Function at 0x404286
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004046b2
test eax, eax
pop ecx
je 0x4046a9
mov esi, 0x94
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.00408210
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp - 0x94], 2
sete al
mov dword [0x40dacc], eax
call fcn.00403fbf
add esi, 0x70
cmp dword [0x40d9f8], ebx
pop ecx
jne 0x404480
push esi
push dword [0x40d9f0]
push dword [0x40dac8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x40d9f0]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x40431b
cmp byte [eax + 1], cl
je 0x40432d
cmp cl, bl
je 0x40432d
cmp byte [eax + 1], 0x3a
jne 0x40432d
mov byte [eax + 3], bl
mov eax, dword [0x40d9f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x404478
xor edi, edi
push dword [0x40d9ec]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x40d9ec]
call fcn.00405cca
pop ecx
push edi
push str._inst_d.exe
push dword [0x40d9ec]
call fcn.00407a30
add eax, dword [0x40d9ec]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x40d9ec]
call section..text
add esp, 0x14
cmp eax, 0xffffffff
je 0x404398
push eax
call fcn.0040121f
or dword [ebp + 8], 0xffffffff
pop ecx
jmp 0x4043ac
push dword [0x40d9ec]
call fcn.0040104d
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
jne 0x4043bf
inc edi
cmp edi, 0x3e7
jl 0x40433f
cmp dword [ebp + 8], 0xffffffff
je 0x404478
push ebx
push dword [0x40da9c]
call section..text
mov edi, eax
pop ecx
cmp edi, 0xffffffff
pop ecx
je 0x40446f
lea eax, [ebp + 0x10]
push eax
push dword [0x40d036]
call fcn.00405d1d
pop ecx
test eax, eax
pop ecx
je 0x404419
push dword [0x40d036]
push dword [ebp + 0x10]
push edi
call fcn.00401077
push dword [0x40d036]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004010cd
lea eax, [ebp + 0x10]
push eax
call fcn.00405d7d
add esp, 0x1c
push edi
call fcn.0040121f
push dword [ebp + 8]
call fcn.0040121f
push str.__S_
push dword [0x40d9ec]
call fcn.00407ac0
push dword [0x40da9c]
push dword [0x40d9ec]
call fcn.00407ac0
push str.___DEL
push dword [0x40d9ec]
call fcn.00407ac0
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x40d9ec]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4046a4
push dword [ebp + 8]
call fcn.0040121f
pop ecx
cmp dword [0x40d9f8], ebx
je 0x4044a1
push esi
push dword [0x40d9f0]
push dword [0x40dac8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x40d9f0]
push ebx
call fcn.004040d2
pop ecx
pop ecx
call fcn.004047dc
test eax, eax
je 0x4046a9
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [0x40daa8], eax
call esi
mov dword [0x40daa4], eax
call fcn.004048f8
test eax, eax
je 0x4044dc
call fcn.00404d2f
call fcn.00404844
test eax, eax
jne 0x4044e4
or eax, 0xffffffff
jmp 0x4046ab
xor eax, eax
test byte [0x40da98], 1
je 0x4044f2
push 1
pop eax
push eax
call fcn.00401246
pop ecx
mov edi, eax
push ebx
push 0x4036d1
push dword [0x40dac4]
push edi
push dword [0x40dac8]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x40dac0], eax
je 0x404636
test byte [0x40da98], 1
jne 0x40457a
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x40dac4]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x40dac0]
call esi
push 1
push dword [0x40dac4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x40dac4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov cx, word [0x40d042]
xor eax, eax
cmp cx, 0xffff
mov dword [0x40dab8], eax
je 0x4045b1
movzx eax, cx
mov dword [0x40dab8], eax
shl eax, 2
push ebx
push dword [eax + 0x40d0c0]
push dword [eax + 0x40d0a4]
call fcn.004012e7
add esp, 0xc
cmp word [0x40d042], 0xffff
jne 0x40462a
dec eax
je 0x4045ff
dec eax
je 0x4045f1
sub eax, 0x3ed
jne 0x404617
cmp dword [0x40dab8], ebx
jle 0x404617
dec dword [0x40dab8]
jmp 0x404617
cmp dword [0x40dab8], 6
jge 0x404623
push 6
pop eax
jmp 0x4045ac
cmp dword [0x40dab8], 6
jge 0x404610
inc dword [0x40dab8]
jmp 0x404617
or dword [0x40dab8], 0xffffffff
mov eax, dword [0x40dab8]
cmp eax, 0xffffffff
je 0x40462a
jmp 0x4045b1
or dword [0x40dab8], 0xffffffff
push dword [0x40dac0]
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call fcn.00401282
mov eax, dword [0x40da0c]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, ebx
pop ecx
je 0x404678
push eax
call fcn.00402585
push dword [0x40d9f0]
lea eax, [ebp - 0x2ac]
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push 1
push eax
call esi
call fcn.004048b8
cmp dword [0x40d054], ebx
je 0x40469f
mov eax, dword [0x40da10]
cmp eax, ebx
je 0x40469f
push eax
call fcn.00402585
pop ecx
push 1
push dword [0x40d9f0]
call esi
call fcn.00403c8f
call fcn.0040477e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10