Function at 0x42c5a0
Capabilities:
Bypass mark of the web
Check os version
Copy file
Create process on windows
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fa81
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x134], edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x130], esi
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x42c7c3
lea edx, [ebp + 8]
mov ecx, 0x492eb0
call fcn.00428520
test eax, eax
jne 0x42c641
push str.Temp_path_creating_failed.
push 3
push 3
push 0x175
push str.CInstallingStrategy::Restart
push str.InstallingStrategy.cpp
lea ecx, [ebp - 0x148]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x10
mov ecx, edi
call fcn.0042d530
xor esi, esi
jmp 0x42cc87
call fcn.00403450
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x42c65d
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x138], edi
mov byte [ebp - 4], 1
mov esi, 0x104
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x42c697
push esi
lea ecx, [ebp - 0x138]
call fcn.00403880
mov edi, dword [ebp - 0x138]
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
jne 0x42c6b7
add esi, 0x104
jns 0x42c674
push 0x80070057
call fcn.004039a0
push dword [edi - 8]
push edi
call fcn.0045ed24
add esp, 8
test eax, eax
js 0x42c6ad
cmp eax, dword [edi - 8]
jg 0x42c6ad
mov dword [edi - 0xc], eax
xor ecx, ecx
push 1
mov word [edi + eax*2], cx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x42c745
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CopyFile_faild__error:__u.
push 3
push 3
push 0x184
push str.CInstallingStrategy::Restart
push str.InstallingStrategy.cpp
lea ecx, [ebp - 0x148]
call fcn.00457220
push eax
call fcn.004573f0
mov ecx, dword [ebp - 0x134]
add esp, 0x14
call fcn.0042d530
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42c73e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
jmp 0x42cc87
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00402e80
add eax, 0x10
add esp, 4
mov dword [ebp - 0x12c], eax
push 0x10
push str.:Zone.Identifier
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 2
call fcn.00409770
mov esi, dword [ebp - 0x12c]
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call eax
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42c79c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42c7b7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x130]
mov edi, dword [ebp - 0x134]
cmp dword [0x4b049c], 0
jne 0x42c7d9
push str.InstallInit
call fcn.0040c350
add esp, 4
push 0x4954d0
lea ecx, [ebp - 0x128]
call fcn.00403ac0
mov byte [ebp - 4], 3
cmp dword [0x4b04bc], 0
je 0x42c808
push 0xc
push str.__SHOWPARAMS
lea ecx, [ebp - 0x128]
call fcn.00409770
cmp dword [0x4b049c], 0
je 0x42c83e
push 4
push str.__UP
lea ecx, [ebp - 0x128]
call fcn.00409770
cmp dword [0x4b04b8], 0
je 0x42c83e
push 7
push str.__SILUP
lea ecx, [ebp - 0x128]
call fcn.00409770
cmp dword [0x4b04b4], 0
je 0x42c859
push 3
push 0x495510
lea ecx, [ebp - 0x128]
call fcn.00409770
cmp dword [0x4b0498], 0
je 0x42c874
push 3
push 0x495518
lea ecx, [ebp - 0x128]
call fcn.00409770
cmp dword [0x4b04a8], 0
je 0x42c88f
push 6
push str.__FAKE
lea ecx, [ebp - 0x128]
call fcn.00409770
mov eax, dword [0x4b0644]
cmp dword [eax - 0xc], 0
jne 0x42ca24
push 4
lea eax, [ebp - 0x12c]
mov ecx, 0x4b0614
push eax
call fcn.0044aac0
push eax
mov edx, str.__VERACC
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x130]
call fcn.0040fae0
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409770
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c8ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c920
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 4
lea eax, [ebp - 0x12c]
mov ecx, 0x4b0604
push eax
call fcn.0044aac0
push eax
mov edx, str.__VERPCK
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.0040fae0
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x128]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409770
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c981
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42c9a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 4
lea eax, [ebp - 0x12c]
mov ecx, 0x4b060c
push eax
call fcn.0044aac0
push eax
mov edx, str.__VERSEC
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x130]
call fcn.0040fae0
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x128]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409770
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ca03
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ca24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x4b05cc], 0
je 0x42ca5e
mov eax, dword [0x4b0698]
cmp dword [eax - 0xc], 0
je 0x42ca5e
push 7
push str.__LANG
lea ecx, [ebp - 0x128]
call fcn.00409770
mov eax, dword [0x4b0698]
lea ecx, [ebp - 0x128]
push dword [eax - 0xc]
push eax
call fcn.00409770
mov eax, dword [0x4b04d8]
test eax, eax
je 0x42ca7c
push eax
lea eax, [ebp - 0x128]
push str.__PRWND0x_x
push eax
call fcn.0042e830
add esp, 0xc
mov eax, dword [0x4b0648]
cmp dword [eax - 0xc], 0
je 0x42cb10
push 0x4b0648
mov edx, str.__PRREGKEY_
lea ecx, [ebp - 0x12c]
call fcn.0040fae0
push 0x491ea8
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x130]
call fcn.00409520
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x128]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409770
mov byte [ebp - 4], 0xa
mov eax, ebx
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42caef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cb10
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x38
lea eax, [ebp - 0x180]
mov dword [ebp - 0x184], 0x3c
push 0
push eax
call fcn.0045b910
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 0x180], 0x2000140
push 0
push eax
mov dword [ebp - 0x124], 0x114
call fcn.0045b910
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 5
mov ecx, str.open
mov eax, str.runas
mov dword [ebp - 0x168], 1
cmovbe eax, ecx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42cc16
mov eax, dword [edi + 0x10]
test eax, eax
je 0x42cbc5
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42cc16
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42cc16
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42cc16
mov eax, dword [ebp - 0x13c]
push dword [ebp + 8]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
jmp 0x42cc66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x148]
push esi
push str.Error_restart__error:__u.
push 3
push 3
push 0x1dd
push str.CInstallingStrategy::Restart
push str.InstallingStrategy.cpp
call fcn.00457220
push eax
call fcn.004573f0
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
push dword [ebp + 8]
call eax
cmp esi, 0x4c7
je 0x42cc64
mov ecx, edi
call fcn.0042d530
xor esi, esi
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x128]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cc87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42cca6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret 8