Function at 0x42a6ad
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x98
mov eax, 0x4674ee
call fcn.00435814
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0x46c7f8
cmp byte [ebp + 0xc], bl
je 0x42a7d6
lea eax, [ebp - 0x1c]
push eax
call fcn.004250fc
pop ecx
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], ebx
je 0x42a7c8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a7c8
lea ecx, [ebp - 0x50]
call fcn.0040b355
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareRuanMeiPCMaster
mov byte [ebp - 4], 2
call fcn.004076dd
push closesocket
lea ecx, [ebp - 0x50]
call fcn.00422d2c
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.OpenUrlWithSaayaa
call fcn.004076dd
lea ecx, [ebp - 0x50]
call fcn.00420377
cmp eax, ebx
je 0x42a7b5
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00408533
add esp, 8
mov ecx, esp
mov dword [ebp - 0x10], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
mov byte [ebp - 4], 3
call fcn.0040c3f7
add esp, 0xc
call fcn.00429be9
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov edi, eax
mov byte [ebp - 4], 2
call fcn.00405c12
cmp edi, ebx
je 0x42a7b5
lea ecx, [ebp - 0x50]
call fcn.0040a472
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, edi
call fcn.004358ec
ret
lea ecx, [ebp - 0x50]
call fcn.0040a472
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00405c12
call fcn.00407842
cmp eax, 0x13
jge 0x42a83b
push 0x38
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.004374f0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x3c
mov dword [ebp - 0xa0], 0x400
mov dword [ebp - 0x98], str.open
mov dword [ebp - 0x88], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, ebx
je 0x42a83b
mov edi, eax
jmp 0x42a7a2
lea eax, [ebp + 0xc]
push eax
call fcn.00425402
pop ecx
push ebx
mov edi, 0x47017c
push edi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.00408038
test eax, eax
js 0x42a894
push dword [ebp + 8]
lea ecx, [ebp + 0xc]
push edi
call fcn.004083b7
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov edi, esp
push eax
call fcn.00405e04
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.00429be9
mov edi, eax
pop ecx
cmp edi, ebx
je 0x42a894
mov ecx, dword [ebp + 0xc]
jmp 0x42a79a
lea ecx, [ebp - 0x38]
call fcn.0040b355
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Internet_Exploreriexplore.exe
mov byte [ebp - 4], 5
call fcn.004076dd
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.00424ffa
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.0040df75
mov byte [ebp - 4], 7
call fcn.00407842
cmp eax, 0x1b
jl 0x42a9eb
lea ecx, [ebp - 0x68]
call fcn.0040b355
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareClassesActivatableClassesPackageDefaultBrowser_NOPUBLISHERIDServerDefaultBrowserServer
mov byte [ebp - 4], 8
call fcn.004076dd
lea ecx, [ebp - 0x68]
call fcn.004220db
cmp eax, ebx
je 0x42a9d4
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov edi, esp
push eax
call fcn.00405e04
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.ExePath
mov byte [ebp - 4], 9
call fcn.004076dd
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 8
call fcn.00424ecc
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xa
call fcn.00408533
add esp, 8
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
mov byte [ebp - 4], 0xb
call fcn.0040c3f7
add esp, 0xc
call fcn.00429be9
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.00405c12
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00405c12
cmp edi, ebx
je 0x42a9d4
lea ecx, [ebp - 0x68]
call fcn.0040a472
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00405c12
lea ecx, [ebp - 0x38]
call fcn.0040a472
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00405c12
jmp 0x42a88c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.0040a472
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.00405c12
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42aa3b
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00408533
add esp, 8
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
mov byte [ebp - 4], 0xc
call fcn.0040c3f7
add esp, 0xc
call fcn.00429be9
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00405c12
cmp edi, ebx
jne 0x42a9b1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00405c12
lea ecx, [ebp - 0x38]
call fcn.0040a472
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00405c12
xor edi, edi
jmp 0x42a7a2