Function at 0x4776c0
Capabilities:
Check os version
Delete file
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x518
mov edx, dword [ebp + 8]
mov eax, dword [0x4f195c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [edx]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4776eb
and byte [esi + 0x18e], 0xc7
mov eax, dword [edx]
cmp eax, 6
ja 0x477e3d
mov byte [ebp - 0x4b8], 0xa
movzx eax, word [eax*2 + 0x4cee8c]
add eax, 0x47770a
jmp eax
mov edx, dword [0x508060]
test edx, edx
je 0x477a53
movzx ecx, byte [esi + 0x194]
test ecx, 0x80
jne 0x477cff
push 0x30c
push 0
lea edx, [ebp - 0x3b3]
push edx
call fcn.004a08c0
add esp, 0xc
mov dword [ebp - 0x4c8], 0
mov edx, 0x40
xor ecx, ecx
mov dword [ebp + edx - 0x50c], ecx
mov dword [ebp + edx - 0x510], ecx
mov dword [ebp + edx - 0x514], ecx
mov dword [ebp + edx - 0x518], ecx
sub edx, 0x10
jne 0x477a7a
movzx edx, byte [esi + 0x18e]
mov dword [ebp - 0x508], 0x44
test dl, 0x20
je 0x477b6d
test dl, 8
jne 0x477ade
cmp dword [0x4f1980], 0
je 0x477f1e
mov ecx, dword [0x4f19f0]
push dword [esi + 0x74]
lea edx, [ebp - 0x3b3]
push edx
call ecx
add esp, 8
jmp 0x477b0f
cmp dword [0x4f1980], 0
je 0x477f54
mov ecx, dword [0x4f19f0]
push dword [esi + 0x74]
push dword [esi + 0x74]
push str._s__DEL__s
lea edx, [ebp - 0x3b3]
push edx
call ecx
add esp, 0x10
and byte [esi + 0x18e], 0xf7
lea edx, [ebp - 0x518]
push edx
xor edx, edx
lea ecx, [ebp - 0x508]
push ecx
push edx
push edx
push 0x4000000
push 1
push edx
push edx
lea edi, [ebp - 0x3b3]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x477f3e
xor edi, edi
push 0xffffffffffffffff
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x477f28
push dword [ebp - 0x518]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [esi + 0x18e]
jmp 0x477b6f
xor edi, edi
test dl, 0x10
jne 0x477b82
test dl, 8
jne 0x477ce3
jmp 0x477cf9
push 0x105
lea edx, [ebp - 0x4b7]
push edx
push str.FOR_DEFAULT_PRINT_DEVICE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x477bad
cmp eax, 0x105
jae 0x477bad
movsx edx, byte [ebp - 0x4b7]
jmp 0x477bb6
mov byte [ebp - 0x4b7], 0
xor edx, edx
test edx, edx
jne 0x477bc6
mov dword [ebp - 0x51c], 0x4ceec8
jmp 0x477bcf
lea edx, [ebp - 0x4b7]
mov dword [edx - 0x65], edx
mov dword [ebp - 0xa4], 0x94
lea edx, [ebp - 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 1
jne 0x477c1b
cmp dword [0x4f1980], 0
je 0x477f5e
mov ecx, dword [0x4f19f0]
push dword [ebp - 0x51c]
push dword [esi + 0x74]
push str.Command.com__C_COPY___s___s
lea edx, [ebp - 0x3b3]
push edx
call ecx
jmp 0x477c45
cmp dword [0x4f1980], 0
je 0x477fe5
mov ecx, dword [0x4f19f0]
push dword [ebp - 0x51c]
push dword [esi + 0x74]
push str.Cmd.exe__C_COPY___s___s
lea edx, [ebp - 0x3b3]
push edx
call ecx
add esp, 0x10
lea edx, [ebp - 0x518]
push edx
lea ecx, [ebp - 0x508]
push ecx
xor ecx, ecx
lea edx, [ebp - 0x3b3]
push ecx
push ecx
push 0x4000000
push 1
push ecx
push ecx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x477fc0
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x477faa
push 0xffffffffffffffff
push dword [ebp - 0x518]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x477f94
push dword [ebp - 0x518]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x477f7e
movzx edx, byte [esi + 0x18e]
mov ecx, edx
btr ecx, 3
jae 0x477cf9
cmp dword [esi + 0x100], 0
je 0x477ce3
mov edx, ecx
mov edi, 5
mov byte [esi + 0x18e], dl
xor ecx, ecx
test ecx, ecx
je 0x477cfd
test dl, 4
jne 0x477cf9
push dword [esi + 0x74]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x477f68
test edi, edi
je 0x477cff
mov ebx, edi
push dword [esi + 0x74]
call fcn.00460cc0
add esp, 4
test eax, eax
je 0x477d12
mov ebx, eax
jmp 0x477d22
xor edx, edx
mov dword [esi + 0x74], str._Unknown_
mov word [esi + 0x176], dx
push dword [esi + 0x48]
call fcn.00460cc0
add esp, 4
test eax, eax
je 0x477d35
mov ebx, eax
jmp 0x477d3c
mov dword [esi + 0x48], 0
test byte [esi + 0x18e], 0x40
je 0x477d5f
push dword [esi + 0x6c]
call fcn.00460cc0
add esp, 4
test eax, eax
je 0x477d58
mov ebx, eax
jmp 0x477d5f
mov dword [esi + 0x6c], 0
movzx edx, byte [esi + 0x191]
test edx, 0x80
jne 0x477e1f
mov ecx, dword [esi + 0x3c]
lea edx, [esi + 0x20]
mov edi, dword [esi + 0x38]
mov dword [ebp - 0x4bc], ecx
mov ecx, dword [esi + 0x30]
mov dword [ebp - 0x4c0], edi
movzx edi, byte [esi + 0x199]
mov dword [ebp - 0x4c4], ecx
test byte [esi + 0x18d], 0x18
je 0x477ddd
push 0x190
push 0
push edx
mov edx, dword [esi + 0x118]
mov dword [ebp - 0x51c], edx
call fcn.004a08c0
add esp, 0xc
movzx edx, byte [esi + 0x18d]
and edx, 0xffffffe7
mov ecx, dword [ebp - 0x51c]
add edx, 8
mov byte [esi + 0x18d], dl
mov dword [esi + 0x118], ecx
jmp 0x477ded
push 0x190
push 0
push edx
call fcn.004a08c0
add esp, 0xc
mov edx, dword [ebp - 0x4c0]
and edi, 2
mov dword [esi + 0x38], edx
movzx edx, byte [esi + 0x199]
and edx, 0xfffffffd
mov ecx, dword [ebp - 0x4bc]
or edx, edi
mov edi, dword [ebp - 0x4c4]
mov dword [esi + 0x3c], ecx
mov byte [esi + 0x199], dl
mov dword [esi + 0x30], edi
jmp 0x477e26
and byte [esi + 0x18d], 0xdf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x477e57
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x477e57
mov eax, 0x30
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.004a91cc
call fcn.004a89f0
movzx edx, byte [esi + 0x18e]
not edx
and edx, 8
shr edx, 3
push edx
push eax
call fcn.004a89d0
add esp, 8
cmp eax, 0xffffffff
jne 0x477a36
and byte [esi + 0x18e], 0xf7
mov edx, dword [0x508060]
jmp 0x477a3c
call fcn.004a0af0
jmp 0x477ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477b58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477b42
call fcn.004a0af0
jmp 0x477aeb
call fcn.004a0af0
jmp 0x477bfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477cfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477cb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov edi, 0x1c
jmp 0x477c8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, byte [esi + 0x18e]
mov ecx, edx
and ecx, 8
mov edi, 0x1c
mov dword [esi + 0x100], eax
shr ecx, 3
jmp 0x477cdf
call fcn.004a0af0
jmp 0x477c28