Function at 0x408bc0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x14e8
call fcn.00447e90
mov eax, dword [0x462100]
xor eax, esp
mov dword [esp + 0x14e4], eax
push esi
push 0x208
lea eax, [esp + 0x214]
push 0
push eax
call fcn.00434ac0
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360SafeTrashAutoScan.ini
lea edx, [esp + 0x214]
push edx
call esi
push 0x10ce
lea eax, [esp + 0x41c]
push str.ie_chachesysid3210sysid3075sysid3205sysid3106sysid3103sysid3204sysid3102sysid6004sysid3201sysid6003sysid3008sysid3002sysid6009sysid5999sysid3208sysid6002sysid3005sysid3209sysid6000sysid3009sysid6008sysid4011sysid3207sysid3203sysid3107sysid3206sysid3202sysid6001sysid4067sysid3000sysid4070sysid2004sysid3403sys_quick_timesysid7003sysid7000sysid3402sysid4069sysid4083sysid3129sysid4022sys_360_loudongsysid3046sysid7004sysid7005sys_adobe_airsys_adobe_photoshopsys_apple_updatesys_avastsys_avgsys_antivir_desktopsys_daemon_toolssysid4012sysid4013sysid4057sysid4020sysid2040sys_flash_cachesysid3404sysid4064sysid4004sys_office_filessysid3406sys_office_recentsysid3020sysid4062sys_ms_silverlightsysid4065sysid4009sysid4099sysid4005sysid3052sysid6007sysid3105sysid6006sysid4006sysid4082sysid4014sysid4063sysid2009sysid3023sys_ms_windefendersys_ms_livesysid3022sysid3014sysid4002sysid4003sysid3024sysid3007sysid3004sysid3003sysid4084sysid4097sysid3051sysid7001sysid7009sysid3025sysid3405sysid3048sysid4016sysid2018sysid4061sysid3401sys_ks_loudongsysid3011sysid4010sysid3016sysid3018sysid3050sysid3130sysid4101sys_lu_loudongsysid3600sysid3012sysid3070sysid3128sys_nortonsysid3019sysid4095sysid7002sysid3104sys_qq_loudongsysid3079sysid4001sysid3043sysid3067sysid3044sysid3021sysid3045sysid3015sysid3013sys_tmpsys_thumbsys_mem_zhuanchusys_win_err_reportsys_update_filessys_iis_logssysid3131sysid3073sys_win_pre_readsysid3078sysid3072sys_logssys_invalid_lnksys_update_uninstall_filessysid3101sysid4030sysid4031sysid4032sysid4033sysid4034sysid4035sysid4024sysid4025sysid4026sysid4027sysid4028sysid4029sysid4023sysid3074sysid3076sysid3211sysid4036sysid4037sysid4038sysid4053sysid4054sysid4055sysid4056sysid4039sysid4059sysid4040sysid4041sysid4042sysid4043sysid4045sysid4046sysid4047sysid4048sysid4049sysid4050sysid4051sysid4052
push eax
call fcn.00435260
add esp, 0xc
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0x41c]
push edx
push str.checked
push str.autoscan
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00434ac0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360Safe.exe
lea edx, [esp + 0xc]
push edx
call esi
call fcn.00402860
test eax, eax
je 0x408ce0
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040a280
add esp, 4
test eax, eax
jne 0x408cc8
push ebx
push 0x4670a8
lea esi, [esp + 0xc]
lea ebx, [esp + 0x10]
call fcn.0040a3a0
pop ebx
test eax, eax
je 0x408ce0
cmp dword [esp + 4], 3
je 0x408ce0
push 5
push 0
push str._funnameqinglilaji
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x14e8]
pop esi
xor ecx, esp
call fcn.004331eb
add esp, 0x14e8
ret