Function at 0x9c8120
Capabilities:
Check os version
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x92c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x928], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp ebx, 0xb
jne 0x9c81b6
cmp dword [0xbfc9d0], 0
jne 0x9c818a
mov esi, 1
mov dword [0xbfc9d0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x9c818a
cmp al, 6
jb 0x9c818a
push esi
mov dword [0xbfc9d4], esi
call fcn.009c8750
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp dword [0xbfc9d4], 0
je 0x9c8733
push 1
call fcn.009c8750
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp ebx, 0xa
jne 0x9c822e
cmp dword [0xbfc9d0], 0
jne 0x9c8202
mov esi, 1
mov dword [0xbfc9d0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x9c8202
cmp al, 6
jb 0x9c8202
push 2
mov dword [0xbfc9d4], esi
call fcn.009c8750
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp dword [0xbfc9d4], 0
je 0x9c8733
push 2
call fcn.009c8750
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, 0xa
mov esi, str.SYSTEMCurrentControlSetControlSafeBoot
lea edi, [esp + 0x410]
rep movsd dword es:[edi], dword [esi]
push 0xda
lea eax, [esp + 0x43e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x51d]
push 0
push ecx
mov byte [esp + 0x524], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0x518]
call fcn.009790d0
cmp byte [esp + 0x518], 0
je 0x9c8733
cmp ebx, 1
jne 0x9c8567
mov ebx, 0x400
push str.AlternateShell
lea eax, [esp + 0x10]
lea edi, [esp + 0x14]
mov ecx, str.SYSTEMCurrentControlSetControlSafeBoot
mov edx, 0x80000002
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], ebx
call fcn.0094c020
cmp byte [esp + 0x10], 0
jne 0x9c82e0
mov edx, dword [0xacaea4]
mov eax, dword [0xacaea8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
push 0
lea ecx, [esp + 0x14]
push str.slock.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9c8487
lea ecx, [esp + 0x410]
mov edx, 0x80000002
call fcn.0097eed0
test eax, eax
je 0x9c8487
lea edx, [esp + 0x518]
push edx
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x730]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s
push ecx
call fcn.00a78f30
add esp, 0x10
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x740]
push edx
push 0
call fcn.0095db20
test eax, eax
je 0x9c83a2
push 0x103
lea eax, [esp + 0x625]
push 0
push eax
mov byte [esp + 0x62c], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x624]
call fcn.00960a40
add esp, 4
mov ecx, esi
push ecx
push str._SUBINACL_SB__Failed_to_start_subinacl_A1___Reason:__s
jmp 0x9c842c
lea edx, [esp + 0x518]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x418]
push ecx
lea edx, [esp + 0x734]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s__grant_sf
push edx
call fcn.00a78f30
add esp, 0x14
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 1
lea eax, [esp + 0x740]
push eax
push 0
call fcn.0095db20
test eax, eax
je 0x9c8436
push 0x103
lea ecx, [esp + 0x625]
push 0
push ecx
mov byte [esp + 0x62c], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x624]
call fcn.00960a40
add esp, 4
mov edx, esi
push edx
push str._SUBINACL_SB__Failed_to_start_subinacl_B1___Reason:__s
push 0
call fcn.0096a780
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0xaa21e4
mov edx, str.ASBack
mov ecx, 0x80000002
call fcn.0094bd00
mov ecx, dword [str.slock.exe]
mov edx, dword [0xac2858]
mov ax, word [0xac285c]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], edx
push str.SYSTEMCurrentControlSetControlSafeBoot
mov edx, str.AlternateShell
mov ecx, 0x80000002
mov word [esp + 0x20], ax
call fcn.0094bd00
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], ebx
call fcn.00968110
test eax, eax
push 0xaedd70
lea edi, [esp + 0x14]
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov edx, 0x80000002
lea eax, [esp + 0x10]
je 0x9c84b7
call fcn.0094baa0
jmp 0x9c84bc
call fcn.0094c020
cmp byte [esp + 0x10], 0
jne 0x9c84ea
mov edx, dword [str.explorer.exe]
mov eax, dword [0xab5744]
mov ecx, dword [0xab5748]
mov dword [esp + 0x10], edx
mov dl, byte [0xab574c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
push 0
lea eax, [esp + 0x14]
push str.slock.exe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9c8560
lea ecx, [esp + 0x10]
push ecx
push 0xaa21e4
mov edx, str.SHBack
mov ecx, 0x80000002
call fcn.0094bd00
push 1
push 0x2c
mov edx, str.slock.exe
lea ecx, [esp + 0x18]
call fcn.009694d0
call fcn.00968110
test eax, eax
je 0x9c8547
lea ecx, [esp + 0x10]
call fcn.0094bb50
push 1
jmp 0x9c872b
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov edx, 0xaedd70
mov ecx, 0x80000002
call fcn.0094bd00
push 1
jmp 0x9c872b
test ebx, ebx
jne 0x9c8733
mov byte [esp + 0x10], bl
mov ebx, 0x400
push str.ASBack
lea eax, [esp + 0x10]
lea edi, [esp + 0x14]
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x10], ebx
call fcn.0094c020
cmp byte [esp + 0x10], 0
je 0x9c85b6
push 0
mov eax, edi
push str.slock.exe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c85ca
mov ecx, dword [0xacaea4]
mov edx, dword [0xacaea8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x410]
mov edx, 0x80000002
call fcn.0097eed0
test eax, eax
je 0x9c8697
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetControlSafeBoot
mov edx, str.AlternateShell
mov ecx, 0x80000002
call fcn.0094bd00
lea ecx, [esp + 0x518]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x418]
push eax
lea ecx, [esp + 0x734]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s__grant_sr
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x740]
push edx
push 0
call fcn.0095db20
call fcn.00968d70
test eax, eax
je 0x9c865f
lea eax, [esp + 0x410]
push eax
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_NT_SERVICETrustedInstaller_
lea ecx, [esp + 0x730]
push ecx
jmp 0x9c8674
lea edx, [esp + 0x410]
push edx
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setownerAdministrators
lea eax, [esp + 0x730]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x740]
push ecx
push 0
call fcn.0095db20
push str.SHBack
lea eax, [esp + 0x10]
lea edi, [esp + 0x14]
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], ebx
call fcn.0094c020
cmp byte [esp + 0x10], 0
je 0x9c86da
push 0
mov edx, edi
push str.slock.exe
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c8700
mov eax, dword [str.explorer.exe]
mov ecx, dword [0xab5744]
mov edx, dword [0xab5748]
mov dword [esp + 0x10], eax
mov al, byte [0xab574c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], al
call fcn.00968110
lea ecx, [esp + 0x10]
test eax, eax
je 0x9c8714
call fcn.0094bb50
jmp 0x9c8729
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov edx, 0xaedd70
mov ecx, 0x80000002
call fcn.0094bd00
push 0
call fcn.009c7860
add esp, 4
mov ecx, dword [esp + 0x934]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret