Function at 0x4168b0
Capabilities:
Check os version
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x465ccc
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4835f0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4835f0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov ebp, dword [esp + 0x14c]
push 0
push str.NSVCPRTCPU
call edi
push eax
call fcn.0042ecf0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x416928
push 0x64
call esi
push 0
push str.NSVCPRTCPU
call edi
push eax
call fcn.0042ecf0
test eax, eax
jne 0x416911
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x416942
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x144], 0
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x416977
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push str.ProtectCopuck.exe
push 0x4882d8
lea ecx, [esp + 0x20]
push str._s__s
push ecx
mov byte [esp + 0x154], 1
call fcn.004012d0
push str.ProtectCopuck.exe
push 0x4882d8
lea edx, [esp + 0x2c]
push str._s_s
push edx
call fcn.004012d0
add esp, 0x20
push 0x3e8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
mov eax, dword [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x4169e9
push 1
call esi
inc bl
cmp bl, 0x64
jl 0x4169d3
push 0x3e8
call esi
xor bl, bl
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.0044b7be
add esp, 8
test eax, eax
je 0x416a13
push 1
call esi
inc bl
cmp bl, 0x64
jl 0x4169f2
push 0x3e8
call esi
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x416a34
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ebx, 2
mov byte [esp + 0x144], bl
cmp dword [ebp + 0xb0], 0
jg 0x416a5e
call fcn.00433f65
mov eax, dword [ebp + 0xac]
mov eax, dword [eax]
mov ecx, str.RENAME_UPDATE
jmp 0x416a70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416a96
test dx, dx
je 0x416a92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416a96
add eax, 4
add ecx, 4
test dx, dx
jne 0x416a70
xor eax, eax
jmp 0x416a9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x416ab1
push 4
push str.RUN2
lea ecx, [esp + 0x24]
call fcn.004029b0
jmp 0x416ada
cmp dword [ebp + 0xb0], 0
jg 0x416abf
call fcn.00433f65
mov eax, dword [ebp + 0xac]
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x20]
push 0x471fd0
push edx
call fcn.004012d0
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x416b95
cmp dword [esp + 0x34], ebx
jne 0x416b95
cmp dword [esp + 0x28], 6
jb 0x416b95
call fcn.00434084
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x416b24
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
push str.ProtectCop
lea ecx, [esp + 0x24]
push 0x471e94
push ecx
mov byte [esp + 0x150], 3
call fcn.004012d0
mov esi, dword [esp + 0x2c]
add esp, 0xc
push 0
push 0
push esi
push str.schtasks
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
lea eax, [esi - 0x10]
mov byte [esp + 0x144], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416bb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x416bb5
push 5
push 0x4882d8
push str.RUN2
push str.ProtectCopuck.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov byte [esp + 0x144], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
cmp edi, 0x20
jle 0x416c39
test edx, edx
jg 0x416be2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x144], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x144], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x416c9c
test edx, edx
jg 0x416c47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x144], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x144], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0044a6e6
add esp, 0x134
ret 4