Function at 0x412db0
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete file
Parse pe header
Read file on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4a0e0b
push eax
mov eax, 0x1184
mov dword fs:[0], esp
call fcn.004999f0
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, 0xf
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x11a4]
mov eax, dword [esp + 0x11a8]
xor ebp, ebp
push edi
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x30], str.open
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x40], 5
mov dword [esp + 0x38], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413060
mov ecx, dword [esp + 0x30]
push ebp
push ebp
push 3
push ebp
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x413060
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0x64]
push 0x40
push eax
push esi
call ebx
test eax, eax
je 0x412ee0
cmp dword [esp + 0x10], 0x40
jne 0x412ee0
cmp word [esp + 0x5c], 0x5a4d
jne 0x412ee0
mov ecx, dword [esp + 0x98]
push ebp
push ebp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x98]
jne 0x412ee0
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0xa4]
push 0xf8
push eax
push esi
call ebx
test eax, eax
je 0x412ee0
cmp dword [esp + 0x10], 0xf8
jne 0x412ee0
cmp dword [esp + 0x9c], 0x4550
jne 0x412ee0
cmp word [esp + 0xa2], bp
je 0x412ee0
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x413060
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
xor esi, esi
push edx
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call fcn.00415050
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, esi
jne 0x413060
mov ecx, dword [esp + 0x18]
call fcn.00412270
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x4c6f80
call fcn.00403f40
mov ebx, dword [esp + 0x30]
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x194]
rep stosd dword es:[edi], eax
push 0x800
lea ecx, [esp + 0x198]
push 0x4b8a78
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncat]
push 0x800
lea edx, [esp + 0x1a4]
push 0x4b833c
push edx
call esi
push 0x800
lea eax, [esp + 0x1b0]
push 0x4b8a4c
push eax
call esi
push 0x800
lea ecx, [esp + 0x1bc]
push 0x4b833c
push ecx
call esi
push 0x800
lea edx, [esp + 0x1c8]
push str.vL
push edx
call esi
push 0x800
lea eax, [esp + 0x1d4]
push ebx
push eax
call esi
add esp, 0x48
lea ecx, [esp + 0x194]
push 0x800
push 0x4b8a0c
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x194]
push 0x14
push 0x4b833c
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x413058
push 0xc8
push 0x4b89c8
push 0x4b84d4
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x413040
call fcn.004150c0
test eax, eax
je 0x413040
push 5
push 0
push 0
push 0x4b866c
jmp 0x41304b
push 5
push 0
push 0
push 0x4b84d4
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
mov edi, eax
jne 0x413163
mov ecx, dword [esp + 0x18]
call fcn.00413430
mov ecx, dword [eax + 0x34]
mov edx, dword [ecx - 0xc]
test edx, edx
jl 0x4130a0
mov dword [esp + 0x10], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4130c7
mov ecx, dword [0x4b7080]
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x34]
test esi, esi
jne 0x4130b5
xor eax, eax
jmp 0x4130bc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00406cb0
lea ecx, [esp + 0x10]
mov dword [esp + 0x119c], 0
call fcn.00406ea0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_CharUpperW]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
jl 0x413138
push str.SAFE
push ecx
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov ecx, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x413138
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x413138
push edi
mov ecx, 0x4c6f80
call fcn.00403920
push 0
mov ecx, 0x4c6f80
call fcn.00403930
push 0x42
mov ecx, 0x4c6f80
call fcn.00403450
mov ecx, dword [esp + 0x10]
mov edx, dword [0x4b7084]
lea eax, [ecx - 0xc]
cmp eax, edx
je 0x413163
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x413163
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff4
push ecx
call fcn.00437568
add esp, 4
mov ecx, dword [esp + 0x58]
mov eax, ebx
neg eax
sbb eax, eax
pop edi
and eax, ecx
mov ecx, dword [esp + 0x1190]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1190
ret 8