Function at 0x1004d0a
Capabilities:
Check os version
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0x560
mov eax, 0x1009d6b
call fcn.01007e90
push 0x98
xor ebx, ebx
lea eax, [ebp - 0x4bc]
push ebx
push eax
mov dword [ebp - 0x4c0], 0x9c
call sub.msvcrt.dll_memset
mov esi, 0x1001430
lea edi, [ebp - 0x424]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xfb
lea eax, [ebp - 0x41b]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call sub.msvcrt.dll_memset
mov esi, 0x100152c
lea edi, [ebp - 0x320]
movsd dword es:[edi], dword [esi]
push 0xfe
lea eax, [ebp - 0x31a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
add esp, 0x24
push 0x104
lea eax, [ebp - 0x118]
push eax
call ebx
lea edi, [ebp - 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004d95
push 5
pop ecx
mov esi, 0x1001610
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0x21c]
push eax
movsw word es:[edi], word [esi]
call ebx
lea edi, [ebp - 0x21c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004dbe
mov esi, 0x1001708
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x56c]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.010022b1
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x1004e0f
mov dword [ebp - 0x500], 0x1001adc
push 0x100a820
lea eax, [ebp - 0x500]
push eax
call sub.msvcrt.dll__CxxThrowException
cmp dword [ebp - 0x4bc], 5
jne 0x10050ef
cmp dword [ebp - 0x4b8], esi
jne 0x1004e93
cmp word [ebp - 0x56c], si
je 0x1004e44
mov dword [ebp - 0x528], 0x1001ab8
push 0x100a820
lea eax, [ebp - 0x528]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001aa4
call fcn.010021ff
test al, al
je 0x1004e79
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a98
call fcn.010021ff
test al, al
jne 0x100534f
mov dword [ebp - 0x530], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x530]
jmp 0x1004e09
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x4b8], ebx
jne 0x1004fc2
movzx eax, word [ebp - 0x56c]
test eax, eax
je 0x1004f73
cmp eax, 6
je 0x1004f24
cmp eax, 9
je 0x1004ed5
mov dword [ebp - 0x538], 0x1001ab8
push 0x100a820
lea eax, [ebp - 0x538]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a64
call fcn.010021ff
test al, al
je 0x1004f0a
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a58
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x540], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x540]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a4c
call fcn.010021ff
test al, al
je 0x1004f59
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a40
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x52c], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x52c]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a34
call fcn.010021ff
test al, al
je 0x1004fa8
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a28
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x518], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x518]
jmp 0x1004e09
cmp dword [ebp - 0x4b8], 2
jne 0x10057b1
movzx eax, word [ebp - 0x56c]
test eax, eax
je 0x10050a0
cmp eax, 6
je 0x1005051
cmp eax, 9
je 0x1005002
mov dword [ebp - 0x4e0], 0x1001ab8
push 0x100a820
lea eax, [ebp - 0x4e0]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a64
call fcn.010021ff
test al, al
je 0x1005037
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a58
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x520], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x520]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a4c
call fcn.010021ff
test al, al
je 0x1005086
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a40
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x4e8], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x4e8]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a1c
call fcn.010021ff
test al, al
je 0x10050d5
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001a10
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x51c], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x51c]
jmp 0x1004e09
cmp dword [ebp - 0x4bc], 6
jne 0x10057b1
cmp dword [ebp - 0x4b8], esi
jne 0x1005228
movzx eax, word [ebp - 0x56c]
cmp eax, esi
je 0x10051d9
cmp eax, 6
je 0x100518a
cmp eax, 9
je 0x100513b
mov dword [ebp - 0x4f0], 0x1001ab8
push 0x100a820
lea eax, [ebp - 0x4f0]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x1001a04
call fcn.010021ff
test al, al
je 0x1005170
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x10019f8
call fcn.010021ff
test al, al
jne 0x100534f
mov dword [ebp - 0x53c], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x53c]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x10019ec
call fcn.010021ff
test al, al
je 0x10051bf
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x10019e0
call fcn.010021ff
test al, al
jne 0x100534f
mov dword [ebp - 0x4f8], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x4f8]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x10019d4
call fcn.010021ff
test al, al
je 0x100520e
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x10019c8
call fcn.010021ff
test al, al
jne 0x100534f
mov dword [ebp - 0x524], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x524]
jmp 0x1004e09
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x4b8], ebx
jne 0x10057b1
movzx eax, word [ebp - 0x56c]
test eax, eax
je 0x1005304
cmp eax, 6
je 0x10052b9
cmp eax, 9
je 0x100526a
mov dword [ebp - 0x4d4], 0x1001ab8
push 0x100a820
lea eax, [ebp - 0x4d4]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x10019bc
call fcn.010021ff
test al, al
je 0x100529f
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x10019b0
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x534], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x534]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x10019a4
call fcn.010021ff
test al, al
je 0x10052ea
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001998
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x508], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x508]
jmp 0x1004e09
lea eax, [ebp - 0x118]
push eax
mov esi, 0x1001ab0
push esi
push 0x100198c
call fcn.010021ff
test al, al
je 0x1005335
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001980
call fcn.010021ff
test al, al
jne 0x1005352
mov dword [ebp - 0x504], 0x1001a70
push 0x100a820
lea eax, [ebp - 0x504]
jmp 0x1004e09
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x4c4]
push eax
push 0x100164c
push 0x80000002
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x100538c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x514], eax
push 0x100a73c
lea eax, [ebp - 0x514]
jmp 0x1004e09
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x1d
push 0x1001960
push ebx
push 0
push 0x1001954
push dword [ebp - 0x4c4]
call esi
push 4
pop edi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x100194c
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call esi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x100193c
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call esi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x1001934
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], 3
call esi
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x4c4]
push eax
push 0x1001740
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x100544d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x510], eax
push 0x100a73c
lea eax, [ebp - 0x510]
jmp 0x1004e09
push 0x1a
push 0x1001918
push ebx
push 0
push 0x1001954
push dword [ebp - 0x4c4]
call esi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x100194c
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call esi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x100193c
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call esi
push edi
lea eax, [ebp - 0x4c8]
push eax
push edi
push 0
push 0x1001934
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], 3
call esi
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x4c4]
push eax
push 0x10014b0
push 0x80000002
call ebx
mov edi, eax
test edi, edi
je 0x100551b
push 0x10018e8
push 0x100c600
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
mov dword [ebp - 0x4d8], edi
push 0x100a73c
lea eax, [ebp - 0x4d8]
jmp 0x1004e09
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x41b]
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0
mov edi, 0x100146c
push edi
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4cc], 0xfb
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1005594
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x100147c
push 0x100c600
mov esi, eax
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4dc], esi
push 0x100a73c
lea eax, [ebp - 0x4dc]
jmp 0x1004e09
push 0x1001430
push dword [ebp - 0x4cc]
lea eax, [ebp - 0x41b]
push eax
call fcn.010022e0
test eax, eax
jne 0x1005617
mov eax, dword [ebp - 0x4cc]
add eax, 9
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x4d0]
push 0
push edi
push dword [ebp - 0x4c4]
call esi
test eax, eax
je 0x1005617
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x10018bc
push 0x100c600
mov esi, eax
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4e4], esi
push 0x100a73c
lea eax, [ebp - 0x4e4]
jmp 0x1004e09
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x4c4]
push eax
push 0x1001590
push 0x80000002
call ebx
mov ebx, eax
test ebx, ebx
je 0x100566a
push 0x1001890
push 0x100c600
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
mov dword [ebp - 0x4ec], ebx
push 0x100a73c
lea eax, [ebp - 0x4ec]
jmp 0x1004e09
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x31a]
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0
push edi
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4cc], 0xfe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10056de
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x1001560
push 0x100c600
mov esi, eax
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], esi
push 0x100a73c
lea eax, [ebp - 0x4f4]
jmp 0x1004e09
push 0x100152c
push dword [ebp - 0x4cc]
lea eax, [ebp - 0x31a]
push eax
call fcn.010022e0
test eax, eax
jne 0x1005761
mov eax, dword [ebp - 0x4cc]
add eax, 6
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x4d0]
push 0
push edi
push dword [ebp - 0x4c4]
call esi
test eax, eax
je 0x1005761
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x1001864
push 0x100c600
mov esi, eax
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4fc], esi
push 0x100a73c
lea eax, [ebp - 0x4fc]
jmp 0x1004e09
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1001818
push 0x100c698
call fcn.01004319
pop ecx
pop ecx
push eax
call fcn.010045e2
pop ecx
call fcn.01007efb
ret
mov dword [ebp - 0x50c], 0x1001adc
push 0x100a820
lea eax, [ebp - 0x50c]
jmp 0x1004e09