Function at 0x407370
Capabilities:
Check os version
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4706a2
mov eax, dword fs:[0]
push eax
mov eax, 0x1eb4
call fcn.004675f0
mov eax, dword [0x491654]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e7c], eax
lea eax, [ebp - 0x1e24]
call fcn.004025a7
push 0x3e8
lea ecx, [ebp - 0x1dec]
push ecx
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4073ed
push 0x104
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x1dec]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp - 0x41c]
push ecx
lea edi, [ebp - 0x1e24]
call fcn.00402628
push 0x110
lea edx, [ebp - 0x128]
push 0
mov edi, 0x114
push edx
mov dword [ebp - 0x12c], edi
call fcn.0045e9a0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call esi
cmp dword [ebp - 0x128], 6
jae 0x407534
lea ecx, [ebp - 0x161c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x161c]
push edx
push 0
push 0x47ad5c
push 0x47a990
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x161c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x161c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x161c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 0x1e40]
call fcn.00408610
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x1e78]
mov byte [ebp - 4], 1
call fcn.004025ce
push 0x47ab84
lea ecx, [ebp - 0x1e78]
push ecx
mov byte [ebp - 4], 2
call fcn.0040260d
push 0
lea edx, [ebp - 0x1e40]
mov edi, eax
push edx
or eax, 0xffffffff
call fcn.004030d3
lea eax, [ebp - 0x1e78]
call fcn.00402639
mov edi, eax
lea eax, [ebp - 0x1e24]
call fcn.00402639
push eax
mov ecx, edi
call fcn.004072a0
add esp, 4
test al, al
je 0x407515
lea eax, [ebp - 0x1e78]
push eax
lea ecx, [ebp - 0x1e24]
call fcn.00403c8f
lea ecx, [ebp - 0x1e78]
call fcn.004025ff
lea ecx, [ebp - 0x1e40]
mov byte [ebp - 4], 0
call fcn.004025ff
mov edi, 0x114
push 0x110
lea ecx, [ebp - 0x128]
push 0
push ecx
mov dword [ebp - 0x12c], edi
call fcn.0045e9a0
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call esi
cmp dword [ebp - 0x128], 6
jae 0x40758a
call fcn.00407140
test al, al
jne 0x40758a
push 0x30
push 0
push 0x47ab88
push 0x47abd8
call fcn.004089f0
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x38
lea eax, [ebp - 0x1eb8]
push 0
push eax
mov dword [ebp - 0x1ebc], 0x3c
call fcn.0045e9a0
add esp, 0xc
push str.unas
push 0x47abe8
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x1e5c]
call fcn.004025ce
push 0x110
lea ecx, [ebp - 0x128]
push 0
mov byte [ebp - 4], 3
push ecx
mov dword [ebp - 0x12c], edi
call fcn.0045e9a0
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call esi
cmp dword [ebp - 0x128], 6
jae 0x407643
call fcn.00407140
test al, al
je 0x407643
push 0x47a9fc
push 0x47aa04
call fcn.004089f0
add esp, 8
push eax
lea eax, [ebp - 0x1e40]
call fcn.004025ce
mov byte [ebp - 4], 4
call fcn.00403325
mov esi, eax
lea eax, [ebp - 0x1e5c]
call fcn.00403979
lea ecx, [ebp - 0x1e40]
mov byte [ebp - 4], 3
call fcn.004025ff
lea eax, [ebp - 0x1e5c]
call fcn.00402639
mov dword [ebp - 0x1eb0], eax
lea eax, [ebp - 0x1e24]
call fcn.00402639
push ecx
mov dword [ebp - 0x1eac], eax
mov eax, esp
mov dword [ebp - 0x1eb4], 0
mov dword [ebp - 0x1ea0], 1
mov dword [ebp - 0x1e80], esp
call fcn.00403325
lea eax, [ebp - 0x1e08]
call fcn.004025a4
push 0
push 0
lea edi, [ebp - 0x1e08]
call fcn.004032db
mov eax, dword [ebp - 0x1e7c]
push 0xffffffffffffffff
push eax
xor eax, eax
mov ecx, edi
call fcn.004031db
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 5
call fcn.00402639
push 0x47ac0c
push eax
push 0x47ac04
push 0x47abf0
push 0x47abec
mov ecx, edi
push ecx
call fcn.0040260d
push eax
call fcn.0040260d
push eax
call fcn.0040260d
push eax
call fcn.0040260d
push eax
call fcn.0040260d
mov eax, edi
call fcn.00402639
push 0x47ac10
push 0x47ac38
mov dword [ebp - 0x1ea8], eax
mov dword [ebp - 0x1eb8], 0x40
call fcn.004089f0
add esp, 8
push eax
push str.INFO
mov ecx, ebx
call fcn.00417c10
mov edx, dword [ebp - 0x1ea8]
push edx
push str.INFO
mov ecx, ebx
call fcn.00417c10
lea eax, [ebp - 0x1ebc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x407805
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x407791
push eax
push ecx
push str.ser_did_not_allow_elevation__error_code_d
push 0x47ac98
call fcn.004089f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x61c]
push 0x100
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea edx, [ebp - 0x61c]
jmp 0x4077d3
push eax
push ecx
push 0x47ac9c
push 0x47a9f8
call fcn.004089f0
add esp, 0xc
push eax
lea eax, [ebp - 0x214]
push 0x100
push eax
call fcn.00453686
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [ebp - 0x214]
push edx
push str.WARNING
mov ecx, ebx
call fcn.00417c10
lea ecx, [ebp - 0x1e08]
call fcn.004025ff
lea ecx, [ebp - 0x1e5c]
call fcn.004025ff
lea ecx, [ebp - 0x1e24]
call fcn.004025ff
xor al, al
jmp 0x407828
lea ecx, [ebp - 0x1e08]
call fcn.004025ff
lea ecx, [ebp - 0x1e5c]
call fcn.004025ff
lea ecx, [ebp - 0x1e24]
call fcn.004025ff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452dc2
mov esp, ebp
pop ebp
ret