Function at 0x408d70
Capabilities:
Check os version
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.00414930
push 0x11c
lea edx, [ebp - 0x320]
push 0
push edx
call fcn.00414930
add esp, 0x18
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
cmp dword [ebp - 0x31c], 6
mov ecx, 0x80
jb 0x4094f0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x22
push str.WinMasterServices_V7_Client7
push 0x22
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterRC_Slave7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterRC_SlaveX7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x80
lea edi, [ebp - 0x204]
or eax, edx
push 0x22
rep stosd dword es:[edi], eax
push str.WinMasterFT_Slave7
push 0x22
push str._c_netsh_advfirewall_firewall_delete_rule_name
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterRC_Master7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterRC_MasterEx7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterRC_MasterX7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMasterFT_Master7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMaster_Client7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMaster_Server7
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMaster_WCFSvr
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMaster_RegSvr
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.WinMaster_Loader
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh_advfirewall_firewall_delete_rule_name
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x204]
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFwmcSystem7.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFWM7_Server.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFwmcFTMaster7.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x80
lea edi, [ebp - 0x204]
or eax, edx
rep stosd dword es:[edi], eax
push 0x22
push str.C:Program_FilesWW2017CFwmcFTSlave7.exe
push 0x22
push str._c_netsh__firewall_delete_allowedprogram_program_
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFwmcRCMaster7.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFwmcRCSlave7.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFWM7_WCFService.exe
mov eax, edx
push 0x22
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
push str._s_c_s_c
lea eax, [ebp - 0x204]
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFWM7_CAService.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
xor eax, eax
movzx edx, ax
push 0x22
push str.C:Program_FilesWW2017CFWM7Ldr.exe
mov eax, edx
shl edx, 0x10
push 0x22
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
push str._c_netsh__firewall_delete_allowedprogram_program_
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x204]
push str._s_c_s_c
push eax
call esi
add esp, 0x18
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push str.cmd.exe
push str.open
push 0
call ebx
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x408], 0
xor eax, eax
jmp 0x409510
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]
mov word [ebp + eax - 0x404], cx
add eax, 2
test cx, cx
jne 0x409510
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x408]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0x80000002
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x409599
mov edx, dword [ebp - 0x408]
push str.8150:TCP
push edx
call esi
mov eax, dword [ebp - 0x408]
push str.8250:TCP
push eax
call esi
mov ecx, dword [ebp - 0x408]
push str.8251:TCP
push ecx
call esi
mov edx, dword [ebp - 0x408]
push str.8850:TCP
push edx
call esi
mov eax, dword [ebp - 0x408]
push str.8851:TCP
push eax
call esi
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
xor eax, eax
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileGloballyOpenPortsList]
mov word [ebp + eax - 0x404], cx
add eax, 2
test cx, cx
jne 0x4095c1
lea eax, [ebp - 0x408]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0x80000002
call ebx
test eax, eax
jne 0x40963e
mov edx, dword [ebp - 0x408]
push str.8150:TCP
push edx
call esi
mov eax, dword [ebp - 0x408]
push str.8250:TCP
push eax
call esi
mov ecx, dword [ebp - 0x408]
push str.8251:TCP
push ecx
call esi
mov edx, dword [ebp - 0x408]
push str.8850:TCP
push edx
call esi
mov eax, dword [ebp - 0x408]
push str.8851:TCP
push eax
call esi
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret