Function at 0x42caa0
Capabilities:
Create process on windows
Create shortcut via ishelllink
Delete file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d5231
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
mov eax, dword [ebp]
sub eax, 0x10
push eax
call fcn.0040ff10
add eax, 0x10
mov dword [esp + 0x28], eax
push 0x5c
push eax
mov dword [esp + 0xbc], 0
call fcn.004adb61
add esp, 0xc
test eax, eax
jne 0x42cb06
or eax, 0xffffffff
jmp 0x42cb0c
sub eax, dword [esp + 0x24]
sar eax, 1
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004315e0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xb4], 1
call fcn.0040fdf0
mov byte [esp + 0xb0], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42cb55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0042f420
test eax, eax
je 0x42d6c7
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42cb7c
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0xb0], 2
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42cbae
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0xb0], 3
mov edx, dword [str.var_fso__r_n]
test edx, edx
jne 0x42cbd4
xor eax, eax
jmp 0x42cbef
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cbe0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040fe70
mov edx, dword [str.fso__new_ActiveXObject__Scripting.FileSystemObject____r_n]
test edx, edx
jne 0x42cc08
xor eax, eax
jmp 0x42cc1f
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cc10
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040ee60
push 0xa
lea ecx, [esp + 0x54]
call fcn.004a3582
mov byte [esp + 0xb0], 4
mov ecx, dword [esp + 0x24]
push 0x5c
push ecx
call fcn.004adb61
add esp, 8
test eax, eax
jne 0x42cc55
or esi, 0xffffffff
jmp 0x42cc5d
sub eax, dword [esp + 0x24]
sar eax, 1
mov esi, eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x54]
call fcn.004a3768
cmp esi, 0xffffffff
je 0x42ccf6
mov bl, 5
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
call fcn.004315e0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xb4], bl
call fcn.0040fdf0
mov byte [esp + 0xb0], 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ccbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx - 0xc], 2
je 0x42ccf6
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x54]
call fcn.004a3733
mov eax, dword [esp + 0x24]
push 0x5c
push eax
call fcn.004adb61
add esp, 8
test eax, eax
je 0x42ccf6
sub eax, dword [esp + 0x24]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cc76
cmp dword [esp + 0x5c], 0
jle 0x42ce35
mov ecx, dword [esp + 0x54]
mov eax, dword [ecx + 8]
sub eax, 0x10
push eax
call fcn.0040ff10
add eax, 0x10
add esp, 4
mov dword [esp + 0x2c], eax
push 0x51ea6c
push 0x51cb10
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0xbc], 6
call fcn.004312b0
push 0x27
lea ebx, [esp + 0x30]
call fcn.00431230
mov esi, dword [esp + 0x2c]
mov ebx, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
lea edi, [ebx + 1]
sub eax, edi
or eax, ecx
jge 0x42cd6b
push edi
lea ecx, [esp + 0x30]
call fcn.00410340
mov esi, dword [esp + 0x2c]
test edi, edi
mov word [esi + ebx*2], 0x27
jl 0x42ce43
cmp edi, dword [esi - 8]
jg 0x42ce43
mov dword [esi - 0xc], edi
mov word [esi + edi*2], 0
mov eax, dword [str.if____fso.FolderExists__s____r_n]
push esi
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00410070
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov edx, dword [str._tfso.CreateFolder__s___r_n]
push esi
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00410070
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.0040ee60
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x54]
call fcn.004a36aa
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ce06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0xb0], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ce2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x5c], 0
jg 0x42cd01
mov edx, dword [str.var_WshShell__WScript.CreateObject__WScript.Shell____r_n]
test edx, edx
jne 0x42ce4d
xor eax, eax
jmp 0x42ce61
push 0x80070057
call fcn.004103e0
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ce52
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040ee60
push ebp
lea ecx, [esp + 0x1c]
call fcn.0040fdf0
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42ce90
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
push 4
lea ecx, [esp + 0x2c]
push ecx
mov bl, 7
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], bl
call fcn.0040dbf0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xb4], 8
call fcn.0040fdf0
mov byte [esp + 0xb0], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42cef2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
push str..lnk
push ecx
call fcn.004ad47d
add esp, 8
test eax, eax
je 0x42cf16
push str..lnk
lea ecx, [esp + 0x1c]
call fcn.0040da00
push 0x27
lea ebx, [esp + 0x1c]
call fcn.00431230
push 0x27
mov ecx, ebx
call fcn.00431d70
push 0x51ea6c
push 0x51cb10
mov edx, ebx
push edx
call fcn.004312b0
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42cf56
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0xb0], 9
mov ecx, dword [esp + 0x18]
mov edx, dword [str.var_oShellLink__WshShell.CreateShortcut__s___r_n]
push ecx
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00410070
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov ecx, dword [esp + 0xc0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040fdf0
push 0x27
lea ebx, [esp + 0x1c]
call fcn.00431230
push 0x27
mov ecx, ebx
call fcn.00431d70
push 0x51ea6c
push 0x51cb10
mov edx, ebx
push edx
call fcn.004312b0
mov eax, dword [esp + 0x18]
mov ecx, dword [str.oShellLink.TargetPath___s__r_n]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00410070
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov eax, dword [esp + 0xc4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x42d05f
push eax
mov ecx, ebx
call fcn.0040fdf0
push 0x22
call fcn.00431230
push 0x22
mov ecx, ebx
call fcn.00431d70
push 0x51ea6c
push 0x51cb10
mov edx, ebx
push edx
call fcn.004312b0
mov eax, dword [esp + 0x18]
mov ecx, dword [str.oShellLink.Arguments___s__r_n]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00410070
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x42d0c9
push eax
lea ecx, [esp + 0x1c]
call fcn.0040fdf0
push 0x27
lea ebx, [esp + 0x1c]
call fcn.00431230
push 0x27
mov ecx, ebx
call fcn.00431d70
push 0x51ea6c
push 0x51cb10
mov edx, ebx
push edx
call fcn.004312b0
mov eax, dword [esp + 0x18]
mov ecx, dword [str.oShellLink.IconLocation___s__r_n]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00410070
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov eax, dword [esp + 0xcc]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x42d120
push eax
lea ecx, [esp + 0x1c]
call fcn.0040fdf0
push 0x27
lea ebx, [esp + 0x1c]
call fcn.00431230
push 0x27
mov ecx, ebx
call fcn.00431d70
mov edx, dword [esp + 0x18]
mov eax, dword [str.oShellLink.WorkingDirectory___s__r_n]
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00410070
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov eax, dword [esp + 0xd0]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
je 0x42d178
push eax
lea ecx, [esp + 0x1c]
call fcn.0040fdf0
push 0x27
lea ebx, [esp + 0x1c]
call fcn.00431230
push 0x27
mov ecx, ebx
call fcn.00431d70
mov eax, dword [esp + 0x18]
mov ecx, dword [str.oShellLink.Description___s__r_n]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00410070
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.0040ee60
mov edx, dword [str.oShellLink.Save____r_n]
test edx, edx
jne 0x42d186
xor eax, eax
jmp 0x42d19f
mov eax, edx
lea esi, [eax + 2]
jmp 0x42d190
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d190
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040ee60
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42d1c4
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0xb8]
add ecx, 0x20
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0xb4], 0xa
call fcn.0040fdf0
push 0xe
push str._ShortcutJS.js
lea ecx, [esp + 0x34]
call fcn.0040ee60
lea ecx, [esp + 0x40]
call fcn.004a2c0c
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esp + 0xc0], 0xb
mov edx, dword [esp + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
push edx
push edi
push edi
call ebx
mov esi, eax
test esi, esi
jle 0x42d255
push esi
call fcn.004a08e1
push esi
mov edi, eax
push 0
push edi
call fcn.004b0770
mov eax, dword [esp + 0x30]
add esp, 0x10
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call ebx
mov ecx, dword [esp + 0x2c]
push 0
push 0x1001
push ecx
lea ecx, [esp + 0x4c]
call fcn.004a3008
push esi
push edi
lea ecx, [esp + 0x48]
mov ebx, eax
call fcn.004a295a
push edi
call fcn.004a08dc
add esp, 4
lea ecx, [esp + 0x40]
call fcn.004a2baa
test ebx, ebx
jge 0x42d3ad
lea ecx, [esp + 0x40]
mov byte [esp + 0xb0], 0xa
call fcn.004a2ce0
mov byte [esp + 0xb0], 9
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d2ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
mov byte [esp + 0xb0], 7
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d2ef
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov byte [esp + 0xb0], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d317
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xb0], 3
call fcn.004a3667
mov byte [esp + 0xb0], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d350
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d378
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xb0], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d3a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80070005
jmp 0x42d8cf
call fcn.004a08e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42d3c7
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xb8]
add ecx, 0x10
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb4], 0xc
call fcn.0040fdf0
push str.wscript.exe
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.00431720
lea ecx, [esp + 0x3c]
push 0x51d048
push ecx
mov bl, 0xd
lea ecx, [esp + 0x40]
mov byte [esp + 0xc4], bl
call fcn.00431800
push str.____E:javascript
push eax
lea edx, [esp + 0x58]
push edx
mov byte [esp + 0xd0], 0xe
call fcn.00431720
mov byte [esp + 0xd0], bl
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d465
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x3c
lea ecx, [esp + 0x70]
push 0
push ecx
call fcn.004b0770
add esp, 0xc
mov dword [esp + 0x6c], 0x3c
mov dword [esp + 0x70], 0x440
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0xd4], 1
mov dword [esp + 0x74], eax
jne 0x42d4ab
call fcn.0042f480
test eax, eax
mov dword [esp + 0x78], str.runas
jne 0x42d4b3
mov dword [esp + 0x78], 0x51d04c
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x8c], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x42d65c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0x80070000
mov esi, dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d520
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 0xc
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d548
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 0xb
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d570
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xb0], 0xa
call fcn.004a2ce0
lea eax, [esi - 0x10]
mov byte [esp + 0xb0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d5a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
mov byte [esp + 0xb0], 7
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d5ca
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov byte [esp + 0xb0], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d5f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xb0], 3
call fcn.004a3667
mov byte [esp + 0xb0], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d62b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d8a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42d8a2
mov ebx, dword [esp + 0x8c]
cmp ebx, 0x20
jle 0x42d4ef
mov esi, dword [esp + 0xa4]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea edx, [esp + 0x30]
push edx
xor ebx, ebx
push esi
mov dword [esp + 0x38], ebx
call edi
test eax, eax
je 0x42d6ac
cmp dword [esp + 0x30], 0x103
jne 0x42d6ac
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x30]
push eax
push esi
call edi
test eax, eax
jne 0x42d68b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebx
je 0x42d4f5
mov ebx, 0x80004005
jmp 0x42d4f5
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0xbc]
call fcn.0042ddf0
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea edx, [esp + 0x1c]
push edx
push 0x517720
push 1
push 0
push 0x517730
call esi
mov ebx, eax
cmp ebx, 0x800401f0
mov edi, 1
jne 0x42d723
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x517720
push 1
push 0
push 0x517730
call esi
mov ebx, eax
test ebx, ebx
jl 0x42d898
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x50]
push ecx
call eax
mov ecx, dword [esp + 0xc4]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x42d75d
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
push ecx
call eax
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x42d77b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0x44]
push ecx
call eax
mov ecx, dword [esp + 0xcc]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x42d797
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x24]
push ecx
call eax
mov ecx, dword [esp + 0xd0]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x42d7b3
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x1c]
push ecx
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push 0x517740
push eax
mov eax, dword [ecx]
call eax
mov ebx, eax
test ebx, ebx
jl 0x42d88c
mov eax, dword [ebp]
sub eax, 0x10
push eax
call fcn.0040ff10
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x28], esi
push 4
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0xb8], 0xf
call fcn.0040dbf0
mov eax, dword [eax]
push str..lnk
push eax
call fcn.004ad47d
add esp, 8
test eax, eax
mov eax, dword [esp + 0x30]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d835
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42d84b
push str..lnk
lea ecx, [esp + 0x2c]
call fcn.0040da00
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
mov ebx, eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi - 0x10]
mov byte [esp + 0xb0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d88c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
jne 0x42d8a2
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esp + 0xb0], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d8cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret 0x20