Function at 0x42fce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2a8
mov eax, dword [0x57254c]
xor eax, esp
mov dword [esp + 0x2a4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
call fcn.00410cb0
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42fd4b
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0x4f676552
push ecx
push eax
mov dword [esp + 0x7c], 0x4b6e6570
mov dword [esp + 0x80], 0x78457965
mov word [esp + 0x84], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x2c]
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_bind
call eax
test eax, eax
jne 0x42ff82
push 0x209
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0x2c], 1
push eax
call fcn.004fb730
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x18], eax
call fcn.00410cb0
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42fdca
movaps xmm0, xmmword [0x55b280]
lea ecx, [esp + 0x70]
push ecx
push eax
movups xmmword [esp + 0x78], xmm0
mov byte [esp + 0x88], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x30], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esi + 0x30]
push 0
push str.DisplayIcon
push dword [esp + 0x2c]
call eax
test eax, eax
jne 0x42ff82
cmp byte [esp + 0x98], al
je 0x42ff82
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
push 0x5568dc
push 0
lea eax, [esp + 0xa0]
push eax
push ecx
call fcn.00405960
add esp, 4
mov ecx, eax
call fcn.00451b80
test eax, eax
je 0x42ff82
lea eax, [esp + 0x98]
push eax
push ecx
call fcn.00405960
add esp, 4
mov ecx, eax
call fcn.00451ad0
test eax, eax
je 0x42ff82
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
push 0x5571bc
lea eax, [esp + 0x9c]
push 0x209
push eax
call fcn.004ff77b
add esp, 0xc
lea eax, [esp + 0x98]
push 0x557408
push 0x209
push eax
call fcn.004ff77b
mov esi, dword [esp + 0x20]
add esp, 0xc
lea eax, [esi + 0x808]
push eax
lea eax, [esp + 0x9c]
push 0x209
push eax
call fcn.004ff77b
add esp, 0xc
lea eax, [esi + 0x408]
push eax
lea eax, [esp + 0x9c]
push 0x209
push eax
call fcn.004ff77b
add esp, 0xc
lea eax, [esp + 0x98]
push 0x557408
push 0x209
push eax
call fcn.004ff77b
add esp, 0xc
mov dword [esp + 0x28], 0x44
lea eax, [esp + 0x70]
xorps xmm0, xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
push eax
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x40], xmm0
push eax
sub esp, 0xc
movlpd qword [esp + 0x58], xmm0
lea eax, [esp + 0xac]
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
push 0
sub esp, 8
movlpd qword [esp + 0x84], xmm0
movaps xmmword [esp + 0x90], xmm0
push eax
push ecx
call fcn.0040e6f0
mov ecx, eax
call fcn.00451040
test eax, eax
je 0x42ff82
push 0
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x74]
call esi
mov edi, 1
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test eax, eax
je 0x42ffcf
call fcn.00410cb0
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42ffc6
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0x43676552
push ecx
push eax
mov dword [esp + 0x7c], 0x65736f6c
mov dword [esp + 0x80], 0x79654b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x34], eax
push dword [esp + 0x14]
mov ecx, dword [esi + 0x34]
call ecx
mov ecx, dword [esp + 0x2ac]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4