Function at 0x48d7d0
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d70eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
push ebx
push ebp
push esi
mov esi, edx
xor ebp, ebp
cmp esi, ebp
push edi
mov ebx, ecx
jne 0x48d800
xor eax, eax
jmp 0x48da29
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a8]
push eax
push esi
push str.__s___s
lea edi, [esp + 0x28]
mov dword [esp + 0x1ac], ebp
call fcn.00404190
push 0x110
lea ecx, [esp + 0x90]
push ebp
push ecx
call fcn.004a4620
add esp, 0x18
lea edx, [esp + 0x7c]
push edx
mov dword [esp + 0x80], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48d875
cmp dword [esp + 0x80], 6
jne 0x48d875
mov esi, 1
cmp esi, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebp
lea esi, [esp + 0x14]
jne 0x48d88c
call fcn.00412e30
jmp 0x48d891
call fcn.00412dc0
cmp eax, ebp
jne 0x48d9eb
push 0x40
lea eax, [esp + 0x3c]
push ebp
push eax
mov dword [esp + 0x40], 0x44
call fcn.004a4620
mov ecx, dword [esp + 0x20]
xor eax, eax
neg ebx
sbb ebx, ebx
and ebx, 5
push ecx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x70], 1
mov word [esp + 0x74], bx
call fcn.00412ea0
add esp, 0x10
test al, al
jne 0x48d905
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x48d8f8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x14]
push edx
call fcn.00413080
add esp, 4
push str.userenv.dll
mov dword [esp + 0x40], str.Winsta0Default
mov ebx, 0x30
mov dword [esp + 0x1c], ebp
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
test ebp, ebp
je 0x48d968
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push ebp
call edi
push str.DestroyEnvironmentBlock
push ebp
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x48d968
mov eax, dword [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
je 0x48d960
mov ebx, 0x430
jmp 0x48d968
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x1c]
push 0
push ecx
push ebx
push 0
push 0
push 0
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [esp + 0x20], eax
test eax, eax
mov eax, dword [esp + 0x24]
je 0x48d9b9
test eax, eax
je 0x48d9c4
mov ecx, dword [esp + 0x1ac]
test ecx, ecx
jbe 0x48d9b9
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x48d9c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x48d9d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x48d9de
mov ecx, dword [esp + 0x18]
push ecx
call edi
test ebp, ebp
je 0x48d9e9
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebp, ebp
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x48d9fa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1a0], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48da25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x198]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x194
ret