Function at 0x70274e20
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70316e1f
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
add eax, 0x10
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 4], 0
call fcn.7023e230
add esp, 4
test eax, eax
je 0x70274fec
lea ecx, [ebp - 0x8c]
push ecx
call fcn.7025a430
push 0x25
push str.http:__s.360.cn_wangdun_Operator.html
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.7020c1f0
push str.stype
mov ecx, 0x7032f1dc
lea ebx, [ebp - 0x8c]
call fcn.7025a5a0
mov edx, dword [ebp + 8]
push edx
push 0x7032628c
mov ecx, 0x14
lea edi, [ebp - 0x28]
call fcn.7021b4f0
add esp, 8
push 0x7032af34
mov ecx, edi
call fcn.7025a5a0
mov edi, dword [ebp - 0x90]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test edi, edi
je 0x70274f38
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x70274f38
lea ebx, [eax + eax]
mov eax, ebx
call fcn.702e98d0
mov edi, esp
test edi, edi
je 0x70274f32
mov eax, dword [ebp - 0x90]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov byte [edi], 0
call esi
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [ebp - 0x90]
jmp 0x70274f3a
mov edi, dword [ebp - 0x90]
xor eax, eax
push eax
lea ecx, [ebp - 0x8c]
push ecx
mov ecx, 0x70326160
call fcn.7025ae40
test edi, edi
je 0x70274f8f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x70274f8f
lea ebx, [eax + eax]
mov eax, ebx
call fcn.702e98d0
mov edi, esp
test edi, edi
je 0x70274f8f
mov edx, dword [ebp - 0x90]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call esi
neg eax
sbb eax, eax
and eax, edi
jmp 0x70274f91
xor eax, eax
push 0x40010
mov edi, eax
lea ecx, [ebp - 0x8c]
call fcn.7025b240
cmp dword [ebp - 0x34], 0
jne 0x70274fc2
lea eax, [ebp - 0x30]
push eax
call fcn.702a9810
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x70274fd1
mov dword [ebp - 0x34], 1
jmp 0x70274fc5
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 0x13c]
push 1
call eax
lea ecx, [ebp - 0x8c]
call fcn.7025af10
lea ecx, [ebp - 0x8c]
push ecx
mov byte [ebp - 4], 0
call fcn.7025a4a0
mov edx, dword [0x703580e4]
mov eax, dword [edx + 0xc]
mov ecx, 0x703580e4
call eax
add eax, 0x10
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x94]
push 0x70359f90
push ecx
mov byte [ebp - 4], 2
call fcn.70228650
mov ebx, eax
lea edx, [ebp - 0x9c]
push edx
mov edi, 0xa3
mov byte [ebp - 4], 3
call fcn.702278e0
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [ebx]
mov eax, dword [eax]
push ecx
push eax
lea edi, [ebp - 0x98]
call fcn.70208e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70275072
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x94]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70275098
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x98]
push ecx
call fcn.70261ef0
mov edx, dword [0x703580e4]
mov eax, dword [edx + 0xc]
add esp, 4
mov ecx, 0x703580e4
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x9c], ebx
lea ecx, [ebp - 0x94]
push ecx
mov edi, 0x8d
mov byte [ebp - 4], 5
call fcn.702278e0
mov eax, dword [ebp - 0x94]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x702750fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
lea ecx, [ebp - 0x94]
push 0x70359f90
xor esi, esi
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
push ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xc4], 0x28
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xb8], 0xc9
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb4], 0x2000000
call fcn.70228650
add esp, 8
mov byte [ebp - 4], 6
mov edi, dword [ebp - 0x94]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], ebx
call fcn.70261d00
test eax, eax
je 0x702751a9
lea edx, [ebp - 0xc4]
push edx
push esi
call dword [0x703597a8]
cmp byte [ebp - 0xac], 1
jne 0x70275202
push 0x40
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.702e95e0
add esp, 0xc
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x74]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
xor eax, eax
push esi
push 0x70359b40
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x74], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x24]
push ecx
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 5
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70275231
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70275251
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x98]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70275277
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x702752a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
lea esp, [ebp - 0xd4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret