Function at 0x428360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12ec
call fcn.004cd140
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x20e]
xor eax, eax
push edi
xor ebx, ebx
push ecx
mov dword [ebp - 0x12d0], ebx
mov word [ebp - 0x210], ax
call fcn.004c5470
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x428412
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x428412
push str.360BDoctorExt_bin360FeedBack.exe
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x428412
lea eax, [ebp - 0x210]
lea ecx, [ebp - 0x12b0]
lea ebx, [edi + 1]
call fcn.00401520
call fcn.0044e7d0
test al, al
je 0x428412
lea ecx, [ebp - 0x210]
call fcn.00450b20
mov byte [ebp - 0x1291], bl
test al, al
jne 0x428419
mov byte [ebp - 0x1291], 0
test bl, 1
je 0x428436
cmp dword [ebp - 0x1298], 8
jb 0x428436
mov edx, dword [ebp - 0x12ac]
push edx
call fcn.004c097a
add esp, 4
cmp byte [ebp - 0x1291], 0
je 0x42846d
push 0xa
push edi
push edi
lea eax, [ebp - 0x210]
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov ebx, 7
push 9
mov eax, 0x5195ac
lea esi, [ebp - 0x12cc]
mov dword [ebp - 0x12b4], ebx
mov dword [ebp - 0x12b8], edi
mov word [ebp - 0x12c8], cx
call fcn.004017f0
xor edx, edx
push 1
mov eax, 0x5193a4
lea esi, [ebp - 0x1274]
mov dword [ebp - 0x125c], ebx
mov dword [ebp - 0x1260], edi
mov word [ebp - 0x1270], dx
call fcn.004017f0
lea eax, [ebp - 0x12cc]
push eax
mov ecx, esi
push ecx
lea ecx, [ebp - 0x12b0]
call fcn.0044d1b0
mov ecx, eax
lea edi, [ebp - 0x12ec]
call fcn.0040e410
add esp, 4
mov ecx, eax
lea edi, [ebp - 0x1290]
call fcn.0040e410
mov esi, 8
add esp, 4
cmp dword [ebp - 0x12d4], esi
jb 0x428511
mov edx, dword [ebp - 0x12e8]
push edx
call fcn.004c097a
add esp, 4
xor edi, edi
xor eax, eax
mov dword [ebp - 0x12d4], ebx
mov dword [ebp - 0x12d8], edi
mov word [ebp - 0x12e8], ax
cmp dword [ebp - 0x1298], esi
jb 0x42853f
mov ecx, dword [ebp - 0x12ac]
push ecx
call fcn.004c097a
add esp, 4
xor edx, edx
mov dword [ebp - 0x1298], ebx
mov dword [ebp - 0x129c], edi
mov word [ebp - 0x12ac], dx
cmp dword [ebp - 0x125c], esi
jb 0x42856b
mov eax, dword [ebp - 0x1270]
push eax
call fcn.004c097a
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x125c], ebx
mov dword [ebp - 0x1260], edi
mov word [ebp - 0x1270], cx
cmp dword [ebp - 0x12b4], esi
jb 0x428597
mov edx, dword [ebp - 0x12c8]
push edx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 0x128c]
cmp dword [ebp - 0x1278], esi
jae 0x4285ab
lea ecx, [ebp - 0x128c]
call fcn.00450b20
test al, al
je 0x428683
xor eax, eax
mov word [ebp - 0x1270], ax
push edi
mov eax, 0x51c620
lea esi, [ebp - 0x1274]
mov dword [ebp - 0x125c], ebx
mov dword [ebp - 0x1260], edi
call fcn.004017f0
mov ebx, esi
lea esi, [ebp - 0x1290]
call fcn.00407e40
xor ecx, ecx
push 0x1046
push ecx
lea edx, [ebp - 0x1256]
push edx
mov word [ebp - 0x1258], cx
call fcn.004c5470
mov eax, dword [ebp - 0x1270]
mov esi, 8
add esp, 0xc
cmp dword [ebp - 0x125c], esi
jae 0x428622
lea eax, [ebp - 0x1270]
push eax
lea eax, [ebp - 0x1258]
push str.http:__suggest.se.360.cn_sedoctor_ctypesecversion_s
push eax
or edx, 0xffffffff
call fcn.0042bcd0
mov eax, dword [ebp - 0x128c]
add esp, 0xc
cmp dword [ebp - 0x1278], esi
jae 0x42864e
lea eax, [ebp - 0x128c]
push 0xa
push 0
lea ecx, [ebp - 0x1258]
push ecx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x125c], esi
jb 0x428683
mov edx, dword [ebp - 0x1270]
push edx
call fcn.004c097a
add esp, 4
cmp dword [ebp - 0x1278], esi
jb 0x42869a
mov eax, dword [ebp - 0x128c]
push eax
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret