Function at 0x413633
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80000000
jae 0x41391c
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 5
jne 0x4136aa
xor eax, eax
mov al, byte [ebp - 3]
test eax, eax
je 0x41367a
mov dword [0x462260], 1
xor eax, eax
mov al, byte [ebp - 3]
cmp eax, 1
jne 0x413692
mov dword [0x462264], 1
xor eax, eax
mov al, byte [ebp - 3]
cmp eax, 1
jbe 0x4136aa
mov dword [0x462270], 1
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 6
je 0x4136c6
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 7
jne 0x41381c
mov dword [0x462280], 1
push 0x46e280
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4136ed
mov dword [0x4622b8], 1
push 0
push 0
call fcn.0042e65e
add esp, 8
test eax, eax
jne 0x4137eb
push 0x46e288
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x4137c0
mov dword [ebp - 0x14], 0
push 0x200
lea eax, [ebp - 0x214]
push eax
push str.SystemRoot_system32_sppsvc.exe
call fcn.004280cc
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x14], eax
cmp dword [0x45e03c], 0
je 0x41376b
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x14]
push eax
push str._r_n0912A:Precheck__d.__s_LA
call fcn.00452380
add esp, 0xc
push 0x200
lea eax, [ebp - 0x214]
push eax
push str.SystemRoot_sysnative_sppsvc.exe
call fcn.004280cc
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x14], eax
cmp dword [0x45e03c], 0
je 0x4137bb
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x14]
push eax
push str._r_n0912B:Precheck__d.__s_LA
call fcn.00452380
add esp, 0xc
jmp 0x4137e6
cmp dword [0x45e03c], 0
je 0x4137e6
push 0x46e314
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str._r_n0912C:Precheck_bypassed...__x_
call fcn.00452380
add esp, 8
jmp 0x413805
cmp dword [0x45e03c], 0
je 0x413805
push str._r_n0630A:Precheck_bypassed.
call fcn.00452380
add esp, 4
mov dword [0x462260], 1
push str.__proceeding_
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x13880
push 0x5dfac0
call fcn.004381a6
add esp, 0x14
cmp dword [ebp - 0x10], 0
je 0x413868
mov dword [0x462284], 1
cmp dword [0x45e03c], 0
je 0x413868
push str._n_r_n__USE_64BIT____n_n
call fcn.00452380
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x413881
mov dword [0x462294], 0
jmp 0x41389f
cmp dword [ebp - 8], 0
je 0x41389f
cmp dword [ebp - 0x10], 0
je 0x41389f
mov dword [0x462294], 1
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 4
jne 0x4138b7
mov dword [0x462268], 1
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 5
jne 0x4138cf
mov dword [0x46226c], 1
cmp dword [0x45e03c], 0
je 0x413904
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
push eax
xor eax, eax
mov al, byte [ebp - 3]
push eax
xor eax, eax
mov al, byte [ebp - 4]
push eax
push str._n_nFound_Windows__u._u__Build:__u__n_r
call fcn.00452380
add esp, 0x10
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 6
jb 0x41391c
mov dword [0x4621fc], 1
pop edi
pop esi
pop ebx
leave
ret