Function at 0x46acd0
Capabilities:
Bypass mark of the web
Check os version
Create process on windows
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x6c
push 0xffffffffffffffff
push 0x619cc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
lea eax, [ebp + 0x50]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 4], 0
call fcn.0046a220
add esp, 4
mov ecx, dword [ebp + 0x50]
push ecx
mov byte [ebp - 4], 1
call fcn.0051e6f4
add esp, 4
test al, al
jne 0x46ad40
mov edx, dword [ebp + 0x50]
push edx
lea eax, [ebp + 0x30]
push str.Cannot_find_help_file:__ls
push eax
call fcn.0051c348
add esp, 0xc
push 0x694d20
lea ecx, [ebp + 0x30]
push ecx
call fcn.005f8355
test byte [0x6b2cd4], 1
jne 0x46ad64
or dword [0x6b2cd4], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x1f
not al
and al, 1
mov byte [0x6b2cd0], al
jmp 0x46ad69
mov al, byte [0x6b2cd0]
test al, al
mov ebx, 0x6575cc
je 0x46ae17
mov edi, dword [ebp + 0x50]
mov esi, dword [ebp + 0x54]
sub esi, edi
sar esi, 1
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
je 0x46adb8
push 0
push esi
lea ecx, [ebp + 0x5c]
call fcn.00518d09
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x46adb8
add esi, esi
push esi
push edi
push eax
call fcn.005f7b00
mov edx, dword [ebp + 0x5c]
lea eax, [esi + edx]
mov dword [ebp + 0x60], eax
add esp, 0xc
mov word [eax], 0
push 0x636060
push str.:Zone.Identifier
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 2
call fcn.0040fcf0
mov eax, dword [ebp + 0x5c]
push eax
call fcn.0051e6f4
add esp, 4
test al, al
je 0x46ae03
mov ecx, dword [ebp + 0x74]
push 0x34
push str.VirtualDub_warning
push str.VirtualDub_has_detected_that_its_help_file__VirtualDub.chm__has_an_Internet_Explorer_download_location_marker_on_it._This_may_prevent_the_help_file_from_being_displayed_properly__resulting_in__Action_canceled__errors_being_displayed._Would_you_like_to_remove_it_
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x46ae03
mov edx, dword [ebp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x46ae17
push eax
call fcn.005f7371
add esp, 4
mov esi, dword [ebp + 0x78]
test esi, esi
je 0x46ae51
push 0x635f36
push 0x635f30
lea ecx, [ebp + 0x50]
call fcn.0040fcf0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ae35
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
push eax
push esi
lea ecx, [ebp + 0x50]
call fcn.0040fcf0
push str._hh.exe___
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
call fcn.004039e0
lea ecx, [ebp + 0x50]
push ecx
lea edx, [ebp + 0x5c]
push edx
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00410190
add esp, 0xc
push 0x22
push eax
lea ecx, [ebp + 0x44]
push ecx
mov byte [ebp - 4], 4
call fcn.0046a6b0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x46aea2
push eax
call fcn.005f7371
add esp, 4
mov eax, dword [ebp + 0x5c]
cmp eax, 0x6575cc
mov bl, 7
mov byte [ebp - 4], bl
je 0x46aeba
push eax
call fcn.005f7371
add esp, 4
test byte [0x6b2cd4], 1
jne 0x46aede
or dword [0x6b2cd4], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x1f
not al
and al, 1
mov byte [0x6b2cd0], al
jmp 0x46aee3
mov al, byte [0x6b2cd0]
test al, al
push 0x40
mov dword [ebp - 0x60], 0x44
push 0
je 0x46af85
lea edx, [ebp - 0x5c]
push edx
call fcn.005f7e70
mov eax, dword [ebp + 0x48]
sub eax, dword [ebp + 0x44]
add esp, 0xc
sar eax, 1
lea ecx, [ebp + 0x2c]
push ecx
add eax, 1
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x2c], 0
call fcn.0046ac60
mov esi, dword [ebp + 0x38]
test esi, esi
jne 0x46af2c
xor eax, eax
jmp 0x46af33
mov eax, dword [ebp + 0x3c]
sub eax, esi
sar eax, 1
mov ecx, dword [ebp + 0x48]
mov edx, dword [ebp + 0x44]
sub ecx, edx
sar ecx, 1
cmp eax, ecx
jbe 0x46af43
mov eax, ecx
add eax, eax
push eax
push edx
push esi
call fcn.005f7b00
add esp, 0xc
lea ecx, [ebp + 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test esi, esi
mov edi, eax
je 0x46b02a
push esi
call fcn.005f7e65
jmp 0x46b027
lea eax, [ebp - 0x5c]
push eax
call fcn.005f7e70
lea ecx, [ebp + 0x44]
push ecx
lea edx, [ebp + 0x38]
push edx
call fcn.0051b61b
add esp, 0x14
mov eax, dword [ebp + 0x3c]
sub eax, dword [ebp + 0x38]
lea ecx, [ebp + 0x6b]
push ecx
add eax, 1
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 8
mov byte [ebp + 0x6b], 0
call fcn.0040e580
mov esi, dword [ebp + 4]
test esi, esi
jne 0x46afc7
xor eax, eax
jmp 0x46afcc
mov eax, dword [ebp + 8]
sub eax, esi
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + 0x38]
sub ecx, edx
cmp eax, ecx
jbe 0x46afda
mov eax, ecx
push eax
push edx
push esi
call fcn.005f7b00
add esp, 0xc
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test esi, esi
mov edi, eax
je 0x46b014
push esi
call fcn.005f7e65
add esp, 4
mov eax, dword [ebp + 0x38]
cmp eax, 0x6575c8
mov byte [ebp - 4], bl
je 0x46b02a
push eax
call fcn.005f7371
add esp, 4
test edi, edi
je 0x46b07a
mov ecx, dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp + 0x14]
push edx
call esi
mov eax, dword [ebp + 0x44]
cmp eax, 0x6575cc
je 0x46b053
push eax
call fcn.005f7371
add esp, 4
mov eax, dword [ebp + 0x50]
cmp eax, 0x6575cc
je 0x46b066
push eax
call fcn.005f7371
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x6c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 0x24]
push str.Cannot_launch_HTML_Help:___s
push eax
call fcn.0051d61a
add esp, 0xc
push 0x697a88
lea ecx, [ebp + 0x24]
push ecx
call fcn.005f8355
mov edx, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x10]
push str.VirtualDub_Error
push edx
call fcn.0051c282
mov eax, 0x46b066
ret