Function at 0x4196d0
Capabilities:
Check os version
Persist via ginadll registry key
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484732
mov eax, dword fs:[0]
push eax
sub esp, 0x3b4
mov eax, dword [0x4aa6b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x49aa14
call fcn.00418fa0
add esp, 4
push str.SoftwareEDataStoreInternetCloud
call fcn.00418fa0
mov eax, dword [0x4ad5a0]
mov ebx, 8
add esp, 4
cmp dword [0x4ad5b4], ebx
jae 0x41972f
mov eax, 0x4ad5a0
push eax
call fcn.00419180
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
xor eax, eax
push 0x4ad5a0
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x22c], ax
call fcn.00401980
push 0xe
push str.InternetCloud
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], edi
call fcn.00403070
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], ebx
jae 0x41978f
lea eax, [ebp - 0x22c]
push eax
call fcn.00419180
add esp, 4
push 0xffffffffffffffff
push edi
push 0x4ad5a0
lea ecx, [ebp - 0x22c]
call fcn.00401980
push 0xa
push str.Languages
lea ecx, [ebp - 0x22c]
call fcn.00403070
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], ebx
jae 0x4197d1
lea eax, [ebp - 0x22c]
push eax
call fcn.00419180
add esp, 4
push 0xffffffffffffffff
push edi
push 0x4ad5a0
lea ecx, [ebp - 0x22c]
call fcn.00401980
push 4
push str._res
lea ecx, [ebp - 0x22c]
call fcn.00403070
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], ebx
jae 0x419813
lea eax, [ebp - 0x22c]
push eax
call fcn.00419180
add esp, 4
push 0xffffffffffffffff
push edi
push 0x4ad5a0
lea ecx, [ebp - 0x22c]
call fcn.00401980
push 0x18
push str.InternetCloudLanguages
lea ecx, [ebp - 0x22c]
call fcn.00403070
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], ebx
jae 0x419855
lea eax, [ebp - 0x22c]
push eax
call fcn.00419180
add esp, 4
push 0xffffffffffffffff
push edi
push 0x4ad5a0
lea ecx, [ebp - 0x22c]
call fcn.00401980
push 0x12
push str.InternetCloud_res
lea ecx, [ebp - 0x22c]
call fcn.00403070
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], ebx
jae 0x419897
lea eax, [ebp - 0x22c]
push eax
call fcn.00419180
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 4
push str.11111111111111111111111111111111111111
call esi
mov eax, dword [0x4ad5a0]
cmp dword [0x4ad5b4], ebx
jae 0x4198bf
mov eax, 0x4ad5a0
push eax
call esi
mov eax, dword [0x4ad5a0]
cmp dword [0x4ad5b4], ebx
jae 0x4198d4
mov eax, 0x4ad5a0
push eax
call fcn.00419400
add esp, 4
push str.22222222222222222222222222222222222222
call esi
call fcn.00418ec0
test al, al
je 0x419b6b
lea ecx, [ebp - 0x3b8]
push ecx
mov dword [ebp - 0x3b8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b4], 5
jne 0x4199be
lea edx, [ebp - 0x3bc]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x419b6b
push 0xd
push str.WinxpGina.dll
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], edi
mov word [ebp - 0x248], ax
call fcn.00401ad0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x234], ebx
jae 0x419971
lea eax, [ebp - 0x248]
mov ecx, dword [ebp - 0x238]
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [ebp - 0x3bc]
push 1
push edi
push str.GinaDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x3bc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x234], ebx
jb 0x419b6b
mov edx, dword [ebp - 0x248]
push edx
call fcn.0041da61
add esp, 4
jmp 0x419b6b
lea esi, [ebp - 0x280]
call fcn.004032e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x274], edi
je 0x4199ee
mov eax, dword [ebp - 0x27c]
cmp eax, edi
je 0x4199ee
lea ecx, [ebp - 0x268]
push ecx
call eax
mov dword [ebp - 0x26c], eax
push 4
xor edx, edx
mov esi, 7
push 0x49ab14
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x238], edi
mov word [ebp - 0x248], dx
call fcn.00401ad0
push 0xffffffffffffffff
push edi
push 0x4ad5a0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00402f60
push 0xe
push str.Register.reg_
lea ecx, [ebp - 0x248]
call fcn.00403070
mov edx, dword [ebp - 0x248]
cmp dword [ebp - 0x234], ebx
jae 0x419a57
lea edx, [ebp - 0x248]
xor eax, eax
mov word [ebp - 0x264], ax
mov eax, edx
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x254], edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x419a71
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x264]
call fcn.00401ad0
mov byte [ebp - 4], 3
xor ecx, ecx
push 0x16
mov word [ebp - 0x29c], cx
mov esi, 7
push str.C:windows_regedit.exe
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x28c], edi
call fcn.00401ad0
lea edx, [ebp - 0x264]
push edx
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 4
call fcn.00411440
add esp, 4
cmp dword [ebp - 0x288], ebx
jb 0x419aed
mov eax, dword [ebp - 0x29c]
push eax
call fcn.0041da61
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x28c], edi
mov word [ebp - 0x29c], cx
cmp dword [ebp - 0x250], ebx
jb 0x419b19
mov edx, dword [ebp - 0x264]
push edx
call fcn.0041da61
add esp, 4
cmp dword [ebp - 0x234], ebx
jb 0x419b30
mov eax, dword [ebp - 0x248]
push eax
call fcn.0041da61
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x238], edi
mov word [ebp - 0x248], cx
cmp dword [ebp - 0x274], edi
je 0x419b6b
cmp dword [ebp - 0x26c], edi
je 0x419b6b
mov eax, dword [ebp - 0x278]
cmp eax, edi
je 0x419b6b
mov edx, dword [ebp - 0x268]
push edx
call eax
call fcn.00418f30
test al, al
je 0x419b7e
call fcn.0040a8f0
call fcn.0040a810
push 0x1fc
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.00428990
lea ecx, [ebp - 0x210]
add esp, 0xc
push ecx
call fcn.004193a0
add esp, 4
cmp eax, edi
jne 0x419c9d
lea edx, [ebp - 0x3bc]
push edx
push 1
lea eax, [ebp - 0x210]
push eax
push edi
xor esi, esi
mov dword [ebp - 0x3bc], edi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp eax, edi
jne 0x419cd0
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [eax + 0xc]
and ecx, 3
cmp cl, 2
jne 0x419bed
mov esi, 1
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, edi
jne 0x419c9d
push 0x6a
lea esi, [ebp - 0x280]
call fcn.004110d0
add esp, 4
mov edi, eax
push 0x7b
lea esi, [ebp - 0x264]
mov byte [ebp - 4], 5
call fcn.004110d0
add esp, 4
cmp dword [edi + 0x14], ebx
jb 0x419c29
mov edi, dword [edi]
cmp dword [eax + 0x14], ebx
jb 0x419c30
mov eax, dword [eax]
push 0x24
push edi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
mov esi, 8
sete bl
cmp dword [ebp - 0x250], esi
jb 0x419c5e
mov edx, dword [ebp - 0x264]
push edx
call fcn.0041da61
add esp, 4
xor eax, eax
mov dword [ebp - 0x250], 7
mov dword [ebp - 0x254], 0
mov word [ebp - 0x264], ax
cmp dword [ebp - 0x26c], esi
jb 0x419c92
mov ecx, dword [ebp - 0x280]
push ecx
call fcn.0041da61
add esp, 4
test bl, bl
je 0x419c9b
call fcn.0040ac50
mov ebx, esi
cmp dword [ebp - 0x218], ebx
jb 0x419cb4
mov edx, dword [ebp - 0x22c]
push edx
call fcn.0041da61
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d331
mov esp, ebp
pop ebp
ret
push eax
push str.NetUserGetInfo_failed:__d_n
call fcn.0041f81b
add esp, 8
jmp 0x419bfc