Function at 0x402d3d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8c
mov eax, dword [0x451220]
xor eax, esp
mov dword [esp + 0xb88], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [esp + 0x14], ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
call fcn.00402749
mov ecx, dword [eax]
test ecx, ecx
je 0x402d96
call fcn.004114e9
test eax, eax
je 0x402d96
push str.Initialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402d96
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.00406e8b
call fcn.00413ab4
cmp dword [ebp + 8], 0
jne 0x402ddf
call fcn.00403c28
test eax, eax
je 0x402dcf
call fcn.00413ab4
lea eax, [esp + 0x33]
push eax
call fcn.0040ab65
call fcn.0040aba0
jmp 0x4036c2
call fcn.00401b63
test al, al
je 0x402ddf
xor eax, eax
jmp 0x4036c5
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
cmp dword [ebp + 8], 0
jne 0x402e37
lea eax, [esp + 0x20]
push eax
call fcn.004029c5
pop ecx
mov esi, eax
push esi
call fcn.00413ab4
pop ecx
cmp esi, 0xfffffffe
je 0x402f61
cmp esi, 0xffffff9c
je 0x402f61
cmp esi, 0xffffffff
je 0x402f55
cmp esi, 1
je 0x402f55
cmp esi, 2
je 0x402f55
call fcn.00413ab4
call fcn.00413ab4
call fcn.0040b495
test eax, eax
jne 0x402e45
call fcn.0040c16a
call fcn.00413ab4
call fcn.00402604
call fcn.00413ab4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea esi, [esp + 0x28]
call fcn.00406e38
push str._ElevateStandUserSaas
call fcn.00404c5b
test eax, eax
jle 0x402e77
call fcn.00402b83
push dword [esp + 0x24]
call fcn.00413ab4
mov eax, dword [0x453c6c]
pop ecx
mov ecx, 0x453c6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
call fcn.0040a226
pop ecx
call fcn.00413ab4
lea edi, [esp + 0x10]
call fcn.00409fae
lea esi, [esp + 0x40]
call fcn.00404d28
mov eax, dword [0x453c6c]
xor esi, esi
mov ecx, 0x453c6c
mov dword [esp + 0x1c], esi
call dword [eax + 0xc]
mov edi, eax
add edi, 0x10
lea eax, [esp + 0x10]
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], esi
call fcn.0040a1db
test eax, eax
je 0x402f87
mov ecx, dword [esp + 0x18]
xor eax, eax
inc eax
mov dword [ecx + 0xc], eax
mov dword [0x455594], eax
mov dword [0x4555a4], eax
call fcn.00407249
mov dword [ecx + 8], eax
add ecx, 4
call section..text
test eax, eax
jne 0x402f78
lea eax, [edi - 0x10]
call fcn.00406e8b
lea esi, [esp + 0x40]
call fcn.00404eaa
push dword [esp + 0x40]
call fcn.0042751c
pop ecx
lea ecx, [esp + 0x10]
call fcn.00409fea
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.00406e8b
jmp 0x402dd8
mov dword [0x454a28], 1
jmp 0x402f6e
call fcn.0040b553
test eax, eax
jne 0x402e32
call fcn.00413ab4
jmp 0x402dd8
lea eax, [esp + 0x10]
push eax
call fcn.0040a133
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a190
test eax, eax
je 0x40306b
call fcn.00403f72
call fcn.004122bb
xor ebx, ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
cmp dword [eax + 4], ebx
je 0x402fe2
xor esi, esi
call fcn.004122bb
cmp dword [eax + 4], ebx
je 0x402fbb
inc esi
push esi
push str.SOFTWARE360safe360ScanCC2FCASH
push edi
call fcn.00408859
add esp, 0xc
push esi
mov ecx, str.SOFTWARE360safe360Scan
call fcn.00408969
pop ecx
push esi
mov ecx, str.SOFTWARE360safe
call fcn.00408969
pop ecx
push 0x208
lea eax, [esp + 0x98c]
push ebx
push eax
call fcn.00429ac0
add esp, 0xc
push ebx
push 0x19
lea eax, [esp + 0x990]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [esp + 0x988], bx
je 0x40304b
push str.360.lnk
lea eax, [esp + 0x98c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40304b
lea eax, [esp + 0x988]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40304b
lea eax, [esp + 0x988]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.360DeepscanRunOnce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [esp + 0x10]
push eax
call fcn.0040a0f6
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a247
test eax, eax
je 0x4030f3
mov ecx, dword [esp + 0x18]
xor eax, eax
inc eax
mov dword [ecx + 0xc], eax
mov dword [0x455594], eax
mov dword [0x4555a4], eax
call fcn.00407249
mov dword [ecx + 8], eax
add ecx, 4
call section..text
test eax, eax
jne 0x4030e9
xor edi, edi
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.00406e8b
lea esi, [esp + 0x40]
call fcn.00404eaa
push dword [esp + 0x40]
call fcn.0042751c
pop ecx
lea ecx, [esp + 0x10]
call fcn.00409fea
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, edi
jmp 0x4036c5
call fcn.0040a28b
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a2da
test eax, eax
je 0x403164
and dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
call fcn.004039cb
test eax, eax
je 0x403682
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x403131
cmp eax, 2
je 0x403131
cmp eax, 0xb
je 0x403131
cmp eax, 0xc
jne 0x403682
mov eax, dword [0x453c6c]
mov ecx, 0x453c6c
call dword [eax + 0xc]
push dword [esp + 0x1c]
add eax, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push str.__emppara_d
push eax
call fcn.0040678c
mov esi, dword [esp + 0x24]
add esp, 0xc
jmp 0x40324e
lea eax, [esp + 0x10]
call fcn.0040a31e
test al, al
je 0x403188
push str.__PreventMode1
lea esi, [esp + 0x24]
call fcn.00406e38
mov esi, dword [esp + 0x20]
jmp 0x40324e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
call fcn.0040a42c
test eax, eax
je 0x403270
call fcn.004122bb
mov esi, dword [eax + 4]
call fcn.0040daeb
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov ecx, str._x641_
cmp dword [edi - 0xc], ebx
je 0x4031e4
cmp esi, ebx
jne 0x4031c4
mov ecx, 0x447820
call fcn.0040db95
push ecx
push edi
push 0x26e5
mov esi, eax
push ebx
push str._tpkill_list__f__typedisa_1__rid_d__md5__dst_d__l70__cmdl_s__s
mov ecx, esi
call fcn.0040dd1b
add esp, 0x14
jmp 0x40320a
cmp esi, ebx
jne 0x4031ed
mov ecx, 0x447820
call fcn.0040db95
push ecx
push 0x2700
mov esi, eax
push ebx
push str._tpkill_list__f__typedisa_1__rid_d__md5__dst_d__l70__cmdl__s
mov ecx, esi
call fcn.0040dd1b
add esp, 0x10
mov eax, esi
call fcn.0040dd0b
mov eax, dword [0x453c6c]
mov ecx, 0x453c6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
cmp dword [edi - 0xc], ebx
je 0x40323f
push edi
push str.__shamumaark1__cmd1__ddvn_s
push eax
call fcn.0040678c
add esp, 0xc
jmp 0x40324a
push str.__shamumaark1__cmd1
push eax
call fcn.00406e04
mov esi, dword [esp + 0x1c]
push esi
lea eax, [esp + 0x14]
push eax
call fcn.0040a087
push str._funnameshamuma_new
call fcn.004036df
lea eax, [esi - 0x10]
call fcn.00406e8b
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a51a
test al, al
je 0x40328a
call fcn.00413ab4
xor edi, edi
inc edi
jmp 0x4030a2
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
call fcn.0040a55c
test eax, eax
je 0x403307
call fcn.00413ab4
push str.GlobalScanInHpPrinterCheck_Q360DsMainMutex
xor esi, esi
inc esi
push esi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
mov dword [eax], esi
call fcn.004071b7
test eax, eax
je 0x4032ea
lea esi, [esp + 0x18]
call fcn.00407187
test eax, eax
jne 0x4032ea
mov ebx, dword [esp + 0x1c]
call fcn.00407057
mov ecx, dword [esp + 0x38]
neg eax
sbb eax, eax
neg eax
mov dword [ecx], eax
jmp 0x4032f1
call fcn.00413ab4
mov dword [ebx], edi
cmp dword [esp + 0x18], 0
je 0x403282
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403282
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
call fcn.0040a5e0
test eax, eax
je 0x403359
call fcn.00413ab4
push str.GlobalScanInHpPrinterCheck_Q360DsMainMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x18], eax
call fcn.004071b7
test eax, eax
je 0x403352
lea esi, [esp + 0x18]
call fcn.00407187
test eax, eax
jne 0x403352
mov ebx, dword [esp + 0x1c]
call fcn.004070ef
jmp 0x4032f1
call fcn.00413ab4
jmp 0x4032f1
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x14]
call fcn.0040a3a4
test eax, eax
je 0x40337e
call fcn.00413ab4
push dword [esp + 0x34]
call fcn.004046a7
jmp 0x403282
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
call fcn.0040a836
test eax, eax
je 0x4033bf
call fcn.00413ab4
mov esi, dword [esp + 0x28]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov edi, esp
call fcn.0040698f
add eax, 0x10
mov dword [edi], eax
call fcn.00404087
mov eax, esi
call fcn.00406e8b
xor edi, edi
inc edi
jmp 0x4030ae
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
call fcn.0040a927
test eax, eax
je 0x403414
call fcn.004111b7
test eax, eax
je 0x4033ff
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], esi
je 0x4033fd
push ecx
add eax, 0xfffffff0
mov esi, esp
call fcn.0040698f
add eax, 0x10
mov dword [esi], eax
call fcn.004100a4
pop ecx
mov dword [ebx], eax
jmp 0x403404
and dword [ebx], esi
call fcn.00413ab4
push dword [ebx]
call fcn.00413ab4
and dword [ebx], 0
pop ecx
jmp 0x403282
lea eax, [esp + 0x10]
call fcn.0040a95d
test eax, eax
je 0x403450
call fcn.004111b7
test eax, eax
je 0x40327d
call fcn.0041121e
test eax, eax
je 0x40327d
push ecx
push esp
call fcn.00410506
pop ecx
call fcn.0041062e
pop ecx
mov dword [ebx], eax
jmp 0x403282
lea eax, [esp + 0x10]
call fcn.0040a360
test eax, eax
je 0x403496
call fcn.004077f1
lea ebx, [esp + 0x98]
call fcn.0041798e
mov edi, ebx
call fcn.00417ac6
test eax, eax
je 0x403485
mov eax, ebx
call fcn.00418013
call fcn.00417f4e
lea edi, [esp + 0x98]
call fcn.00417a1c
jmp 0x403682
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
call fcn.0040a664
test eax, eax
je 0x4034d3
call fcn.00413ab4
call fcn.004077f1
lea eax, [esp + 0x58]
call fcn.00413cc4
push eax
lea ecx, [esp + 0x44]
call fcn.00414021
lea eax, [esp + 0x58]
call fcn.00413cc9
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a6e2
test eax, eax
je 0x40350d
call fcn.00413ab4
call fcn.004077f1
call fcn.00407bf4
test eax, eax
je 0x403637
lea edx, [esp + 0x58]
call fcn.00414a63
mov eax, edx
push eax
call fcn.00414a84
jmp 0x4035d2
lea eax, [esp + 0x10]
call fcn.0040a726
test eax, eax
je 0x403546
call fcn.00413ab4
call fcn.004077f1
call fcn.00407bf4
test eax, eax
je 0x403637
lea edx, [esp + 0x58]
call fcn.00414a63
mov edi, edx
call fcn.0041525c
jmp 0x4035d2
lea eax, [esp + 0x10]
call fcn.0040a7ae
test eax, eax
je 0x403570
call fcn.00413ab4
call fcn.004077f1
lea edx, [esp + 0x58]
call fcn.00414a63
mov eax, edx
push eax
call fcn.00414fc6
jmp 0x4035d2
lea eax, [esp + 0x10]
call fcn.0040a7f2
test eax, eax
je 0x4035a2
call fcn.004077f1
call fcn.00407bf4
test eax, eax
je 0x403682
lea edx, [esp + 0x58]
call fcn.00414a63
mov eax, edx
push eax
call fcn.0041518e
jmp 0x4035d2
lea eax, [esp + 0x10]
call fcn.0040a76a
test eax, eax
je 0x4035e0
call fcn.004077f1
call fcn.00407bf4
test eax, eax
je 0x403682
lea edx, [esp + 0x58]
call fcn.00414a63
mov eax, edx
push eax
call fcn.0041575a
lea esi, [esp + 0x58]
call fcn.00414a75
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040a993
test eax, eax
je 0x4035f9
call fcn.0040cde9
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x10]
call fcn.0040a9ce
test eax, eax
je 0x40363e
call fcn.00413ab4
call fcn.00407bf4
test eax, eax
je 0x403637
call fcn.00413ab4
lea eax, [esp + 0x58]
call fcn.0040b777
lea eax, [esp + 0x58]
push eax
call fcn.0040b79e
lea eax, [esp + 0x58]
call fcn.0040b794
jmp 0x403682
call fcn.00413ab4
jmp 0x403682
lea eax, [esp + 0x10]
call fcn.0040aa09
test eax, eax
je 0x403652
call fcn.0040e82a
jmp 0x4035f2
lea ebx, [esp + 0x20]
lea eax, [esp + 0x10]
call fcn.0040aa44
test eax, eax
je 0x403673
push dword [esp + 0x20]
call fcn.0040422b
mov edi, eax
jmp 0x4030a2
call fcn.00413ab4
lea eax, [esp + 0x10]
push eax
call fcn.0040a177
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.00406e8b
lea esi, [esp + 0x40]
call fcn.00404eaa
push dword [esp + 0x40]
call fcn.0042751c
pop ecx
lea ecx, [esp + 0x10]
call fcn.00409fea
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.00406e8b
xor eax, eax
inc eax
mov ecx, dword [esp + 0xb94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00427527
mov esp, ebp
pop ebp
ret 0xc