Function at 0x42182d
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xdf0
mov eax, 0x468c4f
call fcn.00443402
mov ebx, ecx
mov esi, dword [ebp + 8]
xor eax, eax
push 0x3a
push eax
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4a]
push eax
call fcn.004423c0
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x44a]
push eax
call fcn.004423c0
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x4c]
push eax
push str.Msi.DLL
call fcn.00440c7b
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.0044189f
add esp, 0x2c
test eax, eax
jns 0x421b54
mov ecx, ebx
call fcn.00432691
mov edi, eax
mov ecx, edi
call fcn.00436230
mov ecx, edi
mov esi, eax
call fcn.004378c8
test eax, eax
je 0x421905
cmp dword [esi + 8], 5
jne 0x4218c1
cmp dword [esi + 0xc], 2
jae 0x4218ca
call fcn.0045886b
test al, al
je 0x4218fe
call fcn.0045886b
test al, al
je 0x4218db
or eax, 0xffffffff
jmp 0x421b57
lea eax, [ebp - 0xdf8]
push eax
mov dword [ebp - 0xdf8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp word [ebp - 0xce4], ax
jae 0x4218d3
mov ecx, str.SupportOSMsi30
jmp 0x42191b
mov ecx, edi
call fcn.0043787a
mov ecx, str.SupportOSMsi12
mov edx, str.SupportOS
test eax, eax
cmove ecx, edx
push edi
push ecx
call fcn.0044015b
pop ecx
pop ecx
test eax, eax
je 0x4219d1
cmp dword [esi], 2
jne 0x4219ca
call fcn.00440f10
test eax, eax
jne 0x421958
mov ecx, 0x4b2
push ecx
mov dword [0x4a6674], ecx
call fcn.00440748
xor eax, eax
pop ecx
inc eax
jmp 0x421b57
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0xc4a]
push eax
call fcn.004423c0
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4219a6
lea ecx, [ebp - 0xc4c]
push ecx
mov ecx, ebx
call fcn.00421d6b
test eax, eax
jne 0x4219a6
push 2
jmp 0x421b56
push esi
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4219ca
lea eax, [ebp - 0xc4c]
push eax
mov ecx, ebx
call fcn.00421d6b
test eax, eax
je 0x42199f
xor eax, eax
jmp 0x421b57
cmp dword [esi + 0x14], 2
jne 0x4219dd
cmp dword [esi + 8], 4
je 0x4219e8
mov ecx, edi
call fcn.004378c8
test eax, eax
je 0x4219f6
mov ecx, edi
call fcn.0043530b
push 3
jmp 0x421b56
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0xdf9]
push eax
push str.SuppressWrongOS
lea ecx, [ebp - 0xcac]
call fcn.004025e0
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0xdf9]
push eax
push str.Startup
lea ecx, [ebp - 0xc7c]
call fcn.004025e0
mov byte [ebp - 4], bl
push 0
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xc7c]
push eax
mov ecx, edi
call fcn.00436d5b
mov bl, al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc7c]
call fcn.00401580
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.00401580
test bl, bl
je 0x4218d3
push 0
lea eax, [ebp - 0xdf9]
mov ebx, 0x4b7
push eax
lea ecx, [ebp - 0xc7c]
mov dword [0x4a6674], ebx
mov dword [ebp - 0xc7c], 0x47d68c
mov dword [ebp - 0xc54], 0x484b70
call fcn.00402580
mov dword [ebp - 4], 5
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0xdf9]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xcdc]
call fcn.004025e0
mov esi, eax
mov byte [ebp - 4], 6
mov ecx, dword [edi + 0x260]
push ebx
lea eax, [ebp - 0xcac]
push eax
call fcn.0041802d
mov byte [ebp - 4], 7
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x421aeb
mov esi, dword [esi]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x421af6
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0xc7c]
push eax
call fcn.004033b0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcac]
call fcn.00401580
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcdc]
call fcn.00401580
cmp dword [ebp - 0xc64], 8
lea ecx, [ebp - 0xc78]
cmovae ecx, dword [ebp - 0xc78]
push ecx
call fcn.00440061
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc7c]
call fcn.00401580
jmp 0x4218d3
push 0xfffffffffffffffe
pop eax
call fcn.004433b1
ret 4