Function at 0x404584
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004049e4
test eax, eax
pop ecx
je 0x4049db
mov esi, 0x94
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.004086f0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp - 0x94], 2
sete al
mov dword [0x40fb1c], eax
call fcn.004042bd
cmp dword [0x40fa48], ebx
pop ecx
jne 0x40477f
push 0x104
push dword [0x40fa40]
push dword [0x40fb18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x40fa40]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x40461a
cmp byte [eax + 1], cl
je 0x40462c
cmp cl, bl
je 0x40462c
cmp byte [eax + 1], 0x3a
jne 0x40462c
mov byte [eax + 3], bl
mov eax, dword [0x40fa40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x404777
mov dword [ebp + 8], ebx
push dword [0x40fa3c]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x40fa3c]
call fcn.0040605d
pop ecx
push dword [ebp + 8]
push str._inst_d.exe
push dword [0x40fa3c]
call fcn.00407e40
add eax, dword [0x40fa3c]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x40fa3c]
call section..text
or esi, 0xffffffff
add esp, 0x14
cmp eax, esi
je 0x40469e
push eax
call fcn.0040121f
pop ecx
mov edi, esi
jmp 0x4046b0
push dword [0x40fa3c]
call fcn.0040104d
mov edi, eax
pop ecx
cmp edi, esi
jne 0x4046c4
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x3e7
jl 0x40463f
cmp edi, esi
je 0x404777
push ebx
push dword [0x40faec]
call section..text
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
je 0x404770
lea eax, [ebp + 8]
push eax
push dword [0x40f036]
call fcn.004060b0
pop ecx
test eax, eax
pop ecx
je 0x40471c
push dword [0x40f036]
push dword [ebp + 8]
push esi
call fcn.00401077
push dword [0x40f036]
push dword [ebp + 8]
push edi
call fcn.004010cd
lea eax, [ebp + 8]
push eax
call fcn.00406110
add esp, 0x1c
push esi
call fcn.0040121f
push edi
call fcn.0040121f
push str.__S_
push dword [0x40fa3c]
call fcn.00407ed0
push dword [0x40faec]
push dword [0x40fa3c]
call fcn.00407ed0
push str.___DEL
push dword [0x40fa3c]
call fcn.00407ed0
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x40fa3c]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4049d6
push edi
call fcn.0040121f
pop ecx
cmp dword [0x40fa48], ebx
je 0x4047a4
push 0x104
push dword [0x40fa40]
push dword [0x40fb18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x40fa40]
push ebx
call fcn.004043d0
pop ecx
pop ecx
call fcn.00404b0e
test eax, eax
je 0x4049db
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [0x40faf8], eax
call esi
mov dword [0x40faf4], eax
call fcn.00404c2a
test eax, eax
je 0x4047df
call fcn.00405061
call fcn.00404b76
test eax, eax
jne 0x4047e7
or eax, 0xffffffff
jmp 0x4049dd
xor eax, eax
test byte [0x40fae8], 1
je 0x4047f5
push 1
pop eax
push eax
call fcn.00401246
pop ecx
mov edi, eax
push ebx
push 0x40399a
push dword [0x40fb14]
push edi
push dword [0x40fb18]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x40fb10], eax
je 0x404939
test byte [0x40fae8], 1
jne 0x40487d
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x40fb14]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x40fb10]
call esi
push 1
push dword [0x40fb14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x40fb14]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov cx, word [0x40f042]
xor eax, eax
cmp cx, 0xffff
mov dword [0x40fb08], eax
je 0x4048b4
movzx eax, cx
mov dword [0x40fb08], eax
shl eax, 2
push ebx
push dword [eax + 0x40f0c0]
push dword [eax + 0x40f0a4]
call fcn.004012e7
add esp, 0xc
cmp word [0x40f042], 0xffff
jne 0x40492d
dec eax
je 0x404902
dec eax
je 0x4048f4
sub eax, 0x3ed
jne 0x40491a
cmp dword [0x40fb08], ebx
jle 0x40491a
dec dword [0x40fb08]
jmp 0x40491a
cmp dword [0x40fb08], 6
jge 0x404926
push 6
pop eax
jmp 0x4048af
cmp dword [0x40fb08], 6
jge 0x404913
inc dword [0x40fb08]
jmp 0x40491a
or dword [0x40fb08], 0xffffffff
mov eax, dword [0x40fb08]
cmp eax, 0xffffffff
je 0x40492d
jmp 0x4048b4
or dword [0x40fb08], 0xffffffff
push dword [0x40fb10]
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call fcn.00401282
mov eax, dword [0x40fa5c]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, ebx
pop ecx
je 0x40497b
push eax
call fcn.004025ef
push dword [0x40fa40]
lea eax, [ebp - 0x2ac]
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push 1
push eax
call esi
call fcn.00404bea
cmp dword [0x40f054], ebx
je 0x4049d1
mov eax, dword [0x40fa60]
cmp eax, ebx
je 0x4049d1
push eax
call fcn.004025ef
push dword [0x40fa44]
call fcn.00406084
pop ecx
pop ecx
push dword [0x40fa44]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
push dword [0x40fa3c]
push dword [0x40fa40]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
push dword [0x40fa3c]
call esi
call fcn.00403f58
call fcn.00404ab0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10