Function at 0x42aca0
Capabilities:
Create process on windows
Get common file path
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x42ac83
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
mov eax, dword [0x4bbec8]
dec eax
cmp eax, 3
ja case.default.0x42ac21
jmp dword [eax*4 + 0x42ac90]
mov dword [0x4bbec8], 2
jmp case.default.0x42ac21
mov eax, dword [edi + 0x530]
mov dword [edi + 0x12c], eax
lea eax, [edi + 0xc8]
push 1
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.default.0x42ac21
mov dword [0x4bbec8], 0
jmp case.default.0x42ac21
mov byte [0x4bbecc], 1
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42ac7c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
xor eax, eax
pop esi
ret 0x10
push 0x80004005
call fcn.00402080
nop dword [eax]
sub byte [edx + eax*2 + 0x42ac3400], ch
add byte [eax - 84], ah
inc edx
add byte [esp + ebp*4 + 0x42], dl
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, ecx
push edi
push 0
mov dword [ebp - 0x224], ebx
push dword [ebx + 4]
call esi
push 0
push dword [ebx + 0x30]
call esi
push str..exe
push 0x4c10c8
lea eax, [ebp - 0x218]
mov dword [ebx + 0x5e0], 3
push str.pcmastersetup_
push eax
call fcn.0040a220
add esp, 0xc
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0040a190
mov edx, dword [ebp - 0x218]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ad2a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x42afb6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x214], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x42afc0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x42afca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x218], eax
call fcn.00408110
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044c180
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403710
push dword [ebp - 0x228]
lea eax, [ebp - 0x214]
push dword [ebp - 0x220]
push 0x4a649c
push eax
call fcn.0041ad10
mov edx, dword [ebp - 0x220]
add esp, 0x10
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ae03
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x214]
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.0041d210
add esp, 8
lea ecx, [ebp - 0x21c]
push eax
call fcn.00409a20
mov edx, dword [ebp - 0x214]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ae42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
mov dword [ebp - 0x214], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 0x20d], al
lea ecx, [esi - 0x10]
mov edi, esp
push ecx
call fcn.00403380
mov ecx, dword [ebp - 0x224]
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.00424470
mov ecx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x218]
cmp dword [ecx - 0xc], 0
je 0x42aecd
cmp byte [ebp - 0x20d], 0
je 0x42aecd
test al, al
je 0x42aecd
cmp byte [0x4c103f], 0
jne 0x42aefb
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42aefb
push ecx
lea eax, [edi - 0x10]
mov esi, esp
push eax
call fcn.00403380
add eax, 0x10
mov dword [esi], eax
mov esi, esp
push dword [ebp - 0x214]
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0040add0
add esp, 8
mov eax, dword [ebp - 0x224]
push 0
push 0
push 0x10
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x230]
call fcn.00402130
mov edx, dword [ebp - 0x230]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42af38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42af4f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42af6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x214]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42af86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42afa1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004495f3
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
int3