Function at 0x40a7e0
Capabilities:
Check os version
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdf4
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x93
lea eax, [ebp - 0x9f]
push ebx
push eax
mov byte [ebp - 0xa0], bl
call fcn.00428450
add esp, 0xc
push 0x115
lea ecx, [ebp - 0x4bf]
push ebx
push ecx
mov byte [ebp - 0x4c0], bl
call fcn.00428450
add esp, 0xc
push 0x7fe
lea eax, [ebp - 0xcbe]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xcc0], dx
call fcn.00428450
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x3a7]
push ebx
push ecx
mov byte [ebp - 0x3a8], bl
call fcn.00428450
add esp, 0xc
push 0x206
lea eax, [ebp - 0x2a6]
xor edx, edx
push ebx
push eax
mov byte [ebp - 0xde1], bl
mov byte [ebp - 0xde2], bl
mov word [ebp - 0x2a8], dx
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0xdf0]
push ecx
lea edx, [ebp - 0xde8]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.systemcurrentcontrolset_servicesWin_Win7
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xdf0], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40a8d5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x11c
lea eax, [ebp - 0xde0]
push ebx
push eax
mov dword [ebp - 0xdec], 3
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0xde0]
push ecx
mov dword [ebp - 0xde0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xddc], 6
mov ecx, dword [ebp - 0xde8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0xdec]
push eax
push 4
push ebx
sbb edx, edx
push 0x43f26c
add edx, 3
push ecx
mov dword [ebp - 0xdec], edx
call edi
xor eax, eax
nop
movzx ecx, word [eax + 0x486954]
mov word [ebp + eax - 0x2a8], cx
add eax, 2
cmp cx, bx
jne 0x40a940
lea eax, [ebp - 0x2a8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a960
mov ecx, dword [ebp - 0xde8]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x2a8]
push eax
push 1
push ebx
push str.Version
push ecx
call edi
cmp dword [0x489434], ebx
je 0x40a9dd
push 0x43f278
call fcn.00406870
add esp, 4
xor eax, eax
jmp 0x40a9b0
movzx ecx, word [eax + str.4901_5BVH_29ZM]
mov word [ebp + eax - 0x2a8], cx
add eax, 2
cmp cx, bx
jne 0x40a9b0
lea eax, [ebp - 0x2a8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a9d0
jmp 0x40aa3b
mov eax, 0x4881a0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a9e5
sub eax, edx
sar eax, 1
cmp eax, 0xe
jne 0x40aa5e
push 0x43eedc
call fcn.00406870
add esp, 4
xor eax, eax
jmp 0x40aa10
movzx ecx, word [eax + 0x4881a0]
mov word [ebp + eax - 0x2a8], cx
add eax, 2
cmp cx, bx
jne 0x40aa10
lea eax, [ebp - 0x2a8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40aa30
mov ecx, dword [ebp - 0xde8]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x2a8]
push eax
push 1
push ebx
push str.SerialNumber
push ecx
call edi
jmp 0x40aa6b
push 0x43f2a4
call fcn.00406870
add esp, 4
mov edx, dword [ebp - 0xde8]
push str.ConsolePublicKey
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x43f2c8
call fcn.00406870
mov eax, 0x4881c0
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40aa92
sub eax, edx
sar eax, 1
cmp eax, 0x12a
jne 0x40aade
push 0x43ef54
call fcn.00406870
lea eax, [ebp - 0xa0]
add esp, 4
push eax
call fcn.00406e20
add esp, 4
test eax, eax
je 0x40aad1
mov byte [ebp - 0xde1], 1
jmp 0x40aaeb
mov byte [ebp - 0xde1], bl
push 0x43ef7c
jmp 0x40aae3
push str._quP_n0RlQ
call fcn.00406870
add esp, 4
mov eax, 0x488418
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40aaf3
sub eax, edx
sar eax, 1
je 0x40ab3a
push 0x43efbc
call fcn.00406870
lea ecx, [ebp - 0x4c0]
add esp, 4
push ecx
call fcn.00407200
add esp, 4
test eax, eax
je 0x40ab2d
mov byte [ebp - 0xde2], 1
jmp 0x40ab47
mov byte [ebp - 0xde2], bl
push 0x43efe4
jmp 0x40ab3f
push str._quP_n0R
call fcn.00406870
add esp, 4
cmp byte [ebp - 0xde1], 1
jne 0x40ab6d
mov eax, dword [ebp - 0xde8]
push 0x94
lea edx, [ebp - 0xa0]
push edx
push 3
push ebx
push str.ConsolePublicKey
push eax
call edi
cmp byte [ebp - 0xde2], 1
jne 0x40ab93
mov edx, dword [ebp - 0xde8]
push 0x114
lea ecx, [ebp - 0x4c0]
push ecx
push 3
push ebx
push str.SignedPublicKey
push edx
call edi
lea esi, [ebp - 0xcc0]
call fcn.004074e0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40aba3
sub eax, edx
sar eax, 1
cmp eax, 0x1f4
jbe 0x40abee
push str.uP_n_tg
call fcn.00406870
lea eax, [ebp - 0x3a8]
add esp, 4
push eax
lea ecx, [ebp - 0xcc0]
call fcn.00407000
add esp, 4
test eax, eax
jne 0x40ac17
push 0x43f33c
call fcn.00406870
add esp, 4
jmp 0x40ac34
lea ecx, [ebp - 0xcc0]
push ecx
push str._quP_n0RI
push 0x486150
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x486150
call fcn.00406870
add esp, 4
jmp 0x40ac34
mov eax, dword [ebp - 0xde8]
push 0x100
lea edx, [ebp - 0x3a8]
push edx
push 3
push ebx
push str.ConsoleIdentify
push eax
call edi
mov ecx, dword [ebp - 0xde8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret