Function at 0x42ddf7
Capabilities:
Create process on windows
Get file attributes
Get graphical window text

Disassembly:
sub esp, 0xc34
push ebx
push ebp
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [esp + 0x14], ax
xor ebp, ebp
lea eax, [esp + 0x16]
push ebp
push eax
mov esi, ecx
call fcn.004127c0
add esp, 0xc
xor eax, eax
push edi
mov word [esp + 0x21c], ax
lea eax, [esp + 0x21e]
push ebp
push eax
call fcn.004127c0
add esp, 0xc
xor eax, eax
push 0x81e
mov word [esp + 0x424], ax
lea eax, [esp + 0x426]
push ebp
push eax
call fcn.004127c0
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
add esp, 0xc
lea eax, [esp + 0x420]
push 0x410
push eax
push dword [esi + 0x2a8]
call ebx
push ecx
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x428]
push eax
mov ecx, esi
call fcn.0042db2b
test al, al
jne 0x42dea7
push dword [esi + 0x2a8]
call dword [sym.imp.USER32.dll_SetFocus]
or eax, 0xffffffff
jmp 0x42e05d
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x218]
push eax
push dword [esi + 0x2a8]
call edi
mov eax, dword [esi + 0x54]
add eax, 0x626
je 0x42dedf
push 0xffffffffffffffff
lea ecx, [esp + 0x21c]
push ecx
push 0x104
push eax
call fcn.0040fb9c
add esp, 0x10
push 0x410
lea eax, [esp + 0x424]
push eax
push dword [esi + 0x60]
call ebx
push ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x428]
push ecx
mov ecx, esi
call fcn.0042db2b
test al, al
jne 0x42df0f
push dword [esi + 0x60]
jmp 0x42de99
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x60]
call edi
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042d993
test al, al
je 0x42df0a
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
lea eax, [esp + 0x10]
push eax
call edi
or ebx, 0xffffffff
cmp eax, ebx
je 0x42df9b
push 0x104
lea eax, [esp + 0x21c]
push eax
push 0x24
call fcn.00422830
mov eax, dword [esi + 0x54]
add eax, 0xe
push eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x428]
push 0x410
push eax
call fcn.0040abf2
mov eax, dword [esi + 0x54]
add esp, 0x10
add eax, 0xe
push 0x24
push eax
lea eax, [esp + 0x428]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x42df9b
mov eax, ebx
jmp 0x42e05d
lea eax, [esp + 0x10]
push eax
call edi
cmp eax, ebx
je 0x42dfc1
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042d763
test al, al
jne 0x42dfc1
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x42df94
mov eax, dword [esi + 0x54]
add eax, 0x216
je 0x42dfdf
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x104
push eax
call fcn.0040fb9c
add esp, 0x10
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push ebp
mov ebx, 0xf0
push ebx
push dword [esi + 0x538]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e001
or dword [eax], 1
jmp 0x42e004
and dword [eax], 0xfffffffe
push ebp
push ebp
push ebx
push dword [esi + 0x4f0]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e01b
or dword [eax], 2
jmp 0x42e01e
and dword [eax], 0xfffffffd
push ebp
push ebp
push ebx
push dword [esi + 0x514]
call edi
test eax, eax
mov eax, dword [esi + 0x54]
je 0x42e057
or dword [eax], 4
mov eax, dword [esi + 0x54]
cmp byte [eax + 0xd], 0
jne 0x42e05a
push 1
push ebp
push ebp
push str.http:__www.mql5.com__utm_campaignWebInstallerutm_mediumspecialutm_sourceinstaller
push str.open
push ebp
mov byte [eax + 0xd], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42e05a
and dword [eax], 0xfffffffb
push 3
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc34
ret