Function at 0x429464
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
xor ebx, ebx
mov dword [0x45a040], ebx
call fcn.00415b73
push ebx
call fcn.00417164
mov dword [esp], 0x458940
push 0x45b530
mov ecx, 0x4cae2c
call fcn.00401c3b
mov eax, dword [0x4cae2c]
cmp dword [eax - 8], 3
jge 0x42970f
mov eax, dword [0x4a16f0]
push esi
push edi
mov dword [ebp - 0x234], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x230]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x234]
push esi
push eax
push dword [0x4a17b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4581d0]
push str._away_with_it.exe
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
call fcn.004070c2
mov eax, dword [0x4ca400]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [eax - 0xc], ebx
jl 0x429510
mov dword [ebp - 0x14], eax
add eax, 0xfffffff4
push eax
call edi
jmp 0x429522
mov ecx, dword [0x4581d0]
push eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
call fcn.00401988
push 0x105
lea ecx, [ebp - 4]
call fcn.00401b75
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00401bdd
lea eax, [ebp - 4]
lea ecx, [ebp - 0x20]
push eax
call fcn.0040711b
lea eax, [ebp - 0x10]
push eax
call fcn.0042a5b9
mov eax, dword [0x4ca400]
pop ecx
cmp dword [eax - 0xc], ebx
jl 0x42956c
mov dword [ebp - 8], eax
add eax, 0xfffffff4
push eax
call edi
jmp 0x42957e
mov ecx, dword [0x4581d0]
push eax
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
call fcn.00401988
lea eax, [ebp - 8]
push str._Uninstall.ini
push eax
mov esi, 0x45b008
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401a95
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004019f3
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401a95
lea ecx, [ebp - 0x1c]
call fcn.00401802
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 8]
call fcn.00401802
push 0x45b530
push 0x458940
lea ecx, [ebp - 0x10]
call fcn.00401c3b
lea eax, [ebp - 0x28]
mov ecx, 0x4ca3fc
push eax
call fcn.0040711b
push ebx
push str.admin_install
call fcn.0042a5a1
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x429603
call fcn.00427304
test eax, eax
je 0x42961f
mov edi, str._Uninstall.exe
mov eax, edi
test eax, eax
je 0x429615
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.004018f3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00408ead
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004019f3
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00401ae1
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 0x1c]
call fcn.00401802
push ebx
lea eax, [ebp - 0x234]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x10]
push 0x4a16d4
push eax
lea eax, [ebp - 0xc]
push str.___uninstall___UNPATH:
push eax
call fcn.00408ead
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401a95
lea ecx, [ebp - 0xc]
call fcn.00401802
cmp dword [ebp - 8], ebx
pop edi
pop esi
jne 0x4296b3
push 9
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 4]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4296d5
push ebx
push 0x459904
push ebx
lea ecx, [ebp - 0x24]
call fcn.00401b75
push eax
push ebx
lea ecx, [ebp - 4]
call fcn.00401b75
push eax
call fcn.00429092
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.00401802
lea ecx, [ebp - 0x28]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea ecx, [ebp - 0x14]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x20]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
jmp 0x429727
push ebx
push 0x42894f
push ebx
push 0xc2
push dword [0x4a17b0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop ebx
leave
ret