Function at 0x412010
Capabilities:
Acquire debug privileges
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1180
call fcn.0040ace0
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 0x1c], eax
call fcn.00410760
call fcn.0040d660
mov dword [0x445af0], eax
cmp dword [0x445af0], 0
je 0x4120a4
call fcn.0040d4b0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1024], eax
push str.Wow64DisableWow64FsRedirection
push 0x417e3c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x445b88], eax
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x445b8c], eax
push str.RegDeleteKeyExW
mov eax, dword [ebp - 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x445b90], eax
call fcn.0040e210
push 0x2001d
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [0x445b74], eax
mov dword [ebp - 0x14], 1
call fcn.00411be0
push 0x441958
push 0x443a20
call fcn.00401198
add esp, 8
push 0x417eb4
push 0x443a20
call fcn.00411da0
add esp, 8
push 0xa
lea ecx, [ebp - 0x1020]
push ecx
mov edx, dword [0x43128c]
push edx
call fcn.004031bc
add esp, 0xc
lea eax, [ebp - 0x1020]
push eax
push 0x443a20
call fcn.0040116a
add esp, 8
push 0xa
lea ecx, [ebp - 0x1020]
push ecx
mov edx, dword [0x431290]
push edx
call fcn.004031bc
add esp, 0xc
lea eax, [ebp - 0x1020]
push eax
push 0x443a20
call fcn.0040116a
add esp, 8
push 0x420818
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41f818
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 3
lea ecx, [ebp - 8]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x412297
lea edx, [ebp - 0x10]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4121e5
mov dword [ebp - 0x1034], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1030], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x102c], ecx
mov dword [ebp - 0x1028], 2
push 0
push 0
push 0
lea edx, [ebp - 0x1034]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea ecx, [ebp - 0x10]
push ecx
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x412239
mov dword [ebp - 0x1044], 1
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1040], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x103c], eax
mov dword [ebp - 0x1038], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x1044]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x10]
push eax
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41228d
mov dword [ebp - 0x1054], 1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1050], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x104c], edx
mov dword [ebp - 0x1048], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1054]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040d490
push 0x1000
push 0x428818
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x428818
call fcn.004030f8
add esp, 4
push 0x428818
push 0x423818
call fcn.00401198
add esp, 8
push str.SYSWOW64
push 0x423818
call fcn.00411da0
add esp, 8
push 0x1000
push 0x424818
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x424818
call fcn.004030f8
add esp, 4
push 0x424818
push 0x422818
call fcn.00401198
add esp, 8
push str.DRIVERS
push 0x422818
call fcn.00411da0
add esp, 8
push 4
push 0x422818
push 0x41f810
call fcn.004012c0
add esp, 0xc
xor eax, eax
mov word [0x41f814], ax
push 0x445ba8
push str.SOFTWARE
push 0x80000002
call fcn.0040d430
add esp, 0xc
push 0x445ba4
push str.SYSTEM
push 0x80000002
call fcn.0040d430
add esp, 0xc
push 0x445bb4
push str.SYSTEMCurrentControlSet
push 0x80000002
call fcn.0040d430
add esp, 0xc
cmp dword [0x445ba8], 0
je 0x4123a6
cmp dword [0x445ba4], 0
je 0x4123a6
cmp dword [0x445bb4], 0
je 0x4123a6
mov dword [ebp - 0x1180], 1
jmp 0x4123b0
mov dword [ebp - 0x1180], 0
mov ecx, dword [ebp - 0x1180]
mov dword [ebp - 0x14], ecx
cmp dword [0x445af0], 0
je 0x4123d4
push str..x64
push 0x443a20
call fcn.0040116a
add esp, 8
call fcn.0040d470
call fcn.00411880
push str.PATH
call fcn.00403790
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412400
mov edx, dword [ebp - 4]
push edx
call fcn.004117a0
add esp, 4
cmp dword [0x445af0], 0
je 0x41243f
call fcn.0040d490
push 0x445bb0
push str.ClassesWow6432Node
mov eax, dword [0x445ba8]
push eax
call fcn.0040d430
add esp, 0xc
push 0x445bac
push str.Wow6432Node
mov ecx, dword [0x445ba8]
push ecx
call fcn.0040d430
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x412612
call fcn.0040d470
call fcn.0040d470
mov dword [ebp - 0x1178], 0x11c
lea edx, [ebp - 0x1178]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1174], 5
jne 0x41248f
cmp dword [ebp - 0x1170], 2
jne 0x41248f
cmp dword [0x445af0], 0
je 0x41248f
mov dword [0x445b80], 1
push 0x424818
push 0x421818
call fcn.00401198
add esp, 8
push str.DLLCACHE
push 0x421818
call fcn.00411da0
add esp, 8
mov dword [ebp - 0x117c], 1
jmp 0x4124ce
mov eax, dword [ebp - 0x117c]
add eax, 1
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 3
jg 0x4124e8
mov ecx, dword [ebp - 0x117c]
push ecx
call fcn.00411e10
add esp, 4
jmp 0x4124bf
push 0x424818
call fcn.00402ca5
add esp, 4
mov dword [0x447bc8], eax
push 0x428818
push 0x427818
call fcn.00401198
add esp, 8
push 0x418014
push 0x427818
call fcn.0040116a
add esp, 8
push 0x424818
push 0x446bc0
call fcn.00401198
add esp, 8
push str.TASKS
push 0x446bc0
call fcn.0040116a
add esp, 8
lea edx, [ebp - 4]
push edx
push str.TasksFolder
push str.MicrosoftSchedulingAgent
mov eax, dword [0x445ba8]
push eax
call fcn.0040ff90
add esp, 0x10
test eax, eax
je 0x4125a1
mov ecx, dword [ebp - 4]
push ecx
call fcn.004030f8
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.0040d330
add esp, 4
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
test ecx, ecx
je 0x412595
mov edx, dword [ebp - 4]
push edx
push 0x427818
call fcn.00401198
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.00402dfe
add esp, 4
call fcn.00410f40
push 0x428818
push 0x425818
call fcn.00401198
add esp, 8
push str.WINSXS
push 0x425818
call fcn.0040116a
add esp, 8
push 0x425818
call fcn.00402ca5
add esp, 4
mov dword [0x447bc0], eax
push 0x428818
push 0x426818
call fcn.00401198
add esp, 8
push str.ASSEMBLY
push 0x426818
call fcn.0040116a
add esp, 8
push 0x426818
call fcn.00402ca5
add esp, 4
mov dword [0x447bc4], eax
cmp dword [0x445af0], 0
jne 0x412624
xor ecx, ecx
mov word [0x423818], cx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004010d5
mov esp, ebp
pop ebp
ret