Function at 0x46f13e
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x610ca8
call fcn.0060bcd8
sub esp, 0x180
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x46f15f
xor eax, eax
jmp 0x46f34f
push ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x20]
call fcn.004065d8
push edi
push esi
lea eax, [ebp - 0x20]
xor ebx, ebx
push str.__s___s
push eax
mov dword [ebp - 4], ebx
call fcn.00406cc8
push 0x110
lea eax, [ebp - 0x188]
push ebx
push eax
call fcn.005e1720
add esp, 0x1c
mov dword [ebp - 0x18c], 0x114
lea eax, [ebp - 0x18c]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x46f1c2
cmp dword [ebp - 0x188], 6
cmove esi, ecx
test esi, esi
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp - 0x20]
jne 0x46f1d9
lea ecx, [ebp - 0x10]
call fcn.00418b11
mov edi, dword [ebp - 0x10]
jmp 0x46f21b
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.00418a7b
test eax, eax
je 0x46f1f8
lea ecx, [ebp - 0x14]
call fcn.0041898c
test eax, eax
jne 0x46f336
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x13
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, dword [ebp - 0x1c]
test eax, eax
mov eax, ebx
cmove edi, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
test eax, eax
jne 0x46f339
push 0x40
lea eax, [ebp - 0x74]
mov dword [ebp - 0x78], 0x44
push ebx
push eax
call fcn.005e1720
add esp, 0xc
mov dword [ebp - 0x4c], 1
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
cmp dword [ebp + 8], ebx
je 0x46f251
push 5
pop eax
jmp 0x46f253
xor eax, eax
mov ecx, edi
mov word [ebp - 0x48], ax
call fcn.00418b84
test al, al
jne 0x46f27b
cmp dword [ebp - 0x10], ebx
je 0x46f273
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
call fcn.00418cff
push str.userenv.dll
mov dword [ebp - 0x70], str.Winsta0Default
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x46f2e1
push str.CreateEnvironmentBlock
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x46f2de
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ecx
call eax
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x46f2d9
mov eax, 0x430
jmp 0x46f2e4
mov dword [ebp - 0x18], ebx
jmp 0x46f2e1
mov edi, dword [ebp - 0x14]
push 0x30
pop eax
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push ebx
push dword [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x34], 0
mov ebx, eax
je 0x46f310
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0
je 0x46f31f
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46f32b
push dword [ebp - 0x18]
call eax
test edi, edi
je 0x46f336
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x46f344
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret