Function at 0x408930
Capabilities:
Check os version
Create process on windows
Get common file path
Link many functions at runtime
Print debug messages
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43abbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x540
push ebx
mov ebx, ecx
push esi
mov dword [esp + 0xc], ebx
lea esi, [ebx + 8]
mov ecx, esi
call fcn.004217d0
test eax, eax
jne 0x408995
mov ecx, ebx
call fcn.004088d0
test eax, eax
je 0x408977
mov ecx, esi
call fcn.004217d0
test eax, eax
jne 0x408995
mov ecx, ebx
call fcn.00408d40
pop esi
pop ebx
mov ecx, dword [esp + 0x540]
mov dword fs:[0], ecx
add esp, 0x54c
ret
push ebp
push edi
push 0x50
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x558], ebp
je 0x408a1e
lea ecx, [esi + 0x1c]
call fcn.00432720
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateIpNetEntry
push eax
mov dword [esi], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.SendARP
push eax
call edi
mov ecx, dword [esi]
push str.EnableRouter
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.UnenableRouter
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.GetAdaptersInfo
push eax
call edi
mov dword [esi + 0x14], eax
or eax, 0xffffffff
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], eax
mov dword [esi + 0x18], eax
mov ebp, esi
jmp 0x408a21
or eax, 0xffffffff
mov dword [esp + 0x558], eax
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xb0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
mov dword [0x44526c], ebp
push ecx
mov dword [esp + 0xb4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xb4], 6
jae 0x408bc2
mov dl, byte [0x445264]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x145]
mov byte [esp + 0x144], dl
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x144]
push eax
push ecx
push edx
push str.Test
push str.SYSTEMCurrentControlSetServicesPacketParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x28], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x408b63
call fcn.004325d0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x248]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x450]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x350]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x248]
push 0
push ecx
push 0x104
push str.Packet.inf
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x248]
lea eax, [esp + 0x34c]
push edx
push str.snetcfg.exe__v__l___s___c_p__i_ms_packet
push 0x100
push eax
call fcn.00421960
add esp, 0x10
lea ecx, [esp + 0x34c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call ebx
jmp 0x408b90
mov edi, str.Hello
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Hello
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x408b97
call fcn.004325d0
mov ecx, ebp
call fcn.00408ca0
push 0x3e8
call ebx
call fcn.00432530
test eax, eax
jne 0x408bb3
mov ecx, ebp
call fcn.00408ca0
push 0x3e8
call ebx
call fcn.00432530
mov eax, dword [esp + 0x14]
mov ebx, eax
mov dword [eax + 4], 1
jmp 0x408bc9
mov dword [ebx + 4], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x408c2a
mov esi, dword [0x44526c]
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 6
jb 0x408c01
xor eax, eax
jmp 0x408c27
call fcn.00432530
test eax, eax
jne 0x408c15
push str.Failed_to_load
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00432650
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [esi + 0x18], eax
mov eax, edx
mov dword [ebx + 4], eax
lea ecx, [ebx + 0x3b8]
call fcn.0042f390
pop edi
pop ebp
test eax, eax
jne 0x408c57
pop esi
mov eax, 0x8004
pop ebx
mov ecx, dword [esp + 0x540]
mov dword fs:[0], ecx
add esp, 0x54c
ret
lea esi, [ebx + 0x320]
mov ecx, esi
call fcn.00430ce0
mov ecx, esi
call fcn.00432060
lea ecx, [ebx + 0x478]
call fcn.004150d0
mov ecx, ebx
call fcn.0040a460
mov ecx, dword [esp + 0x548]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x54c
ret