Function at 0x1011621
Capabilities:
Check os version
Copy file
Create process on windows
Get common file path
Get session user name
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.01011309
push 8
pop edi
push 5
pop ebx
test al, al
jne 0x101165d
mov dword [ebp - 4], 2
call fcn.01012109
jmp 0x101180f
call fcn.0101264d
test al, al
je 0x1011808
call fcn.0101768d
test al, al
je 0x1011808
cmp dword [0x101c1d8], 0
mov eax, 0x1007430
jne 0x101168a
mov eax, 0x1007424
push eax
push 0x10073c0
push edi
call fcn.01017562
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x20]
push 0x64
pop ecx
cdq
idiv ecx
movzx eax, word [ebp - 0x1e]
push edx
push eax
movzx eax, word [ebp - 0x1a]
push eax
push 0x1007368
push edi
call fcn.01017562
add esp, 0x20
push 0x101c05c
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [0x101c06c]
movzx eax, word [0x101c07e]
push dword [0x101c070]
push eax
push dword [0x101c074]
movzx eax, word [0x101c05c]
push eax
push 0x10072f0
push edi
call fcn.01017562
add esp, 0x1c
push 0x101c080
mov dword [0x101c080], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0101a030
cmp word [eax], 0
je 0x101174e
call fcn.0101a030
push eax
lea eax, [ebp - 0x2b0]
push 0x10072e4
push eax
call fcn.010112bd
add esp, 0xc
mov esi, eax
jmp 0x1011753
mov esi, 0x1001b68
call fcn.0101a020
cmp eax, 0xffffffff
je 0x1011776
call fcn.0101a020
push eax
lea eax, [ebp - 0x44]
push 0x10072dc
push eax
call fcn.0101129c
add esp, 0xc
jmp 0x101177b
mov eax, 0x1001b68
movzx ecx, byte [0x101c19a]
push ecx
movzx ecx, word [0x101c198]
push ecx
push dword [0x101c090]
movzx ecx, word [0x101c196]
push 0x101c094
push ecx
movzx ecx, word [0x101c194]
push ecx
push esi
push eax
push dword [0x101c08c]
push dword [0x101c088]
push dword [0x101c084]
push 0x1007250
push edi
call fcn.01017562
mov ax, word [0x101c05c]
add esp, 0x34
cmp ax, bx
je 0x10117e0
mov byte [0x101c1bc], 0
cmp ax, 0xc
jne 0x10117e7
mov byte [0x101c1bc], 1
call fcn.01012a40
mov byte [0x101c1bd], al
call fcn.0101a010
cmp eax, 0x501
jae 0x101183e
push 0x10071f8
call fcn.01011f22
pop ecx
mov dword [ebp - 4], 2
mov eax, dword [0x101c1d4]
cmp eax, 1
je 0x1011826
cmp dword [0x101c1d8], 0
mov byte [ebp - 5], 0
je 0x101182a
mov byte [ebp - 5], 1
cmp dword [ebp - 4], 0
jne 0x1011a7f
mov esi, 0x10071d8
jmp 0x1011a93
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1011888
call esi
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0100e252
push eax
push 0x10071a0
push 9
call fcn.01017562
add esp, 0xc
and dword [ebp - 0xc], 0
push dword [ebp - 0xc]
xor eax, eax
test edi, edi
setne al
push eax
push 0x1007160
push 8
call fcn.01017562
add esp, 0x10
call fcn.01014d71
test al, al
je 0x1011808
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24c]
mov edi, 0x104
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10118eb
call esi
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0100e252
push eax
push 0x100712c
call fcn.01011f22
pop ecx
jmp 0x1011807
lea eax, [ebp - 0x24c]
push eax
push 0x100710c
push 8
call fcn.01017562
add esp, 0xc
call fcn.010126cc
test al, al
je 0x1011808
mov edx, dword [0x101c1fc]
push 0
mov ecx, 0x10070f0
call fcn.0101a360
test al, al
je 0x1011939
push 0x1007080
push 8
call fcn.01017562
pop ecx
pop ecx
mov byte [0x101c1dc], 1
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1011964
call esi
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0100e252
push eax
push 0x1007030
jmp 0x10118e0
lea ecx, [ebp - 0x24c]
call fcn.01016fef
push eax
push 0x100700c
push 8
mov dword [0x101c204], eax
call fcn.01017562
add esp, 0xc
call fcn.010174e5
test al, al
je 0x1011808
call fcn.010124ed
test al, al
je 0x1011808
mov esi, 0x10045f0
push esi
push ebx
call fcn.01017562
pop ecx
pop ecx
mov ecx, dword [0x1006800]
xor edi, edi
test ecx, ecx
je 0x10119e1
xor eax, eax
mov eax, dword [eax + 0x1006804]
push dword [eax]
push ecx
push 0x10045b0
push ebx
call fcn.01017562
add esp, 0x10
inc edi
mov eax, edi
shl eax, 3
mov ecx, dword [eax + 0x1006800]
test ecx, ecx
jne 0x10119ba
push esi
push ebx
call fcn.01017562
mov esi, 0x258
push esi
call fcn.0101a2c0
push esi
mov dword [0x101c29c], eax
call fcn.0101a2c0
add esp, 0x10
cmp dword [0x101c29c], 0
mov dword [0x101c2a4], eax
je 0x1011808
test eax, eax
je 0x1011808
cmp dword [0x101c1d4], 1
jne 0x1011a6c
cmp byte [0x101c1bf], 0
mov ecx, dword [0x101c204]
jne 0x1011a39
mov ecx, dword [0x101c1fc]
mov dword [0x101c208], ecx
call fcn.01016fef
push eax
push 0x1006fec
push ebx
mov dword [0x101c208], eax
call fcn.01017562
add esp, 0xc
cmp dword [0x101c1d4], 1
jne 0x1011a6c
lea eax, [ebp - 4]
push eax
call fcn.01010641
jmp 0x1011a75
lea eax, [ebp - 0x24]
push eax
call fcn.01017f9d
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x101180f
mov ecx, dword [ebp - 4]
shr ecx, 1
mov esi, 0x1001b68
test cl, 1
jne 0x1011a93
mov esi, 0x1006fc4
mov ecx, dword [ebp - 4]
shr ecx, 1
mov byte [ebp - 6], cl
and byte [ebp - 6], 1
mov dword [ebp - 0xc], ecx
mov edx, 0x1006fb4
jne 0x1011aae
mov edx, 0x1006fa0
cmp byte [ebp - 5], 0
mov ecx, 0x1001b68
jne 0x1011abe
mov ecx, 0x1006f80
cmp eax, 1
mov eax, 0x1006f7c
je 0x1011acd
mov eax, 0x1006f74
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push esi
push edx
push ecx
push eax
lea eax, [ebp - 0xcb0]
push 0x1006f48
push eax
call edi
mov eax, dword [0x101c2b4]
add esp, 0x18
test eax, eax
je 0x1011aff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x101c2b4], 0
cmp byte [0x101c1e3], 0
jne 0x1011c3e
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 4], esi
jne 0x1011b1f
cmp byte [ebp - 5], bl
je 0x1011b2e
push 0x40
pop ebx
jmp 0x1011b2e
movzx ebx, byte [ebp - 0xc]
not bl
and ebx, 1
shl ebx, 5
or ebx, 0x10
cmp dword [0x101c2b8], esi
je 0x1011c0c
cmp dword [0x101c1d4], 1
jne 0x1011bba
cmp byte [ebp - 6], 0
jne 0x1011bba
mov edx, dword [0x101c1b8]
push 0x1006788
lea ecx, [ebp - 0x24c]
call fcn.0101739e
push esi
lea eax, [ebp - 0x24c]
push eax
push dword [0x101c2b8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1011bba
lea eax, [ebp - 0x24c]
push eax
push 0x1002bcc
push 5
call fcn.0101220e
add esp, 0xc
call fcn.0100e69b
call fcn.0101753d
push dword [0x101c2b8]
call fcn.0101a300
pop ecx
lea ecx, [ebp - 0x24c]
call fcn.01016fef
mov dword [0x101c2b8], eax
mov byte [0x101c1e5], 1
cmp dword [ebp - 4], esi
je 0x1011c0c
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0xcb0]
push eax
call esi
push dword [0x101c2b8]
lea eax, [ebp + eax*2 - 0xcb0]
push 0x1006e18
push eax
call edi
add esp, 0xc
cmp byte [0x101c1e5], 0
jne 0x1011c0c
push 0x1006d80
lea eax, [ebp - 0xcb0]
push eax
call esi
lea eax, [ebp + eax*2 - 0xcb0]
push eax
call edi
pop ecx
pop ecx
or ebx, 4
test ebx, ebx
je 0x1011c54
lea eax, [ebp - 0xcb0]
push eax
push 0x10027b8
push 6
push 6
push ebx
push 0
call fcn.01011f41
add esp, 0x18
test bl, 4
je 0x1011c54
cmp eax, 6
jne 0x1011c54
mov byte [0x101c1e5], 1
jmp 0x1011c54
lea eax, [ebp - 0xcb0]
push eax
push 0x1006d38
push 8
call fcn.01017562
add esp, 0xc
cmp byte [0x101c1e0], 0
pop edi
pop esi
pop ebx
je 0x1011c81
push 0x1006b40
push 7
push 7
push 0x34
push 0
call fcn.01011f41
add esp, 0x14
cmp eax, 6
jne 0x1011c81
mov byte [0x101c1e4], 1
mov eax, dword [0x101c2b4]
test eax, eax
je 0x1011c98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x101c2b4], 0
mov edx, dword [0x101c2b8]
test edx, edx
je 0x1011cf9
cmp byte [0x101c1e5], 0
je 0x1011cf4
cmp dword [ebp - 4], 0
je 0x1011cf9
cmp byte [0x101c1e4], 0
jne 0x1011cf9
cmp byte [0x101c1dd], 0
jne 0x1011cf9
lea ecx, [ebp - 0x24c]
call fcn.0101702b
push 5
push 0x1001b68
push dword [0x101c2b8]
push 0x1006b30
push 0x1006b24
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1011cf9
call fcn.0101753d
movzx eax, byte [ebp - 0xc]
movzx ecx, byte [ebp - 4]
and eax, 1
add eax, eax
and ecx, 1
or eax, ecx
leave
ret