Function at 0x402b42
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0x6c8
mov eax, 0x447363
call fcn.00431b45
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x68c], edi
cmp dword [edi + 0x80], ebx
jbe 0x402b73
lea eax, [edi + 0x70]
push eax
call fcn.00401fac
pop ecx
lea ecx, [ebp - 0x683]
mov byte [ebp - 0x681], bl
mov byte [ebp - 0x679], bl
call fcn.00430a45
lea esi, [edi + 0x1c]
push esi
push edi
lea ecx, [ebp - 0x683]
mov dword [ebp - 4], ebx
call fcn.00401c8c
test al, al
je 0x4032b2
cmp dword [edi + 0x9c], ebx
jbe 0x402bba
lea eax, [edi + 0x8c]
push eax
call fcn.00401fac
pop ecx
add edi, 0xfc
cmp dword [edi + 0x14], 8
jb 0x402bc8
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x690]
call fcn.00402b01
xor ebx, ebx
inc ebx
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], bl
jb 0x402be4
mov eax, dword [esi]
jmp 0x402be6
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00402985
mov dword [ebp - 0x688], eax
mov edi, str..cab
push edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x680], ebx
call fcn.004323b4
pop ecx
mov ecx, dword [ebp - 0x688]
push eax
push edi
push dword [ecx + 0x10]
push 0
call fcn.004024d8
test eax, eax
jne 0x402c4e
push eax
push 0x448574
lea ecx, [ebp - 0x690]
call fcn.0040288d
mov ecx, eax
call fcn.0040253b
mov byte [ebp - 0x682], 1
test eax, eax
jns 0x402c55
mov byte [ebp - 0x682], 0
push 0
push ebx
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], ebx
call fcn.00401347
cmp byte [ebp - 0x682], 0
je 0x402dac
cmp dword [esi + 0x14], 8
jb 0x402c7d
mov eax, dword [esi]
jmp 0x402c7f
mov eax, esi
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004020f3
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._s360Ini.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x402cc4
mov eax, dword [esi]
jmp 0x402cc6
mov eax, esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0040215d
pop ecx
pop ecx
mov dword [ebp - 0x680], eax
test eax, eax
je 0x402d6f
push str.Start
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x688], eax
test eax, eax
je 0x402d63
push 0x220
lea eax, [ebp - 0x678]
push 0
push eax
call fcn.00432be0
add esp, 0xc
lea eax, [ebp - 0x678]
mov edi, 0x20323a
push eax
mov dword [ebp - 0x678], 3
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x668], 0x66ff300
call dword [ebp - 0x688]
push str.__silent_install3_1_1___homepagehttp:__hao.360.cn
lea eax, [ebp - 0x420]
push eax
push edi
mov byte [ebp - 0x679], 1
call fcn.00401f1a
add esp, 0xc
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x679], 0
jne 0x402dac
mov ecx, dword [ebp - 0x690]
add ecx, 0xfffffff0
call fcn.00402059
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x683]
call fcn.00401000
mov al, bl
call fcn.00431b8f
ret
cmp dword [esi + 0x14], 8
jb 0x402db6
mov eax, dword [esi]
jmp 0x402db8
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00402985
mov dword [ebp - 0x688], eax
mov edi, str..dll
push edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x680], 2
call fcn.004323b4
pop ecx
mov ecx, dword [ebp - 0x688]
push eax
push edi
push dword [ecx + 0x10]
push 0
call fcn.004024d8
test eax, eax
jne 0x402e24
push eax
push 0x4484d0
lea ecx, [ebp - 0x690]
call fcn.0040288d
mov ecx, eax
call fcn.0040253b
mov byte [ebp - 0x679], 1
test eax, eax
jns 0x402e2b
mov byte [ebp - 0x679], 0
push 0
push ebx
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], ebx
call fcn.00401347
cmp byte [ebp - 0x679], 0
je 0x402ee8
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x402e55
mov eax, dword [esi]
jmp 0x402e57
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x680], eax
test eax, eax
je 0x402ed5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetInterface
push eax
call edi
push str.ReleaseInterface
push dword [ebp - 0x680]
mov dword [ebp - 0x688], eax
call edi
mov edi, eax
cmp dword [ebp - 0x688], ebx
je 0x402ebe
test edi, edi
je 0x402ec9
call dword [ebp - 0x688]
mov ebx, eax
test ebx, ebx
je 0x402ebe
mov eax, dword [ebx]
push 2
push 0xc
push ebx
call dword [eax]
test eax, eax
je 0x402ebe
mov eax, dword [ebx]
push 0xffffffffffffffff
push ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
test edi, edi
je 0x402ec9
test ebx, ebx
je 0x402ec9
push ebx
call edi
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 0x14], 8
jb 0x402edf
mov eax, dword [esi]
jmp 0x402ee1
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x402ef2
mov eax, dword [esi]
jmp 0x402ef4
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x458]
call fcn.00402985
mov ebx, eax
mov edi, 0x4484a0
push edi
mov byte [ebp - 4], 4
mov dword [ebp - 0x680], 4
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.004024d8
test eax, eax
je 0x402f89
cmp dword [esi + 0x14], 8
jb 0x402f3f
mov eax, dword [esi]
jmp 0x402f41
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00402985
mov ebx, eax
mov edi, str..ini
push edi
mov dword [ebp - 4], 5
mov dword [ebp - 0x680], 0xc
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.004024d8
test eax, eax
je 0x402f89
xor bl, bl
jmp 0x402f8b
mov bl, 1
test byte [ebp - 0x680], 8
je 0x402faa
and dword [ebp - 0x680], 0xfffffff7
push 0
push 1
lea ecx, [ebp - 0x43c]
call fcn.00401347
xor eax, eax
inc eax
xor edi, edi
test byte [ebp - 0x680], 4
mov dword [ebp - 4], eax
je 0x402fc8
push edi
push eax
lea ecx, [ebp - 0x458]
call fcn.00401347
test bl, bl
je 0x4030e9
push 0x40
lea eax, [ebp - 0x6d0]
push edi
push eax
call fcn.00432be0
add esp, 0xc
push 0x456084
lea ecx, [ebp - 0x680]
mov dword [ebp - 0x6d4], 0x44
call fcn.00402575
mov ebx, dword [ebp - 0x68c]
mov byte [ebp - 4], 6
cmp dword [ebx + 0x48], edi
jbe 0x40303a
lea eax, [ebx + 0x38]
cmp dword [eax + 0x14], 8
jb 0x403016
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x403020
mov ecx, dword [esi]
jmp 0x403022
mov ecx, esi
push eax
push ecx
lea eax, [ebp - 0x680]
push str.__s___s
push eax
call fcn.0040292c
add esp, 0x10
jmp 0x40305b
cmp dword [esi + 0x14], 8
jb 0x403044
mov eax, dword [esi]
jmp 0x403046
mov eax, esi
push eax
lea eax, [ebp - 0x680]
push 0x448478
push eax
call fcn.0040292c
add esp, 0xc
push edi
lea ecx, [ebp - 0x680]
call fcn.004025f0
cmp dword [esi + 0x14], 8
jb 0x403071
mov ecx, dword [esi]
jmp 0x403073
mov ecx, esi
lea edx, [ebp - 0x430]
push edx
lea edx, [ebp - 0x6d4]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
je 0x4030b9
push 0xffffffffffffffff
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x430]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x42c]
call edi
xor edi, edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x680]
call fcn.00402321
cmp dword [esi + 0x14], 8
jb 0x4030ce
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x680]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00402059
jmp 0x4030ef
mov ebx, dword [ebp - 0x68c]
cmp dword [ebx + 0x64], edi
jbe 0x4032a4
cmp dword [ebx + 0xb8], edi
jbe 0x403293
mov esi, 0x448474
push esi
call fcn.004323b4
pop ecx
push eax
push 0
push esi
lea ecx, [ebx + 0xa8]
call fcn.00402358
mov esi, eax
cmp esi, 0xffffffff
je 0x40319b
push esi
push 0
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebx + 0xa8]
call fcn.00402940
lea ecx, [ebx + 0xc4]
push eax
mov byte [ebp - 4], 7
call fcn.00402aad
push 0
push 1
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 1
call fcn.00401347
push dword [ebx + 0xb8]
inc esi
push esi
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebx + 0xa8]
call fcn.00402940
lea ecx, [ebx + 0xe0]
push eax
mov byte [ebp - 4], 8
call fcn.00402aad
push 0
push 1
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 1
call fcn.00401347
and dword [ebp - 0x68c], 0
mov edi, str.HKEY_CLASSES_ROOT
push edi
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0xd4]
lea ecx, [ebx + 0xc4]
push 0
call fcn.004024d8
test eax, eax
jne 0x4031d1
mov ecx, connect
jmp 0x403253
mov edi, str.HKEY_CURRENT_USER
push edi
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0xd4]
lea ecx, [ebx + 0xc4]
push 0
call fcn.004024d8
test eax, eax
jne 0x4031fd
mov ecx, reloc.WS2_32.dll_accept
jmp 0x403253
mov edi, str.HKEY_LOCAL_MACHINE
push edi
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0xd4]
lea ecx, [ebx + 0xc4]
push 0
call fcn.004024d8
test eax, eax
jne 0x403229
mov ecx, reloc.WS2_32.dll_bind
jmp 0x403253
mov edi, str.HKEY_USERS
push edi
call fcn.004323b4
pop ecx
push eax
push edi
push dword [ebx + 0xd4]
lea ecx, [ebx + 0xc4]
push 0
call fcn.004024d8
test eax, eax
jne 0x4032a4
mov ecx, reloc.WS2_32.dll_closesocket
lea eax, [ebx + 0xe0]
cmp dword [eax + 0x14], 8
jb 0x403261
mov eax, dword [eax]
lea edx, [ebp - 0x68c]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403285
add ebx, 0x54
push ebx
call fcn.00401fac
pop ecx
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40329d
add ebx, 0x54
push ebx
call fcn.00401fac
pop ecx
mov byte [ebp - 0x681], 1
mov ecx, dword [ebp - 0x690]
add ecx, 0xfffffff0
call fcn.00402059
mov bl, byte [ebp - 0x681]
jmp 0x402d95