Function at 0x42abc0
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48920b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1284
call fcn.00465640
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x1280], eax
push ebx
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x1298]
mov dword fs:[0], eax
push 0
mov esi, ecx
call fcn.004510c6
add esp, 4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, esi
call fcn.00429fa0
mov edi, eax
call fcn.00449852
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42ac3c
push 0x80004005
call fcn.004108b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x12a0], 0
cmp edi, 0xfffffffd
je 0x42b290
cmp edi, 0xfffffffe
je 0x42b289
cmp edi, 0xffffffff
je 0x42b24c
mov ecx, esi
call fcn.0042ab10
mov ecx, esi
call fcn.0042a7a0
xor ecx, ecx
push 0xfe
push ecx
lea edx, [esp + 0x1196]
push edx
mov word [esp + 0x1198], cx
call fcn.00463850
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x1190]
push str.EST_MUTEX_2012_10_31__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x118c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4c2860], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42acee
push str.exists...
call fcn.0042a410
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x1c]
call fcn.00411f40
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x12a4], 1
call fcn.00419b30
mov eax, dword [eax]
push eax
push str.cmdline__s__n
mov byte [esp + 0x12a8], 2
call fcn.00427230
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 8
mov byte [esp + 0x12a0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ad54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x42ae07
push str._install
push ecx
call fcn.00466169
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x42adc8
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x42adc8
lea ecx, [esp + 0x13]
call fcn.00427d30
lea ecx, [esp + 0x13]
mov byte [esp + 0x12a0], 3
call fcn.004280a0
lea ecx, [esp + 0x13]
mov byte [esp + 0x12a0], 1
call fcn.00413a20
lea ecx, [esp + 0x18]
call fcn.004111f0
lea ecx, [esp + 0x14]
call fcn.004111f0
mov eax, 1
jmp 0x42b2d5
cmp dword [ecx - 0xc], 0
jl 0x42ae07
push str._uninstall
push ecx
call fcn.00466169
add esp, 8
test eax, eax
je 0x42ae07
sub eax, dword [esp + 0x18]
sar eax, 1
cmp eax, 0xffffffff
je 0x42ae07
lea ecx, [esp + 0x13]
call fcn.00427d30
lea ecx, [esp + 0x13]
mov byte [esp + 0x12a0], 4
call fcn.00428430
jmp 0x42ad9b
mov edi, dword [0x4c64e0]
cmp edi, 1
jne 0x42afc0
lea ecx, [esp + 0x20]
call fcn.0042d680
mov ecx, dword [0x4c64e8]
mov edx, dword [ecx]
lea edi, [esi + 0xac]
mov bl, 5
push edx
mov ecx, edi
mov byte [esp + 0x12a4], bl
call fcn.00411dd0
mov eax, dword [esi + 0xb0]
add esi, 0xb0
cmp dword [eax - 0xc], 0
jne 0x42aec6
push str.esafenet_cdgout_exe32_20110929
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x42ae95
push eax
mov ecx, 0x4c2948
call fcn.0041c150
test eax, eax
jne 0x42ae9c
lea ecx, [esp + 0x20]
call fcn.004111f0
lea ecx, [esp + 0x18]
call fcn.004111f0
lea ecx, [esp + 0x14]
call fcn.004111f0
jmp 0x42b2d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004316e0
push eax
mov ecx, esi
call fcn.00411dd0
push 0x48ffd0
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.00411ae0
add esp, 0xc
mov byte [esp + 0x12a0], 6
jmp 0x42aee1
push 0x48ffd0
lea edx, [esp + 0x20]
push esi
push edx
call fcn.00411ae0
add esp, 0xc
mov byte [esp + 0x12a0], 7
push eax
lea ecx, [esp + 0x24]
call fcn.00411910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x12a0], bl
call fcn.004111f0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push 0x48ee7c
push ecx
call fcn.004195c0
push 0x48ee7c
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x12b8], 8
call fcn.00411ae0
add esp, 0x18
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x12a4], 9
call fcn.00411910
lea ecx, [esp + 0x1c]
call fcn.004111f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x12a0], bl
call fcn.004111f0
push edi
lea eax, [esp + 0x20]
push 0x48ee7c
push eax
call fcn.004195c0
push 0x48ee7c
push eax
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x12b8], 0xa
call fcn.00411ae0
add esp, 0x18
push eax
mov ecx, edi
mov byte [esp + 0x12a4], 0xb
call fcn.00411d40
lea ecx, [esp + 0x24]
call fcn.004111f0
lea ecx, [esp + 0x1c]
call fcn.004111f0
mov edx, dword [edi]
mov eax, dword [esp + 0x20]
push 1
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42ae75
mov ecx, dword [0x4c64e8]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esp + 0x2c]
call fcn.00411f40
mov byte [esp + 0x12a0], 0xc
cmp edi, 2
jne 0x42b243
mov dword [esi + 0xa8], 1
mov eax, dword [0x4c64e8]
mov ecx, dword [eax + 4]
lea edi, [esi + 0xac]
push ecx
mov ecx, edi
call fcn.00411dd0
mov ecx, edi
call fcn.004196b0
mov ecx, eax
call fcn.004184b0
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call fcn.00413600
push str..exe
mov ecx, eax
mov byte [esp + 0x12a4], 0xd
call fcn.004293f0
test eax, eax
lea ecx, [esp + 0x24]
sete bl
mov byte [esp + 0x12a0], 0xc
call fcn.004111f0
test bl, bl
je 0x42b05f
mov dword [esi + 0xa8], 0
mov ecx, dword [esi + 0xb0]
cmp dword [ecx - 0xc], 0
lea ebx, [esi + 0xb0]
jne 0x42b07e
call fcn.004316e0
push eax
mov ecx, ebx
call fcn.00411dd0
mov ecx, esi
call fcn.00429eb0
test eax, eax
je 0x42b0d2
push 0x4a
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4c2864
call fcn.00430a90
mov eax, dword [eax]
push 0
push 4
push eax
mov byte [esp + 0x12ac], 0xe
call fcn.0044aa9f
cmp eax, 6
lea ecx, [esp + 0x24]
setne byte [esp + 0x13]
mov byte [esp + 0x12a0], 0xc
call fcn.004111f0
cmp byte [esp + 0x13], 0
jne 0x42b243
mov ecx, esi
call fcn.0042a550
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
mov dword [esi + 0xa4], eax
call fcn.004112e0
mov ecx, esi
call fcn.0042a8b0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004112e0
mov eax, dword [esi + 0xa8]
push edi
push eax
mov ecx, 0x4c2948
call fcn.00421530
cmp eax, 0x2537
jne 0x42b243
mov ecx, dword [esi + 0xa8]
push ecx
push 0
mov ecx, edi
call fcn.00411300
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4c294c
call fcn.004112e0
mov ecx, 0x4c2948
call fcn.004181d0
test eax, eax
je 0x42b235
lea ecx, [esp + 0x20]
call fcn.0042d680
mov ecx, 0x22b
mov esi, 0x4c2e6c
lea edi, [esp + 0x2e]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x22b
mov esi, 0x4c2e6c
lea edi, [esp + 0x8dd]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4c294c]
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 0x931]
push eax
push ecx
movsw word es:[edi], word [esi]
lea edx, [esp + 0x2c]
push str._s_s_s
push edx
mov byte [esp + 0x12b4], 0xf
movsb byte es:[edi], byte [esi]
call fcn.004135e0
add esp, 0x14
lea ecx, [esp + 0x1c]
call fcn.0042d680
mov esi, dword [esp + 0x20]
push esi
lea eax, [esp + 0x20]
push 0x492a64
push eax
mov byte [esp + 0x12ac], 0x10
call fcn.004135e0
add esp, 8
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.004112e0
mov ecx, 0x4c2948
call fcn.004180a0
test eax, eax
jne 0x42b20c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0x492a58
jmp 0x42b215
push 0
push 0
push 0x492a4c
call fcn.0044aa9f
lea ecx, [esp + 0x1c]
call fcn.004111f0
lea ecx, [esp + 0x20]
call fcn.004111f0
lea ecx, [esp + 0x28]
jmp 0x42ae79
push 0
push 0
push 0x492a3c
call fcn.0044aa9f
lea ecx, [esp + 0x28]
jmp 0x42ae79
lea eax, [esp + 0x14]
push str._rN_e
push eax
call fcn.004135e0
mov esi, dword [esp + 0x1c]
add esp, 8
push 0
push 0
push esi
call fcn.0044aa9f
lea eax, [esi - 0x10]
mov dword [esp + 0x12a0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x42b2c7
push 0x492a18
jmp 0x42b295
push 0x492a00
lea ecx, [esp + 0x18]
push ecx
call fcn.004135e0
mov esi, dword [esp + 0x1c]
add esp, 8
push 0
push 0
push esi
call fcn.0044aa9f
lea eax, [esi - 0x10]
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov dword [esp + 0x12a0], ecx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b2d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1298]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1280]
xor ecx, esp
call fcn.004644d0
mov esp, ebp
pop ebp
ret