Function at 0x435fc0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439504
mov eax, dword fs:[0]
push eax
sub esp, 0x7cc
mov eax, dword [0x44c654]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00435c40
mov dword [ebp - 0x55c], 0
cmp dword [0x450628], 0
je 0x43601f
push 0x442c50
push 0x442c54
push 0x442c5c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00434a00
add esp, 0x10
push 0x114
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.0041fb00
add esp, 0xc
mov dword [ebp - 0x134], 0x114
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x130], 5
jae 0x436073
push 0
push 0x442c88
push 0x442c9c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xfffffffd
jmp 0x43666f
cmp dword [ebp - 0x130], 5
jne 0x436099
cmp dword [ebp - 0x12c], 1
jne 0x436099
push 0x442cb4
lea edx, [ebp - 0x120]
push edx
call fcn.004207d8
add esp, 8
push fcn.004013c0
push fcn.00401a50
push 2
push 4
lea eax, [ebp - 0x13c]
push eax
call fcn.0042086b
mov dword [ebp - 4], 0
push 0x442cd4
lea ecx, [ebp - 0x138]
call fcn.004015a0
mov dword [ebp - 0x140], 1
push 0x104
push 0
lea ecx, [ebp - 0x34c]
push ecx
call fcn.0041fb00
add esp, 0xc
push 0x104
lea edx, [ebp - 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004023b0
mov byte [ebp - 4], 1
push 0x442cfc
lea ecx, [ebp - 0x10]
call fcn.00401050
lea ecx, [ebp - 0x138]
push ecx
mov edx, esp
mov dword [ebp - 0x778], esp
push ecx
mov ecx, edx
call fcn.00402890
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x7b0], eax
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x77c], esp
lea edx, [ebp - 0x10]
push edx
call fcn.00402890
mov dword [ebp - 0x7b4], eax
mov byte [ebp - 4], 1
call fcn.00435e10
add esp, 8
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0xffffffff
jne 0x436206
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
push 0x442d00
push 0x103
lea edx, [ebp - 0x76c]
push edx
call fcn.004208d0
add esp, 0x14
push 0
push 0x442d34
lea eax, [ebp - 0x76c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x780], 0xfffffffe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
push fcn.004013c0
push 2
push 4
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0041fe5b
mov eax, dword [ebp - 0x780]
jmp 0x43666f
push 0x442d48
lea ecx, [ebp - 0x144]
call fcn.004023b0
mov byte [ebp - 4], 3
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x144]
call fcn.00401050
push 0x442d50
lea ecx, [ebp - 0x144]
call fcn.00401050
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x144]
call fcn.00401050
cmp dword [0x450634], 0
je 0x436271
push 0x442d54
lea ecx, [ebp - 0x144]
call fcn.00401050
push 0x442d58
lea ecx, [ebp - 0x144]
call fcn.00401050
push 0x104
push 0
lea ecx, [ebp - 0x554]
push ecx
call fcn.0041fb00
add esp, 0xc
mov dword [ebp - 0x558], 0
call fcn.00435410
test eax, eax
je 0x436447
cmp dword [0x450630], 0
je 0x4362f3
mov dword [ebp - 0x784], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x144]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
push fcn.004013c0
push 2
push 4
lea edx, [ebp - 0x13c]
push edx
call fcn.0041fe5b
mov eax, dword [ebp - 0x784]
jmp 0x43666f
mov dword [ebp - 0x558], 1
mov dword [ebp - 0x774], 0
push 0x14
call fcn.00403ad8
add esp, 4
mov dword [ebp - 0x78c], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x78c], 0
je 0x43635e
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x790], esp
push 0x442d5c
call fcn.00401340
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 0x78c]
call fcn.00437990
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c4], eax
jmp 0x436368
mov dword [ebp - 0x7c4], 0
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp - 0x788], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x788]
mov dword [ebp - 0x774], edx
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x794], esp
push 0x442d60
call fcn.00401340
mov dword [ebp - 0x7c8], eax
lea eax, [ebp - 0x798]
push eax
mov ecx, dword [ebp - 0x774]
call fcn.004373c0
mov dword [ebp - 0x7cc], eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d0], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x7d0]
push edx
lea ecx, [ebp - 0x770]
call fcn.00402890
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x798]
call fcn.004013c0
lea ecx, [ebp - 0x770]
call fcn.00401320
movzx eax, al
test eax, eax
je 0x43641c
push 0x64
lea ecx, [ebp - 0x554]
push ecx
push 0x442d70
push 0x442d80
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00434970
add esp, 0x14
jmp 0x43643c
push 0x104
lea ecx, [ebp - 0x770]
call fcn.00402aa0
push eax
lea edx, [ebp - 0x554]
push edx
call fcn.004209a3
add esp, 0xc
lea ecx, [ebp - 0x770]
call fcn.004013c0
push 2
call fcn.00435540
add esp, 4
push str.removeall
lea ecx, [ebp - 0x560]
call fcn.004023b0
mov byte [ebp - 4], 6
push 0x442ddc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x79c]
push ecx
call fcn.00401230
add esp, 0xc
mov dword [ebp - 0x7d4], eax
lea ecx, [ebp - 0x560]
call fcn.00402aa0
push eax
mov ecx, dword [ebp - 0x7d4]
call fcn.00402aa0
push eax
call fcn.00435490
add esp, 8
mov dword [ebp - 0x564], eax
lea ecx, [ebp - 0x79c]
call fcn.004013c0
mov edx, 1
test edx, edx
je 0x4364d7
push 0x2bf20
mov eax, dword [ebp - 0x564]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4364d5
jmp 0x4364d7
jmp 0x4364b4
push str.BMSInstallAgent.exe
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x7a0]
push edx
call fcn.00401230
add esp, 0xc
mov dword [ebp - 0x7d8], eax
lea ecx, [ebp - 0x144]
call fcn.00402aa0
push eax
mov ecx, dword [ebp - 0x7d8]
call fcn.00402aa0
push eax
call fcn.00435490
add esp, 8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x7a0]
call fcn.004013c0
cmp dword [ebp - 0x14], 0
jne 0x436598
push 0
push 0x442e2c
push 0x442e40
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x7a4], 0xffffffff
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x560]
call fcn.004013c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x144]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
push fcn.004013c0
push 2
push 4
lea eax, [ebp - 0x13c]
push eax
call fcn.0041fe5b
mov eax, dword [ebp - 0x7a4]
jmp 0x43666f
cmp dword [0x450628], 0
je 0x4365dd
mov ecx, 1
test ecx, ecx
je 0x4365c1
push 0x2bf20
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4365bf
jmp 0x4365c1
jmp 0x4365a1
push 0x442e64
push 0x442e68
push 0x442e70
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00434a00
add esp, 0x10
lea eax, [ebp - 0x554]
push eax
call fcn.0041fc48
add esp, 4
test eax, eax
je 0x436617
cmp dword [0x45062c], 0
je 0x436617
lea ecx, [ebp - 0x554]
push ecx
push str.agentid
push str.SOFTWAREMicrosoftCryptographyIAS
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00434a00
add esp, 0x10
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x7a8], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x560]
call fcn.004013c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x144]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
push fcn.004013c0
push 2
push 4
lea eax, [ebp - 0x13c]
push eax
call fcn.0041fe5b
mov eax, dword [ebp - 0x7a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041faea
mov esp, ebp
pop ebp
ret