Function at 0x42dfe5
Capabilities:
Create process on windows
Get file attributes
Get graphical window text

Disassembly:
sub esp, 0xc34
push ebx
push ebp
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [esp + 0x14], ax
xor ebp, ebp
lea eax, [esp + 0x16]
push ebp
push eax
mov esi, ecx
call fcn.004127f0
add esp, 0xc
xor eax, eax
push edi
mov word [esp + 0x21c], ax
lea eax, [esp + 0x21e]
push ebp
push eax
call fcn.004127f0
add esp, 0xc
xor eax, eax
push 0x81e
mov word [esp + 0x424], ax
lea eax, [esp + 0x426]
push ebp
push eax
call fcn.004127f0
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
add esp, 0xc
lea eax, [esp + 0x420]
push 0x410
push eax
push dword [esi + 0x2a8]
call ebx
push ecx
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x428]
push eax
mov ecx, esi
call fcn.0042dd19
test al, al
jne 0x42e095
push dword [esi + 0x2a8]
call dword [sym.imp.USER32.dll_SetFocus]
or eax, 0xffffffff
jmp 0x42e24b
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x218]
push eax
push dword [esi + 0x2a8]
call edi
mov eax, dword [esi + 0x54]
add eax, 0x626
je 0x42e0cd
push 0xffffffffffffffff
lea ecx, [esp + 0x21c]
push ecx
push 0x104
push eax
call fcn.0040fbca
add esp, 0x10
push 0x410
lea eax, [esp + 0x424]
push eax
push dword [esi + 0x60]
call ebx
push ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x428]
push ecx
mov ecx, esi
call fcn.0042dd19
test al, al
jne 0x42e0fd
push dword [esi + 0x60]
jmp 0x42e087
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x60]
call edi
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042db81
test al, al
je 0x42e0f8
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x10]
push eax
call edi
or ebx, 0xffffffff
cmp eax, ebx
je 0x42e189
push 0x104
lea eax, [esp + 0x21c]
push eax
push 0x24
call fcn.00422888
mov eax, dword [esi + 0x54]
add eax, 0xe
push eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x428]
push 0x410
push eax
call fcn.0040ac14
mov eax, dword [esi + 0x54]
add esp, 0x10
add eax, 0xe
push 0x24
push eax
lea eax, [esp + 0x428]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x42e189
mov eax, ebx
jmp 0x42e24b
lea eax, [esp + 0x10]
push eax
call edi
cmp eax, ebx
je 0x42e1af
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042d951
test al, al
jne 0x42e1af
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x42e182
mov eax, dword [esi + 0x54]
add eax, 0x216
je 0x42e1cd
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x104
push eax
call fcn.0040fbca
add esp, 0x10
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push ebp
mov ebx, 0xf0
push ebx
push dword [esi + 0x538]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e1ef
or dword [eax], 1
jmp 0x42e1f2
and dword [eax], 0xfffffffe
push ebp
push ebp
push ebx
push dword [esi + 0x4f0]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e209
or dword [eax], 2
jmp 0x42e20c
and dword [eax], 0xfffffffd
push ebp
push ebp
push ebx
push dword [esi + 0x514]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e245
or dword [eax], 4
mov eax, dword [esi + 0x54]
cmp byte [eax + 0xd], 0
jne 0x42e248
push 1
push ebp
push ebp
push str.http:__www.mql5.com__utm_campaignWebInstallerutm_mediumspecialutm_sourceinstaller
push str.open
push ebp
mov byte [eax + 0xd], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42e248
and dword [eax], 0xfffffffb
push 3
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc34
ret