Function at 0x404b40
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x475099
mov eax, dword fs:[0]
push eax
mov eax, 0x266c
call fcn.00448e60
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x2664], eax
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x267c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x268c]
lea ecx, [esp + 0xb0]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0
call fcn.004039d0
lea ecx, [esp + 0x30]
mov dword [esp + 0x2684], 0
call fcn.00468ff0
push 0x4825ec
push 0x482c68
lea ecx, [esp + 0x38]
mov byte [esp + 0x268c], 1
call fcn.00469230
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x30]
call fcn.00468ae0
mov edx, dword [0x4ad954]
push 0x68
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x404bfa
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esp + 0x30]
call fcn.00468fc0
mov ecx, ebx
lea edx, [esp + 0xb0]
call fcn.0041bd30
test al, al
jne 0x404c5b
push 0x482c68
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x48260c
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x30]
call fcn.00468c30
lea ecx, [esp + 0xb0]
mov dword [esp + 0x2684], 0xffffffff
call fcn.00411a60
xor al, al
jmp 0x405347
lea eax, [esp + 0xb0]
push eax
push ebx
call fcn.004045a0
add esp, 8
test al, al
je 0x404c15
push 0x4a93d0
lea ecx, [esp + 0xa4]
push ecx
push str.UserManager
call fcn.00402f70
add esp, 4
mov ecx, eax
call fcn.0043fa40
push 0
push 0
push 0
push 0
push 0x482620
push eax
lea ecx, [esp + 0x88]
mov byte [esp + 0x269c], 2
call fcn.0046e600
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2684], 4
call fcn.0046d3c0
lea ecx, [esp + 0x70]
call fcn.0046d690
test al, al
jne 0x404d24
push 0
push ebx
lea ecx, [esp + 0x78]
call fcn.0046e8f0
test al, al
jne 0x404d24
push 0x482628
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482634
lea ecx, [esp + 0x74]
mov esi, eax
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x70]
call fcn.0046d3c0
jmp 0x404c34
lea ecx, [esp + 0xd4]
mov byte [esp + 0x12], 1
call fcn.00468ff0
lea eax, [esp + 0xb0]
mov byte [esp + 0x2684], 5
call fcn.0041b9c0
call fcn.00404a90
mov byte [esp + 0x13], al
mov eax, dword [esp + 0xb0]
test eax, eax
mov ecx, eax
je 0x4051d1
jmp 0x404d69
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov eax, ecx
lea ebp, [eax + 8]
mov ecx, ebp
mov dword [esp + 0x2c], edx
mov esi, 0x485ff8
call fcn.00468b10
mov cx, word [eax]
cmp cx, word [esi]
jne 0x404da6
test cx, cx
je 0x404da2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x404da6
add eax, 4
add esi, 4
test cx, cx
jne 0x404d80
xor eax, eax
jmp 0x404dab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404dfd
mov ecx, ebp
mov esi, str.14108
call fcn.00468b10
jmp 0x404dc0
mov cx, word [eax]
cmp cx, word [esi]
jne 0x404de6
test cx, cx
je 0x404de2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x404de6
add eax, 4
add esi, 4
test cx, cx
jne 0x404dc0
xor eax, eax
jmp 0x404deb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4051c6
cmp byte [esp + 0x13], al
je 0x4051c6
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad954]
je 0x404e15
mov edi, 0x4ad950
call fcn.0040bd10
mov eax, dword [ebp + 0x28]
cmp eax, dword [ebp + 0x20]
jle 0x4051c6
lea ecx, [esp + 0x90]
call fcn.00468ff0
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [esp + 0x64]
call fcn.004695b0
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x20]
push edx
push str.ev
push eax
push str._av
lea ecx, [esp + 0x70]
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
lea edi, [ebp + 0x10]
mov ecx, edi
call fcn.0046d380
push eax
lea ecx, [esp + 0x54]
call fcn.00469560
push 0x482654
lea ecx, [esp + 0x54]
mov byte [esp + 0x2688], 8
call fcn.00469230
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x64]
call fcn.00468b10
push eax
lea ecx, [esp + 0x30]
call fcn.0046d910
lea ecx, [esp + 0x60]
mov byte [esp + 0x2684], 9
call fcn.00468ae0
mov edx, dword [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.0041d910
add esp, 8
test al, al
jne 0x404f12
push 0x482658
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482664
mov ecx, ebp
mov esi, eax
call fcn.00468b10
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov byte [esp + 0x12], 0
jmp 0x405197
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x130]
push edx
mov esi, ebx
mov byte [esp + 0x1678], 0
call fcn.00425b80
test al, al
jne 0x404f74
push 0x482674
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.0046e300
test al, al
jne 0x404f6a
push 0x482690
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
mov byte [esp + 0x12], 0
jmp 0x405197
push 0
push edi
push ebx
lea ecx, [esp + 0x24]
call fcn.0046eda0
test al, al
jne 0x404fcb
push 0x4826ac
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x4826b4
mov ecx, edi
mov esi, eax
call fcn.0046d3a0
push eax
push 0x4826b0
lea ecx, [esp + 0x24]
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
jmp 0x404efc
push 0
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.0046e300
test al, al
jne 0x40500f
push 0x4826c4
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482634
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov eax, dword [ebp + 0x28]
add dword [esp + 0x14], 1
mov ecx, ebp
mov dword [ebp + 0x24], eax
mov esi, 0x485ff8
call fcn.00468b10
mov cx, word [eax]
cmp cx, word [esi]
jne 0x40504c
test cx, cx
je 0x405048
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x40504c
add eax, 4
add esi, 4
test cx, cx
jne 0x405026
xor eax, eax
jmp 0x405051
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405197
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x248]
push 0x7fe
push eax
mov word [esp + 0x167c], ax
lea eax, [esp + 0x167e]
push eax
mov byte [ebp + 8], 1
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
call fcn.004498f0
add esp, 0xc
lea ecx, [esp + 0xe6c]
push ecx
lea edx, [esp + 0x1678]
push 0x400
push edx
call fcn.00447193
add esp, 0xc
cmp word [esp + 0x1674], 0
lea edi, [esp + 0x1674]
mov esi, edi
je 0x405197
jmp 0x4050d0
movzx eax, word [esi]
cmp ax, 0x20
je 0x4050e9
cmp ax, 0xd
je 0x4050e9
cmp ax, 0xa
jne 0x40518a
push edi
lea ecx, [esp + 0x84]
mov word [esi], 0
call fcn.00469560
push 0x4826d0
lea ecx, [esp + 0x84]
call fcn.00468db0
push 0x4826d4
lea ecx, [esp + 0x84]
call fcn.00468db0
push 0x4826d8
lea ecx, [esp + 0x84]
call fcn.00468db0
lea ecx, [esp + 0x80]
call fcn.00468bf0
test eax, eax
jbe 0x40517b
lea ecx, [esp + 0x80]
call fcn.00468ae0
push eax
lea ecx, [esp + 0xa4]
call fcn.00469560
lea eax, [esp + 0xa0]
push eax
lea eax, [ebp + 0x14]
mov byte [esp + 0x2688], 0xb
call fcn.00411a00
lea ecx, [esp + 0xa0]
call fcn.00468c30
lea ecx, [esp + 0x80]
lea edi, [esi + 2]
call fcn.00468c30
add esi, 2
cmp word [esi], 0
jne 0x4050d0
lea ecx, [esp + 0x18]
call fcn.0046d3c0
lea ecx, [esp + 0x50]
call fcn.00468c30
lea ecx, [esp + 0x60]
call fcn.00468c30
lea ecx, [esp + 0x90]
mov byte [esp + 0x2684], 5
call fcn.00468c30
cmp dword [esp + 0x2c], 0
jne 0x404d65
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad82c]
je 0x4051e9
mov edi, 0x4ad828
call fcn.0040bd10
cmp dword [esp + 0x14], 0
je 0x405310
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ac7a4
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4ac7a4
call edi
xor ebp, ebp
push 0x7fe
lea ecx, [esp + 0x1e7a]
push ebp
push ecx
mov word [esp + 0x1e80], bp
call fcn.004498f0
add esp, 0xc
push str.UserManager
call fcn.00402f70
add esp, 4
add eax, 0x5d8
push eax
push 0x4826dc
lea edx, [esp + 0x1e7c]
push 0x104
push edx
call fcn.00446633
push 0x40
lea eax, [esp + 0xfc]
push ebp
push eax
call fcn.004498f0
xor eax, eax
add esp, 0x1c
push 0x4ac78c
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0xe8], 0x44
call esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0xe8]
push edx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x1e94]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x40]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
push 0x4ac78c
call edi
cmp byte [esp + 0x12], 0
jne 0x405310
push 0x48270c
mov ecx, ebx
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0xd4]
call fcn.00468c30
lea ecx, [esp + 0x70]
call fcn.0046d3c0
jmp 0x404c34
lea ecx, [esp + 0xd4]
call fcn.00468c30
lea ecx, [esp + 0x70]
call fcn.0046d3c0
lea ecx, [esp + 0x30]
call fcn.00468c30
lea ecx, [esp + 0xb0]
mov dword [esp + 0x2684], 0xffffffff
call fcn.00411a60
mov al, 1
mov ecx, dword [esp + 0x267c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2664]
xor ecx, esp
call fcn.0044610a
add esp, 0x2678
ret