Function at 0x4716e1
Capabilities:
Check os version
Delete file
Move file
Persist via lnk shortcut
Write file on windows

Disassembly:
push 0x190
mov eax, 0x68d317
call fcn.0056e23b
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x180]
mov esi, dword [ebp + 0xc]
push 0x11c
push 0
push eax
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x194], esi
call fcn.00644240
add esp, 0xc
mov dword [ebp - 0x180], 0x11c
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x17c], 0xa
jb 0x471926
mov ecx, 0x7967e0
xor esi, esi
call fcn.005688e3
test eax, eax
je 0x471a8f
push str.ShowToasts
mov ecx, 0x7967e0
call fcn.0056881c
mov dword [ebp - 0x198], eax
test eax, eax
je 0x471a8f
lea ecx, [ebp - 0x2c]
call fcn.004173bc
and dword [ebp - 4], esi
lea ecx, [ebp - 0x64]
call fcn.004173bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x64]
push eax
push 0x6c2cc4
call fcn.004555ca
push eax
lea eax, [ebp - 0x48]
push str._sMicrosoftWindowsStart_MenuProgramsPrivacy_EraserPrivacy_Eraser.lnk
push eax
call fcn.0041ccda
add esp, 0x14
lea eax, [ebp - 0x2c]
push 1
push eax
lea eax, [ebp - 0x64]
push eax
push 0x6c2cdc
call fcn.004555ca
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.0047095b
push 8
pop esi
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005657e0
pop ecx
test eax, eax
jne 0x47185e
lea eax, [ebp - 0x188]
push eax
push str.ToastsIcon.png
push 0x796118
call fcn.00568f5e
add esp, 0xc
mov dword [ebp - 0x184], eax
test eax, eax
je 0x47185e
push 3
pop ebx
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push ebx
push 0xc0000000
push eax
call fcn.005654e9
add esp, 0x1c
mov dword [ebp - 0x18c], eax
cmp eax, 0xffffffff
jne 0x4718c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x47180e
mov ebx, dword [ebp - 0x184]
push 1
push ebx
call fcn.0056df27
mov ebx, dword [ebp - 0x190]
pop ecx
pop ecx
cmp dword [ebp - 0x14], esi
lea esi, [ebp - 0x44]
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x3ec], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp - 0x30], 8
push eax
cmovae esi, dword [ebp - 0x44]
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0042810e
pop ecx
pop ecx
push eax
push esi
push ebx
push dword [ebp - 0x194]
push dword [edi + 0x3cc]
call dword [ebp - 0x198]
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
jmp 0x471a8a
mov ebx, dword [ebp - 0x184]
lea ecx, [ebp - 0x19c]
push 0
push ecx
push dword [ebp - 0x188]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4718f6
push 0x6c2da0
lea ecx, [ebp - 0x2c]
call fcn.004179fb
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x47184e
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
push 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x47184e
push ebx
lea ecx, [ebp - 0x48]
call fcn.0041d41a
push 3
pop ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
push esi
call fcn.0041d41a
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
cmp eax, 0x3f
jbe 0x47195f
push 0
push 0x6c2da4
add eax, 0xffffffc1
lea ecx, [ebp - 0x28]
push eax
push 0x3f
call fcn.00450e23
mov eax, dword [ebp - 0x34]
mov ecx, 0xff
cmp eax, ecx
jbe 0x471981
push 0
push 0x6c2da8
add eax, 0xffffff01
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00450e23
push 0x200
lea esi, [edi + 0x128]
push 0
push esi
call fcn.00644240
push 0x80
lea eax, [edi + 0x32c]
push 0
push eax
call fcn.00644240
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x44]
inc eax
push eax
push ecx
push 0x100
push esi
call fcn.00651feb
mov eax, dword [ebp - 0x18]
add esp, 0x28
test eax, eax
je 0x4719ec
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
inc eax
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
lea eax, [edi + 0x32c]
push 0x40
push eax
call fcn.00651feb
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x9d
push dword [edi + 0x3c4]
mov dword [edi + 0x14], 0x92
mov dword [edi + 0x3ac], 0x24
mov dword [edi + 0x328], 0x7530
call esi
push 0x9d
push dword [edi + 0x3c4]
mov dword [edi + 0x3c0], eax
call esi
mov dword [edi + 0x1c], eax
call fcn.00564e5d
lea ecx, [edi + 8]
test eax, eax
je 0x471a4a
mov dword [edi + 0x328], ebx
mov dword [ecx], 0x3a8
jmp 0x471a5a
mov dword [edi + 0x328], 4
mov dword [ecx], 0x3b8
mov eax, dword [ebp + 0x10]
push ecx
push 1
mov ecx, edi
mov dword [edi + 0x3ec], eax
call fcn.004716a2
mov esi, eax
xor eax, eax
mov word [edi + 0x128], ax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov eax, esi
call fcn.0056e1e5
ret 0xc