0x41f508
mov eax, dword [0x506804]
jmp 0x41f514
mov eax, dword [0x506800]
jmp 0x41f514
mov eax, dword [0x5067f8]
add eax, 0xfffffff0
push eax
call fcn.00404d50
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret