Function at 0x404bc0
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x474c69
mov eax, dword fs:[0]
push eax
mov eax, 0x266c
call fcn.004489c0
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x2664], eax
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x267c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x268c]
lea ecx, [esp + 0xb0]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0
call fcn.00403a50
lea ecx, [esp + 0x30]
mov dword [esp + 0x2684], 0
call fcn.00468b50
push 0x4825ec
push 0x482c68
lea ecx, [esp + 0x38]
mov byte [esp + 0x268c], 1
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
lea ecx, [esp + 0x30]
call fcn.00468640
mov edx, dword [0x4ad934]
push 0x68
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x404c7a
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esp + 0x30]
call fcn.00468b20
mov ecx, ebx
lea edx, [esp + 0xb0]
call fcn.0041bd70
test al, al
jne 0x404cdb
push 0x482c68
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x48260c
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x30]
call fcn.00468790
lea ecx, [esp + 0xb0]
mov dword [esp + 0x2684], 0xffffffff
call fcn.00411810
xor al, al
jmp 0x4053c7
lea eax, [esp + 0xb0]
push eax
push ebx
call fcn.00404620
add esp, 8
test al, al
je 0x404c95
push 0x4a93bc
lea ecx, [esp + 0xa4]
push ecx
push str.UserManager
call fcn.00402f60
add esp, 4
mov ecx, eax
call fcn.0043f540
push 0
push 0
push 0
push 0
push 0x482620
push eax
lea ecx, [esp + 0x88]
mov byte [esp + 0x269c], 2
call fcn.0046e160
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2684], 4
call fcn.0046cf20
lea ecx, [esp + 0x70]
call fcn.0046d1f0
test al, al
jne 0x404da4
push 0
push ebx
lea ecx, [esp + 0x78]
call fcn.0046e450
test al, al
jne 0x404da4
push 0x482628
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482634
lea ecx, [esp + 0x74]
mov esi, eax
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x70]
call fcn.0046cf20
jmp 0x404cb4
lea ecx, [esp + 0xd4]
mov byte [esp + 0x12], 1
call fcn.00468b50
lea eax, [esp + 0xb0]
mov byte [esp + 0x2684], 5
call fcn.0041ba00
call fcn.00404b10
mov byte [esp + 0x13], al
mov eax, dword [esp + 0xb0]
test eax, eax
mov ecx, eax
je 0x405251
jmp 0x404de9
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov eax, ecx
lea ebp, [eax + 8]
mov ecx, ebp
mov dword [esp + 0x2c], edx
mov esi, 0x485ff8
call fcn.00468670
mov cx, word [eax]
cmp cx, word [esi]
jne 0x404e26
test cx, cx
je 0x404e22
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x404e26
add eax, 4
add esi, 4
test cx, cx
jne 0x404e00
xor eax, eax
jmp 0x404e2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404e7d
mov ecx, ebp
mov esi, str.14108
call fcn.00468670
jmp 0x404e40
mov cx, word [eax]
cmp cx, word [esi]
jne 0x404e66
test cx, cx
je 0x404e62
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x404e66
add eax, 4
add esi, 4
test cx, cx
jne 0x404e40
xor eax, eax
jmp 0x404e6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405246
cmp byte [esp + 0x13], al
je 0x405246
mov esi, dword [0x4ac79c]
cmp esi, dword [0x4ad934]
je 0x404e95
mov edi, 0x4ad930
call fcn.0040bd10
mov eax, dword [ebp + 0x28]
cmp eax, dword [ebp + 0x20]
jle 0x405246
lea ecx, [esp + 0x90]
call fcn.00468b50
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [esp + 0x64]
call fcn.00469110
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x20]
push edx
push str.ev
push eax
push str._av
lea ecx, [esp + 0x70]
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
lea edi, [ebp + 0x10]
mov ecx, edi
call fcn.0046cee0
push eax
lea ecx, [esp + 0x54]
call fcn.004690c0
push 0x482654
lea ecx, [esp + 0x54]
mov byte [esp + 0x2688], 8
call fcn.00468d90
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x64]
call fcn.00468670
push eax
lea ecx, [esp + 0x30]
call fcn.0046d470
lea ecx, [esp + 0x60]
mov byte [esp + 0x2684], 9
call fcn.00468640
mov edx, dword [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.0041d9a0
add esp, 8
test al, al
jne 0x404f92
push 0x482658
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482664
mov ecx, ebp
mov esi, eax
call fcn.00468670
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov byte [esp + 0x12], 0
jmp 0x405217
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x130]
push edx
mov esi, ebx
mov byte [esp + 0x1678], 0
call fcn.00425c20
test al, al
jne 0x404ff4
push 0x482674
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.0046de60
test al, al
jne 0x404fea
push 0x482690
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
mov byte [esp + 0x12], 0
jmp 0x405217
push 0
push edi
push ebx
lea ecx, [esp + 0x24]
call fcn.0046e900
test al, al
jne 0x40504b
push 0x4826ac
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x4826b4
mov ecx, edi
mov esi, eax
call fcn.0046cf00
push eax
push 0x4826b0
lea ecx, [esp + 0x24]
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov ecx, eax
jmp 0x404f7c
push 0
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.0046de60
test al, al
jne 0x40508f
push 0x4826c4
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482634
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov eax, dword [ebp + 0x28]
add dword [esp + 0x14], 1
mov ecx, ebp
mov dword [ebp + 0x24], eax
mov esi, 0x485ff8
call fcn.00468670
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4050cc
test cx, cx
je 0x4050c8
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4050cc
add eax, 4
add esi, 4
test cx, cx
jne 0x4050a6
xor eax, eax
jmp 0x4050d1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405217
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x248]
push 0x7fe
push eax
mov word [esp + 0x167c], ax
lea eax, [esp + 0x167e]
push eax
mov byte [ebp + 8], 1
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
call fcn.00449450
add esp, 0xc
lea ecx, [esp + 0xe6c]
push ecx
lea edx, [esp + 0x1678]
push 0x400
push edx
call fcn.00446cf3
add esp, 0xc
cmp word [esp + 0x1674], 0
lea edi, [esp + 0x1674]
mov esi, edi
je 0x405217
jmp 0x405150
movzx eax, word [esi]
cmp ax, 0x20
je 0x405169
cmp ax, 0xd
je 0x405169
cmp ax, 0xa
jne 0x40520a
push edi
lea ecx, [esp + 0x84]
mov word [esi], 0
call fcn.004690c0
push 0x4826d0
lea ecx, [esp + 0x84]
call fcn.00468910
push 0x4826d4
lea ecx, [esp + 0x84]
call fcn.00468910
push 0x4826d8
lea ecx, [esp + 0x84]
call fcn.00468910
lea ecx, [esp + 0x80]
call fcn.00468750
test eax, eax
jbe 0x4051fb
lea ecx, [esp + 0x80]
call fcn.00468640
push eax
lea ecx, [esp + 0xa4]
call fcn.004690c0
lea eax, [esp + 0xa0]
push eax
lea eax, [ebp + 0x14]
mov byte [esp + 0x2688], 0xb
call fcn.0041c4b0
lea ecx, [esp + 0xa0]
call fcn.00468790
lea ecx, [esp + 0x80]
lea edi, [esi + 2]
call fcn.00468790
add esi, 2
cmp word [esi], 0
jne 0x405150
lea ecx, [esp + 0x18]
call fcn.0046cf20
lea ecx, [esp + 0x50]
call fcn.00468790
lea ecx, [esp + 0x60]
call fcn.00468790
lea ecx, [esp + 0x90]
mov byte [esp + 0x2684], 5
call fcn.00468790
cmp dword [esp + 0x2c], 0
jne 0x404de5
mov esi, dword [0x4ac79c]
cmp esi, dword [0x4ad80c]
je 0x405269
mov edi, 0x4ad808
call fcn.0040bd10
cmp dword [esp + 0x14], 0
je 0x405390
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ac784
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4ac784
call edi
xor ebp, ebp
push 0x7fe
lea ecx, [esp + 0x1e7a]
push ebp
push ecx
mov word [esp + 0x1e80], bp
call fcn.00449450
add esp, 0xc
push str.UserManager
call fcn.00402f60
add esp, 4
add eax, 0x5d8
push eax
push 0x4826dc
lea edx, [esp + 0x1e7c]
push 0x104
push edx
call fcn.00446193
push 0x40
lea eax, [esp + 0xfc]
push ebp
push eax
call fcn.00449450
xor eax, eax
add esp, 0x1c
push 0x4ac76c
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0xe8], 0x44
call esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0xe8]
push edx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x1e94]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x40]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
push 0x4ac76c
call edi
cmp byte [esp + 0x12], 0
jne 0x405390
push 0x48270c
mov ecx, ebx
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0xd4]
call fcn.00468790
lea ecx, [esp + 0x70]
call fcn.0046cf20
jmp 0x404cb4
lea ecx, [esp + 0xd4]
call fcn.00468790
lea ecx, [esp + 0x70]
call fcn.0046cf20
lea ecx, [esp + 0x30]
call fcn.00468790
lea ecx, [esp + 0xb0]
mov dword [esp + 0x2684], 0xffffffff
call fcn.00411810
mov al, 1
mov ecx, dword [esp + 0x267c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2664]
xor ecx, esp
call fcn.00445c6a
add esp, 0x2678
ret