Function at 0x11140
Capabilities:
Delete registry value
Get system information on windows
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push esi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov word [ebp - 0x64], 0
xor ecx, ecx
mov dword [ebp - 0x62], ecx
mov word [ebp - 0x5e], cx
mov word [ebp - 0x40], 0
xor edx, edx
mov dword [ebp - 0x3e], edx
mov word [ebp - 0x3a], dx
mov dword [ebp - 0x68], 0x20
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x11450
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0x40
lea edx, [ebp - 0x64]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
push 0
push 0x2c
lea eax, [ebp - 0x2c]
push eax
push 0
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jne 0x11352
mov ecx, dword [ebp - 0x20]
xor edx, edx
add ecx, 1
adc edx, 0
mov eax, dword [ebp - 0x24]
xor esi, esi
push esi
push eax
push edx
push ecx
call sub.ntoskrnl.exe__allmul
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push 0
push 0x100000
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call sub.ntoskrnl.exe__alldiv
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x58]
push eax
push 0xf003f
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jne 0x11352
cmp dword [ebp - 0x34], 0
jl 0x11287
jg 0x1127e
cmp dword [ebp - 0x38], 0x700
jb 0x11287
mov dword [ebp - 0x68], 0x200
jmp 0x112dc
cmp dword [ebp - 0x34], 0
jl 0x112a1
jg 0x11298
cmp dword [ebp - 0x38], 0x380
jb 0x112a1
mov dword [ebp - 0x68], 0x100
jmp 0x112dc
cmp dword [ebp - 0x34], 0
jl 0x112bb
jg 0x112b2
cmp dword [ebp - 0x38], 0x1c0
jb 0x112bb
mov dword [ebp - 0x68], 0x80
jmp 0x112dc
cmp dword [ebp - 0x34], 0
jl 0x112d5
jg 0x112cc
cmp dword [ebp - 0x38], 0x140
jbe 0x112d5
mov dword [ebp - 0x68], 0x40
jmp 0x112dc
mov dword [ebp - 0x68], 0x20
push 0x11420
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
push 4
lea edx, [ebp - 0x68]
push edx
push 4
push 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x68], edx
push 0x113e0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 4
lea ecx, [ebp - 0x68]
push ecx
push 4
push 0
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
mov esp, ebp
pop ebp
ret