Function at 0x4046c7
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00404b45
test eax, eax
pop ecx
je 0x404b3c
mov esi, 0x94
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.004089e0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x94], 2
sete al
cmp eax, ebx
mov dword [0x411bac], eax
je 0x404737
cmp dword [ebp - 0xa0], 4
mov dword [0x411ba8], 1
je 0x40473d
mov dword [0x411ba8], ebx
push dword [ebp + 0x10]
call fcn.004043dc
cmp dword [0x411ad4], ebx
pop ecx
jne 0x4048df
push 0x104
push dword [0x411ac4]
push dword [0x411ba4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x411ac4]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x40477a
cmp byte [eax + 1], cl
je 0x40478c
cmp cl, bl
je 0x40478c
cmp byte [eax + 1], 0x3a
jne 0x40478c
mov byte [eax + 3], bl
mov eax, dword [0x411ac4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4048d7
mov dword [ebp + 8], ebx
push dword [0x411ac0]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x411ac0]
call fcn.0040629f
pop ecx
push dword [ebp + 8]
push str._inst_d.exe
push dword [0x411ac0]
call fcn.00408080
add eax, dword [0x411ac0]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x411ac0]
call section..text
or esi, 0xffffffff
add esp, 0x14
cmp eax, esi
je 0x4047fe
push eax
call fcn.0040121f
pop ecx
mov edi, esi
jmp 0x404810
push dword [0x411ac0]
call fcn.0040104d
mov edi, eax
pop ecx
cmp edi, esi
jne 0x404824
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x3e7
jl 0x40479f
cmp edi, esi
je 0x4048d7
push ebx
push dword [0x411b78]
call section..text
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
je 0x4048d0
lea eax, [ebp + 8]
push eax
push dword [0x40f036]
call fcn.004062f2
pop ecx
test eax, eax
pop ecx
je 0x40487c
push dword [0x40f036]
push dword [ebp + 8]
push esi
call fcn.00401077
push dword [0x40f036]
push dword [ebp + 8]
push edi
call fcn.004010cd
lea eax, [ebp + 8]
push eax
call fcn.00406352
add esp, 0x1c
push esi
call fcn.0040121f
push edi
call fcn.0040121f
push str.__S_
push dword [0x411ac0]
call fcn.00408110
push dword [0x411b78]
push dword [0x411ac0]
call fcn.00408110
push str.___DEL
push dword [0x411ac0]
call fcn.00408110
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x411ac0]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x404b37
push edi
call fcn.0040121f
pop ecx
cmp dword [0x411ad4], ebx
je 0x404904
push 0x104
push dword [0x411ac4]
push dword [0x411ba4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x411ac4]
push ebx
call fcn.00404513
pop ecx
pop ecx
call fcn.00404c6f
test eax, eax
je 0x404b3c
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [0x411b84], eax
call esi
mov dword [0x411b80], eax
call fcn.00404d8b
test eax, eax
je 0x40493f
call fcn.00405280
call fcn.00404cd7
test eax, eax
jne 0x404947
or eax, 0xffffffff
jmp 0x404b3e
xor eax, eax
test byte [0x411b74], 1
je 0x404955
push 1
pop eax
push eax
call fcn.00401246
pop ecx
mov edi, eax
push ebx
push 0x403b02
push dword [0x411ba0]
push edi
push dword [0x411ba4]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x411b9c], eax
je 0x404a99
test byte [0x411b74], 1
jne 0x4049dd
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x411ba0]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x411b9c]
call esi
push 1
push dword [0x411ba0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x411ba0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov cx, word [0x40f042]
xor eax, eax
cmp cx, 0xffff
mov dword [0x411b94], eax
je 0x404a14
movzx eax, cx
mov dword [0x411b94], eax
shl eax, 2
push ebx
push dword [eax + 0x40f0f4]
push dword [eax + 0x40f0d8]
call fcn.004012e7
add esp, 0xc
cmp word [0x40f042], 0xffff
jne 0x404a8d
dec eax
je 0x404a62
dec eax
je 0x404a54
sub eax, 0x3ed
jne 0x404a7a
cmp dword [0x411b94], ebx
jle 0x404a7a
dec dword [0x411b94]
jmp 0x404a7a
cmp dword [0x411b94], 6
jge 0x404a86
push 6
pop eax
jmp 0x404a0f
cmp dword [0x411b94], 6
jge 0x404a73
inc dword [0x411b94]
jmp 0x404a7a
or dword [0x411b94], 0xffffffff
mov eax, dword [0x411b94]
cmp eax, 0xffffffff
je 0x404a8d
jmp 0x404a14
or dword [0x411b94], 0xffffffff
push dword [0x411b9c]
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call fcn.00401282
mov eax, dword [0x411ae8]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, ebx
pop ecx
je 0x404adc
push eax
call fcn.004026eb
pop ecx
lea eax, [ebp - 0x2ac]
push dword [0x411ac4]
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2ac]
push 1
push eax
call esi
call fcn.00404d4b
cmp dword [0x40f054], ebx
je 0x404b32
mov eax, dword [0x411aec]
cmp eax, ebx
je 0x404b32
push eax
call fcn.004026eb
push dword [0x411ac8]
call fcn.004062c6
pop ecx
pop ecx
push dword [0x411ac8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
push dword [0x411ac0]
push dword [0x411ac4]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
push dword [0x411ac0]
call esi
call fcn.00404077
call fcn.00404c11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10