Function at 0x42d5a0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ab13c
mov eax, dword fs:[0]
push eax
sub esp, 0x910
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x90c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x924]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x934]
mov edi, dword [esp + 0x938]
mov ebx, 1
mov esi, ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ebx
call fcn.0042c8d0
mov dword [esp + 0x34], ebx
xor ebx, ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], eax
call fcn.004399f0
cmp edi, ebx
mov dword [esp + 0x92c], ebx
je 0x42d61f
mov dword [edi], ebx
cmp ebp, ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
je 0x42daae
mov eax, ebp
lea edx, [eax + 2]
jmp 0x42d640
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42d640
sub eax, edx
sar eax, 1
je 0x42daae
push ebp
lea ecx, [esp + 0x20]
call fcn.004393c0
push str.crindex
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d6a4
lea ecx, [esp + 0x50]
call fcn.0048c790
lea ecx, [esp + 0x50]
mov byte [esp + 0x92c], 1
call fcn.0048ce10
lea ecx, [esp + 0x50]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x92c], bl
call fcn.0048c950
jmp 0x42dab2
push str.createsc
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
mov ebp, dword [sym.imp.MSVCR80.dll__wtoi]
je 0x42d736
push str.createsc
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
lea ecx, [esp + 0x1c]
call fcn.004079b0
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
mov byte [esp + 0x92c], 2
je 0x42d726
push str.scfrom
lea ecx, [esp + 0x20]
mov edi, 1
call fcn.00439310
test al, al
je 0x42d712
push str.scfrom
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
call ebp
add esp, 4
mov edi, eax
mov ecx, dword [esp + 0x18]
push edi
push ecx
call ebp
add esp, 4
push eax
call fcn.00440f00
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x92c], bl
call fcn.00404930
push str.uphotwrds
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d7bb
call fcn.00472b00
mov ecx, eax
call fcn.00473540
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x92c], 3
mov esi, 0xa
lea edx, [esp + 0x40]
push edx
call fcn.00472b00
mov ecx, eax
call fcn.004736d0
test eax, eax
jne 0x42d796
push 0x7d0
call edi
sub esi, 1
cmp esi, ebx
jg 0x42d773
call fcn.00472b00
mov ecx, eax
call fcn.00471de0
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x92c], bl
call fcn.0046f0e0
jmp 0x42dab2
push str.unstart
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
jne 0x42daae
push str.usertoken
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
lea ecx, [esp + 0x1c]
je 0x42d866
push str.usertoken
call fcn.00439350
push eax
lea ecx, [esp + 0x1c]
call fcn.004079b0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d841
mov ecx, dword [esp + 0x18]
push 5
push ebx
push ebx
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x20
jg 0x42d854
cmp eax, 0x4c7
je 0x42d854
mov edx, dword [esp + 0x18]
push 0x10
push edx
push 0x4b7a18
jmp 0x42d84d
mov eax, dword [esp + 0x18]
push 0x10
push eax
push 0x4b79e4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.00404930
jmp 0x42dab2
push str.from
mov dword [0x4e0200], ebx
call fcn.00439310
test al, al
je 0x42d893
push str.from
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
call ebp
add esp, 4
mov dword [0x4e0200], eax
push 0x4b5a3c
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d8be
push 0x4b5a3c
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
call ebp
add esp, 4
mov dword [0x4dc9e8], eax
push str.search
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d8ea
push str.search
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
mov ecx, 0x4e0278
call dword [0x4b3378]
push 0x4b5a5c
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d915
push 0x4b5a5c
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
call ebp
add esp, 4
mov dword [0x4e0204], eax
push str.openurl
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d941
push str.openurl
lea ecx, [esp + 0x20]
call fcn.00439350
push eax
mov ecx, 0x4e0294
call dword [0x4b3378]
mov edi, dword [esp + 0x38]
cmp edi, ebx
jne 0x42d95b
push str.RegServer
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42d9b9
push 0x4b72c0
push 1
mov ecx, esi
call fcn.0042c6e0
cmp eax, ebx
jge 0x42d987
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42d987
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.0042b220
jmp 0x42dab2
mov ecx, esi
call fcn.0042c750
push 0x4b72b0
push 1
mov ecx, esi
call fcn.0042c6e0
push 0x4b72d0
push 1
mov ecx, esi
call fcn.0042c6e0
mov ecx, esi
call fcn.0042b810
cmp edi, ebx
je 0x42daae
push str.UnregServer
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
jne 0x42daae
push str.calltip
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
lea ecx, [esp + 0x1c]
je 0x42d9fd
push str.calltip
call fcn.00439350
push eax
call ebp
add esp, 4
mov dword [esi + 0x4c], eax
jmp 0x42dab2
push str.Embedding
call fcn.00439310
test al, al
jne 0x42da1d
push str.Automation
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42da24
mov dword [esi + 0x40], 1
push str.Browser
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
jne 0x42da48
push str.localse
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42da4f
mov dword [esi + 0x44], 1
cmp dword [esi + 0x40], ebx
je 0x42da59
cmp dword [esi + 0x44], ebx
je 0x42daae
push str.trans
lea ecx, [esp + 0x20]
call fcn.00439310
test al, al
je 0x42da6f
xor edi, edi
jmp 0x42da73
mov edi, dword [esp + 0x34]
cmp dword [esi + 0x44], ebx
jne 0x42dab2
mov ecx, dword [section..Shared]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42dab2
cmp dword [esi + 0x40], ebx
jne 0x42da9b
mov edx, dword [esp + 0x3c]
push edi
push edx
mov ecx, esi
call fcn.0042cd90
mov eax, dword [section..Shared]
push ebx
push ebx
push 0x7f6
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x92c], 0xffffffff
call fcn.00439900
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x924]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90c]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x91c
ret 8