Function at 0x429e70
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x1c], 6
jb 0x429ef0
cmp dword [ebp + 0x10], 0
jne 0x429ef0
mov dword [ebp - 0x8c], 0
jmp 0x429efa
mov dword [ebp - 0x8c], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x429f11
call fcn.0040f390
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
jne 0x429f25
push 0x42fbdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x429f47
push 0x42fc80
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x14], 0
jne 0x429f64
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x429f80
lea edx, [ebp - 0x18]
push edx
call fcn.00429710
add esp, 4
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x429f97
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x429fb2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.msi.dll_MsiOpenDatabaseW
mov dword [ebp - 0xc], eax
jmp 0x42a134
push 0x10
push 0
lea ecx, [ebp - 0x88]
push ecx
call fcn.00411440
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x78]
push edx
call fcn.00411440
add esp, 0xc
mov dword [ebp - 0x78], 0x44
mov eax, dword [ebp - 8]
push eax
call fcn.00429b90
add esp, 4
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x78]
push edx
push 0
push 0
push 0x400
push str.msiexec__unregister
push 0x42fcc0
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x2c]
push 0x3e8
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x10
push 0
lea edx, [ebp - 0x88]
push edx
call fcn.00411440
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x78]
push eax
call fcn.00411440
add esp, 0xc
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x78]
push edx
push 0
push 0
push 0x400
push str.msiexec__regserver
push 0x42fd00
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x2c]
push 0x10
push 0
lea ecx, [ebp - 0x88]
push ecx
call fcn.00411440
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x78]
push edx
call fcn.00411440
add esp, 0xc
push 0x3e8
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x14], 3
je 0x42a0bb
cmp dword [ebp + 0x14], 2
je 0x42a0bb
mov dword [ebp - 0x90], 0x42fd28
jmp 0x42a0c5
mov dword [ebp - 0x90], str._quiet
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp + 8]
push eax
push str.msiexec__i___s___s__s
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040fcb0
add esp, 0x14
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x400
mov ecx, dword [ebp - 0x28]
push ecx
push str.msiexec.exe
push 1
mov edx, dword [ebp - 0x20]
push edx
call dword [ebp - 0x2c]
test eax, eax
jne 0x42a116
mov dword [ebp - 0xc], 0x643
cmp dword [ebp - 0x28], 0
je 0x42a125
mov eax, dword [ebp - 0x28]
push eax
call fcn.0040f4e0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x20], 0
je 0x42a144
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x42a154
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10], 0
je 0x42a164
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x18], 0
je 0x42a17d
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret