Function at 0x401b60
Capabilities:
Check os version
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xe0
push ebx
push ebp
push esi
mov esi, dword [esp + 0xf0]
push edi
xor ebx, ebx
push esi
mov dword [esp + 0x20], ebx
call fcn.00401b20
mov edi, 0x40ce88
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x401c93
mov edi, 0x40cee6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x401c93
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x401ca0
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [esp + 0x1c], 0x40ce88
push ebx
lea eax, [esp + 0x90]
push str.SYSTEMCurrentControlSetServicesClassNetTrans_04d
push eax
call ebp
mov edi, str.IpAddress
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 0x1e
and ecx, 3
mov dword [esp + 0x14], 7
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c89
lea eax, [esp + 0x18]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401c89
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
add eax, 0x5e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x1c], eax
and ecx, 3
cmp eax, 0x40cf44
rep movsb byte es:[edi], byte [esi]
jge 0x401c93
inc ebx
cmp ebx, 0x14
jl 0x401bc7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe0
ret
mov edx, esi
mov ebx, 0x40ce9c
and edx, 0xffff
mov dword [esp + 0x28], edx
jmp 0x401cb7
mov edx, dword [esp + 0x28]
lea edi, [ebx + 0x1e]
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x40b28c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esp + ecx + 0x74]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ebp, 1
push ebp
push ebx
lea edx, [esp + 0x94]
push str.SYSTEMCurrentControlSetServices_s_dParameters
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, str.InterruptNumber
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 4
and ecx, 3
mov dword [esp + 0x18], eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push 0x20019
push 0
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f2e
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401de8
mov edi, str.INTERRUPT
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f2e
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx - 0x2c]
cmp eax, ecx
jne 0x401f2e
mov edi, str.IoBaseAddress
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401e91
mov edi, str.IoAddress
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f2e
mov eax, dword [esp + 0x20]
push ebp
push ebx
lea ecx, [esp + 0x94]
push str.SYSTEMCurrentControlSetServices_s_dParametersTcpip
push ecx
mov dword [ebx - 0x28], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, str.IPAddress
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 0x1e
and ecx, 3
mov dword [esp + 0x14], 7
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f2e
lea eax, [esp + 0x18]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401f3d
inc ebp
cmp ebp, 0xa
jl 0x401d02
jmp 0x401fe7
lea edi, [esp + 0x6c]
lea esi, [esp + 0x4c]
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x401f6d
test al, al
je 0x401f69
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x401f6d
add esi, 2
add edi, 2
test al, al
jne 0x401f45
xor eax, eax
jmp 0x401f72
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401fc3
push 0x40b1e4
push 0x40b908
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x401fc3
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x6c]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401fe7
mov dword [esp + 0x1c], 1
jmp 0x401fe7
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx - 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebx, 0x5e
cmp ebx, 0x40cf58
jl 0x401cb3
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret