Function at 0x48de30
Capabilities:
Check os version
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor al, al
push edi
mov edi, dword [ebp + 0x10]
push 0x4c4eb8
push 0x4afa4c
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], edi
mov byte [ebp - 0x85], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e5228
test eax, eax
je 0x48de83
call eax
jmp 0x48de89
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.004519b0
test eax, eax
je 0x48deee
push ebx
push 0
push 0x48dcb0
call fcn.00493b6c
push dword [ebp + 0x14]
push 1
call fcn.00451600
add esp, 0x14
test eax, eax
jne 0x48deda
push 0x10
push 0x4b0220
push str.Unable_to_extract_64_bit_image._Run_Process_Explorer_from_a_writeable_directory.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x48df46
mov dword [0x4dfca4], 0
call ebx
cmp al, 6
jb 0x48df46
mov dword [0x4e5ff8], 0xf60
call ebx
shr eax, 8
movzx eax, al
sub eax, 0
je 0x48df3c
dec eax
je 0x48df30
mov dword [0x4dfca4], 3
jmp 0x48df46
mov dword [0x4dfca4], 2
jmp 0x48df46
mov dword [0x4dfca4], 1
push esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor esi, esi
mov dword [0x4e51dc], edi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x84], edi
cmp word [edi], si
je 0x48dfdc
mov edx, dword [ebp + esi*4 - 0x84]
xor eax, eax
cmp word [edx], ax
je 0x48df9f
xor ecx, ecx
cmp word [ecx + edx], 0x20
je 0x48df94
inc eax
lea ecx, [eax + eax]
cmp word [ecx + edx], 0
jne 0x48df82
test eax, eax
je 0x48df9f
inc esi
mov dword [ebp - 0x8c], esi
lea ecx, [eax + eax]
mov eax, dword [ebp + esi*4 - 0x88]
cmp word [eax + ecx], 0
je 0x48dfdc
xor edx, edx
mov word [eax + ecx], dx
mov esi, dword [ebp - 0x8c]
mov eax, dword [ebp + esi*4 - 0x88]
add eax, 2
add eax, ecx
mov dword [ebp + esi*4 - 0x84], eax
cmp esi, 0x20
je 0x48dfdc
movzx eax, word [eax]
test ax, ax
jne 0x48df72
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0x4b0220
call fcn.00435870
add esp, 0xc
test eax, eax
je 0x48e164
xor esi, esi
cmp dword [ebp - 0x8c], esi
jle 0x48e203
lea ecx, [ecx]
mov edx, dword [ebp + esi*4 - 0x84]
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48e020
sub ecx, edi
sar ecx, 1
lea eax, [ecx + 1]
push eax
push edx
call fcn.00491d92
mov ecx, dword [ebp + esi*4 - 0x84]
add esp, 8
movzx eax, word [ecx]
cmp eax, 0x2f
je 0x48e054
cmp eax, 0x2d
jne 0x48e0fe
movzx eax, word [ecx + 2]
add eax, 0xffffffbb
cmp eax, 0xf
ja case.0x48e06b.70
movzx eax, byte [eax + 0x48e314]
jmp dword [eax*4 + 0x48e2fc]
mov byte [0x4e51d8], 1
jmp case.0x48e0ce.72
cmp word [ecx + 4], 0x3a
jne case.0x48e0ce.73
lea eax, [ecx + 6]
push eax
call fcn.00492994
add esp, 4
mov dword [0x4d9438], eax
jmp case.0x48e0ce.72
call ebx
cmp al, 6
jb case.0x48e0ce.73
mov byte [ebp - 0x85], 1
jmp case.0x48e0ce.72
cmp word [ecx + 4], 0x3a
jne case.0x48e0ce.73
movzx eax, word [ecx + 6]
add eax, 0xffffffb8
cmp eax, 0xa
ja case.0x48e0ce.73
movzx eax, byte [eax + 0x48e338]
jmp dword [eax*4 + 0x48e324]
push 0x100
jmp 0x48e0e2
push 0x20
jmp 0x48e0e2
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
inc esi
cmp esi, dword [ebp - 0x8c]
jl 0x48e010
jmp 0x48e114
push 0x4c4f74
push ecx
call fcn.004913b3
add esp, 8
test eax, eax
je case.0x48e0ce.73
mov al, byte [ebp - 0x85]
test al, al
je 0x48e203
call fcn.004529e0
test al, al
jne 0x48e203
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x90]
call fcn.004518d0
add esp, 0xc
test eax, eax
je 0x48e2e7
cmp eax, 0x4c7
je 0x48e164
push dword [0x4e5180]
push 0x4bf814
call fcn.00483c20
add esp, 8
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
cmp word [ecx + 4], 0x54
jne case.0x48e0ce.73
push 0
push 0
push 0
push 0
call fcn.0045c140
add esp, 0x10
jmp 0x48e2e7
call fcn.0048ddf0
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
call ebx
push 0x40
push 0x4b0220
cmp al, 6
jb 0x48e1e0
push 0x4c4b10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
push 0x4c4cc0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov esi, dword [ebp - 0x94]
push esi
call fcn.004403d0
add esp, 8
test eax, eax
je 0x48e2e7
push 0x4bac64
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0xb0]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x48e2e7
mov esi, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
mov eax, dword [0x4e6000]
test eax, eax
je 0x48e26f
lea ecx, [ebp - 0xb0]
push ecx
push ebx
push eax
call esi
test eax, eax
jne 0x48e2cc
mov eax, dword [0x4e6000]
mov ecx, dword [0x4e5ffc]
test ecx, ecx
je 0x48e28c
lea eax, [ebp - 0xb0]
push eax
push ecx
call edi
test eax, eax
jne 0x48e2cc
mov eax, dword [0x4e6000]
test eax, eax
je 0x48e29e
lea ecx, [ebp - 0xb0]
push ecx
push eax
call edi
test eax, eax
jne 0x48e2cc
lea eax, [ebp - 0xb0]
push eax
push ebx
push dword [0x4e5180]
call esi
test eax, eax
jne 0x48e2cc
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x48e252
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0x10