Function at 0x48bc15
Capabilities:
Check if file exists
Create thread
Get common file path
Persist via app paths registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push 0xe40
mov eax, 0x527d79
call fcn.004f21fd
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xcf8], esi
mov edi, ecx
mov dword [ebp - 0xce8], edx
mov dword [ebp - 0xd04], 1
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x48bcbb
mov eax, dword [ebx]
mov ecx, 0x4c42444d
cmp eax, ecx
ja 0x48cfa5
je 0x48cdd6
mov ecx, 0x1f9
cmp eax, ecx
ja 0x48c4ed
je 0x48c4e3
cmp eax, 0x25
ja 0x48c10e
cmp eax, 0x24
jae 0x48c0da
cmp eax, 0x16
ja 0x48be15
je 0x48be07
dec eax
je 0x48bde4
dec eax
dec eax
je 0x48bd48
sub eax, 0xa
je 0x48bd04
sub eax, 4
je 0x48bcd2
dec eax
dec eax
je 0x48bcc9
dec eax
dec eax
jne 0x48bcbb
push 1
mov ecx, edi
call fcn.00490fc0
mov eax, dword [ebp - 0xd04]
call fcn.004f2259
ret 4
mov esi, edi
call fcn.00494afa
jmp 0x48bcbb
push esi
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x48bcee
push 1
push esi
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push 0x3e8
push 0x452
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x48bcbb
cmp dword [ebx + 4], 0x410
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
mov esi, 0x208
push esi
push ebx
call fcn.004e785a
pop ecx
pop ecx
cmp eax, esi
jae 0x48bcbb
push ebx
lea eax, [ebp - 0xd18]
push eax
call fcn.00405747
lea eax, [ebp - 0xd18]
push eax
mov byte [ebp - 4], 0x17
call fcn.00491580
jmp 0x48caba
cmp dword [0x585740], esi
je 0x48bd65
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48bcbb
push esi
push 3
jmp 0x48d740
push 1
push 1
lea eax, [ebp - 0xe10]
call fcn.00411173
pop ecx
pop ecx
push str.galaxy.dat
push eax
lea eax, [ebp - 0xa54]
push eax
mov byte [ebp - 4], 4
call fcn.0041e00a
add esp, 0xc
push 0
push 1
lea esi, [ebp - 0xe10]
mov byte [ebp - 4], 6
call fcn.00404e82
cmp dword [ebp - 0xa3c], 8
mov edi, dword [ebp - 0xa50]
jae 0x48bdb7
lea edi, [ebp - 0xa50]
call fcn.0048586e
push edi
mov esi, eax
call int.004150b0
call fcn.0048586e
mov ecx, eax
call fcn.00415651
lea esi, [ebp - 0xa54]
push 0
push 1
call fcn.00404e82
jmp 0x48bcbb
call fcn.004365aa
mov ecx, dword [eax + 0x1c]
cmp ecx, esi
jne 0x48bdfc
cmp dword [eax + 0x18], esi
je 0x48bdfc
call fcn.00436847
mov ecx, dword [eax]
mov dword [ebp - 0xd04], ecx
jmp 0x48bcbb
push 1
mov esi, edi
call fcn.00495038
jmp 0x48bcbb
sub eax, 0x17
je 0x48c0d3
dec eax
je 0x48c08e
sub eax, 6
je 0x48bf79
sub eax, 3
je 0x48bebb
dec eax
je 0x48be72
dec eax
jne 0x48bcbb
push dword [ebx + 4]
mov edi, dword [ebx + 8]
lea ecx, [ebp - 0xdf4]
call fcn.0043088e
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.0049a7ef
push 0
push 1
lea ecx, [ebp - 0xdf4]
call fcn.004051fe
jmp 0x48bcbb
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x48bcbb
shr eax, 1
dec eax
push eax
push ebx
lea eax, [ebp - 0xdd8]
call fcn.004238e9
push edi
mov byte [ebp - 4], 0x1c
call fcn.0049a358
lea esi, [ebp - 0xdd8]
jmp 0x48bdd6
cmp dword [ebx + 4], 0x10
jne 0x48bcbb
cmp dword [ebx + 8], esi
je 0x48bcbb
push 2
mov esi, edi
call fcn.0049a736
test al, al
je 0x48bcbb
cmp dword [edi + 0x68c], 0
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
mov ebx, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xd10], ecx
mov dword [ebp - 0xd0c], eax
jne 0x48bf33
push 0x582e91
push 0x1f0
call fcn.004eb6e3
pop ecx
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x48bf27
mov esi, eax
call fcn.004b361f
jmp 0x48bf29
xor eax, eax
mov byte [ebp - 4], 0
mov dword [edi + 0x68c], eax
mov eax, dword [edi + 0x68c]
test eax, eax
je 0x48bcbb
mov dword [eax + 0x1e4], 1
mov edi, dword [edi + 0x68c]
mov eax, dword [ebp - 0xd10]
mov dword [edi + 0x1d0], eax
mov eax, dword [ebp - 0xd0c]
mov dword [edi + 0x1e0], ebx
mov dword [edi + 0x1d4], eax
call fcn.004a4509
jmp 0x48bcbb
cmp dword [ebx + 4], 0xc
jne 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
cmp byte [edi + 0x6e0], 0
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xd1c], eax
mov byte [ebp - 0xce1], 0
je 0x48bfd4
cmp eax, dword [edi + 0x6ec]
jb 0x48bfcd
ja 0x48bfc4
cmp ebx, dword [edi + 0x6e8]
jb 0x48bfcd
mov byte [ebp - 0xce1], 1
jmp 0x48bfe1
mov byte [ebp - 0xce1], 0
cmp byte [edi + 0x6d5], 0
je 0x48c06d
push 0
mov esi, edi
call fcn.0049a736
test al, al
je 0x48c06d
cmp dword [edi + 0x688], 0
jne 0x48c02b
push 0x582e91
push 0x1f0
call fcn.004eb6e3
pop ecx
pop ecx
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x48c01f
mov esi, eax
call fcn.004b361f
jmp 0x48c021
xor eax, eax
mov byte [ebp - 4], 0
mov dword [edi + 0x688], eax
mov eax, dword [edi + 0x688]
test eax, eax
je 0x48c06d
push dword [ebp - 0xd1c]
movzx ecx, word [edi + 0x6d6]
push ebx
push dword [ebp - 0xcf8]
push dword [edi + 0x6dc]
push dword [edi + 0x6d8]
push ecx
mov cl, byte [edi + 0x6d5]
push eax
mov al, byte [ebp - 0xce1]
call fcn.004b36c7
jmp 0x48bcbb
push 0
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x48bcbb
push 1
push 0
push 0x10
push eax
jmp 0x48dae5
mov ecx, dword [0x5856ac]
cmp ecx, esi
je 0x48bcbb
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd00]
mov dword [ebp - 0xd00], 0x18
mov dword [ebp - 0xcf8], eax
call fcn.00484952
jmp 0x48bcbb
push 8
jmp 0x48be09
mov ecx, dword [0x5856ac]
cmp ecx, esi
je 0x48bcbb
cmp eax, 0x24
jne 0x48c0f4
mov eax, 0x7e9
jmp 0x48c102
cmp eax, 0x25
jne 0x48bcbb
mov eax, 0x7ea
push esi
push eax
push 0xc34
jmp 0x48ce5d
mov ecx, 0x191
cmp eax, ecx
ja 0x48c3e8
je 0x48c3c5
sub eax, 0x26
je 0x48c352
sub eax, 0xd
je 0x48c211
dec eax
je 0x48c205
sub eax, 0xfe
je 0x48c1e6
sub eax, 0x37
je 0x48c173
sub eax, 0x27
jne 0x48bcbb
add edi, 0x65c
mov eax, edi
call fcn.004a1f66
push 1
call fcn.004a2391
pop ecx
push edi
call fcn.004a22ab
jmp 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
mov eax, dword [0x5856ac]
mov byte [ebp - 0xce8], 0
cmp eax, esi
je 0x48bcbb
cmp dword [ebx], 0xc3
jne 0x48c1a1
mov byte [ebp - 0xce8], 1
push dword [ebp - 0xce8]
push eax
call fcn.004843ad
cmp eax, 1
jne 0x48bcbb
xor eax, eax
cmp byte [ebp - 0xce8], al
push esi
push 0x1f4
sete al
push esi
push esi
push eax
push 0x546ef8
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
cmp dword [ebx], 1
jne 0x48bcbb
mov dword [ebp - 0xd04], esi
jmp 0x48bcbb
mov ecx, edi
call fcn.0049acdc
jmp 0x48bcbb
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0xce8], ebx
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.004e7380
add esp, 0xc
push str.config.ini
push 0x585d80
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48c2ad
push 0x40
lea esi, [ebp - 0xce8]
call fcn.0040566b
lea ecx, [ebp - 0x220]
push ecx
push 0x40
push eax
push 0x53c87c
push str.language
push 0x53c2a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or eax, 0xffffffff
call fcn.00423989
mov ebx, dword [ebp - 0xce8]
xor esi, esi
cmp dword [ebx - 0xc], esi
jne 0x48c2bf
lea eax, [ebx - 0x10]
call fcn.0040557a
jmp 0x48bcbb
lea esi, [ebp - 0xd2c]
call fcn.00435eda
push dword [eax]
push ebx
call fcn.004ead89
mov ebx, eax
mov eax, dword [ebp - 0xd2c]
neg ebx
pop ecx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.0040557a
test bl, bl
je 0x48c2f9
mov eax, dword [ebp - 0xce8]
add eax, 0xfffffff0
jmp 0x48c2b5
call fcn.00496787
mov eax, dword [0x5856ac]
test eax, eax
je 0x48c341
lea ecx, [ebp - 0xd00]
push ecx
push 0
push 0x4a
push dword [0x5864d4]
mov ecx, str.Q360SafeMonClass
push eax
mov dword [ebp - 0xd00], 0x45584954
mov dword [ebp - 0xcf8], str.swchlan
mov dword [ebp - 0xcfc], 8
call fcn.00484b5d
push 0
push 0x7fff7e
push 0x64
push edi
call fcn.0048a5bb
jmp 0x48c2ee
cmp edx, 0xfffe
jne 0x48bcbb
cmp dword [ebx + 4], 8
jne 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
push 8
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x48bcbb
mov eax, dword [ebx + 8]
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xa78]
mov dword [ebp - 0xa78], esi
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa60], esi
call fcn.00438285
mov eax, dword [ebp - 0xa60]
pop ecx
jmp 0x48cf64
cmp dword [ebx + 4], 4
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
push dword [ebx]
mov ecx, edi
call fcn.00496e63
jmp 0x48bcbb
sub eax, 0x192
je 0x48c4c4
sub eax, 0x62
je 0x48c462
dec eax
dec eax
je 0x48c44d
dec eax
je 0x48c42b
dec eax
jne 0x48bcbb
cmp dword [ebx + 4], 0x2d0
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
push ebx
mov ecx, edi
call fcn.0049a198
jmp 0x48bcbb
cmp dword [ebx + 4], 0x30
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
push edi
mov edi, ebx
call fcn.00499f5e
jmp 0x48bcbb
push edi
mov eax, ebx
mov dword [ebx], 0x1f4
call fcn.00494fb0
push esi
push esi
jmp 0x48d792
push edi
mov eax, ebx
call fcn.00494fb0
cmp eax, esi
je 0x48bcbb
mov eax, dword [0x5856ac]
mov esi, eax
test eax, eax
je 0x48bcbb
push ebx
push eax
call fcn.00484a2f
cmp eax, 1
je 0x48c499
and dword [ebp - 0xd04], 0
jmp 0x48bcbb
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xd00], 0x1f6
mov dword [ebp - 0xcf8], eax
jmp 0x48d7f5
cmp dword [ebx + 4], 4
jne 0x48bcbb
cmp dword [ebx + 8], esi
je 0x48bcbb
mov ecx, edi
call fcn.00496b37
jmp 0x48bcbb
call fcn.0049a206
jmp 0x48bcbb
mov ecx, 0x444e5343
cmp eax, ecx
ja 0x48cdf4
je 0x48cf29
mov esi, 0x43505552
cmp eax, esi
ja 0x48cd9c
je 0x48c98b
mov ecx, 0x41505343
cmp eax, ecx
ja 0x48c975
je 0x48c71e
cmp eax, 0x259
jb 0x48bcbb
cmp eax, 0x25a
jbe 0x48c70f
cmp eax, 0x322
jbe 0x48bcbb
cmp eax, 0x326
jbe 0x48c6f8
cmp eax, 0x534258
jne 0x48bcbb
cmp dword [0x585740], 0
je 0x48dad2
cmp dword [ebx + 4], 0x210
jne 0x48bcbb
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48bcbb
xor eax, eax
mov word [ebx + 0x20a], ax
add ebx, 4
push ebx
call fcn.0040b1b1
pop ecx
test al, al
jne 0x48c5f7
push ebx
call fcn.0040b5f7
pop ecx
test al, al
jne 0x48c5f7
push ebx
lea eax, [ebp - 0xa54]
call fcn.0040441b
push 0x52f388
lea eax, [ebp - 0xa74]
mov byte [ebp - 4], 0x10
call fcn.0040441b
mov byte [ebp - 4], 0x11
mov eax, dword [0x5856ac]
test eax, eax
je 0x48c5e3
push eax
lea edx, [ebp - 0xa74]
lea ecx, [ebp - 0xa54]
call fcn.00484787
push 0
push 1
lea esi, [ebp - 0xa74]
call fcn.00404e82
jmp 0x48bdd0
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
lea eax, [ebp - 0xce0]
push eax
call fcn.0044b075
push ecx
mov byte [ebp - 4], 0xe
mov eax, esp
mov dword [ebp - 0xcf8], esp
push ecx
xor edi, edi
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0xcf8], esp
push esi
lea esi, [ebp - 0xcb4]
mov dword [eax], edi
call fcn.0044d511
cmp eax, edi
je 0x48c6e3
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0xe48]
call fcn.0043913e
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x48c663
mov eax, dword [eax + 4]
jmp 0x48c666
add eax, 4
push eax
push dword [ebp - 0xcb0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 1
lea esi, [ebp - 0xe48]
call fcn.00404e82
lea eax, [ebp - 0xce0]
push eax
call fcn.0044cb8b
push edi
push str.IDS_SYS_EXE_NOT_IN_SB
push 0xffffffffffffffff
lea ecx, [ebp - 0xe2c]
call fcn.0043913e
add esp, 0xc
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 8
jb 0x48c6b2
mov eax, dword [eax + 4]
jmp 0x48c6b5
add eax, 4
push edi
mov edx, eax
lea ecx, [ebp - 0xce0]
call fcn.0044c8aa
push edi
push 1
lea esi, [ebp - 0xe2c]
mov byte [ebp - 4], 0xe
call fcn.00404e82
push edi
push 1
lea esi, [ebp - 0xce0]
call fcn.0044c7ce
lea eax, [ebp - 0xce0]
push eax
mov byte [ebp - 4], 0
call fcn.0044b1d0
jmp 0x48bcbb
mov ecx, dword [0x5856ac]
test ecx, ecx
je 0x48bcbb
push 0
push eax
push ecx
jmp 0x48d741
lea eax, [ebp - 0xd04]
push eax
push ebx
push 0
jmp 0x48e03d
mov ecx, dword [ebx + 4]
cmp ecx, 4
jne 0x48c904
mov eax, dword [ebx + 8]
mov dword [ebp - 0xce8], eax
test eax, eax
je 0x48c904
mov eax, dword [0x5856ac]
mov dword [ebp - 0xcec], eax
test eax, eax
je 0x48c8f9
mov esi, dword [ebp - 0xce8]
mov eax, 0x100
test dword [esi], eax
je 0x48c770
push eax
call fcn.00448bf8
pop ecx
push eax
push dword [ebp - 0xcec]
call fcn.004842b1
mov eax, 0x200
test dword [esi], eax
je 0x48c78c
push eax
call fcn.00448bf8
pop ecx
push eax
push dword [ebp - 0xcec]
call fcn.0048432f
mov eax, 0x400
test dword [esi], eax
je 0x48c7ba
push eax
call fcn.00448bf8
xor esi, esi
pop ecx
xor ecx, ecx
inc esi
cmp al, 1
jne 0x48c7a7
mov ecx, esi
push 0
push ecx
push esi
push 3
push dword [ebp - 0xcec]
call fcn.0048442f
jmp 0x48c7bd
xor esi, esi
inc esi
mov ebx, dword [ebp - 0xce8]
mov eax, 0x800
test dword [ebx], eax
je 0x48c7ec
push eax
call fcn.00448bf8
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x48c7db
mov ecx, esi
push 0
push ecx
push esi
push 4
push dword [ebp - 0xcec]
call fcn.0048442f
mov eax, 0x1000
test dword [ebx], eax
je 0x48c815
push eax
call fcn.00448bf8
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x48c804
mov ecx, esi
push 0
push ecx
push esi
push 5
push dword [ebp - 0xcec]
call fcn.0048442f
mov eax, 0x2000
test dword [ebx], eax
je 0x48c83e
push eax
call fcn.00448bf8
pop ecx
xor ecx, ecx
cmp al, 1
jne 0x48c82d
mov ecx, esi
push 0
push ecx
push esi
push 6
push dword [ebp - 0xcec]
call fcn.0048442f
mov eax, 0x10000000
test dword [ebx], eax
je 0x48c895
push eax
call fcn.00448bf8
mov bl, al
xor eax, eax
pop ecx
cmp bl, 1
jne 0x48c859
mov eax, esi
and dword [ebp - 0xd18], 0
lea ecx, [ebp - 0xd18]
push ecx
push eax
push esi
push 7
push dword [ebp - 0xcec]
call fcn.0048442f
cmp bl, 1
jne 0x48c895
push 0
push dword [ebp - 0xd18]
push 0x18aa0
push str.Q360InternationSafeClass
call fcn.004368f9
add esp, 0x10
mov eax, dword [ebp - 0xce8]
test dword [eax], 0x20000000
je 0x48c8aa
mov esi, edi
call fcn.00494ff8
mov ebx, dword [ebp - 0xce8]
test dword [ebx], 0x530000
je 0x48c8cb
push 0
push 0
push 1
push 8
push dword [ebp - 0xcec]
call fcn.0048442f
test dword [ebx], 0x13f00
je 0x48c8f9
mov esi, dword [0x5856ac]
test esi, esi
je 0x48c8f9
call fcn.004b8bf5
xor ecx, ecx
test al, al
setne cl
push 0
mov eax, ecx
push eax
push 0xbd3
push esi
call fcn.0048458b
push 1
mov esi, edi
call fcn.00495038
jmp 0x48c96b
cmp ecx, 8
jne 0x48c96b
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48c96b
cmp dword [ebx], ecx
jne 0x48c96b
mov eax, dword [0x5856ac]
mov esi, eax
test eax, eax
je 0x48c96b
mov eax, 0x585d80
call fcn.00443792
test al, al
jne 0x48c942
call int.00408c5f
push 0
call fcn.004707db
cmp eax, 1
je 0x48c942
xor al, al
jmp 0x48c944
mov al, 1
test byte [ebx + 4], 1
je 0x48c96b
test al, al
je 0x48c95c
call fcn.00448c4a
test al, al
je 0x48c95c
xor eax, eax
inc eax
jmp 0x48c95e
xor eax, eax
push 0
push eax
push 1
push 0xa
push esi
call fcn.0048442f
call fcn.00490a5b
jmp 0x48bcbb
cmp eax, 0x434c4541
je 0x48ca3c
cmp eax, 0x43504d52
jne 0x48bcbb
mov eax, 0xd0
cmp dword [ebx + 4], eax
jne 0x48bcbb
mov edi, dword [ebx + 8]
test edi, edi
je 0x48bcbb
cmp dword [edi], eax
jne 0x48bcbb
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0xcec]
push eax
call fcn.00405747
mov byte [ebp - 4], 7
mov edi, dword [edi + 0xcc]
test edi, edi
jne 0x48cb87
mov ebx, dword [ebx]
cmp ebx, 0x43504d52
jne 0x48cac5
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
call fcn.00405747
push ecx
mov byte [ebp - 4], 8
mov eax, esp
mov dword [ebp - 0xd0c], esp
push str.SOFTWARE360TotalSecurityUpdate
push eax
call fcn.00405747
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xd90]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004049f3
push eax
call fcn.00404ad9
add esp, 0xc
lea esi, [ebp - 0xd90]
jmp 0x48cd65
mov eax, dword [0x5856ac]
mov ebx, eax
test eax, eax
je 0x48bcbb
lea eax, [ebp - 0xd18]
push eax
call fcn.00442c5a
pop ecx
xor eax, eax
mov byte [ebp - 4], 2
lea edi, [ebp - 0xcc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x208
stosw word es:[edi], ax
lea eax, [ebp - 0xcbe]
push 0
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0xcc8]
push eax
push 0xa
mov edx, 0x546ef0
pop ecx
call fcn.0043ab6a
push dword [ebp - 0xd18]
lea edx, [ebp - 0xcbe]
push 0x104
call fcn.00424ffd
mov eax, dword [ebx]
push 0x212
lea ecx, [ebp - 0xcc8]
push ecx
mov ecx, ebx
call dword [eax]
mov eax, dword [ebp - 0xd18]
jmp 0x48c2f4
cmp ebx, esi
jne 0x48cd6a
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.manualver
push eax
call fcn.00405747
push ecx
mov byte [ebp - 4], 9
mov eax, esp
mov dword [ebp - 0xd0c], esp
mov ebx, str.SOFTWARE360TotalSecurityUpdate
push ebx
push eax
call fcn.00405747
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0xd70]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004049f3
push eax
call fcn.00404ad9
add esp, 0xc
lea esi, [ebp - 0xd70]
call fcn.00401105
xor esi, esi
push esi
push dword [ebp - 0xcec]
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
call fcn.00405747
push ecx
mov byte [ebp - 4], 0xa
mov eax, esp
mov dword [ebp - 0xd0c], esp
push ebx
push eax
call fcn.00405747
push edi
lea eax, [ebp - 0xda0]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004049f3
push eax
call fcn.00404ad9
add esp, 0xc
lea esi, [ebp - 0xda0]
jmp 0x48cd65
cmp edi, 1
jne 0x48cd6a
xor eax, eax
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd18], eax
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xce8]
push eax
push str._d._d._d._d
push dword [ebp - 0xcec]
call fcn.004ed110
mov ebx, eax
add esp, 0x18
cmp ebx, 4
je 0x48cc11
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xce8]
push eax
push 0x543d5c
push dword [ebp - 0xcec]
call fcn.004ed110
add esp, 0x18
mov ebx, eax
and dword [ebp - 0xd0c], 0
and dword [ebp - 0xcf8], 0
lea edi, [ebp - 0xd34]
call fcn.0040457c
lea ecx, [ebp - 0xd30]
push str.QHVer.dll
push ecx
mov edi, eax
mov byte [ebp - 4], 0xb
call fcn.0040603b
mov edi, dword [eax]
pop ecx
pop ecx
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xd0c]
push eax
call fcn.004413a9
movzx esi, al
mov eax, dword [ebp - 0xd30]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.0040557a
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xd34]
add eax, 0xfffffff0
call fcn.0040557a
test esi, esi
je 0x48cd6a
cmp ebx, 4
jne 0x48cd6a
mov eax, dword [ebp - 0xce8]
mov ecx, dword [ebp - 0xd24]
shl eax, 0x10
add eax, dword [ebp - 0xd28]
shl ecx, 0x10
add ecx, dword [ebp - 0xd18]
cmp eax, dword [ebp - 0xd0c]
ja 0x48cd6a
jb 0x48ccc6
cmp ecx, dword [ebp - 0xcf8]
ja 0x48cd6a
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.manualver
push eax
xor esi, esi
call fcn.00405747
push ecx
mov byte [ebp - 4], 0xc
mov eax, esp
mov dword [ebp - 0xd0c], esp
mov ebx, str.SOFTWARE360TotalSecurityUpdate
push ebx
push eax
call fcn.00405747
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0xd60]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004049f3
call fcn.0040494e
lea esi, [ebp - 0xd60]
call fcn.00401105
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push str.onlinever
push eax
xor esi, esi
call fcn.00405747
push ecx
mov byte [ebp - 4], 0xd
mov eax, esp
mov dword [ebp - 0xd0c], esp
push ebx
push eax
call fcn.00405747
push edi
lea eax, [ebp - 0xd80]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004049f3
call fcn.0040494e
lea esi, [ebp - 0xd80]
call fcn.00401105
push 0
mov esi, str.Q360InternationSafeClass
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x48cd91
push 0
push 0xff
push 0x789
push esi
call fcn.004368f9
add esp, 0x10
mov eax, dword [ebp - 0xcec]
jmp 0x48c2f4
cmp eax, 0x43524552
je 0x48dec6
cmp eax, 0x44415649
je 0x48cdd6
cmp eax, 0x44424449
je 0x48cdd6
cmp eax, 0x44454c46
je 0x48dec6
cmp eax, 0x44484d52
je 0x48dec6
cmp eax, 0x444b5049
jne 0x48bcbb
lea eax, [ebp - 0xcf8]
push eax
call fcn.004b0d75
pop ecx
test eax, eax
je 0x48bcbb
push 0
push dword [ebx]
jmp 0x48cf9a
mov edx, 0x47414d45
cmp eax, edx
ja 0x48cf6f
je 0x48cf35
cmp eax, 0x444e5354
je 0x48cef3
cmp eax, 0x44524452
je 0x48cedc
cmp eax, 0x45584544
je 0x48ce89
cmp eax, 0x45584954
je 0x48ce68
cmp eax, 0x46524453
je 0x48ce3d
cmp eax, 0x46524553
jne 0x48bcbb
mov ecx, dword [0x5856ac]
cmp ecx, esi
je 0x48bcbb
xor edx, edx
cmp eax, 0x46524553
jne 0x48ce55
inc edx
push edx
push 0x64
push 0xbd2
push ecx
call fcn.0048458b
jmp 0x48bcbb
cmp byte [0x5856cc], 0
je 0x48bcbb
push 1
push 0x7fff7f
push 0x64
push edi
call fcn.0048a5bb
jmp 0x48bcbb
cmp dword [ebx + 4], 4
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
mov ebx, dword [ebx]
cmp ebx, 1
jne 0x48ceac
push str.SOFTWARE360TotalSecurityChrome
jmp 0x48ced2
cmp ebx, 2
jne 0x48ceb8
push str.SOFTWARE360TotalSecurityOpera
jmp 0x48ced2
cmp ebx, 3
jne 0x48cec4
push str.SOFTWARE360TotalSecurityYandex
jmp 0x48ced2
cmp ebx, 6
jne 0x48bcbb
push 0x5305e0
call fcn.00411441
jmp 0x48d90a
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48bcbb
push dword [ebx + 8]
push 2
jmp 0x48d740
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48cf29
mov dword [ebp - 0xd00], ecx
lea ecx, [ebp - 0xd00]
push ecx
push esi
push 0x4a
push dword [0x5864d4]
mov ecx, str.Q360SafeMonClass
push eax
mov dword [ebp - 0xcf8], esi
mov dword [ebp - 0xcfc], esi
call fcn.00484b5d
mov eax, edi
call fcn.00493393
jmp 0x48bcbb
xor ebx, ebx
call fcn.00442887
add edi, 0x24
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x24]
cmp eax, esi
je 0x48cf5d
push str.true
push eax
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
jne 0x48cf5d
inc ebx
xor eax, eax
cmp ebx, esi
setne al
mov dword [ebp - 0xd04], eax
jmp 0x48bcbb
mov ecx, eax
sub ecx, 0x4c415649
je 0x48cf98
sub ecx, 4
je 0x48cdd6
sub ecx, 5
je 0x48cf98
sub ecx, 0xedf4
je 0x48cf98
sub ecx, 3
jne 0x48bcbb
push esi
push eax
push edi
call fcn.00491fc1
jmp 0x48bcbb
mov ecx, 0x53435354
cmp eax, ecx
ja 0x48d953
je 0x48d910
mov ecx, 0x504f5057
cmp eax, ecx
ja 0x48d6c7
je 0x48c1fa
mov ecx, 0x4c534d4c
cmp eax, ecx
ja 0x48d27e
je 0x48d129
mov ecx, eax
sub ecx, 0x4c434e4c
je 0x48cdd6
sub ecx, 0x607f9
je 0x48cf98
sub ecx, 0x1fa01
je 0x48cf98
sub ecx, 3
je 0x48cf98
sub ecx, 0x40003
je 0x48d10b
sub ecx, 0x3fbfc
jne 0x48bcbb
xor eax, eax
push 0x208
mov word [ebp - 0xcc0], ax
lea eax, [ebp - 0xcbe]
push esi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xd24]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd18], 0x209
mov dword [ebp - 0xd24], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x48bcbb
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x48bcbb
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcf8], eax
push str.360TotalSecurityDesktopPlusUtils360searchlite.exe
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xcf8]
push 0x53c8fc
push eax
mov byte [ebp - 4], 0x1e
call fcn.00404568
mov esi, dword [ebp - 0xcf8]
add esp, 0x10
push 0
push 5
push 0
mov eax, esi
call fcn.00442a8c
add esp, 0xc
lea eax, [esi - 0x10]
jmp 0x48c2b5
cmp dword [edi + 0x2ec], esi
jne 0x48bcbb
push ebx
add edi, 0x370
push edi
call fcn.004746e9
jmp 0x48bcbb
xor eax, eax
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
mov dword [ebp - 0xcf8], esi
call fcn.004e7380
add esp, 0xc
push str.softmgrSMLSoftMgrLite.exe
push 0x585d80
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call fcn.00405f50
pop ecx
cmp eax, esi
je 0x48d26d
mov eax, dword [0x5856ac]
mov dword [ebp - 0xd0c], eax
cmp eax, esi
je 0x48d26d
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xa54]
call fcn.0040441b
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0xa3c], 8
mov eax, dword [ebp - 0xa50]
jae 0x48d1b7
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xcb8]
push 0x530bf4
push eax
call fcn.00475656
add esp, 0xc
mov esi, 0x52f388
push esi
call fcn.004e73fa
pop ecx
push esi
lea esi, [ebp - 0xa54]
call fcn.00404dce
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0xa74]
call fcn.0040441b
xor ebx, ebx
mov byte [ebp - 4], 0x20
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, edi
inc ebx
cmp edi, ebx
jl 0x48d210
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push ecx
call esi
push eax
call fcn.0040b76a
pop ecx
pop ecx
xor ecx, ecx
test al, al
setne cl
inc ecx
inc ecx
push ecx
call esi
push eax
push dword [ebp - 0xd0c]
lea ecx, [ebp - 0xa74]
lea edx, [ebp - 0xa54]
call fcn.00484a72
inc edi
mov dword [ebp - 0xcf8], eax
cmp eax, ebx
je 0x48d251
cmp edi, 3
jl 0x48d205
push 0
push ebx
lea esi, [ebp - 0xa74]
call fcn.00404e82
push 0
push ebx
lea esi, [ebp - 0xa54]
call fcn.00404e82
xor eax, eax
cmp dword [ebp - 0xcf8], 1
sete al
jmp 0x48cf64
cmp eax, 0x4d47534d
je 0x48d4e3
cmp eax, 0x4d524853
je 0x48da9b
cmp eax, 0x4e534f4e
je 0x48dad2
cmp eax, 0x4f505343
je 0x48d3a6
cmp eax, 0x50455432
je 0x48d310
cmp eax, 0x50455654
jne 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
cmp dword [ebx + 4], 0x418
jne 0x48bcbb
xor ecx, ecx
mov word [eax + 0x416], cx
mov edi, dword [edi + 0x97c]
cmp edi, esi
je 0x48bcbb
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp dword [edi], esi
je 0x48bcbb
mov edi, dword [edi + 4]
cmp edi, esi
je 0x48bcbb
push ecx
push edx
add eax, 8
push eax
call edi
jmp 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
cmp dword [ebx + 4], 0x104c
jb 0x48bcbb
xor ecx, ecx
mov word [eax + 0x416], cx
mov word [eax + 0x826], cx
mov word [eax + 0xc3a], cx
mov word [eax + 0x104a], cx
mov edi, dword [edi + 0x97c]
cmp edi, esi
je 0x48bcbb
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea ebx, [eax + 8]
cmp dword [edi], esi
je 0x48bcbb
mov esi, dword [edi + 8]
test esi, esi
je 0x48d393
push 0
push 0
push ecx
lea ecx, [eax + 0xc3c]
push ecx
lea ecx, [eax + 0x418]
push ecx
push dword [eax + 0x828]
add eax, 0x82c
push edx
push eax
push ebx
call esi
jmp 0x48bcbb
mov edi, dword [edi + 4]
test edi, edi
je 0x48bcbb
push ecx
push edx
push ebx
jmp 0x48d309
mov eax, dword [0x5856ac]
mov esi, eax
test eax, eax
je 0x48d3ee
push 0
push 0xcd
push 0x111
push dword [0x5864d4]
mov ecx, str.Q360SafeMonClass
push eax
call fcn.00484b5d
push ebx
push dword [ebp - 0xce8]
mov dword [ebx], 0x4d505343
push 0x4a
push dword [0x5864d4]
mov ecx, str.Q360InternationSafeClass
push esi
call fcn.00484b5d
push 0
push 0
call fcn.00448783
pop ecx
pop ecx
test eax, eax
jne 0x48d4d0
and dword [ebp - 0xd18], eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x48bcbb
cmp eax, str.ActiveProtection
je 0x48bcbb
mov ebx, str.CloseType
cmp eax, ebx
je 0x48bcbb
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcf8], eax
push str.ActiveProtection
push esi
push str._s_s
lea eax, [ebp - 0xcf8]
mov byte [ebp - 4], 0x16
call fcn.00429c50
and dword [ebp - 0xd28], 0
add esp, 0xc
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0xd28]
push eax
push ebx
mov ebx, dword [ebp - 0xcf8]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd24], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebx - 0x10]
call fcn.0040557a
mov eax, dword [ebp - 0xd18]
cmp eax, 1
je 0x48d4b4
cmp eax, 2
jne 0x48bcbb
dec eax
neg eax
sbb eax, eax
and eax, 0x2932e0
push 0
add eax, 0xdbba0
push eax
push 0x70a
jmp 0x48bcf9
push 0x70a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x48bcbb
cmp dword [edi + 0x2ec], esi
jne 0x48bcbb
push 4
pop esi
cmp dword [ebx + 4], esi
jb 0x48bcbb
mov eax, dword [ebx + 8]
test eax, eax
je 0x48bcbb
and dword [ebp - 0xd0c], 0
push esi
push eax
lea eax, [ebp - 0xd0c]
push eax
call fcn.004ea300
add esp, 0xc
cmp dword [ebp - 0xd0c], 0x52545642
jne 0x48d69b
xor eax, eax
inc eax
push esi
mov word [ebp - 0xd50], ax
call fcn.004e757b
pop ecx
test eax, eax
je 0x48d54d
lea ecx, [ebp - 0xd4c]
mov dword [eax], ecx
jmp 0x48d54f
xor eax, eax
mov dword [ebp - 0xd4c], eax
xor edi, edi
mov dword [ebp - 0xd40], edi
mov dword [ebp - 0xd3c], edi
mov dword [ebp - 0xd38], edi
mov byte [ebp - 4], 0x22
mov eax, dword [ebx + 4]
sub eax, esi
push eax
mov eax, dword [ebx + 8]
add eax, esi
push eax
lea esi, [ebp - 0xab0]
call fcn.00423d89
mov eax, esi
push eax
lea ecx, [ebp - 0xd50]
mov byte [ebp - 4], 0x23
call fcn.0049f8de
test al, al
je 0x48d67d
push edi
lea ecx, [ebp - 0xa94]
mov dword [ebp - 0xa7c], 0xf
call fcn.004052c5
push str._type_
lea ecx, [ebp - 0xdbc]
mov byte [ebp - 4], 0x24
call fcn.00405375
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xdbc]
push eax
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0xd50]
mov dword [ebp - 0xcf8], 1
call fcn.0049ef4b
test al, al
je 0x48d63a
push str.msaashld
lea esi, [ebp - 0xa94]
call fcn.00420ef9
cmp eax, edi
je 0x48d631
push str.dcomshld
call fcn.00420ef9
cmp eax, edi
je 0x48d631
push str.lnkinfo
call fcn.00420ef9
cmp eax, edi
je 0x48d631
push str.win10settingcontentms
call fcn.00420ef9
cmp eax, edi
jne 0x48d63a
mov byte [ebp - 0xce1], 1
jmp 0x48d641
mov byte [ebp - 0xce1], 0
push edi
push 1
lea ecx, [ebp - 0xdbc]
mov dword [ebp - 4], 0x24
call fcn.004051fe
cmp byte [ebp - 0xce1], 0
je 0x48d66f
mov eax, dword [0x5856ac]
cmp eax, edi
je 0x48d66f
push ebx
push eax
call fcn.0048488c
push edi
push 1
lea ecx, [ebp - 0xa94]
call fcn.004051fe
push edi
push 1
lea ecx, [ebp - 0xab0]
call fcn.004051fe
lea esi, [ebp - 0xd4c]
call fcn.0049fa24
jmp 0x48bcbb
cmp dword [ebp - 0xd0c], 0x414e5449
jne 0x48bcbb
cmp dword [ebx + 4], 0x120
jb 0x48bcbb
push dword [ebx + 8]
mov eax, edi
call fcn.0048b85d
jmp 0x48bcbb
mov ecx, 0x524d4b50
cmp eax, ecx
ja 0x48d81a
je 0x48cdd6
sub eax, 0x50536952
je 0x48d7a9
dec eax
je 0x48d784
sub eax, 0xf9ea01
je 0x48d74b
sub eax, 0xf7fafb
je 0x48d730
sub eax, 0x70101
je 0x48d70b
sub eax, 0xf2f4
jmp 0x48cdd0
cmp dword [edi + 0x2ec], esi
jne 0x48bcbb
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48bcbb
push ebx
push eax
call fcn.0048488c
jmp 0x48bcbb
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48bcbb
push esi
push 1
push eax
call fcn.004844c9
jmp 0x48bcbb
call int.00408c5f
push esi
call fcn.004707db
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x48bcbb
cmp dword [0x5856e0], esi
jne 0x48bcbb
push esi
push dword [0x57a72c]
mov dword [0x5856e0], ecx
push 0x3f5
jmp 0x48bcf9
push 1
push edi
mov edi, ebx
call fcn.00494e2c
push 0
push 0
push 0x6c4
push str.Q360BrowseringProtectionClass
call fcn.004368f9
add esp, 0x10
jmp 0x48bcbb
push 0
push edi
mov edi, ebx
call fcn.00494e2c
mov ecx, dword [0x5856ac]
mov esi, ecx
test ecx, ecx
je 0x48bcbb
xor eax, eax
lea edi, [ebp - 0xcfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd00]
mov dword [ebp - 0xd00], 0x50536953
mov dword [ebp - 0xcf8], eax
call fcn.00484952
lea eax, [ebp - 0xd00]
push eax
push dword [ebp - 0xce8]
push 0x4a
push dword [0x5864d4]
push esi
mov ecx, str.Q360SafeMonClass
call fcn.00484b5d
jmp 0x48bcbb
cmp eax, 0x524d5345
je 0x48d8a9
cmp eax, 0x524d5649
je 0x48cdd6
cmp eax, 0x52534b56
je 0x48c1fa
cmp eax, 0x53434641
je 0x48d859
cmp eax, 0x53435343
jne 0x48bcbb
mov esi, edi
call fcn.004936e5
jmp 0x48bcbb
push 0x52f388
lea eax, [ebp - 0xa54]
call fcn.0040441b
mov byte [ebp - 4], 0x15
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x48d889
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48d889
shr eax, 1
push ebx
lea esi, [ebp - 0xa54]
call fcn.00404dce
cmp dword [ebp - 0xa3c], 8
mov eax, dword [ebp - 0xa50]
jae 0x48d89e
lea eax, [ebp - 0xa50]
push eax
call fcn.00441e3c
jmp 0x48bdd0
cmp dword [ebx + 4], 0xc
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
push 0x582e91
push 0xc
call fcn.004eb6e3
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x48bcbb
push 0xc
push ebx
push edi
call fcn.004ea300
add esp, 0xc
push esi
push esi
push edi
push 0x49288b
push esi
push esi
call fcn.004eb0fa
add esp, 0x18
cmp eax, esi
je 0x48d904
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48bcbb
push edi
call fcn.004e7360
pop ecx
jmp 0x48bcbb
mov eax, dword [0x5856ac]
cmp eax, esi
je 0x48d84d
lea ecx, [ebp - 0xd00]
push ecx
push esi
push 0x4a
push dword [0x5864d4]
mov ecx, str.Q360SafeMonClass
push eax
mov dword [ebp - 0xd00], 0x53435343
mov dword [ebp - 0xcf8], esi
mov dword [ebp - 0xcfc], esi
call fcn.00484b5d
jmp 0x48d84d
mov ecx, 0x54495350
cmp eax, ecx
ja 0x48dde6
je 0x48ddae
mov esi, 0x53536953
cmp eax, esi
ja 0x48db31
je 0x48db25
cmp eax, 0x53445043
je 0x48daf0
cmp eax, 0x5348524d
je 0x48da9b
cmp eax, 0x534d4150
je 0x48da7d
cmp eax, 0x53505053
je 0x48da2c
cmp eax, 0x53535343
je 0x48da20
cmp eax, 0x53536952
jne 0x48bcbb
push ebx
push edi
call fcn.00494ed2
mov ecx, dword [0x5856ac]
mov dword [ebp - 0xcf8], ecx
test ecx, ecx
je 0x48bcbb
xor eax, eax
lea edi, [ebp - 0xd1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebx + 8]
push ecx
lea ecx, [ebp - 0xd20]
mov dword [ebp - 0xd20], esi
mov dword [ebp - 0xd18], eax
call fcn.00484952
lea eax, [ebp - 0xd20]
push eax
push dword [ebp - 0xce8]
push 0x4a
push dword [0x5864d4]
push dword [ebp - 0xcf8]
jmp 0x48d80b
mov esi, edi
call fcn.00493086
jmp 0x48bcbb
cmp dword [ebx + 4], 4
jne 0x48bcbb
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48bcbb
mov ebx, dword [ebx]
mov eax, ebx
cdq
push 8
mov dword [ebp - 0xd00], eax
lea eax, [ebp - 0xd00]
push eax
push 0xb
push str.Privacy_Page_State
push str.Software360SafeAntiTrack
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xcfc], edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
call fcn.004989f4
jmp 0x48bcbb
mov esi, str._optimizeboot
call fcn.0043f80f
cmp eax, 1
jle 0x48da91
mov esi, str._shareboot
call fcn.004a9bbd
jmp 0x48bcbb
cmp dword [0x585740], 0
je 0x48dad2
cmp dword [ebx + 4], 0x200c
jne 0x48bcbb
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48bcbb
xor eax, eax
lea ecx, [ebx + 0xc]
mov word [ebx + 0x200a], ax
call fcn.0048b8b0
jmp 0x48bcbb
push dword [edi + 4]
push 0xcf
push 0x111
push dword [0x585730]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x48bcbb
xor ebx, ebx
inc ebx
lea esi, [ebp - 0xcf8]
mov dword [ebp - 0xcf8], ebx
call fcn.0043189f
cmp dword [ebp - 0xcf8], ebx
sete al
mov byte [edi + 0x11a0], al
test al, al
je 0x48bcbb
call fcn.0049a97c
jmp 0x48bcbb
push ebx
push edi
call fcn.00494ed2
jmp 0x48d78e
sub eax, 0x5354524d
je 0x48dcc5
sub eax, 0x2f9
je 0x48dc87
sub eax, 0xf102fd
je 0x48dc76
sub eax, 0x3fb02
je 0x48db62
sub eax, 0xa
jne 0x48bcbb
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x451
push dword [edi + 4]
call esi
push 0x454
push dword [edi + 4]
call esi
and dword [edi + 0x510], 0
cmp dword [ebx], 0x54495345
jne 0x48dc54
cmp dword [ebx + 4], 4
jne 0x48c96b
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48c96b
mov eax, dword [ebx]
mov dword [edi + 0x524], eax
xor esi, esi
call fcn.00442887
lea ecx, [edi + 0x24]
mov edx, dword [ecx]
push eax
call dword [edx + 0x24]
test eax, eax
je 0x48dbd2
push str.true
push eax
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
jne 0x48dbd2
inc esi
call fcn.0048bba1
mov bl, al
test bl, bl
jne 0x48dbe4
and dword [edi + 0x524], 0
test esi, esi
jne 0x48dc2d
call fcn.004415ab
test eax, eax
jne 0x48dc2d
test bl, bl
je 0x48dc2d
lea ebx, [edi + 0xb68]
mov eax, ebx
call fcn.004b4d20
lea esi, [edi + 0x980]
mov eax, esi
call fcn.004b4d20
mov eax, dword [edi + 0x524]
test eax, eax
jne 0x48dc1f
push 1
push eax
push ebx
jmp 0x48dc23
push 0
push eax
push esi
call fcn.004b5058
jmp 0x48c96b
cmp dword [edi + 0x524], 0
jbe 0x48c96b
push 0
push 0x1388
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x48c96b
and dword [edi + 0x524], 0
lea eax, [edi + 0xb68]
call fcn.004b4d20
lea eax, [edi + 0x980]
call fcn.004b4d20
jmp 0x48c96b
push dword [ebx + 4]
mov ecx, dword [ebx + 8]
push edi
call fcn.00498a99
jmp 0x48bcbb
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48bcbb
push ebx
lea eax, [ebp - 0xcf8]
push eax
call fcn.00405747
lea esi, [ebp - 0xcf8]
mov byte [ebp - 4], 3
call fcn.00423530
push eax
push 0x53545546
push edi
call fcn.00491fc1
mov eax, dword [ebp - 0xcf8]
jmp 0x48c2f4
mov eax, dword [0x5856ac]
mov esi, eax
test eax, eax
je 0x48bcbb
xor eax, eax
cmp word [0x586190], ax
je 0x48bcc1
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004e7380
add esp, 0xc
push str._scan
push str.QHSafeScanner.exe
push 0x586190
push str.__s_s___s
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.004ef4ec
add esp, 0x18
test eax, eax
jge 0x48dd32
xor eax, eax
jmp 0x48bcc1
push 0x52f388
lea eax, [ebp - 0xa74]
call fcn.0040441b
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x13
call fcn.0040441b
push 1
push 4
mov byte [ebp - 4], 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea ecx, [ebp - 0xa54]
lea edx, [ebp - 0xa74]
call fcn.00484a72
push 0
lea esi, [ebp - 0xa54]
push 1
cmp eax, 1
je 0x48dd9e
call fcn.00404e82
push 0
push 1
lea esi, [ebp - 0xa74]
call fcn.00404e82
jmp 0x48dd2b
call fcn.00404e82
lea esi, [ebp - 0xa74]
jmp 0x48bdd6
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebx + 4], 4
jne 0x48bcbb
cmp dword [ebx + 8], esi
je 0x48bcbb
and dword [edi + 0x524], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [edi + 0x520], eax
jmp 0x48c96b
mov ecx, 0x54544842
cmp eax, ecx
ja 0x48e001
je 0x48dfcf
mov ecx, eax
sub ecx, 0x54495353
je 0x48df8a
sub ecx, 0x2f9f5
je 0x48df1f
sub ecx, 4
je 0x48df1f
sub ecx, 0x30607
je 0x48ded2
sub ecx, 0x3f6
je 0x48dec6
sub ecx, 0x1fafd
jne 0x48bcbb
cmp dword [ebx + 4], 0x804
jne 0x48bcbb
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x48bcbb
mov edi, dword [0x5856ac]
test edi, edi
je 0x48bcbb
mov esi, 0x818
push esi
push ecx
lea eax, [ebp - 0xa38]
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
push 0xa
mov edx, 0x546ef4
pop ecx
call fcn.0043ab6a
lea eax, [ebx + 4]
push eax
push 0x400
lea edx, [ebp - 0xa24]
call fcn.00424ffd
mov eax, dword [ebx]
and dword [ebp - 0xa28], 0
push esi
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0xa2c], eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax]
jmp 0x48bcbb
mov eax, dword [0x5856ac]
test eax, eax
jmp 0x48d71e
cmp dword [edi + 0x2ec], esi
jne 0x48bcbb
lea eax, [ebp - 0xa78]
push eax
call fcn.0049bf72
mov byte [ebp - 4], 0x12
mov ecx, dword [0x5856ac]
cmp ecx, esi
je 0x48df0a
mov eax, dword [ecx]
lea edx, [ebp - 0xa78]
push edx
push dword [ebx + 4]
push dword [ebx + 8]
call dword [eax + 8]
lea eax, [ebp - 0xa78]
push eax
mov byte [ebp - 4], 0
call fcn.0049bfc3
jmp 0x48bcbb
push 4
cmp eax, 0x544c4d48
jne 0x48df59
call fcn.004e757b
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x18
cmp eax, esi
je 0x48df47
push dword [ebx + 8]
push eax
call fcn.00405747
jmp 0x48df49
xor eax, eax
push eax
push 0xff
push 0x882
jmp 0x48dadf
call fcn.004e757b
pop ecx
mov dword [ebp - 0xcf8], eax
mov byte [ebp - 4], 0x19
cmp eax, esi
je 0x48df78
push dword [ebx + 8]
push eax
call fcn.00405747
jmp 0x48df7a
xor eax, eax
push eax
push 0xff
push 0x883
jmp 0x48dadf
push 0x454
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
push eax
push 0xc8
push 0x451
push dword [edi + 4]
mov dword [edi + 0x410], eax
mov dword [edi + 0x520], eax
mov dword [edi + 0x524], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x510], 1
jmp 0x48c96b
cmp dword [ebx + 4], 4
jne 0x48bcbb
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x48bcbb
mov eax, dword [ebx]
push 0xa
push esi
push edi
mov dword [edi + 0x10c], eax
mov byte [edi + 0x110], 1
call fcn.004963e4
jmp 0x48bcbb
cmp eax, 0x5454534d
je 0x48e170
cmp eax, 0x5457434c
je 0x48e14f
cmp eax, 0x5457534c
je 0x48e12e
cmp eax, 0x63626567
je 0x48e050
cmp eax, 0x66706567
jne 0x48bcbb
lea eax, [ebp - 0xd04]
push eax
push ebx
push esi
push 0x4a
add edi, 0x370
push edi
call fcn.0047424b
jmp 0x48bcbb
cmp dword [ebx + 4], 4
jne 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
mov ecx, dword [edi + 0x440]
cmp ecx, esi
je 0x48bcbb
cmp dword [edi + 0x130], esi
je 0x48bcbb
mov dword [ebp - 0xcec], 1
mov eax, dword [eax]
dec eax
je 0x48e0e5
dec eax
je 0x48e0c0
dec eax
jne 0x48bcbb
cmp dword [edi + 0x134], 1
jne 0x48bcbb
mov eax, dword [ecx]
lea edi, [ebp - 0xcec]
push edi
push ebx
push edx
push 0x4a
call dword [eax + 0x28]
cmp dword [ebp - 0xcec], esi
jmp 0x48c1f4
cmp dword [edi + 0x134], 1
mov eax, dword [ecx]
lea esi, [ebp - 0xcec]
push esi
push ebx
push edx
push 0x4a
jne 0x48e126
call dword [eax + 0x28]
and dword [edi + 0x134], 0
jmp 0x48bcbb
mov eax, dword [ecx]
lea esi, [edi + 0x134]
cmp dword [esi], 0
jne 0x48e116
call dword [eax + 0xc]
test eax, eax
je 0x48bcbb
mov edi, dword [edi + 0x440]
lea ecx, [ebp - 0xcec]
mov dword [esi], 1
mov eax, dword [edi]
push ecx
mov ecx, edi
jmp 0x48e11d
lea edx, [ebp - 0xcec]
push edx
push ebx
push dword [ebp - 0xce8]
push 0x4a
call dword [eax + 0x28]
jmp 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
cmp dword [ebx + 4], 0x40
jb 0x48bcbb
push eax
push edi
call fcn.00494763
jmp 0x48bcbb
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x48bcbb
cmp dword [ebx + 4], 0x40
jb 0x48bcbb
push eax
push edi
call fcn.004948da
jmp 0x48bcbb
xor esi, esi
jmp 0x48da91