Function at 0x42d89d
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xdf0
mov eax, 0x4a2e32
call fcn.00453742
mov ebx, ecx
mov esi, dword [ebp + 8]
xor eax, eax
push 0x3a
push eax
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4a]
push eax
call fcn.004526c0
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x44a]
push eax
call fcn.004526c0
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x4c]
push eax
push str.Msi.DLL
call fcn.0044fff7
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.00450cb8
add esp, 0x2c
test eax, eax
jns 0x42dbc4
mov ecx, ebx
call fcn.0040f919
mov edi, eax
mov ecx, edi
call fcn.004445bc
mov ecx, edi
mov esi, eax
call fcn.00445d92
test eax, eax
je 0x42d975
cmp dword [esi + 8], 5
jne 0x42d931
cmp dword [esi + 0xc], 2
jae 0x42d93a
call fcn.00486688
test al, al
je 0x42d96e
call fcn.00486688
test al, al
je 0x42d94b
or eax, 0xffffffff
jmp 0x42dbc7
lea eax, [ebp - 0xdf8]
push eax
mov dword [ebp - 0xdf8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp word [ebp - 0xce4], ax
jae 0x42d943
mov ecx, str.SupportOSMsi30
jmp 0x42d98b
mov ecx, edi
call fcn.00445d44
mov ecx, str.SupportOSMsi12
mov edx, str.SupportOS
test eax, eax
cmove ecx, edx
push edi
push ecx
call fcn.0044f6de
pop ecx
pop ecx
test eax, eax
je 0x42da41
cmp dword [esi], 2
jne 0x42da3a
call fcn.0045028c
test eax, eax
jne 0x42d9c8
mov ecx, 0x4b2
push ecx
mov dword [0x4ef824], ecx
call fcn.0044fd51
xor eax, eax
pop ecx
inc eax
jmp 0x42dbc7
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0xc4a]
push eax
call fcn.004526c0
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42da16
lea ecx, [ebp - 0xc4c]
push ecx
mov ecx, ebx
call fcn.0042ddf7
test eax, eax
jne 0x42da16
push 2
jmp 0x42dbc6
push esi
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x42da3a
lea eax, [ebp - 0xc4c]
push eax
mov ecx, ebx
call fcn.0042ddf7
test eax, eax
je 0x42da0f
xor eax, eax
jmp 0x42dbc7
cmp dword [esi + 0x14], 2
jne 0x42da4d
cmp dword [esi + 8], 4
je 0x42da58
mov ecx, edi
call fcn.00445d92
test eax, eax
je 0x42da66
mov ecx, edi
call fcn.004434b1
push 3
jmp 0x42dbc6
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0xdf9]
push eax
push str.SuppressWrongOS
lea ecx, [ebp - 0xcac]
call fcn.00402ca0
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0xdf9]
push eax
push str.Startup
lea ecx, [ebp - 0xc7c]
call fcn.00402ca0
mov byte [ebp - 4], bl
push 0
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xc7c]
push eax
mov ecx, edi
call fcn.004451a2
mov bl, al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc7c]
call fcn.00401ac0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.00401ac0
test bl, bl
je 0x42d943
push 0
lea eax, [ebp - 0xdf9]
mov ebx, 0x4b7
push eax
lea ecx, [ebp - 0xc7c]
mov dword [0x4ef824], ebx
mov dword [ebp - 0xc7c], 0x4c8e30
mov dword [ebp - 0xc54], 0x4c9334
call fcn.00403b80
mov dword [ebp - 4], 5
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0xdf9]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xcdc]
call fcn.00402ca0
mov esi, eax
mov byte [ebp - 4], 6
mov ecx, dword [edi + 0x260]
push ebx
lea eax, [ebp - 0xcac]
push eax
call fcn.004209b6
mov byte [ebp - 4], 7
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x42db5b
mov esi, dword [esi]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x42db66
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0xc7c]
push eax
call fcn.004037e0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcac]
call fcn.00401b80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcdc]
call fcn.00401ac0
cmp dword [ebp - 0xc64], 8
lea ecx, [ebp - 0xc78]
cmovae ecx, dword [ebp - 0xc78]
push ecx
call fcn.0044f5e4
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc7c]
call fcn.00401ac0
jmp 0x42d943
push 0xfffffffffffffffe
pop eax
call fcn.004536f1
ret 4