Function at 0x408170
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd6b
mov eax, dword fs:[0]
push eax
sub esp, 0xe34
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x3e8
lea eax, [ebp - 0xde8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x4081cd
push 0x104
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0xde8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push 0x110
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [ebp - 0x124], 0x114
call fcn.0043c0c0
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x124]
push ecx
call esi
cmp dword [ebp - 0x120], 6
jae 0x40821f
call fcn.00408010
test al, al
jne 0x40821f
push 0x30
push 0
push 0x459028
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x38
lea edx, [ebp - 0xe3c]
push 0
push edx
mov dword [ebp - 0xe40], 0x3c
call fcn.0043c0c0
push 0x110
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [ebp - 0x124], 0x114
call fcn.0043c0c0
add esp, 0x18
lea ecx, [ebp - 0x124]
push ecx
call esi
cmp dword [ebp - 0x120], 6
jae 0x40827e
call fcn.00408010
mov dword [ebp - 0xe34], str.open
test al, al
jne 0x408288
mov dword [ebp - 0xe34], str.runas
lea edx, [ebp - 0x618]
xor eax, eax
mov dword [ebp - 0xe30], edx
mov dword [ebp - 0xe38], 0
mov dword [ebp - 0xe24], 1
mov dword [ebp - 0xdf0], 7
mov dword [ebp - 0xdf4], 0
mov word [ebp - 0xe04], ax
mov dword [ebp - 4], eax
push 0xa
mov eax, str._asService
lea ecx, [ebp - 0xe04]
call fcn.00402190
push 1
mov eax, 0x459088
lea ecx, [ebp - 0xe04]
call fcn.00402190
push 8
mov eax, str._logPath
lea ecx, [ebp - 0xe04]
call fcn.00402190
push 2
mov eax, 0x45908c
lea ecx, [ebp - 0xe04]
call fcn.00402190
lea eax, [edi + 4]
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x408320
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x408320
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [ebp - 0xe04]
call fcn.00402190
push 1
mov eax, 0x459094
lea ecx, [ebp - 0xe04]
call fcn.00402190
mov esi, 8
cmp dword [ebp - 0xdf0], esi
jb 0x408368
mov ecx, dword [ebp - 0xe04]
mov dword [ebp - 0xe2c], ecx
jmp 0x408374
lea edx, [ebp - 0xe04]
mov dword [ebp - 0xe2c], edx
push 0x459098
push str.INFO
mov ecx, edi
mov dword [ebp - 0xe3c], 0x40
call fcn.0040c980
mov eax, dword [ebp - 0xe2c]
push eax
push str.INFO
mov ecx, edi
call fcn.0040c980
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x408442
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x4c7
jne 0x4083e7
push eax
push str.User_did_not_allow_elevation__error_code_d
lea edx, [ebp - 0x410]
push 0x100
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
jmp 0x40841a
push eax
push str.Error:__d
lea ecx, [ebp - 0x210]
push 0x100
push ecx
call fcn.00437e0f
add esp, 0x10
push 0
push 0
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x210]
push eax
push str.WARNING
mov ecx, edi
call fcn.0040c980
cmp dword [ebp - 0xdf0], esi
jb 0x40843e
mov ecx, dword [ebp - 0xe04]
push ecx
call fcn.00437245
add esp, 4
xor al, al
jmp 0x40845b
cmp dword [ebp - 0xdf0], esi
jb 0x408459
mov edx, dword [ebp - 0xe04]
push edx
call fcn.00437245
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret