Function at 0x43b5a0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x4af6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push pe_nt_image_headers32
mov dword [ebp - 0x128], eax
xor edi, edi
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x134], esi
push edi
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.0046f6e0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x40
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x190], edi
xorps xmm0, xmm0
push edi
push eax
movdqu xmmword [ebp - 0x14c], xmm0
call fcn.0046f6e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
cmp dword [ebp - 0x11c], 6
mov eax, 1
mov dword [ebp - 0x164], 1
mov word [ebp - 0x160], ax
jb 0x43b874
push edi
push str.Progman
mov dword [ebp - 0x124], 0x3000
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x130], 0x3000
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x43b67a
lea ecx, [ebp - 0x12c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x12c]
call fcn.0043cdf0
add esp, 8
test eax, eax
js 0x43b8bf
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0043cdf0
mov esi, eax
add esp, 8
test esi, esi
js 0x43b8bf
mov eax, dword [ebp - 0x124]
cmp eax, 0x3000
jne 0x43b857
cmp dword [ebp - 0x130], 0x2000
jne 0x43b86a
push dword [ebp - 0x12c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x124], eax
test eax, eax
je 0x43b86a
lea ecx, [ebp - 0x13c]
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43b838
lea eax, [ebp - 0x138]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x43b747
call ebx
mov esi, eax
test esi, esi
jle 0x43b749
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43b80d
push str.AdvApi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x43b7d1
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b7d1
lea ecx, [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x190]
push ecx
push 0
push 0
push 0
push dword [ebp - 0x128]
push dword [ebp - 0x134]
push 0
push dword [ebp - 0x138]
call eax
mov edi, eax
test edi, edi
jne 0x43b7b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b7b5
movzx esi, si
or esi, 0x80070000
push esi
push dword [ebp - 0x128]
push dword [ebp - 0x134]
push str.CreateProcessWithExplorerIL__s___s____d
call fcn.00469290
add esp, 0x10
jmp 0x43b7d6
mov esi, 0x8000ffff
test ebx, ebx
je 0x43b7e1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b86a
call ebx
mov esi, eax
test esi, esi
jle 0x43b81e
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b86a
call ebx
mov esi, eax
test esi, esi
jle 0x43b849
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b86a
cmp eax, 0x2000
jne 0x43b86a
cmp dword [ebp - 0x130], 0x3000
je 0x43b8bf
test esi, esi
js 0x43b8bf
mov esi, dword [ebp - 0x134]
cmp dword [ebp - 0x144], 0
jne 0x43b8bf
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x128]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
jne 0x43b8ac
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ebfa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ebfa
mov esp, ebp
pop ebp
ret