Function at 0x601bb4
Capabilities:
Check os version
Get common file path
Get hostname
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6c
push 0
push 0
dec ecx
jne 0x601bbc
push ecx
push ebx
xor eax, eax
push ebp
push 0x601f11
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultLCID
and al, 0xff
mov byte [0x625e40], al
mov dword [ebp - 4], 0xff
lea edx, [ebp - 0x324]
xor eax, eax
call fcn.0040737c
mov eax, dword [ebp - 0x324]
lea edx, [ebp - 0x320]
call fcn.00427390
mov eax, dword [ebp - 0x320]
lea edx, [ebp - 0x31c]
call fcn.004258e0
mov edx, dword [ebp - 0x31c]
mov eax, 0x625e10
call fcn.0040a9cc
lea edx, [ebp - 0x330]
xor eax, eax
call fcn.0040737c
mov eax, dword [ebp - 0x330]
lea edx, [ebp - 0x32c]
call fcn.0042748c
mov eax, dword [ebp - 0x32c]
lea edx, [ebp - 0x328]
call fcn.004258e0
mov edx, dword [ebp - 0x328]
mov eax, 0x625e14
call fcn.0040a9cc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetComputerNameW
lea edx, [ebp - 0x334]
lea eax, [ebp - 0x204]
call fcn.00427958
mov edx, dword [ebp - 0x334]
mov eax, 0x625e18
call fcn.0040a9cc
mov dword [ebp - 4], 0xff
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 0x33c]
lea eax, [ebp - 0x204]
call fcn.00427958
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.0042f208
mov edx, dword [ebp - 0x338]
mov eax, 0x625e1c
call fcn.0040a9cc
mov dword [ebp - 4], 0xff
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetTempPathW
lea edx, [ebp - 0x344]
lea eax, [ebp - 0x204]
call fcn.00427958
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
call fcn.0042f208
mov edx, dword [ebp - 0x340]
mov eax, 0x625e20
call fcn.0040a9cc
cmp dword [0x625e20], 0
jne 0x601d40
mov eax, 0x625e20
mov edx, dword [0x625e1c]
call fcn.0040a9cc
mov dword [ebp - 0x318], 0x114
lea eax, [ebp - 0x318]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x601d89
mov eax, dword [ebp - 0x308]
mov dword [0x61e108], eax
mov eax, dword [ebp - 0x314]
mov dword [0x61e10c], eax
mov eax, dword [ebp - 0x310]
mov dword [0x61e110], eax
cmp dword [0x61e10c], 6
setae byte [0x625e28]
mov ecx, 0x20019
mov dl, 1
mov eax, dword [0x506830]
call fcn.005079c0
mov ebx, eax
mov eax, dword [0x61e108]
sub eax, 2
jae 0x601e3e
mov edx, 0x80000001
mov eax, ebx
call fcn.00507a64
xor ecx, ecx
mov edx, 0x601f2c
mov eax, ebx
call fcn.00507bc0
test al, al
je 0x601ec9
lea ecx, [ebp - 0x34c]
mov edx, 0x601fbc
mov eax, ebx
call fcn.00508588
mov eax, dword [ebp - 0x34c]
lea edx, [ebp - 0x348]
call fcn.0042f208
mov edx, dword [ebp - 0x348]
mov eax, 0x61e114
call fcn.0040a9cc
lea ecx, [ebp - 0x354]
mov edx, 0x601fd8
mov eax, ebx
call fcn.00508588
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.0042f208
mov edx, dword [ebp - 0x350]
mov eax, 0x61e118
call fcn.0040a9cc
mov eax, ebx
call fcn.00507a34
jmp 0x601ec9
mov edx, 0x80000002
mov eax, ebx
call fcn.00507a64
xor ecx, ecx
mov edx, 0x601f2c
mov eax, ebx
call fcn.00507bc0
test al, al
je 0x601ec9
lea ecx, [ebp - 0x35c]
mov edx, 0x601ff8
mov eax, ebx
call fcn.00508588
mov eax, dword [ebp - 0x35c]
lea edx, [ebp - 0x358]
call fcn.0042f208
mov edx, dword [ebp - 0x358]
mov eax, 0x61e114
call fcn.0040a9cc
lea ecx, [ebp - 0x364]
mov edx, 0x602024
mov eax, ebx
call fcn.00508588
mov eax, dword [ebp - 0x364]
lea edx, [ebp - 0x360]
call fcn.0042f208
mov edx, dword [ebp - 0x360]
mov eax, 0x61e118
call fcn.0040a9cc
mov eax, ebx
call fcn.00507a34
mov eax, ebx
call fcn.00408828
push dword [0x61e118]
push 0x602050
push 0x602078
mov eax, 0x61e11c
mov edx, 3
call fcn.0040b32c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x601f18
lea eax, [ebp - 0x364]
mov edx, 0x13
call fcn.0040a63c
pop eax
jmp eax