Function at 0x401d40
Capabilities:
Check os version
Create service
Delete registry value
Delete service
Initialize winsock library
Persist via run registry key
Persist via windows service
Set registry value
Start service

Disassembly:
mov eax, 0x21ac
call fcn.00422570
mov eax, dword [0x4538c0]
xor eax, esp
mov dword [esp + 0x21a8], eax
push ebx
mov ebx, dword [esp + 0x21b8]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push 0x101
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x457b80
mov dword [0x457b80], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 0x21bc]
mov dword [0x453370], 0x453478
cmp esi, 2
je 0x401da8
cmp esi, 3
jne 0x402255
mov eax, dword [ebx + 4]
mov ecx, str.__install
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401dd0
test dl, dl
je 0x401dcc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401dd0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401db0
xor eax, eax
jmp 0x401dd5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40209a
push dword [0x453480]
lea eax, [esp + 0x1b8]
push dword [0x45347c]
push str._s_will_be_installed_and_started._nBy_clicking_Yes_you_confirm_you_read_and_accepted_License_Agreement._nYou_can_use_Administration_Services_to_control__s_service.
push eax
call fcn.00402430
mov eax, dword [0x453370]
add esp, 0x10
push 0x44
push dword [eax + 8]
lea eax, [esp + 0x1bc]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4023d2
lea eax, [esp + 0x10]
mov byte [esp + 0x1b4], 0x22
push eax
lea eax, [esp + 0x1b9]
push eax
push 0x100
push 0x444384
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov edx, eax
test edx, edx
jne 0x401e77
push str.Failed_to_find_executable_filename
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
lea edi, [esp + 0x1b4]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x401e80
mov eax, dword [0x4443b0]
mov dword [edi], eax
cmp esi, 3
jne 0x401e9b
mov ecx, dword [ebx + 8]
jmp 0x401ea3
mov eax, dword [0x453370]
mov ecx, dword [eax + 0x64]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1bc]
add eax, edx
push eax
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x401ee9
push str.Failed_to_find_config_filename
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401ef1
cmp dword [0x457b90], 2
mov eax, dword [str.____service]
mov dword [ecx], eax
mov eax, dword [0x4443d8]
mov dword [ecx + 4], eax
mov eax, dword [0x4443dc]
mov dword [ecx + 8], eax
jne 0x401fef
push 0x40000010
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x401f5b
push str.Failed_to_open_Service_Manager
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c8]
push eax
mov eax, dword [0x453370]
push 0
push 2
push 0x10
push 0x20000000
push dword [eax + 8]
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x401fb5
push str.Failed_to_create_service
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x402336
push str.Failed_to_start_service
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402036
push str.Failed_to_open_registry
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402040
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1b8]
push eax
mov eax, dword [0x453370]
push 2
push 0
push dword [eax + 4]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402336
push str.Failed_to_set_registry_value
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
cmp esi, 2
je 0x4020a8
cmp esi, 3
jne 0x402255
mov eax, dword [ebx + 4]
mov ecx, str.__remove
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4020d0
test dl, dl
je 0x4020cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4020d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4020b0
xor eax, eax
jmp 0x4020d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4021fe
cmp dword [0x457b90], 2
jne 0x402199
push 0x40000000
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x402124
push str.Failed_to_open_Service_Manager_n
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
mov eax, dword [0x453370]
push 0x10000
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x402163
push str.Failed_to_open_service
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402336
push str.Failed_to_delete_service
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40200f
mov eax, dword [0x453370]
push dword [eax + 4]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x402336
push str.Failed_to_clear_registry
call fcn.004265d5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
cmp esi, 3
jne 0x40224b
mov eax, dword [ebx + 8]
mov ecx, str.__service
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402230
test dl, dl
je 0x40222c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402230
add eax, 2
add ecx, 2
test dl, dl
jne 0x402210
xor eax, eax
jmp 0x402235
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402255
mov dword [0x4543c4], 1
lea esi, [eax + 2]
mov eax, dword [ebx + 4]
jmp 0x40225a
cmp esi, 2
jne 0x402255
mov eax, dword [ebx + 4]
jmp 0x40225a
mov eax, dword [str.3proxy.cfg]
push eax
call fcn.00432e46
add esp, 4
mov dword [0x453264], eax
test eax, eax
je 0x402278
cmp byte [eax], 0x2d
je 0x402278
call fcn.0040b6b0
mov edi, eax
cmp esi, 2
jg 0x402350
test edi, edi
je 0x402350
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x455520
call esi
push 0x455500
call esi
push 0x4554e0
call esi
push 0x4554c0
call esi
push 0x4554a0
call esi
push 0x455480
call esi
push 0x455440
call esi
push 0x455700
call esi
push 0x453230
call fcn.0040ace0
push edi
call fcn.0040b3a0
inc dword [0x4532ac]
add esp, 8
test eax, eax
jne 0x402336
cmp dword [0x455478], eax
jne 0x4022f5
push edi
call fcn.00425f3a
add esp, 4
cmp dword [0x4543c4], 0
je 0x402331
mov eax, dword [0x453370]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 0x401b80
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x402336
call fcn.00401310
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret
push dword [ebx]
push str.Usage:__s__conffile__n
push 2
call fcn.00425c7a
add esp, 4
push eax
call fcn.00402400
mov eax, dword [ebx]
add esp, 0xc
push eax
push eax
push str._n_t_s___install__conffile__n_tto_install_as_service_n_n_t_s___remove_n_tto_remove_service_n
push 2
call fcn.00425c7a
add esp, 4
push eax
call fcn.00402400
push 0x44459c
call fcn.00403920
add esp, 0x14
push eax
push str.available_socket_options:_n_t_s_n
push 2
call fcn.00425c7a
add esp, 4
push eax
call fcn.00402400
mov eax, dword [0x453370]
add esp, 0xc
push dword [0x4531c4]
push dword [eax + 0xc]
push dword [eax + 8]
push str._n_s__s_n_s_n
push 2
call fcn.00425c7a
add esp, 4
push eax
call fcn.00402400
add esp, 0x14
mov ecx, dword [esp + 0x21b4]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042255f
add esp, 0x21ac
ret