Function at 0x42c94e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa0
mov eax, 0x4851cc
call fcn.00468a6e
xor edi, edi
mov dword [ebp - 0x50], edi
test byte [0x4c1aa0], 1
jne 0x42c98f
or dword [0x4c1aa0], 1
push 0x48aba9
mov dword [0x4c1a90], edi
mov dword [0x4c1a94], edi
mov dword [0x4c1a98], edi
call fcn.00469879
pop ecx
mov eax, dword [0x4c1a90]
mov esi, 0x4c1a90
cmp eax, dword [0x4c1a94]
jne 0x42d33b
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
mov dword [ebp - 4], edi
mov edi, str.360safe
push edi
call fcn.00468f76
pop ecx
push eax
push edi
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
mov ebx, 0x48c308
push ebx
lea ecx, [ebp - 0x10]
call fcn.00418067
push str.InstallLocation
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00418067
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.360Safe.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.deepscanzhudongfangyu.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.EfiMon.sys
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.360SelfProtection
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
push str.360netmon
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.360sd
mov dword [ebp - 4], 0xa
call fcn.00468f76
pop ecx
push eax
push str.360sd
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
push str.InstallLocation
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xb
call fcn.00418067
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360SD
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xd
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xe
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.00417891
push str.360sd.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xf
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.00417891
push str.360rps.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x10
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.00417891
push str.360rp
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.baidusd
mov dword [ebp - 4], 0x12
call fcn.00468f76
pop ecx
push eax
push str.baidusd
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
mov byte [ebp - 4], 0x13
push str.UninstallString
lea ecx, [ebp - 0x18]
call fcn.00418067
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x15
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x16
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.00417891
push str.baidusdSvc.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x17
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.00417891
push str.baidusd.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x18
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.baidusafe
mov dword [ebp - 4], 0x19
call fcn.00468f76
pop ecx
push eax
push str.baidusafe
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
push str.UninstallString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
call fcn.00418067
push 0x492918
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x1c
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1d
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x19
call fcn.00417891
push str.BaiduAn.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1e
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x19
call fcn.00417891
push str.BaiduAnTray.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1f
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x19
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.rising
mov dword [ebp - 4], 0x20
call fcn.00468f76
pop ecx
push eax
push str.rising
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
push str.installpath
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x21
call fcn.00418067
push str.SOFTWARE_risingRAV
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x22
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x23
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x24
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00417891
push str.rstray.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x25
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00417891
push str.rsmain.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x26
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00417891
push str.ravmond.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x27
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00417891
push str.rsravmon
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x28
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.duba
mov dword [ebp - 4], 0x29
call fcn.00468f76
pop ecx
push eax
push str.duba
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
push str.ProgramPath
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x2a
call fcn.00418067
push str.softwarekingsoft_antivirus
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2b
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x2c
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2d
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x29
call fcn.00417891
push str.kxetray.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2e
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x29
call fcn.00417891
push str.kislive.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2f
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x29
call fcn.00417891
push str.kismain.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x30
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x29
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0x4c]
call fcn.0042c3f4
push str.QQPCMgr
mov dword [ebp - 4], 0x31
call fcn.00468f76
pop ecx
push eax
push str.QQPCMgr
lea ecx, [ebp - 0x4c]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00418067
push str.InstallDir
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x32
call fcn.00418067
push str.SOFTWARETencentQQPCMgr
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x33
call fcn.00418067
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x34
call fcn.0042bb58
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x35
call fcn.0042becb
lea ecx, [ebp - 0x60]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x31
call fcn.00417891
push str.QQPCMgr.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x36
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x31
call fcn.00417891
push str.QQPCRTP.exe
lea ecx, [ebp - 0x10]
call fcn.00418067
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x37
call fcn.004181f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x31
call fcn.00417891
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042c494
lea ecx, [ebp - 0xac]
call fcn.0042c3f4
push str.huorong
mov dword [ebp - 4], 0x38
call fcn.00468f76
pop ecx
push eax
push str.huorong
lea ecx, [ebp - 0xac]
call fcn.00417d8b
push ebx
lea ecx, [ebp - 0x50]
call fcn.00418067
push str.UninstallString
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x39
call fcn.00418067
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHuorongSysdiag
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3a
call fcn.00418067
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3b
call fcn.0042bb58
push eax
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x3c
call fcn.0042becb
lea ecx, [ebp - 0x78]
call fcn.0042b8e2
mov ecx, dword [ebp - 0x68]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.00417891
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x38
call fcn.00417891
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
call fcn.0042c8e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.0042c494
mov ecx, dword [ebp + 8]
push esi
call fcn.0042c818
mov eax, dword [ebp + 8]
call fcn.00468b46
ret