Function at 0x416a5c
Capabilities:
Check os version
Create process on windows
Self delete

Disassembly:
push 0x10c
mov eax, 0x5082cf
call fcn.005060cc
mov dword [ebp - 0xc0], ecx
and dword [ebp - 0xac], 0
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb0], eax
lea ecx, [ecx - 0x10]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd0], eax
call fcn.004098e7
mov dword [ebp - 0xb4], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xdc], esi
mov byte [ebp - 4], 1
xor ebx, ebx
mov ecx, dword [ebp + 0x1c]
cmp dword [ecx - 0xc], ebx
cmovne ebx, ecx
test edi, edi
je 0x416e39
cmp dword [ebp - 0xd0], 2
je 0x416e39
lea ecx, [ebp - 0xb5]
call fcn.004266ae
mov byte [ebp - 4], 2
cmp dword [ebp - 0xc8], 0
jne 0x416be8
cmp dword [0xd5b274], 0
jne 0x416b48
push 0x90
lea eax, [ebp - 0xa4]
mov dword [0xd5b274], 1
push 0
push eax
mov dword [ebp - 0xa8], 0x94
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0xa4], 0xa
add eax, dword [ebp - 0xa0]
mov dword [0xd5b270], eax
jmp 0x416b4d
mov eax, dword [0xd5b270]
cmp eax, 0x3c
jl 0x416be8
call fcn.00426031
test eax, eax
je 0x416be8
push ecx
mov ecx, esp
mov dword [ebp - 0xc4], esp
push ebx
call fcn.004094e6
push ecx
mov ecx, dword [ebp - 0xb4]
mov edi, esp
mov byte [ebp - 4], 3
mov dword [ebp - 0xbc], edi
call fcn.004098e7
mov ecx, dword [ebp - 0xd0]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
call fcn.00486c3e
pop ecx
pop ecx
test eax, eax
je 0x416be8
or eax, 0xffffffff
push eax
push 7
push ecx
mov ecx, dword [ebp - 0xb4]
mov edi, esp
mov dword [ebp - 0xc4], esp
mov dword [ebp - 0xc0], edi
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.Delayed_startup_item_launched_as_not_admin
call fcn.004094e6
mov byte [ebp - 4], 2
call fcn.00437175
jmp 0x416e20
xor eax, eax
mov dword [ebp - 0x118], 0x3c
cmp dword [ebp - 0xc8], eax
mov edi, str.runas
push 0x38
push eax
cmove edi, eax
lea eax, [ebp - 0x114]
push eax
call fcn.004f1a90
mov eax, dword [ebp - 0xb0]
add esp, 0xc
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x114], 0x40
mov dword [ebp - 0x108], esi
push eax
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x10c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0xc4], eax
test eax, eax
jne 0x416c7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xbc]
push str._err_d
push eax
call fcn.00423158
add esp, 0xc
mov dword [ebp - 0xb0], eax
xor ecx, ecx
mov byte [ebp - 4], 5
inc ecx
jmp 0x416c9d
push 0x51e784
lea ecx, [ebp - 0xd8]
call fcn.004094e6
mov dword [ebp - 0xb0], eax
push 2
mov dword [ebp - 4], 6
pop ecx
or ebx, 0xffffffff
mov dword [ebp - 0xac], ecx
push ebx
push 7
push ecx
mov ecx, dword [ebp - 0xb4]
mov edi, esp
mov dword [ebp - 0xcc], esp
mov dword [ebp - 0xd4], edi
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
push str.Delayed_startup_item_launched
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 7
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 8
push dword [ebp - 0xb0]
mov edx, eax
call fcn.0040a740
pop ecx
mov byte [ebp - 4], 9
call fcn.00437175
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0xc8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416d1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0xac]
test cl, 2
je 0x416d5c
mov edx, dword [ebp - 0xd8]
and ecx, 0xfffffffd
mov dword [ebp - 0xac], ecx
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416d5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 4], 2
test cl, 1
je 0x416d85
mov edx, dword [ebp - 0xbc]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416d85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0xe0]
and dword [ebp - 0xb4], 0
mov esi, dword [ebp - 0xd0]
test edi, edi
je 0x416e0a
push edi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
inc ecx
cmp eax, dword [ecx*4 + 0x51f058]
je 0x416db9
inc ecx
cmp ecx, 7
jb 0x416da6
mov ecx, ebx
jmp 0x416dba
dec ecx
cmp ecx, esi
je 0x416e0a
cmp dword [ebp - 0xc0], 0
je 0x416e0a
cmp dword [ebp - 0xb4], 0
je 0x416ddb
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi*4 + 0x51f05c]
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x416df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x416e0a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp eax, 0xa
jl 0x416d98
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc4], 0
mov esi, dword [ebp - 0xdc]
je 0x416e24
xor ebx, ebx
jmp 0x416e2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.004267da
or edi, 0xffffffff
jmp 0x41711a
cmp dword [esi - 0xc], 0
jne 0x416e4d
test ebx, ebx
jne 0x416e4d
or edi, 0xffffffff
mov ebx, edi
jmp 0x41711a
cmp dword [ebp - 0xc8], 0
je 0x416fc8
lea ecx, [ebp - 0xb5]
call fcn.004266ae
mov eax, dword [ebp - 0xb0]
push eax
push 0
push ebx
push esi
push str.runas
push 0
mov byte [ebp - 4], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
jg 0x416eab
push ebx
lea eax, [ebp - 0xbc]
push str._err_d
push eax
call fcn.00423158
add esp, 0xc
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0xb
push 4
jmp 0x416eca
push 0x51e784
lea ecx, [ebp - 0xc0]
call fcn.004094e6
mov dword [ebp - 0xb0], eax
mov dword [ebp - 4], 0xc
push 8
pop ecx
or eax, 0xffffffff
mov dword [ebp - 0xac], ecx
push eax
push 7
push ecx
mov ecx, dword [ebp - 0xb4]
mov edi, esp
mov dword [ebp - 0xd4], esp
mov dword [ebp - 0xcc], edi
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
push str.Delayed_startup_item_launched_as_admin
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xd
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xe
push dword [ebp - 0xb0]
mov edx, eax
call fcn.0040a740
pop ecx
mov byte [ebp - 4], 0xf
call fcn.00437175
mov byte [ebp - 4], 0xc
or edi, 0xffffffff
mov edx, dword [ebp - 0xc4]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416f4f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0xac]
test cl, 8
je 0x416f8d
mov edx, dword [ebp - 0xc0]
and ecx, 0xfffffff7
mov dword [ebp - 0xac], ecx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416f8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 4], 0xa
test cl, 4
je 0x416fb6
mov edx, dword [ebp - 0xbc]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416fb6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
cmp ebx, 0x20
cmovg ebx, eax
call fcn.004267da
jmp 0x41711a
mov eax, dword [ebp - 0xb0]
mov edx, esi
push ecx
push eax
push ebx
xor ecx, ecx
call fcn.004872d3
mov ebx, eax
add esp, 0xc
cmp ebx, 0x20
jg 0x417007
push ebx
lea eax, [ebp - 0xbc]
push str._err_d
push eax
call fcn.00423158
add esp, 0xc
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], pe_nt_image_headers32
push pe_nt_image_headers32
jmp 0x417026
push 0x51e784
lea ecx, [ebp - 0xc0]
call fcn.004094e6
mov dword [ebp - 0xb0], eax
mov dword [ebp - 4], 0x11
push 0x20
pop ecx
or eax, 0xffffffff
mov dword [ebp - 0xac], ecx
push eax
push 7
push ecx
mov ecx, dword [ebp - 0xb4]
mov edi, esp
mov dword [ebp - 0xd4], esp
mov dword [ebp - 0xcc], edi
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
push str.Delayed_startup_item_launched_as_not_admin
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0x12
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push dword [ebp - 0xb0]
mov edx, eax
call fcn.0040a740
pop ecx
mov byte [ebp - 4], 0x14
call fcn.00437175
mov byte [ebp - 4], 0x11
or edi, 0xffffffff
mov edx, dword [ebp - 0xc4]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4170ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], pe_nt_image_headers32
mov ecx, dword [ebp - 0xac]
test cl, 0x20
je 0x4170e9
mov edx, dword [ebp - 0xc0]
and ecx, 0xffffffdf
mov dword [ebp - 0xac], ecx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4170e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 4], 1
test cl, 0x10
je 0x417112
mov edx, dword [ebp - 0xbc]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417112
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
cmp ebx, 0x20
cmovg ebx, eax
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x417133
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp + 8]
call fcn.00417143
mov eax, ebx
call fcn.00506076
ret