Function at 0x702752d0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x80
push 0xffffffffffffffff
push 0x70316da2
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp]
push eax
mov dword [ebp - 4], 0
call fcn.7025a430
push 0x25
push str.http:__s.360.cn_wangdun_Operator.html
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 1
call fcn.7020c1f0
push str.stype
mov ecx, str.CVE20146332
lea ebx, [ebp]
call fcn.7025a5a0
lea ecx, [ebp - 0x14]
push ecx
call fcn.7023e230
add esp, 4
test eax, eax
je 0x7027541f
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x702753a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x702753a8
lea edi, [eax + eax]
mov eax, edi
call fcn.702e98d0
mov esi, esp
test esi, esi
je 0x702753a8
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x702753aa
xor eax, eax
push eax
lea edx, [ebp]
push edx
mov ecx, 0x70326160
call fcn.7025ae40
test ebx, ebx
je 0x7027540c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x7027540c
lea edi, [eax + eax]
mov eax, edi
call fcn.702e98d0
mov esi, esp
test esi, esi
je 0x7027540c
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
push 0x40010
mov edi, eax
lea ecx, [ebp]
call fcn.7025b240
jmp 0x70275497
xor eax, eax
push 0x40010
mov edi, eax
lea ecx, [ebp]
call fcn.7025b240
jmp 0x70275497
xor eax, eax
mov dword [ebp + 0x78], 0xf
mov dword [ebp + 0x74], eax
mov byte [ebp + 0x64], al
mov byte [ebp - 4], 2
cmp dword [0x7035a008], eax
je 0x70275443
push 5
push str.in_ce
jmp 0x7027545b
cmp dword [0x7035a004], eax
je 0x70275454
push 5
push str.in_se
jmp 0x7027545b
push 6
push str.no_url
lea ecx, [ebp + 0x60]
call fcn.7020c1f0
mov eax, dword [ebp + 0x64]
mov esi, 0x10
cmp dword [ebp + 0x78], esi
jae 0x70275473
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp]
push eax
mov ecx, 0x70326160
call fcn.7025ae40
mov byte [ebp - 4], 1
cmp dword [ebp + 0x78], esi
jb 0x70275497
mov ecx, dword [ebp + 0x64]
push ecx
call fcn.702e1c24
add esp, 4
cmp dword [ebp + 0x58], 0
jne 0x702754b6
lea edx, [ebp + 0x5c]
push edx
call fcn.702a9810
mov ecx, dword [ebp + 0x5c]
test ecx, ecx
je 0x702754c5
mov dword [ebp + 0x58], 1
jmp 0x702754b9
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x13c]
push 1
call edx
lea ecx, [ebp]
call fcn.7025af10
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push 0x70359f90
push eax
mov byte [ebp - 4], 3
call fcn.70228650
mov esi, eax
lea ecx, [ebp - 0x20]
mov bl, 4
push ecx
mov edi, 0xdc
mov byte [ebp - 4], bl
call fcn.702278e0
mov byte [ebp - 4], 5
mov edx, dword [esi]
mov eax, dword [eax]
push edx
push eax
lea edi, [ebp - 0x18]
call fcn.70208e90
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70275540
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70275563
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.70261ef0
xor eax, eax
lea edx, [ebp - 0x10]
push 0x70359f90
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x3c], 0xc9
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x2000000
call fcn.70228650
lea eax, [ebp - 0x1c]
push eax
mov edi, 0xdd
mov byte [ebp - 4], 6
call fcn.702278e0
add esp, 0x10
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
call fcn.70261d00
test eax, eax
je 0x702755f4
lea edx, [ebp - 0x48]
push edx
push ebx
call dword [0x703597a8]
cmp byte [ebp - 0x30], 1
jne 0x70275653
push 0x40
lea eax, [ebp - 0x88]
push ebx
push eax
call fcn.702e95e0
add esp, 0xc
lea ecx, [ebp + 0x6c]
push ecx
lea edx, [ebp - 0x8c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
xor eax, eax
push ebx
push 0x70359b40
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x8c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp + 0x6c]
push ecx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70275684
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x702756a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x702756c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp]
push ecx
mov byte [ebp - 4], 0
call fcn.7025a4a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x702756fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
lea esp, [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.702e1c2f
add ebp, 0x80
mov esp, ebp
pop ebp
ret