Function at 0x422ff0
Capabilities:
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dca3
mov eax, dword fs:[0]
push eax
sub esp, 0xca8
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [0x440444], eax
call fcn.00426820
test eax, eax
jne 0x423034
xor eax, eax
jmp 0x4234cb
push 0x23
push 0x43f788
call fcn.00425bc0
add esp, 8
push 0x437050
push 0x43f788
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x437054
push 0x43f788
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x43f788
call fcn.00404934
add esp, 4
push str._downloadffmpeg
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004255a0
add esp, 8
test eax, eax
je 0x423120
push 0
call fcn.00422aa0
add esp, 4
test eax, eax
je 0x42309e
xor eax, eax
jmp 0x4234cb
push 0x104
lea edx, [ebp - 0x88c]
push edx
push 0x4370b0
push 0x4370c8
call fcn.00422400
add esp, 0x10
test eax, eax
jne 0x4230c7
xor eax, eax
jmp 0x4234cb
lea eax, [ebp - 0x88c]
push eax
push 0x437124
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x42c]
push edx
call fcn.00404c36
add esp, 4
lea eax, [ebp - 0x684]
push eax
lea ecx, [ebp - 0x88c]
push ecx
push 0
call fcn.00429650
add esp, 0xc
lea edx, [ebp - 0x684]
push edx
call fcn.004250a0
add esp, 4
xor eax, eax
jmp 0x4234cb
push 0x43714c
mov eax, dword [ebp + 0x10]
push eax
call fcn.004255a0
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.00422aa0
add esp, 4
test eax, eax
je 0x423157
xor eax, eax
jmp 0x4234cb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
push esi
call fcn.0040599a
add esp, 4
push 0x440514
push 0x4404f4
call fcn.004249f0
add esp, 8
push 0x437168
mov edx, dword [ebp + 0x10]
push edx
call fcn.004255a0
add esp, 8
test eax, eax
je 0x4231bc
mov dword [0x43e7b0], 0
mov dword [0x44044c], 1
push 1
call fcn.00421c30
add esp, 4
xor eax, eax
jmp 0x4234cb
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [0x440444]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.Uninstall.exe
lea edx, [ebp - 0x21c]
push edx
call fcn.004255a0
add esp, 8
test eax, eax
jne 0x423206
push str._uninstall
mov eax, dword [ebp + 0x10]
push eax
call fcn.004255a0
add esp, 8
test eax, eax
je 0x4232d3
call fcn.004229d0
lea ecx, [ebp - 0xca4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0xca4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, word [ebp + eax*2 - 0xca6]
cmp eax, 0x5c
jne 0x42324e
lea ecx, [ebp - 0xca4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp + eax*2 - 0xca6], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x890], eax
mov edx, dword [ebp - 0x890]
push edx
lea eax, [ebp - 0xca4]
push eax
push str._s_vdu_uninstall__x.exe
lea ecx, [ebp - 0xa9c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xa9c]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.00422740
add esp, 8
test eax, eax
jne 0x42329e
xor eax, eax
jmp 0x4234cb
push 4
push 0
lea ecx, [ebp - 0xa9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push 0
push str._uninstallNow
lea edx, [ebp - 0xa9c]
push edx
push 0x437208
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x4234cb
push str._update
mov eax, dword [ebp + 0x10]
push eax
call fcn.004255a0
add esp, 8
test eax, eax
je 0x4232fc
mov dword [0x43e7b0], 0
mov dword [0x440448], 1
push str._silent
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004255a0
add esp, 8
test eax, eax
je 0x42331b
mov dword [0x440458], 1
mov dword [0x4403f4], 0
call fcn.00422d20
test eax, eax
je 0x423335
xor eax, eax
jmp 0x4234cb
call fcn.00428960
mov edx, 0x43fc60
test edx, edx
je 0x42335b
movzx eax, word [0x43fc60]
test eax, eax
je 0x42335b
push 0x43fc60
call fcn.004250a0
add esp, 4
mov ecx, 0x43f788
test ecx, ecx
je 0x42337c
movzx edx, word [0x43f788]
test edx, edx
je 0x42337c
push 0x43f788
call fcn.004250a0
add esp, 4
cmp dword [0x4403f4], 0xb
jne 0x42338c
xor eax, eax
jmp 0x4234cb
mov dword [ebp - 0x220], 1
cmp dword [0x4403f4], 5
jne 0x4234c9
mov dword [ebp - 0x220], 0
push 0x43fc60
push 0
push str.Install_Retries
push 0x437254
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, 0x4404a8
call fcn.00424000
test eax, eax
jne 0x4233e5
mov ecx, 0x4404a8
call fcn.00424640
push eax
call fcn.00404c36
add esp, 4
cmp dword [0x440458], 0
jne 0x423458
lea ecx, [ebp - 0xcb4]
call fcn.004247a0
mov dword [ebp - 4], 0
cmp dword [0x43e7b0], 0
jne 0x423412
cmp dword [0x440454], 0
je 0x42342d
push 0x437284
call fcn.00424a70
add esp, 4
push eax
lea ecx, [ebp - 0xcb4]
call fcn.00424420
jmp 0x423446
push 0x437298
call fcn.00424a70
add esp, 4
push eax
lea ecx, [ebp - 0xcb4]
call fcn.00424420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.00424660
call fcn.004251c0
test eax, eax
jne 0x42347f
mov ecx, 0x440528
call fcn.00424640
push eax
mov ecx, 0x440504
call fcn.00424640
push eax
call fcn.00426540
add esp, 8
push 5
push 0
push 0x4372ac
push str.https:__videodownloaderultimate.com__pfirststeps
push 0x437314
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x440504
call fcn.00424000
test eax, eax
jne 0x4234c9
push 5
push 0
push 0x437320
mov ecx, 0x440504
call fcn.00424640
push eax
push 0x437324
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret