Function at 0x45f742
Capabilities:
Check os version
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0x284
mov eax, 0x53256f
call fcn.004e45be
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 0x114
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x45fdcf
cmp dword [ebp - 0x15c], 5
jne 0x45fdcf
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x158], ebx
jne 0x45fdcf
push ebx
push 3
lea ecx, [ebp - 0x290]
call fcn.004241d9
lea eax, [ebp - 0x16c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServicesTcpipLinkage
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x170], esi
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
je 0x45f831
lea eax, [ebp - 0x280]
push str.Open_Registry_Key_failed__
push eax
call fcn.004191b0
pop ecx
pop ecx
push edi
mov ecx, eax
call fcn.00414b78
push 0x5abf38
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x45f814
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x188]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x188]
push eax
call fcn.004fd5aa
push ebx
call fcn.004e4198
mov ebx, eax
mov dword [ebp - 0x170], ebx
pop ecx
test ebx, ebx
jne 0x45f8b4
lea eax, [ebp - 0x280]
push str.PatchDNS
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x550cc4
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x467
mov ecx, eax
call fcn.00414b78
push str.:_Out_of_memory
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x45f898
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x194]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x194]
jmp 0x45f82b
lea eax, [ebp - 0x164]
xor edi, edi
push eax
push ebx
lea eax, [ebp - 0x178]
inc edi
push eax
push esi
push str.Bind
push dword [ebp - 0x16c]
mov dword [ebp - 0x164], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x168], eax
cmp eax, 0xea
jne 0x45f99f
push ebx
call fcn.004e399c
pop ecx
push dword [ebp - 0x164]
call fcn.004e4198
mov ebx, eax
mov dword [ebp - 0x170], ebx
pop ecx
test ebx, ebx
jne 0x45f97e
lea eax, [ebp - 0x280]
push str.PatchDNS
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x550cc4
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x477
mov ecx, eax
call fcn.00414b78
push str.:_Out_of_memory
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 0x10
jb 0x45f962
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1a0]
jmp 0x45f82b
lea eax, [ebp - 0x164]
push eax
push ebx
push esi
push esi
push str.Bind
push dword [ebp - 0x16c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x168], eax
test eax, eax
jne 0x45fceb
cmp dword [ebp - 0x178], 7
jne 0x45fceb
mov eax, dword [ebp - 0x164]
cmp byte [eax + ebx - 1], 0
je 0x45f9c6
push 2
pop edi
jmp 0x45f9d1
cmp byte [eax + ebx - 2], 0
je 0x45fa83
add eax, edi
push eax
call fcn.004e4198
mov dword [ebp - 0x168], eax
pop ecx
test eax, eax
jne 0x45fa54
lea eax, [ebp - 0x280]
push str.PatchDNS
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x550cc4
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x494
mov ecx, eax
call fcn.00414b78
push str.:_Out_of_memory
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x45fa38
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1ac]
jmp 0x45f82b
push dword [ebp - 0x164]
push ebx
push eax
call fcn.004fced0
add dword [ebp - 0x164], edi
add esp, 0xc
push ebx
call fcn.004e399c
mov ebx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x164]
pop ecx
mov dword [ebp - 0x170], ebx
lea ecx, [ebx - 0x12]
add ecx, eax
mov dword [ebp - 0x174], ecx
cmp eax, 0x12
jb 0x45fdad
mov dword [ebp - 0x168], ebx
mov edi, ebx
cmp ebx, ecx
ja 0x45fad0
cmp byte [edi], 0x5c
jne 0x45fac5
push 0x11
lea eax, [edi + 1]
push 0x5b91f5
push eax
call fcn.004fd9ee
add esp, 0xc
test eax, eax
je 0x45fad8
mov ecx, dword [ebp - 0x174]
inc edi
mov dword [ebp - 0x168], edi
cmp edi, ecx
jbe 0x45faa3
mov edi, esi
mov dword [ebp - 0x168], edi
test edi, edi
je 0x45fdad
cmp edi, ebx
je 0x45fdad
push dword [ebp - 0x164]
call fcn.004e4198
pop ecx
mov ecx, eax
mov dword [ebp - 0x174], ecx
test ecx, ecx
jne 0x45fb70
lea eax, [ebp - 0x280]
push str.PatchDNS
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x550cc4
push eax
call fcn.004191b0
pop ecx
pop ecx
push 0x4ac
mov ecx, eax
call fcn.00414b78
push str.:_Out_of_memory
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x45fb54
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1b8]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1b8]
jmp 0x45f82b
mov esi, edi
mov edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x168]
mov eax, esi
sub eax, ebx
push eax
lea eax, [ecx + 0x12]
push ebx
push eax
call fcn.004fced0
mov eax, dword [ebp - 0x164]
add esp, 0xc
mov edi, dword [ebp - 0x174]
sub eax, esi
add eax, 0xffffffee
add eax, ebx
push eax
lea eax, [esi + 0x12]
add esi, 0x12
push eax
mov eax, edi
sub eax, ebx
add eax, esi
push eax
call fcn.004fced0
add esp, 0xc
push ebx
call fcn.004e399c
pop ecx
push dword [ebp - 0x16c]
mov ebx, edi
mov dword [ebp - 0x170], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x16c]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesTcpipLinkage
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x45fc66
lea eax, [ebp - 0x280]
cmp esi, 5
jne 0x45fc0d
push str.insufficient_privileges__See_KB311218_
jmp 0x45fc27
push str.Open_Registry_Key_failed__
push eax
call fcn.004191b0
pop ecx
pop ecx
push esi
mov ecx, eax
call fcn.00414b78
push 0x5abf38
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 0x10
jb 0x45fc4a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1c4]
jmp 0x45f82b
push dword [ebp - 0x164]
push edi
push 7
push 0
push str.Bind
push dword [ebp - 0x16c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x45fdad
lea eax, [ebp - 0x280]
push str.Set_Registry_Value_failed__
push eax
call fcn.004191b0
pop ecx
pop ecx
push esi
mov ecx, eax
call fcn.00414b78
push 0x5abf38
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 0x10
jb 0x45fccf
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1d0]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1d0]
jmp 0x45f82b
lea eax, [ebp - 0x280]
push str.Query_Registry_Value_failed__
push eax
call fcn.004191b0
pop ecx
pop ecx
push dword [ebp - 0x168]
mov ecx, eax
call fcn.00414b78
push 0x5abf38
push eax
call fcn.004191b0
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042418e
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x45fd33
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.0040e6bb
push 0x5dc580
lea eax, [ebp - 0x1dc]
jmp 0x45f82b
test ebx, ebx
je 0x45fdb8
push ebx
call fcn.004e399c
pop ecx
push dword [ebp - 0x16c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x290]
call fcn.00423023
call fcn.004e450b
ret