Function at 0x401f20
Capabilities:
Check os version
Create service
Delete registry value
Delete service
Initialize winsock library
Persist via run registry key
Persist via windows service
Set registry value
Start service

Disassembly:
mov eax, 0x21ac
call fcn.00420cd0
mov eax, dword [0x44f8e4]
xor eax, esp
mov dword [esp + 0x21a8], eax
push ebx
mov ebx, dword [esp + 0x21b8]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push 0x101
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x453a80
mov dword [0x453a80], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 0x21bc]
mov dword [0x44f3e0], 0x44f4e8
cmp esi, 2
je 0x401f88
cmp esi, 3
jne 0x40227a
mov eax, dword [ebx + 4]
mov ecx, str.__install
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401fb0
test dl, dl
je 0x401fac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401fb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401f90
xor eax, eax
jmp 0x401fb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40227a
push dword [0x44f4f0]
lea eax, [esp + 0x1b8]
push dword [0x44f4ec]
push str._s_will_be_installed_and_started._nBy_clicking_Yes_you_confirm_you_read_and_accepted_License_Agreement._nYou_can_use_Administration_Services_to_control__s_service.
push eax
call fcn.00402610
mov eax, dword [0x44f3e0]
add esp, 0x10
push 0x44
push dword [eax + 8]
lea eax, [esp + 0x1bc]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4025b2
lea eax, [esp + 0x10]
mov byte [esp + 0x1b4], 0x22
push eax
lea eax, [esp + 0x1b9]
push eax
push 0x100
push 0x440384
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov edx, eax
test edx, edx
jne 0x402057
push str.Failed_to_find_executable_filename
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
lea edi, [esp + 0x1b4]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402060
mov eax, dword [0x4403b0]
mov dword [edi], eax
cmp esi, 3
jne 0x40207b
mov ecx, dword [ebx + 8]
jmp 0x402083
mov eax, dword [0x44f3e0]
mov ecx, dword [eax + 0x64]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1bc]
add eax, edx
push eax
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x4020c9
push str.Failed_to_find_config_filename
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4020d1
cmp dword [0x453a90], 2
mov eax, dword [str.____service]
mov dword [ecx], eax
mov eax, dword [0x4403d8]
mov dword [ecx + 4], eax
mov eax, dword [0x4403dc]
mov dword [ecx + 8], eax
jne 0x4021cf
push 0x40000010
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x40213b
push str.Failed_to_open_Service_Manager
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c8]
push eax
mov eax, dword [0x44f3e0]
push 0
push 2
push 0x10
push 0x20000000
push dword [eax + 8]
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x402195
push str.Failed_to_create_service
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x402516
push str.Failed_to_start_service
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402216
push str.Failed_to_open_registry
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402220
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1b8]
push eax
mov eax, dword [0x44f3e0]
push 2
push 0
push dword [eax + 4]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402516
push str.Failed_to_set_registry_value
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
cmp esi, 2
je 0x402288
cmp esi, 3
jne 0x40242b
mov eax, dword [ebx + 4]
mov ecx, str.__remove
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4022b0
test dl, dl
je 0x4022ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4022b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402290
xor eax, eax
jmp 0x4022b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4023de
cmp dword [0x453a90], 2
jne 0x402379
push 0x40000000
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x402304
push str.Failed_to_open_Service_Manager_n
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
mov eax, dword [0x44f3e0]
push 0x10000
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x402343
push str.Failed_to_open_service
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402516
push str.Failed_to_delete_service
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4021ef
mov eax, dword [0x44f3e0]
push dword [eax + 4]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x402516
push str.Failed_to_clear_registry
call fcn.004247e8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
cmp esi, 3
jne 0x40242b
mov eax, dword [ebx + 8]
mov ecx, str.__service
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402410
test dl, dl
je 0x40240c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402410
add eax, 2
add ecx, 2
test dl, dl
jne 0x4023f0
xor eax, eax
jmp 0x402415
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402435
mov dword [0x450344], 1
lea esi, [eax + 2]
mov eax, dword [ebx + 4]
jmp 0x40243a
cmp esi, 2
jne 0x402435
mov eax, dword [ebx + 4]
jmp 0x40243a
mov eax, dword [str.3proxy.cfg]
push eax
call fcn.00431b8e
add esp, 4
mov dword [0x44f2e4], eax
test eax, eax
je 0x402458
cmp byte [eax], 0x2d
je 0x402458
call fcn.0040b5b0
mov edi, eax
cmp esi, 2
jg 0x402530
test edi, edi
je 0x402530
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x451440
call esi
push 0x451420
call esi
push 0x451400
call esi
push 0x4513e0
call esi
push 0x4513c0
call esi
push 0x4513a0
call esi
push 0x451360
call esi
push 0x451620
call esi
push 0x44f2b0
call fcn.0040abd0
push edi
call fcn.0040b2a0
inc dword [0x44f328]
add esp, 8
test eax, eax
jne 0x402516
cmp dword [0x451398], eax
jne 0x4024d5
push edi
call fcn.00423183
add esp, 4
cmp dword [0x450344], 0
je 0x402511
mov eax, dword [0x44f3e0]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 0x401d30
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x402516
call fcn.004014b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret
push dword [ebx]
push str.Usage:__s__conffile__n
push 2
call fcn.00422fd8
add esp, 4
push eax
call fcn.004025e0
mov eax, dword [ebx]
add esp, 0xc
push eax
push eax
push str._n_t_s___install__conffile__n_tto_install_as_service_n_n_t_s___remove_n_tto_remove_service_n
push 2
call fcn.00422fd8
add esp, 4
push eax
call fcn.004025e0
push 0x44059c
call fcn.00403b80
add esp, 0x14
push eax
push str.available_socket_options:_n_t_s_n
push 2
call fcn.00422fd8
add esp, 4
push eax
call fcn.004025e0
mov eax, dword [0x44f3e0]
add esp, 0xc
push dword [0x44f24c]
push dword [eax + 0xc]
push dword [eax + 8]
push str._n_s__s_n_s_n
push 2
call fcn.00422fd8
add esp, 4
push eax
call fcn.004025e0
add esp, 0x14
mov ecx, dword [esp + 0x21b4]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420cbf
add esp, 0x21ac
ret